joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1174de0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x1174dfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1174e01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1174df0
mov eax, 1
add ebx, ebx
jne 0x1174e13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1174e24
jne 0x1174e43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1174e43
dec eax
add ebx, ebx
jne 0x1174e30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1174e08
add ebx, ebx
jne 0x1174e3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1174e95
xor ecx, ecx
sub eax, 3
jb 0x1174e5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1174eca
sar eax, 1
mov ebp, eax
jmp 0x1174e66
add ebx, ebx
jne 0x1174e66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1174e34
inc ecx
add ebx, ebx
jne 0x1174e74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1174e34
add ebx, ebx
jne 0x1174e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1174e76
jne 0x1174e92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1174e76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1174eb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1174ea6
jmp 0x1174df6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1174eb4
add edi, ecx
jmp 0x1174df6
pop esi
mov edi, esi
mov ecx, 0xb800
jmp 0x1174f05
mov al, byte [edi]
inc edi
cmp al, 0x80
jb 0x1174ee5
cmp al, 0x8f
ja 0x1174ee5
cmp byte [edi - 2], 0xf
je 0x1174eeb
sub al, 0xe8
cmp al, 1
ja 0x1174f0f
cmp ecx, 4
jb 0x1174f14
mov eax, dword [edi]
sub al, 5
jne 0x1174f0f
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jb 0x1174f14
mov al, byte [edi]
inc edi
jmp 0x1174ee5
sub ecx, 1
jae 0x1174ed4
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x1174f5c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1506c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1174f1a
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15074]
or eax, eax
je 0x1174f56
mov dword [ebx], eax
add ebx, 4
jmp 0x1174f37
call dword [esi + 0x15070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1174f8d
cmp al, 0xef
ja 0x1174f80
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1174f62
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1174f6f
mov ebp, dword [esi + 0x15078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1174fc1
sub esp, 0xffffff80
jmp 0x1165dd2
Function at 0x91ffa0
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
rol dword [esp + eax - 0xaa7a000], cl
dec edx
btr ax, 0x3e
adc cl, 0xba
rol edx, 3
shr ecx, cl
not eax
dec edx
and ax, word [esp + ecx*2 - 0xe8]
neg byte [esp + ecx - 0x72]
call fcn.00a13d02
mov edx, 0xcd1b7408
mov ecx, dword [ebp]
sub dl, dh
movzx eax, dx
lea ebp, [eax + ebp - 0x7490]
ror eax, 0x49
and al, al
xor ecx, ebx
mul dl
cbw
and eax, 0x3031f49e
xor ecx, 0xad04711a
not al
lea eax, [edx + edx*8 + 0x2fbd19b5]
inc eax
inc ecx
not ecx
shr edx, 0x90
sar edx, 0x24
rol ecx, 1
imul ax, dx
sar dl, 0x64
imul eax, edx
xor ebx, ecx
ror edx, 0xfc
or al, dl
adc esi, ecx
movsx ecx, dl
inc al
mov edx, dword [edi + edx - 0xcfd0]
not cl
lea ecx, [eax + ecx*2 + 0x65106e8e]
cbw
mov cl, byte [edi + ecx - 0x5ee853db]
add edi, 2
jmp 0xa0acac
movzx edx, byte [esi + edx - 0xe79edce]
neg ecx
xor dl, bl
push ecx
call fcn.00d451bb
mov eax, 0xc1a80fbd
movsx edx, ax
lea esi, [esi + edx - 0xfc1]
or edx, 0x7b8ae000
bt eax, 0xa3
cdq
mov ecx, dword [esi]
bswap eax
cdq
xor ecx, ebx
xchg edx, eax
cdq
xor ecx, 0xb8180195
xchg edx, eax
not dx
btr eax, eax
not ecx
and dl, 5
lea ecx, [ecx + eax + 0x320349a5]
jle 0xd6798b
inc ecx
dec al
dec edx
lea edi, [ebp + edi - 0x336999d7]
inc ecx
rol al, 1
movsx esi, dx
inc ecx
dec al
call fcn.00a39762
bswap edx
lea eax, [ecx*8 + 0x4e9e288c]
sar byte [esp + eax - 0xaa7d071], 0xe5
setbe byte [esp + eax - 0xaa7d070]
lea edx, [edx + eax*2 - 0x2261b102]
shl ax, 0xab
ror cl, 0xa1
jle 0x91fd63
add ax, 0x1030
xor eax, eax
shr edx, cl
mov dword [edi + eax*8], edx
call fcn.00dce926
mov ecx, 0x12a7919f
jmp 0xcc3d33
lea edi, [edi + eax*8 - 0x7ff7c]
lea edx, [edx - 0x2c7ac06a]
xor ecx, ebx
xor ecx, 0x790a5bac
bswap eax
inc edx
bswap ecx
not eax
neg dl
rol ecx, 3
bswap edx
bt eax, 0x2a
sbb dl, dl
xor ecx, 0xb688dc0a
xor ebx, ecx
cwde
cdq
ror al, 0xe1
add ebp, ecx
sub eax, edx
push edx
mov dword [esp + eax*8], ebp
ret
lea eax, [ecx - 0x3475e1fd]
mov edx, dword [ecx + esi - 0x12a7919f]
mov eax, dword [edx + ecx - 0x12a7919f]
movsx edx, cl
mov dword [esi + ecx - 0x12a7919f], eax
shl dl, 0x24
movzx eax, dx
mov ecx, dword [edi + ecx - 0x12a7919f]
sub edx, eax
jp 0xe1046d
xor edx, ebx
sal cx, 0xd
not edx
inc edx
jmp 0xdbc7ca
rol ax, 0xaf
bts eax, edx
rol ecx, 1
sub eax, 0xdc3502a4
xor ebx, ecx
bts ax, dx
cdq
sub dl, dl
adc edi, ecx
add dx, dx
mov edx, dword [ebp]
jl 0xd980f8
inc eax
movsx ebp, dh
dec esi
lea edx, [edx + edx - 0x542b5db5]
inc eax
movsx ecx, dh
call fcn.00c79c3d
mov eax, dword [ebp + 4]
mov ecx, 0xf180dc05
call 0xe0b51d
neg edx
sub edx, 0x3f2bdfa7
rol ecx, 0xa9
xor ebx, edx
lea eax, [ecx + ecx - 0x50439de9]
sal cl, 1
inc eax
add ebp, edx
dec ax
or al, 4
or ecx, ecx
jmp ebp
js 0xca8b05
mov edx, 0x8ea1b591
bswap edx
xor edx, edx
movzx eax, byte [esi + edx*2]
shl dl, 0xa7
lea esi, [esi + edx*8 + 1]
not edx
bt edx, edx
btc dx, dx
xor al, bl
sub al, dl
or dx, dx
lea edx, [edx + edx*4 - 0x27436dee]
xor al, 0x92
and dl, dh
not dl
ror al, 1
sar edx, 0x91
neg al
xor bl, al
call fcn.00d406ae
mov dword [esp + eax - 0x3fb5], edi
ret 8
Function at 0x9223bb
Capabilities:
Encode data using base64

