joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb3fb31
Capabilities:
Encode data using xor

Disassembly:
pop ecx
add al, dl
mov word [ebp], ax
sub esi, 4
lea eax, [ecx*2 - 0x48c1fb4b]
shl eax, cl
mov ecx, dword [eax + esi - 0x7ccb8e00]
xor eax, 0x179100b6
xor ecx, ebx
bswap eax
mov edx, eax
xor ecx, 0x7b393115
dec eax
jp 0xc2ce2c
jmp edi
dec edx
lea eax, [eax + edx - 0x38940295]
add cl, cl
xor ebx, eax
shl dword [esp + ecx - 0x761d7786], cl
adc esi, eax
xor dword [esp + edx - 0x761d77d4], 0xaf3981b6
mov eax, 0x92a72d3c
mov dx, word [edi + ecx - 0x761d7788]
movzx eax, byte [ebp + ecx - 0x761d778c]
or cl, byte [esp + ecx - 0x761d7786]
adc cl, 0xa6
xor al, bl
jmp 0xbf2c63
ror ecx, 3
call fcn.00ba2d4b
mov ax, word [edi]
mov dx, word [edi + 2]
mov ecx, 0x6b859483
ror ecx, 5
mov cl, byte [edi + ecx*4 - 0x6d70b28c]
jae 0xbcd8b9
rol eax, 2
pop edx
push ecx
bswap eax
sar cx, 0x62
lea edx, [ecx*8 + 0x761d772a]
xor eax, 0xed3dfdbd
ror dword [esp + ecx*8 - 0x98], 0xf2
ror eax, 2
xadd edx, ecx
adc byte [esp + ecx - 0x761d77c0], 0xab
xor eax, 0xaa30b832
inc ecx
jne 0x835f91
jmp 0xc342ef
push 0x480a3401
adc edi, 4
sar word [esp], 0xcc
shld ax, dx, cl
sar dword [esp], 0x72
mov ecx, 0x11a2298c
mov word [edi + ecx*4 - 0x4688a630], ax
sbb ecx, dword [esp + ecx - 0x11a2298c]
pop eax
mov edx, dword [ebp + eax*2 - 0x2404]
or ecx, 0xbb9db487
shl eax, cl
lea ebp, [ebp + eax*8 - 0x4807fffc]
inc ax
shl eax, 0xa7
xor edx, ebx
or ecx, eax
dec ecx
inc al
inc edx
call fcn.00cd1ec4
rol ecx, 0x68
adc al, 0x23
sub ecx, dword [esp + ecx - 0x1d775c76]
xor al, 0x36
add cl, byte [esp + 3]
sub cx, 0xb9be
add byte [esp + 3], cl
sub al, 0x88
sar ecx, 0x28
mov word [esp + 1], 0x5381
ror ecx, 0xf9
not al
sbb dword [esp], ecx
xor bl, al
push ecx
xor cx, word [esp + 4]
call fcn.00b1ce81
sub ecx, 0x72a5c7b7
xor ax, dx
ja 0xb2d248
movsx edx, ax
shr edx, 0x89
dec ecx
neg dx
call fcn.007b8331
push 0xc224758e
movzx ax, byte [ebp]
mov edx, 0x26a9d09a
mov dl, byte [ebp + edx - 0x26a9d098]
shr dword [esp], 0x52
adc ebp, 2
jmp 0x81cbb0

Function at 0xb4459e
Capabilities:
Encrypt data using speck

Disassembly:
inc esi
lea eax, [edx + eax - 0x4dded793]
sar ecx, 0x84
jp 0x7d4c7c
dec esp
mov dword [esp + eax - 0x5d90], ebp
inc esp
xor dword [esp + eax - 0x5d90], eax
dec ecx
shr esp, cl
sub dword [esp + eax*2 - 0xbb3e], ecx
dec esp
mov ebp, dword [esp + eax*4 - 0x17670]
inc esp
mov dword [esi + eax*8 - 0x2ecf8], eax
dec eax
lea esi, [esi + eax - 0x5d98]
movsx ebx, word [esp + eax - 0x5d94]
dec ecx
shl esp, cl
dec esp
mov dword [esp + eax*2 - 0xbb40], esi
ret 0x10
dec esp
mov ebp, dword [esp + eax*2 - 0xbb28]
dec eax
arpl bp, bp
dec esp
add esi, ebp
inc ebp
mov eax, dword [ebx + eax*8 - 0x2ed09]
dec eax
neg edx
dec edx
lea ebp, [0x16126b9f]
dec ebp
lea ebx, [ebx + eax*8 - 0x2ed09]
inc ebp
xor eax, ebp
dec eax
mov dword [esp + eax*2 - 0xbb40], ecx
and ebp, 0x36200e34
movsx edi, ax
inc ecx
dec eax
jmp 0xb64a61
inc ecx
neg eax
inc ecx
xor eax, 0x8809b502
pop edx
jmp 0x7d3322
Function at 0xb51e31
Capabilities:
Encrypt data using speck

