joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdcb8da
Capabilities:
Encode data using xor

Disassembly:
xor bx, cx
mov word [esi + edx*8 - 0x436], cx
lea esi, [esi + edx - 0x85]
or eax, edx
movsx ecx, dx
shr cx, 0x21
jmp ebp
shl cx, 1
movzx edx, cx
mov dword [esp + ecx - 0x3004a36a], ebp
ret
sub ecx, dword [esp + ecx]
neg dword [esp + ecx]
ror edx, 3
jmp 0xd66cd5
not ecx
xor ebx, edx
sub eax, 0xb7ac733b
not cx
cmovs eax, ecx
add ebp, edx
movsx edx, ax
movzx ax, byte [esi + eax - 0x48538cc7]
add cl, byte [esi]
not al
jmp 0xe5bad9
jae 0xe38d1e
mul ecx
mov ecx, 0x300451b5
mov dword [esi + ecx*2 - 0x6008a36a], edx
mov dword [ecx + esi - 0x300451b1], eax
jmp 0xa4582c
neg eax
not cx
sal cx, 0x41
xor eax, 0xa5bba8b1
neg ecx
pop ecx
bswap eax
add eax, 0x6fbe042d
rol eax, 3
xor ebx, eax
add ebp, eax
mov eax, 0x4c0ad33a
mov ecx, dword [eax + esi - 0x4c0ad33a]
rol al, 0x86
sbb eax, 0xb7991428
mov eax, dword [esi + 4]
jge 0xd9e2be
mov cl, byte [ebp]
sub byte [esp + 1], 0x26
movzx ax, byte [ebp + 2]
adc ebp, 2
mov edx, 0x74b249af
xchg word [esp + edx - 0x74b249ae], dx
imul cl
mov ecx, edx
bswap edx
mov word [ebp + ecx - 0x74b2b75a], ax
shr cx, 0x4e
push ecx
mov eax, dword [edx + edi - 0x5ab7b274]
jnp 0xa1ed3e
retf 0xca0f
retf 0x8966
jmp 0x856edea2
neg cx
not ax
or al, 7
jae 0x9184fd
push edx
cmc
dec edi
mov ebp, 0xa264810d
test eax, 0x1fcd14b5
push 0xe92008b4
pop ds
push 0xc90038b4
pop ds
push 0xbd74d8b4
cwde
js 0xe38d42
adc bl, al
jge 0xe38e0d
cwde
jb 0xe38de3
loop 0xe38e14
jge 0xe38d4f
mov bh, 0xe9
jb 0xe38d8b
jmp 0x8ff07e0f
or al, 0x8f
shl dword [edx], 0xf6
outsb dx, byte [esi]
cmp dword [edi + 0x51], ebp
std
adc byte [eax], 0x9b
je 0xe38d44
shl ch, 1
in eax, dx
push eax
push eax
mov edx, 0x416dda41
xor eax, 0xda123807
sbb byte [eax], ah
mov bl, byte [ebp - 0x6d4e9c74]
dec edi
loopne 0xe38db5
outsd dx, dword [esi]
popfd
wait
dec ebp
pop ebx
cmp al, 0
push edx
push edx
sbb byte [eax + ebp + 0x2e], ah
loope 0xe38e0e
inc ecx
cmp eax, 0x4b925ee4
sbb dword [ebp - 0x64], edx
pop esi
xchg edx, eax
dec ebx
jne 0xe38e54
mov byte [esi - 0x6e], bl
dec ebx
inc ecx
xchg ebp, eax
int3
leave
sbb dword [ecx + ebx*8 + 0x325e4b8f], 0xfae77c7f
fst qword [eax]
invalid
pushfd
invalid
push ds
jne 0xe38def
xor ch, cl
aas
js 0xe38d96
adc dword [ecx + 0x2f], 0x7bfcae84
dec ecx
push ebp
push ecx
das
test byte [esi + 0x55497bfc], ch
xchg edi, ebp
lodsb al, byte [esi]
or dword [eax - 0x4d], ebp
jp 0xe38e5c
xchg ebx, eax
test eax, 0x7c67fdf1
cdq
frstor dword [ecx - 0x48]
jnp 0xe38e7b
popal
imul esi, dword [edx], 0x614d7f4f
imul esi, dword [edx], 0x6165b7ab
imul esi, dword [edx], 0x61790bff
imul esi, dword [edx], 0x2641939b
inc ebp
xchg ebp, eax
loopne 0xe38ddb
add al, 0x56
jns 0xe38ded
xor dword [esi + 0xf], esp
ror dword [esp + ecx], 0
xadd word [esp + ecx], cx
add byte [esp + ecx*2 + 3], ch
dec edx
jmp 0xa48645
or al, 0
insb byte es:[edi], dx
dec esp
add ecx, dword [edx - 0x17]
loop 0xe38e58
sar bh, 0x66
inc ecx
dec edi
dec edx
mov ebp, dword [edx + edx - 0x77a0000d]
inc esp
movsx esi, si
dec ebp
lea edx, [edx + esi*2 - 0x33]
dec eax
xor ebp, ebx
inc ecx
ror esi, 0x7e
dec esi
lea ebp, [edi*2 - 0x70e4967e]
dec eax
dec ebp
inc ecx
not dh
dec eax
bswap ebp
call fcn.00de299c
Function at 0xdcd939
Capabilities:
Authenticate hmac