Disassembly:
mov edi, dword [edi*4 + 0xc7e0bc]
or dword [esp + 4], 0x7b302723
jne 0xcb41c5
push ecx
pushfd
mov ecx, 0x399891f
mov ebp, 0xb269d87
add cx, bp
mov ebp, dword [esp + ebp - 0xb269d7b]
mov dword [esp + 0xc], 0x39759f73
mov ecx, dword [esp + ecx*2 - 0x7324d48]
jno 0xdf2cff
jle 0x96b358
jge 0xdf2cff
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.00955e4f
inc ecx
mov eax, 0xcdbf4917
inc ecx
movzx ecx, al
dec esi
lea edx, [ecx + edx - 0x1b]
dec esp
lea edi, [ecx*4 + 0x7e293fbc]
dec ebx
lea esi, [eax + edi*8 + 0x6d10cbbc]
inc edx
mov ebp, dword [ecx + edx - 0x17]
inc esp
movzx esp, cl
inc ecx
xor ebp, ebx
inc ecx
movzx eax, ax
xor ebp, 0x80030c35
inc cx
dec ebp
dec ebp
lea ecx, [eax - 0x36d11a79]
inc ebp
movsx esi, al
neg ebp
dec eax
cwde
not ebp
neg ebp
inc bp
btr ecx, edi
inc cx
btr edi, esi
jb 0xdf0bf5
jmp 0x9223a6
push ebp
call 0x9223bb
Function at 0x930565
Capabilities:
Encrypt data using speck

