joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42098b
Capabilities:
Encode data using xor

Disassembly:
loope 0x420a07
lds ebx, [esi + edx]
fcom qword [ebx]
pop esp
and esi, ebx
out 0xe8, eax
cmp al, 0x9d
dec edx
sbb dh, byte [eax + 0x28]
pop ss
in al, 0x84
in al, dx
int 0x95
add dword [edx - 0x46], esp
sbb eax, 0x7bd5eec0
ljmp 0xa43c
dec ecx
and al, 0xd2
xchg ebx, eax
inc esp
test al, 0xec
invalid
cmp dl, byte [ecx - 0x20]
push ebx
daa
inc esi
jp 0x4209de
fidiv dword [ecx - 0x28]
jno 0x4209b8
lcall 0xce17, 0xf238fde5
push 0x8e335ea0
xchg esp, eax
or eax, dword [edi]
inc eax
add eax, 0x11a470fa
dec edi
aam 0xe5
and ch, 0xc2
jge 0x420a4a
loope 0x420a70
int 0x12
sbb dword [eax + 0x74b9a5c9], edx
js 0x4209d5
add al, 0x1e
dec esp
xchg ecx, eax
cmp ecx, ecx
or eax, esp
rcr edi, cl
test al, 0x9f
mov eax, 0x7a332924
sub ch, byte [eax - 0x72]
pop ecx
push ebx
or dword [eax - 0x42f7b46e], ecx
invalid
pushfd
xor esp, ecx
movaps xmmword [edx + 0x5d543c9], xmm0
sub ebx, dword [ebx - 0x28]
and eax, 0x88a1e05a
mov byte [0x6d566dd3], al
adc dword [eax + 8], esi
test al, 0xc3
out 0x4f, eax
adc edx, dword [edi - 0x7e]
fild dword [ecx + 0x121fe838]
push ecx
cdq
adc dl, byte [ecx - 0x67]
mov al, byte [0x325855]
xor al, byte [eax]
imul ebp, ecx, 0xffffff90
jnp 0x420a76
psrlw mm5, qword [edx - 0x48be7987]
pop esi
inc edi
mov al, 0x1b
inc edi
imul esp, dword [ecx + ebp*4], 0xffffffbd
fdiv st(2)
test al, 0x52
add byte [edi - 0x33], ch
push es
mov eax, 0x443cfe38
or ch, byte [edx]
adc dword [ecx + edx*4 + 0x1564bacc], edi
pop ss
scasd eax, dword es:[edi]
dec ebp
pop eax
push eax
adc dword [0xb96568ce], 0xd6851490
lahf
enter 0xffffffffffff81c8, 0xfffffffffffffff9
call 0xbd930d00
sahf
cmc
mov esi, 0xfd209c88
aam 0xec
inc eax
in eax, 0x4a
sub ch, byte [esi - 0x31]
outsb dx, byte [esi]
jmp 0x420ace
dec ebp
mov dl, byte [ebx - 0x40e5e832]
loope 0x420a91
dec ebx
mov ebp, 0x91d72a8c
mov ah, 0xcd
push ecx
xchg ecx, eax
mov edi, dword [eax + 0x6d]
int1
jge 0x420a78
jno 0x420b14
cmp byte [eax], al
or dword [edi], edx
pop ebp
and bl, byte [ecx + 0x13]
push ebx
xor dh, byte [esi]
xor al, 0xe8
pop edi
mov eax, 0x19cfd86a
dec ebp
mov gs, word [edx - 0x61293f5d]
enter 0xfffffffffffff38a, 0x4d
add byte [ecx - 0x18f5e0f3], dl
invalid
mov cl, 0xfa
mov eax, dword [0x49e94aea]
jmp 0x45f3a3e8

Function at 0x437453
Capabilities:
Encode data using xor

Disassembly:
call 0xe11a24dc
xchg esi, eax
ljmp 0x2092
push ds
adc edx, dword [eax]
jge 0x4373df