Disassembly:
xor bl, cl
mov dword [esp + edx*2 - 0xf70e000], eax
lea ecx, [esp + ecx + 0x14]
add dword [esp + edx - 0x7b86ff0], edx
mov eax, dword [edx + ecx - 0x7b87000]
jo 0xa4edb0
sbb dl, 0x3c
movzx ecx, dx
mov dword [esi + edx - 0x7b870c5], eax
bswap ecx
mov dword [esp + edx - 0x7b870bf], edx
jno 0xe10656
inc cx
mov esi, dword [ecx]
inc ecx
mov ebp, 0x424e12c
inc edi
movzx ebx, byte [edx + ebp - 0x424e12d]
inc esp
xor bl, bl
inc ecx
mov ecx, ebp
inc ecx
neg bl
inc ecx
dec bl
inc ebp
movsx edi, ch
inc ecx
not bh
inc ecx
not bl
dec ebx
lea ebp, [edi + ebp*8 + 0x2c297a06]
inc ecx
movzx eax, bh
inc ecx
inc bl
xadd eax, ecx
dec eax
lea edx, [eax*8 + 0x588cc595]
inc ecx
xor bl, bl
call fcn.0091928f
lea ebp, [edi]
popal
inc ecx
xor eax, 0x7d85f53a
sal ecx, 0xfe
inc ecx
mov edx, ebp
inc ebp
lea eax, [eax + ecx*2 - 0x732d5ca2]
call fcn.00a6b36b
mov dword [0x2ae88cd2], eax
lodsd eax, dword [esi]
invalid
lea esi, [esi + edx - 0x7b870c5]
pop eax
pop ecx
pop eax
pop ecx
pop edx
jb fcn.00d89820
xchg esp, eax
push 0x3b
inc ecx
mov edx, dword [esi + 0xc4c9b52]
movsb byte es:[edi], byte [esi]
nop
add eax, 0x69b5ae97
mov al, byte [0x49b46f2a]
jge 0xe10624
sub ch, byte [edi - 0x4c]
test eax, 0x71aeec29
mov bl, 0xf4
mov ecx, 0xb9e721d1
jo 0xe106c9
mov ecx, 0x470184ec
lodsd eax, dword [esi]
and dword [ebx + 0x6b56d599], ecx
sub dword [ebp + 0x3dee7fa8], edx
imul ebp, dword [ebx - 0x296805f7], 0xffffff9f
insd dword es:[edi], dx
insd dword es:[edi], dx
jl 0xe1071b
stosd dword es:[edi], eax
out dx, al
fcomp dword [ecx]
sbb esi, dword [eax + edx*2 - 0x27e805a]
mov ah, 0x50
cmpsb byte [esi], byte es:[edi]
jg 0xe10639
std
out 0x3d, al
leave
xor byte [esp + edi*8 + 0x7a], bh
sub al, 0xd
xchg esp, eax
int1
mov ecx, esp
inc edi
push edi
ja 0xe10727
pop ebp
xchg esp, eax
mov al, 0x7b
wait
dec eax
inc ebx
dec edx
into
aad 0x99
push ebp
dec ecx
arpl word [eax + 0x3c], bp
call 0xc8e7bbde
jb 0xe106c9
jle 0xe10752
or eax, 0x1a04f9d1
dec ebp
int1
salc
jge 0xe106b3
jmp 0xe10720
inc esp
push es
push ds
cmp dword [ebx + 0x74bc7b8b], edx
jp 0xe10773
mov edi, dword [ebx - 0x44]
je 0xe1079f
dec ebp
sbb al, 0xa8
sbb al, dh
mov ebx, 0x3f56cb63
cmp al, 0x36
mov cl, 0xc9
mov cl, 0x93
mov edi, 0x73c4da3f
mov edx, 0xa113932e
mov ebp, 0x1057d819
mov ebp, 0x46a0e111
inc esp
push ss
ret
test al, 0x18
invalid
sbb bh, dh
int1
adc dword [eax + ecx*2], edi
jp 0xe10758
int1
adc dword [eax - 0x5c], edi
jbe 0xe1075e
int1
adc dword [eax + edx*2 + 0x62], edx
invalid
mov dl, 0xf7
mov edi, 0x6eeab891
sbb bl, al
test al, 0x91
salc
push ds
les ebp, [esi + 0x11]
stosd dword es:[edi], eax
xor al, 0x92
sub bh, byte [ebp - 0x60a1a2a]
sub edx, dword [edx + 0x43]
idiv byte [0x6e93fb13]
lcall 0x51f4, 0xf891d180
int3
pop eax
dec edi
mov ch, 0xe6
mov byte [0xc7dd17a6], al
pop ds
mov byte [0x675771d4], al
xchg esp, eax
movsd dword es:[edi], dword [esi]
shr byte [ebx + ebp*2 - 0x416dc2f1], 1
ret 0x2f2b
Function at 0xdd4002
Capabilities:
Encrypt data using speck