Disassembly:
ror cx, 1
mov dword [esp + eax*2 - 0xa00], edx
call fcn.00cbd163

Function at 0x93168f
Capabilities:
Encrypt data using speck

Disassembly:
sbb eax, 0x30862690
call fcn.00c77358

Function at 0x935695
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0xa485f40c
dec edx
lea esp, [esp + 0x10]
jne 0xd41aca
mov ebx, 0x79b3ec1d
movzx eax, bl
bts ax, bx
pop ebx

Function at 0x936362
Capabilities:
Encrypt data using speck

Disassembly:
push 0xc70927a7
add eax, 0x9d37dd83
xor ebx, eax
push 0xbbb4c790
add esi, eax
jmp 0xc871e4
not dword [esp + 4]
lea esp, [esp + 0x18]
jmp 0xe01b9e
push esi
call fcn.00dd0641

Function at 0x947283
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec ebp
lea edx, [edx + esi*4 - 0x13f65ac]
movsx ecx, si
inc ecx
mov ecx, dword [edx + esi*4 - 0x13f65a8]
push esi
inc ecx
xor ecx, ebx
inc eax
movzx ebp, dh
mov edx, 0x21125c81
movsx eax, bp
ror ecx, 1
dec word [esp + esi - 0x4fd959]
dec eax
neg dword [esp + esi - 0x4fd96a]
lea ecx, [ecx + esi*4 - 0x1bf983d9]
dec eax
mov dword [esp + esi - 0x4fd962], ebp
call fcn.00dab97a

Function at 0x95183a
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
lea esp, [esp + edi*2 - 0x274]
inc di
jns 0xd89536
jmp 0xddf3d3
add edi, eax
lea esp, [esp + 0x18]
jmp 0x9539cc