Disassembly:
setbe cl
sbb ebp, 1
push ecx
call fcn.007bd958
inc ecx
bswap edx
dec esp
xor ecx, eax
call fcn.00b68afa
neg eax
rol eax, 1
xor ebx, eax
lea ecx, [edx*2 + 0x7229e591]
bswap edx
inc dl
add esi, eax
mov dword [esp + edx*2 - 0x84178a], edx
sal cl, 0x26
mov dx, word [edi + edx*4 - 0x1082f14]
adc edi, 2
shl byte [esp], 5
ja 0xb3796e

Function at 0xb51e66
Capabilities:
Encrypt data using speck

Disassembly:
movsx edi, dx
dec eax
lea esi, [edx + esi - 0x72b20d3b]
inc ebp
movzx esp, al
inc ecx
neg bh
push edx
inc cx
not ecx
dec eax
dec eax
inc cx
not edx
xchg byte [esp + edx - 0x72b20d3c], bl
inc sp
sbb dword [esp + edx - 0x72b20d3b], edi
rol edx, 0x42
inc bp
or ecx, edx
inc ecx
push edi
or dx, 0x7e09
neg dx
inc sp
mov dword [eax + esi - 0xb8], ecx
jle 0xb5be66
push 0x733a6026
neg al
mov ecx, dword [esp + 8]
add ecx, 0xffb311ed
jmp ecx
dec eax
mov dword [esp + eax*2 - 0x172], 0x2705dd95
inc sp
mov ecx, dword [esi + eax*2 - 0x172]
inc sp
mov edx, dword [esi + edx - 0x72b20d3b]
inc ecx
pop eax
jmp 0x850d63

Function at 0xb54e4f
Capabilities:
Encode data using xor

Disassembly:
neg ecx
inc ecx
dec edx
shl eax, 0x4f
dec edi
mov dword [esp + eax - 0x7c0000], 0x7926d9b1
xor edx, 0x459db401
bswap edx
inc eax
neg dword [esp + eax*2 - 0xf80001]
inc edx
xor ebx, edx
sal word [esp + eax - 0x7bfffd], 0x4d
call fcn.0087c4ae
sbb eax, 0xa1e71061
xchg ecx, eax
dec esi
mov dl, 0xd
mov dword [ecx - 0x2b7f3e77], 0x476e65ff
mov eax, 0x4da65179
cmp byte [ecx - 0x27], bh
xchg esi, eax
dec ebp
cmp byte [ecx - 0x2f], bl
salc
dec ebp
cmp byte [ecx], cl
jns 0xb54e55
add al, 0x58
or eax, 0x9eff123f
add al, byte [edi - 0x25d351ba]
invalid

Function at 0xb5ca86
Capabilities:
Encrypt data using speck

Disassembly:
lea edx, [esp + ecx - 0x1eb7]
mov eax, dword [edx + ecx*2 - 0x3dfe]
dec ecx
mov dword [ebp + ecx - 0x1f02], eax
lea ebp, [ebp + ecx*2 - 0x3e00]
or word [esp + ecx - 0x1efa], 0xa63d
pop eax
pop edx
jle fcn.00c1da4d
Function at 0xb6253d
Capabilities:
Encode data using xor

Disassembly:
not edx
and eax, dword [esp + eax*2 + 0x10]
jo fcn.00b297c5
lea eax, [ecx*4 - 0x2a58c4ef]
sbb edx, 0xd62d8aab
call fcn.00c0641f

Function at 0xb668f1
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + edx - 0x6140403], esp
dec eax
arpl cx, cx
dec esp
cmova eax, dword [esp + eax*4]
call fcn.00b149e6

Function at 0xb672db
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
adc esi, edi
sub ax, di
call fcn.00817d89

Function at 0xb6747a
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, edx
and eax, ecx
adc edi, edx
mov edx, 0x6a2fab8
pop eax
pop ecx
pop ecx
pop ecx
jmp fcn.0074a1b4
not edx
sar eax, cl
neg dword [esp + ecx - 0x4607c925]
rol edx, 1
not ecx
sub edx, 0xb7a6a1be
or cl, ch
not edx
mov dword [esp + eax], ecx
or dword [esp + eax*2 + 0xc], eax
jno 0x753515