Disassembly:
mov byte [ecx + edx - 0x61501001], al
sal word [esp + edx - 0x61501001], 0xea
lea eax, [edx*4 + 0x10829ba8]
sub dword [esp + edx - 0x61501001], edx
lea edi, [edx + edi - 0x61501005]
mov eax, dword [edx + edi - 0x61501001]
lea ecx, [edx + edx*2 - 0x3076abd2]
neg edx
xor eax, ebx
push ecx
bswap eax
shr dword [esp + 4], cl
mov dword [esp + 2], ecx
ror eax, 2
call fcn.00a2a7c2
mov dword [esp], edx
rol cl, 1
rol word [esp], 0x8f
xor bl, cl
inc edx
sets dl
sal edx, 0xc
lea ecx, [esp + ecx + 4]
setbe dl
jb 0xd66b58

Function at 0xdd7ada
Capabilities:
Encrypt data using speck

Disassembly:
not eax
not edx
call fcn.00dc794a
mov eax, dword [esi]
mov ecx, 0xc31acd1d
mov ecx, dword ss:[eax]
call fcn.00a27ccf
pop ebx
dec ebp
arpl sp, sp
dec eax
shl ecx, 0x9f
sal si, 0x21
dec ecx
add edi, esp
inc bp
mov ebx, dword [ecx + eax*4 - 0xf0]
inc cx
and ebp, 0xa41d815
dec esp
inc ecx
mov cl, byte [ebp - 0x73]
dec esp
inc ecx
mov al, byte [edi + ecx - 0x41]
out 0x45, al
mov esi, edi
inc cx
shr ebx, cl
inc ecx
sub dh, 0xb8
call fcn.0092fff4
mov eax, dword [esi + edx - 0x65478138]
mov ecx, dword [ecx + esi - 0x6b07fffc]
not eax
or word [esp + edx - 0x65478133], dx
shl dl, 0xe6
not ecx
sub dl, dl
and eax, ecx
push edx
mov dword [esp + edx - 0x654780fc], edx
push edx
mov edx, dword [edx + esi - 0x654780f8]
jmp 0xd6e9fa