Function at 0x951b36
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
and edi, 0xff
jmp 0xa2dab4
mov dword fs:[edx], ecx
lea edx, [eax*4 - 0x43fb62ec]
movsx ecx, al
shr ecx, 0x43
mov eax, dword [ebp + ecx*4 - 0x24]
setne dl
sar ecx, 0x98
ror ecx, 0x16
lea ebp, [ebp + ecx*8 + 4]
shr edx, 0x67
xor eax, ebx
xchg ecx, edx
shl dl, cl
shr dx, cl
adc eax, 0xe4add515
inc edx
rol eax, 3
bt edx, edx
sbb eax, 0x91262813
push edx
lea ecx, [edx + 0x2809528d]
rol eax, 3
xor edx, edx
not byte [esp + edx + 3]
sbb eax, 0x9ba9e293
lea edx, [ecx*8 + 0x5bb19f2b]
and ecx, dword [esp + ecx*2 - 0x5012a51c]
xchg word [esp + ecx - 0x28000000], cx
xor ebx, eax
sal ecx, cl
setp cl
adc esi, eax
ror ecx, 0xf9
mov eax, edx
jae 0xcb9d64
mov dword [esp], 0xfd127701
and byte [esp + 0xb], 0xa6
mov edi, dword [edi*4 + 0x958a04]
jge 0x974d62
neg byte [esp + 0xf]
ror byte [esp + 0xe], 0xe7
shr ecx, 8
neg word [esp + 0xe]
jl 0xc888f5
xor ecx, edi
not byte [esp + 1]
mov dword [esp + 4], 0xc8bb810
inc eax
push 0x2eb78e16
call fcn.00cbadeb
mov dword [esp + ecx*2 - 0x50], esi
ret
Function at 0x95632d
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
mov dword [esp + 4], 0x96149d33
adc ebp, 4
jmp 0xdc7f27
mov dx, word [edx + ebp - 0x2690459c]
imul cx, cx
lea eax, [ecx + ecx*2 + 0x70377ab5]
mov ax, word [ebp + eax - 0x7034efe3]
dec cx
add cl, ch
push ecx
mov cl, byte [ebp + 4]
jns 0x9220b5
add byte [eax], al
dec ecx
outsb dx, byte [esi]
insb byte es:[edi], dx
popal
je 0x9563c6
push edx
arpl word gs:[eax + eax + 0x68], si
cmpsb byte [esi], byte es:[edi]
das
sub dword [esi - 0x6ed46648], esp
daa
mov ecx, dword [ebp + eax - 0x27912b99]
rol eax, 0xe1
neg dword [esp + eax - 0x4f225732]
and ax, word [esp + eax - 0x4f225731]
lea ebp, [ebp + eax - 0x4f22560c]
call fcn.00d478ed
push ebx
movzx ebx, dx
cpuid
js 0x9879b6
mov eax, 0xf520b9a6
movsx ecx, ax
movzx eax, byte [esi - 1]
movzx edx, cl
xor al, bl
xor al, 0x86
dec al
not cl
add ecx, 0xe941402
not al
or dl, 0xa5
sbb dx, cx
ror al, 1
xor bl, al
rol edx, cl
sub dl, 0x38
sete dl
adc eax, esp
mov cx, word [eax + ecx - 0xe93cd5b]
mov eax, 0x1695ea34
mov word [ebp + edx - 0x60000102], cx
shl ax, 0xc3
adc ax, dx
cwd
mov ecx, dword [eax + esi - 0x169552a6]
bts dx, 0x38
xor ecx, ebx
bswap eax
shl eax, 0xd2
call fcn.00d9fd69
mov eax, 0xee80b5ba
movzx edx, al
add eax, 0x64aa2bbb
mov ecx, dword [esi + edx*4 - 0x2e8]
lea esi, [eax + esi - 0x532ae171]
idiv eax
mul al
bt ax, 0x99
xor ecx, ebx
lea edx, [edx + eax*8 + 0x54111131]
not ecx
not edx
sal dx, 0x4a
bswap ecx
inc ecx
lea edx, [eax + eax*8 + 0x3f89749e]
ror ecx, 2
xor ebx, ecx
bswap eax
add ebp, ecx
or ax, word [edx + edi - 0x3f89f76f]
movsx ecx, dx
or edx, 0x9dba0319
mov dx, word [edi + 2]
adc edi, 2
sub cl, 0x27
sar cx, 0x4a
inc cx
and ax, dx
mov edx, 0xeb1c32bc
btr ecx, 0xb5
not ax
call fcn.00a3656d
rcl eax, 1
enter 0xffffffffffffd832, 0xffffffffffffffd3
ret 0xea80
call fcn.0098824b
push edi
mov edi, 0x223f0b2e
push ecx
mov ecx, edi
mov edi, dword [esp + edi*2 - 0x447e1658]
mov dword [esp + 4], 0xd050421d
mov ecx, dword [esp + ecx*2 - 0x447e165c]
lea esp, [esp + 4]
call fcn.00d796d6
push 0x26327811
not dword [esp + 7]
shld dx, ax, cl
pop ecx
not dword [esp + ecx*2 - 0x4c64f022]
call fcn.0095606f
mov edx, 0x34ab9f84
neg edx
mov ecx, dword [edi]
movsx eax, dl
ja 0xdd2375
imul ax
lea edi, [eax + edi - 0x3c0c]
sbb eax, 0x328ab40e
lea edx, [edx + eax*4 - 0x33fe54f5]
xor ecx, ebx
or al, dh
setge dl
lea edx, [edx - 0x7175ef4a]
rol ecx, 1
sal ax, 0x4d
or ax, dx
dec ecx
xor ecx, 0xa2154f99
rol edx, 0x84
rol ecx, 1
bswap ecx
call fcn.00a1a177
rol edx, 0x3b
adc edi, 4
xor ecx, ebx
sar edx, 0x61
ror ecx, 2
idiv ax
neg ecx
dec ecx
shr eax, 0xe8
jbe 0xc89b38
mov ecx, 0x4a274b23
btc ecx, 0x3d
movzx edx, cx
mov dx, word [ecx + ebp - 0x6a274b23]
mov eax, ecx
sal ax, 0x4e
sbb cx, cx
mov ax, word [ecx + ebp - 0x6a26fffe]
xor cl, ch
lea ebp, [ebp + ecx - 0x6a26fffe]
jge 0x989a5e
bswap edx
dec ecx
jo 0x968fcf
imul eax, eax
xor ebx, edx
add esi, edx
mul byte [esp + eax*8 - 0x3f3d]
pop edx
pop edx
pop edx
jb fcn.00dd66d7
Function at 0x95f8ae
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, 0x78855386
ror word [esp + 9], 0x2c
sar dword [esp + 8], 0x77
mov dword [esp], 0x2fb0f304
adc eax, 0xcbb21f99
not eax
sal dword [esp + 1], 0x7a
xor eax, 0xfe9c2d81
xor word [esp + 3], 0xcba
xor ebx, eax
add word [esp + 2], 0xdca3
add ebp, eax
lea esp, [esp + 0xc]
jmp 0xa33c1d