Function at 0xb6aaff
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp], 0x79b31454
call fcn.00ccf835

Function at 0xb749ac
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp + edi - 0x5fac421c], eax
mov esi, ebp
mov ebx, dword [esp + ecx - 0x5fac4214]
mov dword [esp + edi - 0x5fac4214], ecx
sub edi, 0xf8393b0b
movsx edx, cx
mov edi, dword [esp + edi - 0x67730705]
mov ebp, dword [esp + ecx - 0x5fac420c]
movzx eax, cl
mov ecx, dword [ebp + edx*2 - 0x8438]
call fcn.007c8d41
jmp 0x7e1d56

Function at 0xb75baa
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0x8b30f585
push eax
xor ax, cx
dec edx
not ecx
neg edx
or ecx, eax
ror edx, 1
mov ecx, dword [esp + 4]
add ecx, 0xfffc78da
jmp ecx
shr cl, 0xa5
rol ecx, cl
not edx
jns 0x81c837
Function at 0xb79391
Capabilities:
Encode data using xor

Disassembly:
mov word [ecx + edi - 0x64abda6b], ax
mov edx, dword [ebp + ecx - 0x64abda71]
seta cl
pop eax
rol dword [esp + ecx - 0x64abda01], cl
lea ebp, [ebp + ecx - 0x64abda07]
or al, 0xff
and eax, 0xac8d9b54
or eax, 0x9b5425f9
xchg word [esp + ecx - 0x64abd9f4], ax
ror dword [esp + ecx - 0x64abd9ff], 0xe8
xor edx, ebx
call fcn.00b285df
lcall 0x2ef6, 0xb89d1605
mov word [ecx + eax], cs
push esp
wait
call 0xc85d7848
loopne 0x74a554
add byte [edx - 0x4762e9fb], bl
imul byte [esi]
push ds
mov eax, edx
cmp byte [eax], 0xb9
and byte [ebx - 0x26], bh
push cs
push esi
stc
movsd dword es:[edi], dword [esi]
jl 0x74a4f5
push es
cmp dword [ebp - 0x29193884], esp
and dword [ebp + 0x66ec77c], 0xc77ca509
salc
salc
outsb dx, byte [esi]
push edx
jae 0x74a56c
add eax, dword [ebx + 0x7e]
sahf
mov edx, esp
js 0x74a50a
mov dh, 0xce
ja 0x74a517
pop ebp
mov ebx, 0xc5fffe5e
pop ebp
mov ebx, 0xc547aea6
pop ebp
mov ebx, 0xc587ce2e
pop ebp
mov ebx, 0xc5bfceee
pop ebp
mov ebx, 0xc5276616
pop ebp
mov ebx, 0xc5df2e4e
pop esi
invalid
push ss
daa
lds ebx, [ebp - 0x45]
dec esi
ffreep st(5)
pop ebp
mov ebx, 0xc54fd6b6
pop ebp
mov ebx, 0x76166a6b
shl edx, cl
push edx
xor bx, ax
sar dx, 0xa1
jns 0x74a4e0
sub eax, 0x67a25d24
neg ecx
not dx
bswap ecx
lea eax, [edx*2 - 0x6a6f3d7f]
push edx
jmp 0xcc5476
not ecx
lea ecx, [edx + edx*8 + 0x64ae95b6]
inc ax
rol ax, 1
add ax, 0xf4a1
sub dl, cl
rol ax, 1
jmp 0x82af45
rol ecx, 9
inc ax
mov dword [esp + edx - 0x4db2], 0xd3140dab
mov dword [esp + edx - 0x4dae], ecx
rol ax, 1
dec ax
not edx
or dword [esp + 0xc], 0x959b54b2
neg ax
jmp 0x839572
dec ecx
neg ecx
rol ecx, 1
shl edx, 0x7b
lea ecx, [ecx + eax*4 + 0x3ef0d9a7]
xor ebx, ecx
sar eax, 0xda
add edi, ecx
shl word [esp + eax*2 - 0x13], 0xc
call fcn.00cbb837