Function at 0xddc595
Capabilities:
Encrypt data using speck

Disassembly:
dec dl
ror ecx, 1
rol eax, 0x3e
ror al, 0xa2
not ecx
jae 0xa8ff2c
adc dl, dh
xor ecx, 0x6503553b
xor ebx, ecx
or al, 0x2e
setb al
sar edx, 0xfb
mov dword [esi - 4], ecx
movzx edx, word [edi - 0xa]
xor dx, bx
not dx
lea ecx, [eax*8 + 0x6b8c7409]
sar ecx, cl
jae 0xdda065
lea esi, [esi + ecx - 0x2f31f7]
dec eax
push eax
pop eax
jne fcn.00d89820
jmp 0xe68f4a
lea eax, [ecx + ecx*2 + 0x19af4aae]
call fcn.00e25d08
neg dx
dec dx
jmp 0xa35cc2
mov dword [esp + eax*2 - 0x1fefe], 0x35b4f893
call fcn.00e003fc
mov ecx, 0xe2206e87
sal ecx, cl
mov eax, dword [edi + ecx*2 - 0x206e8704]
xor eax, ebx
dec eax
ror cl, 0x44
mov edx, 0xf31b2528
not cl
xor eax, 0xf0fd920
and dl, 0xa6
shl edx, cl
xor cl, dl
lea eax, [ecx + eax + 0x68e79610]
sbb ecx, 0x4c36260c
adc dx, cx
ror eax, 3
and cl, ch
or cl, dh
xor ebx, eax
add ebp, eax
mov eax, 0x7a07d92f
mov ecx, dword [edi + eax - 0x7a07d937]
xor ecx, ebx
xor ecx, 0xb096ca84
dec eax
jns 0x99ca19
bswap eax
neg dx
xor bx, dx
shr eax, 0xbf
or eax, 0x17323c0b
mov word [esi + eax - 0x17323c11], dx
mov edx, dword [edi + ecx*4 - 0xbf3856]
lea edi, [edi + ecx - 0x2fce20]
lea eax, [ecx + 0x13acdd21]
not cl
xor edx, ebx
xor edx, 0xb096ca84
lea eax, [ecx*8 - 0x7bdd2958]
xor al, ch
neg cl
ror edx, 1
neg cx
not edx
xor edx, 0x6503553b
xor ebx, edx
mov dword [esi + ecx*4 - 0xbcc7be], edx
jmp 0x9bd0ed

Function at 0xde1168
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], ecx
not dword [esp + 8]
xor ebx, eax
not dx
ror dword [esp + 1], 0x97
setae byte [esp + 6]
mov dword [esi], eax
or ecx, ecx
jnp 0xdaf525
Function at 0xde2696
Capabilities:
Encrypt data using speck

Disassembly:
bswap ecx
shl eax, 0x84
lea edx, [eax*2 - 0xe7b6ef5]
rol al, 7
ror ecx, 2
jmp 0xa8340f
inc edi
mov ch, byte [ecx + ebp*2 - 2]
pop esi
inc eax
neg ch
inc ecx
push esp
not cl
inc ecx
not ch
inc ecx
or cl, ch
rol ebp, 0x67
dec esp
mov dword [esp + ebp - 0x4d9c68ae], edi
inc cx
mov dword [ecx + ebp - 0x4d9c68c6], ecx
dec eax
lea esi, [edx*4 + 0xa06e4be]
sar byte [esp + ebp - 0x4d9c68ad], 0x66
jp 0xe16f5b
mov ecx, dword [edi - 4]
xor ecx, ebx
mov eax, 0x3c906986
jmp 0xdbbb4a
dec eax
mov dword [esp + ebp - 0x4d9c68c6], edi
ret 0x18