Function at 0x964223
Capabilities:
Encrypt data using speck

Disassembly:
xor cx, bx
add eax, dword [esp + 8]
pop eax
sbb cx, 0x648b
xor dx, word [esp + 3]
not edx
lea eax, [edx + edx*2 - 0x1bc107d3]
xor cx, 0x7a84
dec cx
xadd dword [esp + edx - 0xcda7eac], edx
cbw
ror cx, 1
xor bx, cx
neg eax
rol word [esp + edx - 0x4c6a870a], 0xa9
neg dword [esp + edx - 0x4c6a870b]
lea edi, [edx + edi - 0x4c6a8711]
dec word [esp + edx - 0x4c6a870a]
push edx
not eax
mov word [edi + eax - 0xace0033], cx
call fcn.00983491
dec eax
bswap edi
inc edi
mov ecx, dword [edi + edx - 0x7dc3800c]
sar edx, cl
movzx esi, byte [esp + ebp - 0x2ea566a3]
add edi, 0xa39b7b92
inc ebp
xor ecx, ebx
jmp 0xa33bd3
inc ecx
xor ecx, 0xa81073b6
shr bp, cl
inc ebp
lea ecx, [ecx + ecx - 0x66493348]
push ecx
dec eax
sbb edx, edi
inc ecx
ror ecx, 3
inc sp
add edi, dword [esp + esi*2 + 3]
inc cx
inc eax
ror esi, 0x99
inc ecx
inc ecx
movsx eax, di
dec esp
mov dword [esp + ecx - 0x1189f6fe], ebx
shr byte [esp + ecx - 0x1189f6ff], 0xa5
inc esi
xor dword [esp + edi - 0x7dc38001], ecx
call fcn.00df2da6
jmp 0xd49e51
call fcn.00c95182
add byte [eax], al
inc ebx
jb 0xd49ec0
popal
je 0xd49ec3
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0xd49ec4
je 0xd49ece
bound ebp, qword [ebp + 0x44]
inc ebx
add byte [esi - 9], ah
neg cx
xor edx, 0x5b301b24
xchg dword [esp + ecx - 0x28d5c], ecx
mov dword [esp + 4], eax
not ecx
sub edx, 0x9ab82584
pop eax
add eax, 0x1206f4
jmp eax
fmul dword [ecx + 0xffc2544]
sahf
inc esp
and eax, 0x449e0ffc
cld
and al, 3
imul ebp, dword ss:[ecx - 0x72247a3c], 0xf042464
test byte [edx], dl
jp 0xd49eea
add byte [eax - 0x3ef143ea], bh
or al, byte [eax]

Function at 0x9651d2
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00d9e835
inc dl
sete dl
add esi, eax
movzx edx, byte [ebp + edx - 0x64b43cfd]
xor dl, bl
movsx eax, cx
neg dl
cwde
inc eax
jp 0xdc1b9d
not dl
sar eax, cl
bt eax, eax
sbb dl, cl
rol dl, cl
sar eax, 0x3b
xor ecx, eax
xor bl, dl
xor ecx, 0x90ac570c
mov word [edi + ecx*2 - 0x359059e6], dx
movzx eax, byte [ebp + ecx*4 - 0x6b20b3c3]
lea ebp, [ebp + ecx - 0x1ac82cec]
sar ecx, cl
xor al, bl
lea edx, [ecx + ecx + 0x16058d36]
dec al
shr ecx, cl
xor dx, dx
dec edx
neg al
neg edx
setns cl
sub cl, ch
adc al, dl
bts edx, 0x24
neg cl
shr edx, 0x6c
not al
btr cx, 0x20
dec cl
xor bl, al
or dl, 0x27
adc eax, esp
inc edx
mov edx, dword [ecx + eax - 0xff]
mov dword [edi + ecx - 0x105], edx
lea edx, [ecx + ecx*2 + 0x401a1710]
xor ecx, ecx
adc cx, cx
lea edi, [edi + ecx*8 - 6]
bswap ecx
lea edx, [ecx + edx*4 + 0x233d368a]
jae fcn.00dd66d7
Function at 0x96924c
Capabilities:
Encrypt data using speck