Function at 0xb88fc1
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi], edx
neg byte [esp + 1]
shl dword [esp + 0xc], cl
pop eax
pop ecx
pop eax
pop edx
jmp edi
mov dword [esp + edx*2 - 0x953e], 0xb180bd15
not eax
inc cl
shl dx, cl
xor eax, 0xbd1c552f
push ecx
neg edx
ror eax, 1
sub ecx, dword [esp]
jle 0xb9ef53
mov gs, word [ebp + 0x5f]
add dword [eax], eax
rol byte [0x4f11ebc1], 0x73
dec ebx
outsb dx, byte [esi]
pop ecx
cmp esp, ebp
xor esi, dword [ebx]
jg 0xb88ff0
and esp, ebp
daa
aam 0xa6
add dl, byte [ebx]
pop es
xchg ebx, eax
mov edi, 0xbab725
mov eax, 0xfabc2a18
jl 0xb88fe1
inc esp
sub bh, byte [edx + edi*8 + 0x2a24e41c]
mov esp, 0x28f8d0fa
sub bh, byte [edx + edi*8 + 0x3a3fac40]
insb byte es:[edi], dx
inc eax
sar cl, 4
sar dword [esp + ecx + 2], 0x61
xor ecx, edx
xor ebx, eax
rol edx, 0xc9
add edi, eax
mov eax, dword [esi]
lea ecx, [ecx*4 - 0x29f95e44]
xadd byte [esp + 1], cl
mov edx, dword fs:[eax]
push ecx
jbe 0xc0b108
jle 0x7d586e
Function at 0xb89e83
Capabilities:
Encrypt data using speck

Disassembly:
inc dx
shl eax, 0x99
shr cx, 0x2c
pop ecx
rol dx, 1
dec dx
mov ecx, eax
jmp 0xcbb4ce
inc dx
xor ax, 0x3039
or cl, ah
setp al
rol dx, 1
xchg ecx, eax
add dx, 0xf4a1
xadd al, ch
rol dx, cl
push eax
xadd ax, cx
xor bx, dx
sal dword [esp + eax - 0x2003061], 0x4d
lea eax, [eax - 0x2cd7ceca]
xchg ecx, eax
mov ax, dx
jb 0xbde33d
adc cl, 0x2d
mov cl, byte [edi]
shr ax, cl
jmp 0xc27828
neg dx
jmp 0xbfe8c3

Function at 0xb94551
Capabilities:
Execute syscall

Disassembly:
dec ecx
lea edx, [eax + ecx*8 - 0x24d837ef]
dec ecx
mov edx, esp
inc ebp
movzx esp, ax
inc cx
not eax
inc edi
movzx edx, byte [ebx - 0x103e5]
inc ebp
xor dl, ch
inc ecx
xor dl, 0x83
dec esi
mov dword [esp - 0x103e4], esp
call fcn.008485f0

Function at 0xb9c6a1
Capabilities:
Get number of processors

Disassembly:
lea esp, [esp + 0xc]
je 0xbe9e13
push 0x93b8601c
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
push 0xa500ffb3
dec ebx
call fcn.007d4cc4
mov ecx, 0xf4a5c104
lea eax, [ecx*4 + 0x51df428]
sub ebp, 4
shr al, cl
sub ecx, 0x989eb9a4
sub ax, cx
mov eax, dword [ecx + ebp - 0x5c070760]
mov edx, ecx
jnp 0xbf46b2
and cx, 0x98a0
xor eax, ebx
inc edx
call fcn.00c66419
inc ebp
mov esp, dword [ebx + ebp - 0x5e0d42a7]
jp 0x7c2d02
xchg ecx, esi
mov ch, 0x98
aad 0x91
mov byte [0xf9bb7b27], al
cmp eax, 0xef251300
stc
cmp eax, 0x15146d00
xor esp, ebp
pushal
xor dword [ebx - 0x446c0c95], eax
retf 0x1bff
test ebx, ebx
jmp 0x81d168
push 0x7bbbbe2f
mov eax, dword [ebp]
call fcn.00c1d6f0

Function at 0xba30ac
Capabilities:
Encrypt data using speck

Disassembly:
shr ecx, 0xa1
mov dword [esp + eax - 0x4b929779], ecx
xor ebx, edx
call fcn.00c1f7bd