Function at 0xde82cd
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ecx, 0x1b2a7492
mov edx, dword [edi + ecx*2 - 0x3654e920]
movsx eax, cl
xadd ax, cx
lea edi, [edi + ecx*2 - 0x3655ff1c]
sar eax, cl
js 0xa2f4cf
shr ecx, cl
sbb ecx, dword [esp + ecx*4 - 0x48]
add esi, eax
xor edx, 0x312f4805
lea ecx, [esp + 0x14]
lea eax, [edx*8 - 0x3f447062]
mov edx, dword [ecx + eax*2 - 0x62529f0c]
pop eax
shr dword [esp], 0x63
mov dword [ebp + 4], edx
jns 0xde2720
Function at 0xdf79d8
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + edx*4 + 0x2bb1d514]
jb 0xd7a47e
sub eax, eax
xor ecx, ebx
xadd dx, ax
push edx
sbb ecx, 0xf1011c9c
ror ax, 0xe
not ecx
sal byte [esp + edx - 0x35496762], 0x26
xor ecx, 0x5a9ade29
bswap edx
dec ecx
xor edx, eax
ror ecx, 2
xor ebx, ecx
add esi, ecx
mov edx, dword [ebp + eax - 0x9d8d]
lea ecx, [eax + eax*4 - 0x6ee7b461]
and dword [esp + eax*2 - 0x13b1a], ecx
call fcn.00a0e1bf
lea edx, [edx + ecx*2 - 0x77012f18]
ror edx, 3
shl byte [esp + ecx*2 + 4], cl
lea edx, [edx + ecx - 0x7507d5ac]
mov dword [esp + ecx - 1], 0x7510aebf
or word [esp + ecx + 0xc], cx
ror edx, 3
sub word [esp + ecx + 0xa], 0xfca8
xor ebx, edx
jmp 0xdfdd7a
inc al
jno 0xe026f8
jmp edi
mov dword [ebp + ecx*8 - 4], edx
jne 0xa2b0c7
mov ecx, 0xfb1c968b
mov eax, 0xaa34c8ba
or cl, al
mov eax, dword [ebp]
lea edx, [ecx - 0x10ddb0f4]
xadd cx, dx
bswap edx
mov ecx, dword [ebp + 4]
call fcn.009a75b0
mov word [ebp + 2], cx
mov edx, eax
sub dl, dl
mov ecx, eax
mov eax, dword [ebp + 2]
sbb ebp, 0xfffffffa
not edx
dec edx
movzx ecx, byte [edi + edx - 0x14f422fe]
xor cl, bl
neg edx
neg cl
rol edx, 0x34
lea edx, [edx*8 - 0x7b451471]
dec cl
ror edx, 0x6a
add dl, dh
neg cl
push edx
xchg byte [esp + edx - 0x5dc18ca6], dl
and dl, dl
sbb cl, 0x3a
xor bl, cl
sub byte [esp + edx - 0x5dc18cbe], dl
lea ecx, [esp + ecx + 4]
seto byte [esp + edx - 0x5dc18cc0]
sub byte [esp + edx - 0x5dc18cc1], dh
mov dword [ecx + edx - 0x5dc18cc1], eax
jl 0xdb3864
add dx, dx
movzx ecx, dx
mov ecx, dword [ecx + edi - 0x1981]
rol edx, 0xf0
movzx eax, dl
neg eax
lea edi, [edi + edx*2 - 0x3304bb7d]
seta dl
xor ecx, ebx
ror word [esp + edx - 0x19825d00], 0x44
jb 0xd76347
inc ecx
mov esi, 0x79a0626
inc ebp
mov ebx, esi
dec edi
lea edx, [edx + esi - 0x79a062a]
inc edi
mov eax, dword [edx + esi*4 - 0x1e681898]
inc esp
xor eax, ebx
dec ebx
lea ecx, [esi + ebx*8 + 0x21100e8e]
inc ebp
lea eax, [eax + ecx*2 + 0x23a2d0bc]
inc ecx
rol eax, 2
inc ecx
inc eax
inc ecx
movsx ebp, dh
inc ecx
rol eax, 2
inc edi
lea eax, [esi + eax + 0x7b1e2e60]
inc ecx
bswap eax
shl cx, cl
inc ecx
dec eax
inc ecx
rol dh, 0x66
jb 0xa4b645

Function at 0xdf84c7
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, ecx
and dx, 0xecb9
adc ebp, ecx
ror dl, 0x81
mov ecx, dword [esp + 7]
ror dl, 0xa3
mov eax, dword [esi + ecx - 0x530700ca]
cmovae dx, cx
call fcn.00a8eecf
mov ebp, 0x8adb4bb
call fcn.00ddbabd
lds ecx, [ecx + ebp - 0x1b]
jo 0xdf8549
add ebp, esp
imul esp, dword [esi - 2], 0xb60ff203
dec edi
add al, 0x8b
push esp
and al, 8
add edx, 0x5e9b9
jmp edx
xchg edx, eax
movsd dword es:[edi], dword [esi]
add byte [eax], ah
inc edx
inc edx
lea ecx, [edx + edx*8 - 0x20c755f8]
rol eax, 2
mov word [esp + ecx*2 - 0x649adfba], cx
lea eax, [eax + edx - 0x33981c83]
shl dl, 0xc1
jne 0xe0629c
jge 0xdf852e
int3
test cx, 0xe613
test dx, si

Function at 0xdfae3c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea ecx, [edx + edx + 0x11b218b2]
pop edx
dec eax
mov edx, 0xa00519bd
not eax
lea ecx, [ecx*8 + 0x6927c422]
neg dword [esp]
ror eax, 2
call fcn.00e6a6b9
neg dl
pop ecx
add cx, 0xbe1b
jle 0xe1eb8e
invalid
Function at 0xdfb62d
Capabilities:
Authenticate hmac