Disassembly:
not eax
mov dword [esp + edx - 0x2c59da4e], edx
movsx ecx, dl
and byte [esp + edx - 0x2c59da4b], dl
lea eax, [ecx + eax - 0x401122ec]
mov dword [esp + edx - 0x2c59da52], 0xdc36a0bc
shr word [esp + edx*2 - 0x58b3b49f], 0x6c
rol eax, 1
xor eax, 0x50923a04
neg dx
not eax
bt cx, cx
xor ebx, eax
dec dword [esp + ecx - 0x4c]
jns 0xa18178
add ebp, eax
mov dword [esp + ecx - 0x52], ebp
ret 8

Function at 0x96c07a
Capabilities:
Encode data using base64

Disassembly:
push 0x76074409
lea esp, [esp + 0x1c]
je 0x98ddd1

Function at 0x97034e
Capabilities:
Encode data using xor

Disassembly:
pop edx
sbb ebp, 0xfffffff7
movsx edx, cx
movzx ecx, byte [esi + edx - 0x2b6d]
xor cl, bl
inc edx
add edx, 0x4c2ccfa9
adc cl, 0x33
bt dx, 0x82
neg cl
inc dl
js 0x97d6af
inc cl
bts edx, edx
rol dx, 0x82
add dx, dx
xor cl, 0x2d
add edx, edx
not dx
dec dl
neg cl
neg edx
xor bl, cl
add ecx, esp
mov dword [ecx + edx - 0x66a6b17e], eax
movsx eax, dl
movsx ecx, dx
xadd ax, dx
mov edx, dword [eax + esi - 0xb201]
add eax, 0xc99dfe22
sets cl
btr eax, 0x9a
adc esi, 0xfffffffb
shr cl, cl
xor edx, ebx
call fcn.00dfcd56
aam 0xd2
push esi
xor dword [edx], ebp
out 0xc0, al
or edi, ecx
in eax, 0x89
push 0xe5a52746
mov dword [eax + 0x32], ebp
daa
movsd dword es:[edi], dword [esi]
in eax, 0x89
push 0xe5c1e332
mov dword [eax + 0x61], ebp
sar byte [ecx], cl
cmp ch, byte [ebp - 0x2956e91b]
inc esp
inc ebp
fcmovnu st(0), st(3)
loope 0x9703e5
jecxz 0x97039d
in eax, 0x89
push 0x3a39d261
lodsd eax, dword [esi]
in eax, 0x16
push ss
test eax, 0xdb4544d6
fdisi8087_nop
idiv dword [esi + 0xa]
jle 0x9703fa
mov ch, al
push ebp
sbb esi, esi
pop ebp
jae 0x9703d4
inc edi
jo 0x9703e3
call 0x4873776c
insd dword es:[edi], dx
jae 0x9703da
inc edi
dec ecx
rcl byte [ecx + 0x73]
fadd qword [edi + 0x61]
sbb edi, dword [edi]
hlt
bswap ecx
xchg word [esp + eax - 0x5bc7696b], ax
btr eax, edx
sub ax, 0xd13c
ror ecx, 2
xor ecx, 0xd5b2c11b
dec dword [esp + eax - 0x5b47b64f]
seto al
or dword [esp + eax - 0x5b47b5ff], edx
xor ebx, ecx
add ebp, ecx
mov dword [esp + eax - 0x5b47b600], ebp
ret 4

Function at 0x97338b
Capabilities:
Encrypt data using speck

Disassembly:
inc dx
not dword [esp + ecx - 0x66]
dec edi
lea edx, [ecx + edx - 0x7e]
call fcn.00e19f99