Function at 0xbaabf5
Capabilities:
Encrypt data using speck

Disassembly:
add al, cl
sal dword [esp], 0x39
sal word [esp + 1], 0x48
mov word [edi + 2], ax
mov eax, 0xb71d8701
dec dword [esp]
movsx edx, al
mov ecx, dword [edx + ebp - 1]
add dl, 0x81
sbb dx, ax
xor ecx, ebx
xadd byte [esp + edx - 0x797e], al
xor ecx, 0x830b902f
xor dl, al
neg ecx
xchg dh, al
or edx, 0x120f6492
sbb ax, 0xe3b8
dec ecx
lea edx, [eax + eax*8 - 0x64c3856d]
dec ax
not dword [esp + edx - 0xb473c5c]
neg ecx
xor ebx, ecx
jmp 0x799b87
jmp 0xceb0af
movzx ax, byte [edi]
mov dword [esp], ecx
not ecx
neg cl
mov cl, byte [ecx + edi - 0x4de75a1c]
jbe 0x73aa41
Function at 0xbb851f
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
movzx dx, byte [edx + ecx - 0x1c853fa]
xor eax, dword [esp + eax - 0x61c3cfb9]
push eax
movzx ecx, byte [esp + 0x11]
mov cx, dx
mov dword [esp + 4], eax
movzx cx, cl
je fcn.00c47e98
lea eax, [eax + eax*8 - 0x5fc310e1]
or eax, eax
mov dl, byte [esi + eax*2 - 0x5de5932e]
inc eax
and cl, dl
or dword [esp + eax*2 - 0x5de59330], eax
dec word [esp + eax*2 - 0x5de5931c]
not cl
dec al
lea edx, [eax + 0x22a5bebb]
dec word [esp + eax - 0x2ef2c995]
mov word [esi + edx - 0x51988852], cx
mov eax, esi
push edx
mov dword [esi + edx - 0x51988856], eax
sal dword [esp + edx - 0x51988845], 0x33
mov eax, 0xa02bbc83
lea esi, [esi + edx - 0x51988856]
mov ecx, edx
add edx, 0x1c8296b7
pop ecx
pop eax
pop eax
pop edx
pop ecx
pop ecx
pop eax
jg fcn.0074a1b4
mov ebx, 0x58bb2124
inc ebp
mov eax, dword [ebx + ebx - 0x58bb2128]
inc ebp
xor eax, ebp
inc esp
movsx edi, bl
inc ecx
rol eax, 3
or ebx, ebx
inc ecx
not eax
dec esi
lea ecx, [edi*8 - 0xf600b50]
inc edi
lea eax, [eax + edi*2 - 0x7aa0824c]
inc ecx
xor eax, 0xb412d383
inc ecx
inc eax
inc bl
inc ecx
movzx eax, cl
inc ecx
movsx edx, cx
inc ecx
not eax
inc ecx
push ebp
inc ebp
movzx ebp, di
inc ecx
shr edi, 0xdd
inc esi
xor dword [esp + edi*2], eax
call fcn.00cf1e93

Function at 0xbc191f
Capabilities:
Encrypt data using speck

Disassembly:
and eax, 0x619aac19
lea esi, [esi + eax - 0x61808815]
jp 0xc27150
push edx
not dx
shr al, cl
and dx, word [esp + 1]
jns 0xbf5293
mov esp, ebp
lea ecx, [edi + esi*8 + 0x570891ba]
dec ax
not ecx
xor edx, 0x838c2d92
dec al
xor ebx, ecx
add esi, ecx
lea ecx, [eax + eax*2 + 0x2c834b39]
xor eax, 0x4ab2516
movzx ax, byte [ebp + ecx - 0x5ce07a1e]
mov cl, byte [ebp + ecx - 0x5ce07a1c]
adc ebp, 2
jmp 0x82f256
movsx edx, cl
ror cx, 0x87
xor eax, ebx
pop edx
shl ecx, 0x5e
ror cl, 0x22
ror eax, 1
xor word [esp + 5], cx
not dword [esp + 8]
neg eax
pop ecx
xor eax, 0x4398cf22
lea eax, [ecx + eax - 0x39802586]
xor ebx, eax
add esi, eax
movzx eax, cx
dec cx
pop edx
pop ecx
jno fcn.00bea2f4
mov eax, 0x851fd325
mov edx, dword [ebp]
mov ecx, eax
mov ecx, dword [ebp + 4]
xadd al, ah
adc ebp, 8
ror ax, 0xaa
ror eax, 0xf4
mov dword ss:[edx], ecx
jae fcn.00c06b5e
jb 0x7ffa1c
sar al, 0x84
dec ecx
not ecx
xadd dl, ah
dec ecx
neg ecx
jmp 0xb3d40a
mov word [ebp], ax
rol byte [esp + 1], 0x66
sbb dx, dx
pop ecx
jmp esi
call fcn.00c1a8c6
mov eax, 0x3a350906
mov ecx, dword [esi + eax*2 - 0x746a120c]
or al, 0x80
mov dl, byte [esi + eax - 0x3a350982]
dec ax
lea esi, [esi + eax*2 - 0x746a1304]
not eax
mov byte es:[ecx], dl
mov ecx, dword [ebp]
lea edx, [eax - 0x796fb8c1]
xchg dh, dl
lea ebp, [edx + ebp - 0x4c5bb939]
lea edx, [edx + eax*8 + 0x7abb1384]
and dx, ax
xor ecx, ebx
or eax, eax
rol eax, 0x8b
rol ecx, 2
sub ecx, 0x8f012f22
shl dx, 0xe8
jbe 0xb053dd
sar edx, 0xa2
ror ecx, 2
call fcn.00c7fab0
mov ecx, dword [ecx + edi - 0x5a96428d]
mov edx, 0x56bead9d
dec edx
lea edi, [edx + edi - 0x56bead98]
lea eax, [edx + 0xeb57a03]
neg dx
xor ecx, ebx
jmp 0xbe5053
Function at 0xbcbede
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
call fcn.00c26e3e
push ecx
neg byte [esp]
mov dword [ebp], edx
mov edx, dword [esp]
lea ecx, [edx + ecx*2 - 0x315714d9]
pop eax
lea esi, [esi + ecx - 0x78356e58]
push eax
call fcn.00c11d1f
ror eax, 3
shl cl, 0xa1
jo 0x74bf41
mov ecx, 0x8781d038
call fcn.00c0a3af