Disassembly:
add edx, dword ss:[ecx + eax*2 - 0x70000000]
mov dword [ebp + eax*2 - 0x70000004], edx
mov ecx, 0x412386a5
shr al, 0x81
lea ebp, [ebp + eax*2 - 0x70000004]
lea ecx, [eax*4 - 0x4179f3c8]
mov dword [esp + eax*2 - 0x6ffffff8], ecx
rol cx, 0xc3
pop eax
pop ecx
pop edx
pop eax
pop ecx
jp fcn.00a61cb3

Function at 0xdfb7a0
Capabilities:
Encrypt data using speck

Disassembly:
neg word [esp + 2]
mov dword [ebp], ecx
rol dx, 0xa8
xadd dword [esp], edx
sal dx, 0xad
mov edx, dword [ebp]
shr dword [esp], 0xa1
mov eax, 0x81312b17
mov eax, dword [ebp + 4]
call fcn.00d87db8
sysenter
call fcn.00d96307
mov dword [esp + eax - 0x1cc1afd1], 0x3ba5b30e
sub ecx, 0xd7bd8f3f
xor ecx, 0x95a0fe08
xor ebx, ecx
add esi, ecx
mov eax, dword [ebp + eax*2 - 0x39835fa2]
mov ecx, dword ss:[eax]
jmp 0x9c009b

Function at 0xdfcd90
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
push ecx
pushfd
mov ecx, 0x69af3186
bswap ecx
or ecx, 0xd42ab29f
add cl, 0x89
xor ecx, 0x2292fa3
mov ecx, dword [esp + 4]
mov dword [esp + 4], 0xf9fe210c
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00d589de

Function at 0xe00e5d
Capabilities:
Encrypt data using speck

Disassembly:
lea ecx, [ecx + eax*2 - 0x244f4fcb]
bswap eax
neg ecx
mov dword [esp + edx*4 - 8], edx
dec eax
lea ecx, [ecx + eax*2 + 0x94c8c74]
shl edx, 0x27
or dx, dx
xor ecx, 0x2911241e
call fcn.009aa2ca
dec edi
lea edx, [edx + eax - 0x73a42765]
inc ecx
mov edi, 0x8abaf2f
inc ebx
mov ecx, dword [edx + edi*2 - 0x11575e5e]
inc ebp
movsx esi, ax
inc ecx
mov eax, eax
xor ecx, ebx
jmp 0xa153f0

Function at 0xe029a4
Capabilities:
Encrypt data using speck

Disassembly:
rol eax, 1
inc eax
xor eax, 0xba2358aa
dec eax
sal ebp, cl
inc esp
movzx ebx, si
lea eax, [eax + edx*2 + 0x7579a026]
inc ecx
mov edi, 0x35a4e3b8
dec dword [esp + edx - 0x191e4e05]
dec eax
mov dword [esp + edx*2 - 0x323c9c0a], ebx
dec eax
neg edx
sal ebp, cl
xor dword [esp + edx + 0x191e4e05], eax
pop ebx
inc esp
movsx esp, dh
dec esp
lea edi, [ecx*4 - 0x5ad1e0fd]
inc esp
movsx eax, bp
dec eax
arpl ax, ax
neg ecx
jne 0xa1e62f
xor edx, 0x7844f3d
call fcn.00d58b14
push edx
mov ecx, edx
xor ebx, eax
sar edx, cl
add esi, eax
call fcn.00925624
dec ecx
add edi, 0xfc272528
dec eax
add edi, eax
inc ebp
movzx ebp, word [edx + edx + 0x191e4dff]
neg dl
dec ebp
lea edx, [edx + esi - 0x1f]
inc sp
xor ebp, ebx
inc ecx
push esp
call fcn.00921ef6
inc ecx
sal esp, cl
mov ebx, 0x8d0c5404
inc esi
xor dword [esp + eax - 0x5af7bce0], edi
inc ecx
shr al, 0x84
inc esp
xchg edx, ebx
inc ecx
setb ah
pop ebx
dec esp
or ebp, edx
inc ecx
sub eax, ebp
call fcn.00e175f1
mov edx, 0x191e4e05
dec eax
mov dword [esp + edx*2 - 0x323c9c0a], edx
inc edx
mov eax, dword [edx + edx - 0x191e4e09]
movsx esi, byte [esp + edx*4 - 0x64793811]
dec eax
lea ebp, [edx*2 - 0x6b7999c1]
xor eax, ebx
inc esp
movzx esi, word [esp + edx*4 - 0x64793814]
inc ebp
add dh, dh
dec eax
movzx ecx, dl
shl dword [esp + esi - 0x17], cl
jns 0x9b4826
Function at 0xe05766
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
add ebx, 0x22117218
dec esi
mov dword [esp - 0x25400000], ebp
dec eax
lea eax, [esp + eax + 8]
inc ebp
mov dword [esp + eax - 0x12a00000], eax
inc ecx
or ah, 0x83
push esi
inc ebp
movzx eax, byte [edx + ecx*2 - 0x12d]
dec eax
sal dword [esp + ecx - 0x91], cl
xor dword [esp + ecx - 0x89], ebp
call fcn.00d906cd