Function at 0x974d16
Capabilities:
Encrypt data using speck

Disassembly:
mov word [ebp + edx*2 - 0x50ab8], ax
add word [esp + edx - 0x28557], dx
movzx eax, dx
mov dword [esp + edx - 0x2855b], 0x7ea940bd
movzx edx, byte [esi + edx - 0x28560]
movsx ecx, al
sal dword [esp + eax*2 - 0x10ab6], 0xb0
call fcn.00972310
mov ecx, dword [edi + ecx*2 - 0x81faf4c]
shr ax, 0x25
adc edi, 7
btc ax, 0x33
Function at 0x974de0
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x10]
jne 0xd59116
mov esi, 0x211b26b8
movzx ecx, si
neg ecx
pop esi
mov eax, 0x8b00e313
sub eax, 0xdc303bba
lea ecx, [eax*4 - 0x6647ee74]
not edx
mov dword [edi + ecx - 0x54faaef0], edx
sal eax, cl
mov edx, dword [esi + ecx - 0x54faaef0]
lea esi, [ecx + esi - 0x54faaeec]
push ecx
sar eax, 0x86
xor edx, ebx
imul cx, ax
sub cx, 0xfab
xor edx, 0x360bcf33
neg dword [esp + ecx - 0x54fab055]
push ecx
jae 0xd4bee7
sbb edx, 0x39376336
rol ax, 0x61
ror edx, 1
btc cx, 8
inc edx
xor ebx, edx
xchg dword [esp + ecx - 0x54fab155], ecx
shl cl, 0xe1
jno 0xe1bda6
adc ebp, edx
sub byte [esp + ecx - 0x54fab0a9], 0xa6
movsx edx, ax
mov dword [esp + ecx - 0x54fab0aa], ebp
ret 4
xor edx, 0xbaa4f595
mov dword [esp], 0x4996f01c
jmp 0xe0ab05
mov esi, 0x613d4bb2
bt si, 0x8c
movzx esi, byte [esi + ecx - 0x613d4bb2]
call fcn.00c9802f
dec eax
push 0xa4111e37
jmp 0x96019c
jmp 0xdb7b7a

Function at 0x9787ed
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
lea ebp, [ebp + edi*2 - 0x1d2e7d18]
inc esp
add al, dl
dec esp
mov dword [esp + edi - 0xe973e8d], ecx
inc ecx
movsx edx, cx
inc si
mov dword [edi + ebp - 0xe973e8d], eax
dec eax
mov dword [esp + edi*4 - 0x3a5cfa2c], 0xd0042d94

Function at 0x9810c4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec esp
mov esp, dword [esp + ecx - 0x745810b6]
dec eax
xchg dword [esp + ecx - 0x745810de], eax
dec eax
mov eax, dword [esp + eax - 0x6f287b08]
dec eax
mov dword [esp + ecx - 0x745810be], ecx
push ecx
pop ecx
dec eax
mov ecx, dword [esp + ecx - 0x745810a6]
call fcn.0097d856
mov edx, 0x681a731b
movzx ecx, dx
mov eax, dword [edx + esi - 0x681a731b]
sub edx, edx
call fcn.00d45b94

Function at 0x9f95ee
Capabilities:
Encrypt data using speck

Disassembly:
dec al
inc edx
jmp 0x92000e
adc ax, ax
lea ebp, [ebp + eax - 0x68eb013d]
lea ecx, [eax + eax*8 - 0x38c1d64c]
xor edx, ebx
mov dword [esp + ecx - 0x778134fd], ecx
rol edx, 1
dec edx
bswap edx
dec eax
jne 0x92902e