Function at 0xbcf7e0
Capabilities:
Encrypt data using speck

Disassembly:
or ax, ax
neg edx
and word [esp + 1], 0x191
not cl
sar word [esp + 1], cl
lea edx, [ecx + edx + 0x2a0c8d13]
call fcn.00be6913
pop edx
mov edx, dword [ebp]
mov ecx, 0xb40b40ab
add ecx, ecx
lea ebp, [ecx + ebp - 0x68168152]
lea ecx, [ecx + ecx*4 - 0x66cfee63]
mov eax, 0xfe8b64ba
shl cl, 0x43
xor edx, ebx
ror ax, 0xe7
bswap edx
push eax
sbb edx, 0x45199e17
jmp 0x73b843

Function at 0xbd4d51
Capabilities:
Authenticate hmac

Disassembly:
push ebx
movzx ebp, ax
mov ebp, esi
movsx ebx, al
xor edx, edx
mov ebx, ecx
or edx, ebx
push eax
not dword [esp]
shl edx, 2
or al, ah
sets al
mov eax, ebp
jnp 0xbdc436
neg bp
inc ecx
sub edx, edx
dec bp
ror bp, 1
dec esp
lea edx, [ebx*8 - 0x487bb958]
ror ebx, cl
inc sp
xor ebp, ebp
dec eax
add ebp, esp
mov edi, dword [ecx + ebp + 0x3ac7739b]
inc ecx
ror cl, cl
inc cx
neg eax
inc edx
mov dword [esi + edx + 0x487bb5e0], edi
call fcn.007c0563
rol cl, 0xc4
neg al
add al, 0xaa
rol dx, cl
pop edx
ror al, 1
add edx, 0x9d243db4
rol dword [esp + ecx*8 - 0x377], 0xb2
inc al
lea edx, [ecx + edx*2 - 0x16d05df4]
not cl
xor bl, al
lea eax, [esp + eax + 8]
mov cl, byte [eax + edx - 0x2378892d]
movsx eax, word [esp + edx*2 - 0x46f11256]
jmp 0xca2dea
test ebx, ebx
push 0x8e9366a3
lea esp, [esp + 8]
je 0xc8312b
mov ecx, dword ss:[eax + ecx - 0x80000000]
mov dword [esp], 0x8b85b0af
mov eax, dword [esp]
mov dword [edi], ecx
shl dword [esp], 0x8d
ror eax, 0x5c
mov ecx, dword [ebp]
not byte [esp]
lea edx, [eax*2 - 0x71dda7c1]
xchg edx, eax
add ebp, 4
call fcn.00b4c5ae
not dl
lea eax, [eax + eax*8 + 0x4830070b]
sbb eax, 0x759ed398
rol dl, 1
and eax, eax
call fcn.00cdc0ac
mov ecx, dword [ebp]
mov eax, 0x54842094
lea ebp, [eax + ebp - 0x54842090]
movsx edx, ax
xor ecx, ebx
lea eax, [eax + edx*8 - 0x407370ca]
bswap eax
rol ecx, 2
not edx
rol edx, 0x36
jb 0xcc1be7
adc eax, edx
mov dword [ebp - 4], eax
jmp 0x78454e
mov word [ebp + edx*2 - 0x46f1125a], cx
dec ax
sal al, 0xc1
mov dword [esp + edx*2 - 0x46f1125a], edi
ret 4
neg ecx
not ecx
bswap edx
neg ecx
xadd dl, al
xor ebx, ecx
call fcn.007cf983
ror cl, 1
dec al
dec dl
rol eax, 0x5b
xor bl, cl
mov dword [esp + eax - 0x21f95462], ebp
xchg dword [esp + eax*2 - 0x43f2a8cc], edx
rol eax, 0x6c
mov dword [esp + edx - 0x532a8cc5], edi
jb 0x70ae84
Function at 0xbe04ea
Capabilities:
Encrypt data using speck