Function at 0xe149f1
Capabilities:
Encode data using xor

Disassembly:
call fcn.00dc26d8
xor eax, ebx
jmp 0xd50f5a
mov ecx, 0xa32349a7
sub edi, 4
mov eax, dword [edi]
dec ecx
js 0xd5ca0d
add byte [eax], al
add byte [ebx - 0x77f0b6f9], cl
pop ebx
xor ah, 0xff
ror cl, 1
sal word [esp + eax - 0x5c1eb7b1], 0x81
neg dword [esp + eax - 0x5c1eb7a2]
mov ah, 4
dec edi
dec eax
loope 0xe1499e
xor edi, 0x485e049c
loope 0xe149a6
not cl
mov dword [esp + eax - 0x5c1eb7ba], 0x1d1a7c8c
mov dword [esp + eax - 0x5c1eb7b6], eax
rol cl, 1
xchg word [esp + eax - 0x5c1eb7a9], ax
shr eax, 0x41
sub cl, 0x8f
shl dword [esp + eax*2 - 0x5c1e8fa6], 0xb5
lea eax, [eax + eax*8 - 0x264139ff]
neg cl
shl eax, 0xe4
sete al
sal ax, 0xeb
xor bl, cl
call fcn.00e00ec6
leave
jno 0xe149f5
jmp 0xe14ab6
mov eax, 0xf9a2ae5b
test eax, 0x50762f39
jmp 0x77107cb2

Function at 0xe15734
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
inc dl
neg eax
xor ecx, ecx
sal ecx, 0x35
sbb eax, 0xfc11b52d
xor ebx, eax
add esi, eax
mov eax, edx
add ecx, dword [ecx + edi]
lea edi, [edi + edx*4 - 0x18000]
dec edx
not edx
xor ecx, ebx
call fcn.0093d31a
xor ecx, ebx
movsx edx, ax
call fcn.00e123cb
and edx, 0xd1bb2625
xor ebx, ecx
and ax, 0xfc31
jb 0xe696fa
adc esi, ecx
mov ebp, dword [ebp]
movzx ecx, al
jmp fcn.00a61cb3
sal ecx, 0x65
not eax
movsx edx, cx
jae 0x917922
inc esp
xor dword [esp + ebp - 0x4096a833], eax
inc cx
sar ebp, 0xee
dec eax
mov ebx, dword [esp + ebp - 0x4096a833]
dec esp
mov dword [esp + ebp - 0x4096a83b], esp
dec ebp
arpl ax, ax
jb 0xe1f97a
lea ecx, [ecx + eax + 0x2aca3a4a]
ror ecx, 3
xor ebx, ecx
add ebp, ecx
xadd eax, edx
mov ecx, edx
mov ecx, dword [ecx + esi - 0x4e549fc1]
neg eax
sar edx, 0x17
mov edx, dword [ecx + edx*2 - 0x138]
mov dword [esi + eax - 0x8a2bf76], edx
movzx edx, ax
ror edx, 0x5a
dec edx
lea esi, [esi + eax - 0x8a2bf76]
cmovs eax, edx
sal dx, 0xc1
jle fcn.00d89820
mov ecx, dword [edi]
mov edx, 0x11ad2c15
neg edx
movzx eax, dx
lea edi, [edi + eax - 0xd3e7]
lea eax, [edx*2 + 0x7e1076a3]
sar eax, 2
xor eax, 0xf50b52b2
xor ecx, ebx
rol ecx, 1
dec eax
sar eax, 0x68
not ecx
lea ecx, [ecx + edx - 0x57377f37]
rol ecx, 1
jmp 0xd706d9
inc eax
rol ecx, 0xf6
jae 0xdbe446
Function at 0xe18120
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jl 0xd8fc9a
dec ecx
add edi, esp
inc ecx
pop esp
pop ecx
pop ebp
jmp fcn.00d6eae8
rol dl, 1
xor bl, dl
shr al, 0xe3
lea edx, [esp + edx + 4]
mov ecx, dword [edx + ecx*2 - 0x77adc77c]
mov dword [esi + eax*2 - 0x418cfe1c], ecx
mov dword [esp + eax*2 - 0x418cfe18], 0xe2b6cc0b
mov edx, dword [eax + edi - 0x20c67f11]
mov dword [esp + eax*2 - 0x418cfe18], eax
mov ecx, eax
xor edx, ebx
lea edx, [edx + eax - 0x336ad9c8]
rol edx, 1
ror dword [esp + eax*2 - 0x418cfe18], 0x28
lea edx, [edx + eax*2 - 0x7035cb99]
jae 0xe41371
inc ecx
or ebx, 0xf82fb71c
dec eax
mov dword [esp + eax - 0x2d18], ebx
inc si
add dword [esp + esi - 0x5b0ffffa], esi
inc esp
xor dword [esp + eax*2 - 0x5a40], esp
dec edx
mov dword [esp + esi - 0x5b0ffff8], eax
xchg dword [esp + eax*2 - 0x5a49], edx
dec edx
mov ebx, dword [esp + esi - 0x5b0ffff0]
ror dword [esp + eax - 0x2d1d], 0x8e
dec eax
neg eax
dec esp
sub dword [esp + eax + 0x2d30], eax
dec ebp
arpl sp, sp
jb 0xd75f1c