Function at 0x9fe6f9
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x11e40169], ecx
xor eax, ebx
add ecx, dword [esp + edx - 0x11e4015d]
lea eax, [eax + edx*4 + 0xb7562e6]
neg ecx
lea ecx, [ecx*8 + 0x7bbb8a3e]
call fcn.00c931d9
xor dword [ebx + 0x40181baf], 0x94cca057
or eax, eax
invalid
Function at 0xa0032b
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
lea edi, [edi + eax*2 - 0x7ffffffb]
xor cl, bl
xchg dword [esp + eax - 0x3ffffff8], edx
ror dword [esp + eax*2 - 0x7ffffff9], 0xe
rol cl, 1
sub al, byte [esp + eax - 0x3ffffff6]
cbw
neg cl
xor cl, 0xbd
rol cl, 1
mov dword [esp + eax - 0x40000000], 0xccb595b5
and ax, dx
add edx, edx
xor bl, cl
cwde
lea ecx, [esp + ecx + 0xc]
or dword [esp + eax + 2], edx
jo 0xdbda0d
adc eax, dword [ecx + eax*2]
mov dword [edx + esi - 0x1000000], eax
movsx eax, word [esp + edx - 0xfffffa]
mov dword [esp + edx*4 - 0x4000000], ebp
ret 8
xor ebx, edx
add ebp, edx
shr word [esp + eax*2 - 0xfffb], 0xe1
cdq
mov cl, byte [eax + edi - 0x7ffc]
mul eax
inc dword [esp + edx + 4]
ja 0x939d39
sub esi, 4
mov ecx, 0xf3340fbf
mov eax, ecx
shr ecx, 0xee
mov ecx, dword [esi + ecx - 0x3ccd0]
btc eax, eax
xor ecx, ebx
lea ecx, [eax + ecx + 0x3b54bf51]
neg ecx
cdq
add edx, edx
rol ecx, 3
lea edx, [edx + eax*8 + 0x17bbe5bc]
sar ax, 0xeb
sbb dx, 0x85a0
not ecx
xor ebx, ecx
or edx, edx
sbb ax, dx
div al
add edi, ecx
mov eax, ebp
movsx ecx, dl
not ecx
sub ebp, 4
mov dword [ebp], eax
ror cl, 0x86
shl dl, 0xe3
shl edx, 0x9b
jp fcn.009213ba
cwde
xor ebx, edx
add ebp, edx
mov eax, edi
lea edx, [ecx + ecx*8 + 0x35bc02b5]
rol dl, 0x41
mov dword [edi + ecx - 0x8d3aad7], eax
movzx eax, cx
lea edi, [edi + ecx*2 - 0x11a755aa]
jno fcn.009419ad

Function at 0xa03964
Capabilities:
Encrypt data using speck

Disassembly:
lea ebp, [ebp + ecx - 0xa7e5ffc]
mov dword [esp + ecx*2 - 0x14fcc000], ecx
xor edx, ebx
xor eax, 0x2f92e701
btc ax, ax
jb 0xd777ed
sub dword [esp + eax*2 + 4], eax
mov word [ebp + eax*4], cx
pop ecx
mov dword [esp + eax*4], edi
ret

Function at 0xa03c38
Capabilities:
Encrypt data using speck

Disassembly:
shr dword [esp + ecx + 4], 0xb5
xor bl, al
sub edx, edx
shl ecx, 0x41
lea ecx, [ecx + ecx*8 + 0x8281492]
lea eax, [esp + eax + 8]
xor edx, dword [edx + eax]
btc cx, cx
mov dword [edi + ecx*4 - 0x20a05262], edx
movsx eax, cl
mul byte [esp + ecx*4 - 0x20a05254]
mov dword [esp + ecx - 0x8281496], 0x69bf29a
lea edi, [edi + ecx*2 - 0x10502936]
pop eax
pop eax
jae fcn.009419ad
call fcn.00a27f63
mov ecx, dword [ebp]
mov edx, 0x8e96ad98
add ebp, 4
movsx eax, dl
bswap eax
xor ecx, ebx
ror ecx, 3
btr eax, eax
sbb edx, 0xa2db4bd
sub dl, ah
sbb ecx, 0xcaa8532b
neg al
not ax
not ecx
adc al, 0xc
adc dl, 0xa5
and al, al
ror ecx, 2
inc ecx
jmp 0xdacee1
lea eax, [eax + edx*4 + 0x138eae8d]
mul edx
xor ecx, 0x2f0e41a1
not al
xor ebx, ecx
cwd
neg edx
add esi, ecx
mov edx, dword [edi]
cbw
dec al
mov eax, dword fs:[edx]
mov edx, 0x5e280732
jg 0x9f91d6

Function at 0xa0562d
Capabilities:
Encode data using base64

Disassembly:
sub dword [esp + edx*2 - 0x7d23aadd], edx
xadd eax, edx
inc cl
mov dword [esp + 4], eax
ror dword [esp + 7], 0xcc
neg cl
mov dword [esp], edx
xchg dword [esp + 0xb], edx
xor bl, cl
and dx, 0x13a3
shl word [esp + 0x10], 0x8f
je 0xd435da
mov word [edi - 4], cx
sbb edi, 3
lea ecx, [eax + eax*8 - 0xb489a48]
pop eax
pop ecx
pop eax
pop eax
pop ecx
jmp fcn.00dd66d7