Disassembly:
push edi
pushfd
pop edi
mov dword [esp + 8], edi
mov edi, 0x65a03b90
mov esi, edx
shr edi, 0xf2
mov edi, eax
cld
push 0x237ed3f
rep movsb byte es:[edi], byte [esi]
call fcn.00c4ad90
mov eax, dword [ebp + edx - 0x7ac06a8d]
call fcn.00bd3c2d

Function at 0xbe0516
Capabilities:
Encrypt data using speck

Disassembly:
setb byte [esp]
not eax
rol eax, 3
call fcn.00cb1bab
not ecx
add al, ch
lea edx, [ecx + edx + 0xa199060]
neg eax
xadd cx, ax
xor ebx, edx
add esi, edx
mov ax, word [edi + ecx*2 - 0x4ffe6200]
mov dx, word [edi + ecx*2 - 0x4ffe61fe]
jmp 0xbf2ba1
lea esi, [esi + eax - 0x40af498c]
movsx edx, cl
neg ecx
mov edx, dword [esi + eax - 0x40af4988]
xor edx, ebx
neg edx
not edx
sar al, 2
neg edx
sar ecx, cl
mov dword [esp + eax - 0x40af49e2], eax
inc byte [esp + eax - 0x40af49e0]
lea edx, [ecx + edx - 0x625a3d95]
add al, byte [esp + eax - 0x40af49df]
sar dword [esp + eax - 0x40af4922], cl
xor ebx, edx
add edi, edx
mov bp, word [ebp + eax - 0x40af4922]
shr eax, cl
pop ecx
jp fcn.00c693b9
xor edx, 0xf530d099
jmp 0x845090
add cl, byte [ecx + edi - 0x27ff30fc]
jmp 0xc359f1
sub byte [esp + 2], ch
xor eax, ebx
sub ecx, dword [esp]
bswap ecx
rol eax, 1
add dx, 0x9c30
jnp 0x844e0d
jmp 0xc6371a
add edi, 4
shld ax, dx, cl
call fcn.0073718b
mov ecx, dword [ebp]
add ebp, 4
mov eax, 0x9cbb6383
movsx edx, ax
xor ecx, ebx
inc edx
not ecx
shr ax, 0x62
dec ecx
shl dx, 0x47
xchg edx, eax
sub edx, eax
bswap ecx
xor dx, dx
ror ax, 5
add edx, eax
xor ecx, 0xc2b37e38
push edx
push eax
bswap ecx
push eax
sub byte [esp + eax - 0x60d], 0xa4
lea ecx, [ecx + eax - 0x27bb85aa]
xor word [esp + eax*4 - 0x1840], ax
dec edx
xor ebx, ecx
push edx
add esi, ecx
movzx ecx, al
add ax, 0xf991
xchg word [esp + eax*8 - 0x7fd05], ax
mov edx, dword [edi + eax - 0x9c]
xor eax, ecx
mov eax, dword [edi + eax*2 - 0x114]
or dword [esp + ecx*4 - 0x34], ecx
bswap ecx
adc ecx, ecx
or cl, byte [edi + ecx*2 - 0x3ffffff8]
push 0x2cacb09e
add edi, 6
call fcn.0071c5a1
mov eax, 0x69044181
movsx edx, ax
mov ecx, edx
mov eax, dword [eax + edi - 0x69044181]
mov edx, dword [edi + edx*2 - 0x82fe]
lea ecx, [ecx*8 - 0x537d4d71]
mov cl, byte [edi + 8]
push 0xeab249a3
sar dword [esp], 0x83
adc edi, 6
sar dword [esp], 8
shrd eax, edx, cl
mov edx, 0x9b8be18a
movzx ecx, dl
mov dword [edi + ecx*2 - 0x114], eax
inc cx
mov eax, dword [ebp + ecx*2 - 0x116]
add ecx, 0xcb086337
sal dword [esp], cl
add ebp, 4
jmp 0xc0abd0