Function at 0xe1c17d
Capabilities:
Encrypt data using speck

Disassembly:
not ecx
shl eax, 0x73
neg ecx
xor ecx, 0xd1b3f1a9
rol ax, 0x41
sar edx, 0xeb
xor ebx, ecx
add ebp, ecx
call fcn.00d657e6
lea ebp, [edx + ebp - 0x2990f363]
jo 0xa69673
ror dword [esp + edx*2 - 0x5321e6d2], 0xcc
mov word [edx + eax - 0x2990f369], cx
adc dword [esp + edx*2 - 0x5321e6d2], 0x82266f14
neg dl
mov edx, dword [edi + edx*2 - 0x5321e72e]
add edi, 4
mov eax, dword [esp]
xor edx, ebx
shr dword [esp], 0x39
jne 0xe592e1
mov eax, dword [0x1ad98e34]
retf 0x2607
xor edx, 0xb43408a6
rol eax, 0x64
dec edx
bswap edx
xchg dword [esp], eax
inc edx
xadd byte [esp + eax - 0x5c], ah
xor dword [esp + eax - 0x3b5c], eax
xor ebx, edx
xchg ah, al
add esi, edx
xor byte [esp + eax - 0x5c3b], ah
call fcn.00a8f7bb
inc ebp
mov eax, dword [edx - 4]
inc esp
xor eax, ebx
inc ecx
bswap eax
mov esi, 0xa827d416
movzx ecx, si
dec eax
rol ecx, cl
inc ecx
dec eax
inc ecx
xor eax, 0x38247017
push ecx
bswap esi
inc ecx
inc eax
call fcn.00a72540

Function at 0xe1d9c8
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
adc esi, eax
shr byte [esp + edx - 0x69], 0xe7
pop edx
pop edx
je fcn.00a61cb3
xor edx, ebx
rol edx, 1
pop eax
neg edx
push 0x9313b630
mov dword [esp + 8], 0x64bb4437
call fcn.009bfab5
bswap eax
inc eax
or ecx, edx
mov dword [esp + ecx - 0x3b9f494d], ecx
sar edx, 0x11
not eax
neg eax
xor cx, 0xa425
shl byte [esp + ecx - 0x3b9fed65], 1
xchg byte [esp + ecx*2 - 0x773fdacc], dl
sbb eax, 0xfc11b52d
inc word [esp + ecx - 0x3b9fed67]
not ecx
xor ebx, eax
and ecx, ecx
jl 0xdeb9d5
rol dword [esp + 4], 0xb4
xor ecx, 0x8e18e520
call fcn.00dc12da

Function at 0xe1dc5b
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [edx]
mov edx, 0xc11088a6
movsx eax, dx
mov dword [ebp], ecx
movsx ecx, dx
rol dl, 0x62
mov eax, dword [edi]
pop ecx
adc edi, 4
movsx ecx, dx
xor eax, ebx
shl edx, cl
sbb eax, 0xea114fa7
ror eax, 1
inc eax
sub cl, dh
jl 0xa6a028