Function at 0xbe2a18
Capabilities:
Execute syscall

Disassembly:
push ecx
add ebp, 4
lea eax, [ecx + ecx*4 + 0x33a8dcbb]
push eax
xor edx, ebx
sub edx, 0xd997f224
call fcn.00ce3153
int 0x2e
call fcn.00b975ad
shl al, 0xe1
adc edi, ecx
mov ecx, dword [edx + ebp - 0x3a25a744]
neg eax
rol byte [esp + edx - 0x3a25a72f], 0x81
call fcn.00bde058
jmp 0xc0c1c3
mov edx, dword [ebp]
mov ecx, 0xe2bda09f
jmp 0x7b543e
Function at 0xbeba59
Capabilities:
Encrypt data using speck

Disassembly:
lea edx, [ecx + 0xa23c136]
mov edx, dword [esi + ecx*4 - 0x22468a10]
ja 0xc750c7
syscall
push ebp
pushfd
dec eax
mov ebp, 0x7caf1326
or eax, 0x57340d0e
dec eax
mov ebp, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], 0x79b26b4d
push dword [esp + 8]
popfd
dec eax
lea esp, [esp + 0x10]
call fcn.00ccf835
mov ecx, 0x810ed937
mov ecx, dword [ebp]
mov eax, 0xac00f1a5
inc eax
add ebp, 4
push eax
lea edx, [eax*4 + 0x2f3ed61e]
call fcn.007d48e0
mov ecx, 0xdfbbfd07
ror ecx, cl
lea eax, [ecx*2 - 0x57665e5a]
mov ecx, dword [ebp + ecx*2 - 0x1f7eeff4]
adc ebp, 4
xor ecx, ebx
jmp 0xc60588
sar edx, 0xfd
xor bl, cl
not eax
mov dword [esp + eax - 0x50ea], edx
not eax
sub edi, 2
xor edx, eax
mov word [edi + edx*4 - 0x143a8], cx
pop edx
jnp fcn.00bea2f4
mov ecx, 0x891a285
push ecx
add dword [esp + ecx*4 - 0x22468a14], 0xa7a2511d
mov eax, dword [esi + ecx - 0x891a285]
js 0x822d90
lea edx, [eax + eax*4 + 0x2438081e]
sal word [esp + eax*4], 0x2f
lea ecx, [esp + ecx + 4]
ror edx, 0xe
add eax, dword [ecx + eax*8]
not dword [esp + edx - 0x207890e0]
mov dword [edx + edi - 0x207890e4], eax
mov eax, dword [edx + ebp - 0x207890e5]
movsx ecx, word [esp + edx*2 - 0x40f121c0]
push edx
neg cx
xor eax, ebx
inc eax
not eax
shl dx, 0xa2
rol eax, cl
shr cx, 0x63
neg eax
call fcn.00c5314d
movsx edx, ax
dec ecx
shr eax, 0xf9
neg ecx
jmp 0xb87e43

Function at 0xbf46b8
Capabilities:
Get number of processors

Disassembly:
mov eax, 0xa9061a27
rol cl, cl
mov cl, dl
mov esi, edi
rol eax, cl
lea esi, [ebp + edx - 0x10c]
add al, dl
cmp sp, 0x4336
xor al, byte [edi + esi]
jmp 0xb15140
cmp ecx, eax
jmp 0x86ccf2
pop edx
bswap eax
inc eax
call fcn.00bd8f90
cmp edx, 0x104
jmp 0x81dd3d
jb 0x7ac791
mov eax, dword fs:[0x30]
bsr bx, sp
shr ebx, 0x1d
mov eax, dword [eax + 0xc]
setbe bl
xadd cx, bx
mov ecx, dword [eax + 0xc]
dec bl
sar bl, cl
mov eax, dword [eax + 0x10]
xor bx, sp
mov dword [ebp - 4], eax
mov ebx, ecx
stc
cmp bp, bp
jmp 0x7c9fe1
je 0x8469fc
lea ebx, [ebx]
mov byte [esi], al
jmp 0xb81e7e
je 0x81dd43
inc edx
cmp edi, 0xb4200403
jmp 0x800958
ror eax, 3
neg byte [esp + ecx*2 + 5]
jns 0x80094f
sar ecx, 0x6d
mov dword [esp + ecx], 0x210d9bb3
bswap eax
mov dword [esp + ecx + 4], ecx
lea eax, [eax + edx*2 - 0x4a6e70d7]
dec dx
jae 0xbe3a80
mov ecx, dword [esp + 8]
lea esp, [esp + 0xc]
ret

Function at 0xbf8bb1
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx eax, dl
mov dword [esp + eax - 0x32], eax
xor ecx, ebx
shl eax, 0xce
xor ecx, 0x9bb1481d
call fcn.00bcefd3
inc dl
xor ebx, eax
call fcn.00ccd6ce