Function at 0x48b5bb
Capabilities:
Encode data using xor

Disassembly:
iretd
movsb byte es:[edi], byte [esi]
aaa
adc ah, byte [ebp + 0x2c]
jb 0x48b5a2
mov ecx, 0xe440be9e
pop ecx
add al, 0xa8
or eax, 0x9e58a08
pushfd
mov ecx, dword [ebp + 0x62]
pop esp
popal
dec esp
jge 0x48b638
mov dh, 0xe4
sub ebx, dword [ebx]
push cs
mov eax, dword [0x133acd45]
lcall 0x74ca, 0x70d206c1
stc
xchg edx, eax
cvtps2pi mm7, qword [ecx - 0x30856eea]
adc byte [esi + 0x3198671a], ch
ljmp 0xe3de
adc eax, dword [esi - 0x2a6e6038]
cmp dword [ebx - 0x45], eax
mov ebp, esi
aad 0xbe
or dword [ecx + ecx*4 + 0x119e976d], 0x57
sbb byte es:[ebp + 0x5364039e], bl
sub ch, byte [edi]
inc edi
iretd
Function at 0x4bacbd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43b8
cmp edx, dword [eax]
je 0x4bacdf
add eax, 8
inc ecx
cmp eax, 0x4c4448
jl 0x4bacd0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43b8]
jne 0x4bae0d
mov eax, dword [0x4c8d40]
cmp eax, 1
je 0x4bade7
test eax, eax
jne 0x4bad10
cmp dword [0x4c42e0], 1
je 0x4bade7
cmp edx, 0xfc
je 0x4bae0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bad47
lea eax, [ebp - 0x1a4]
push 0x4bfd20
push eax
call fcn.004bb6a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbb30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bad8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbb30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfd1c
push edi
call fcn.004bda00
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfd00
push eax
call fcn.004bb6a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb6b0
lea eax, [ebp - 0xa0]
push 0x4bfcfc
push eax
call fcn.004bb6b0
push dword [esi + 0x4c43bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb6b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfcd4
push eax
call fcn.004bd974
add esp, 0x2c
pop edi
jmp 0x4bae0d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43bc]
push 0
push eax
push dword [esi]
call fcn.004bbb30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xd36058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d361a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd3607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3606a
add dl, dl
jne 0xd36089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd360dc
xor eax, eax
add dl, dl
jne 0xd36096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3617d
add dl, dl
jne 0xd360a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd360d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd36075
mov eax, 1
add dl, dl
jne 0xd360ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd360f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd360e1
sub eax, ebx
mov ebx, 1
jne 0xd36128
mov ecx, 1
add dl, dl
jne 0xd3610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd36119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd36105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd36075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd3613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd36136
cmp eax, 0x7d00
jae 0xd3616d
cmp eax, 0x500
jb 0xd36168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd36075
cmp eax, 0x7f
ja 0xd36170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd36075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd3619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd36075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x24d0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.024d01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x24d007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24d006a
add dl, dl
jne 0x24d0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24d00dc
xor eax, eax
add dl, dl
jne 0x24d0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24d017d
add dl, dl
jne 0x24d00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x24d00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x24d0075
mov eax, 1
add dl, dl
jne 0x24d00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24d00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24d00e1
sub eax, ebx
mov ebx, 1
jne 0x24d0128
mov ecx, 1
add dl, dl
jne 0x24d010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24d0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24d0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x24d0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x24d013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x24d014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24d0136
cmp eax, 0x7d00
jae 0x24d016d
cmp eax, 0x500
jb 0x24d0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x24d0075
cmp eax, 0x7f
ja 0x24d0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x24d0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x24d019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x24d0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x406243
pop dword [ebp - 0x10]
mov eax, 0xa34cadd1
add eax, 0x5cf3b472
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xed53e33a
add dword [ebp - 0x20], 0x60fe6211
mov dword [ebp - 0x1c], 0x438ae544
sub dword [ebp - 0x1c], 0x115798ff
mov dword [ebp - 0x18], 0x21a3486b
sub dword [ebp - 0x18], 0xd557043d
mov dword [ebp - 0x14], 0xc58b0289
add dword [ebp - 0x14], 0x3a74fd77
lea eax, [ebp - 0x20]
push eax
mov eax, 0x4e5fde2b
sub eax, 0x4e1f5d27
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd7010bae
sub dword [ebp - 0x20], 0x628ea258
mov dword [ebp - 0x1c], 0x3f392cc6
add dword [ebp - 0x1c], 0x23334af
mov dword [ebp - 0x18], 0x5a2771b6
sub dword [ebp - 0x18], 0xf6b8054a
mov dword [ebp - 0x14], 0x95a117d6
sub dword [ebp - 0x14], 0x95a117d6
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x367a7
push 0
call eax
mov ecx, 0x45d2
xor edx, edx
add edx, eax
mov ebx, 0xdaf88c7e
sub ebx, 0xdab1a87e
add ebx, dword [ebp - 0x10]
mov esi, 0x9fbf8539
sub esi, 0x8ba845ad
mov edi, dword [ebx]
sub dword [ebp - 4], 0x74da79ca
xor edi, esi
sub dword [ebp - 8], edi
mov dword [edx], edi
mov dword [ebp - 8], 0x42a18de5
add edx, 0xdeb67da4
add edx, 0x21498260
add ebx, 4
loop 0x40635c
add eax, 0xac2e8ee3
add eax, 0x53d27b38
xor ebx, ebx
add ebx, eax
add eax, 0xa673a015
add eax, 0x598c5ff0
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0xef12e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add edx, edi
mov edx, dword [ebp + 8]
sub esp, 0x114
push esi
stc
jmp 0xf1ba90
test edx, edx
jmp 0xf32897
je 0x17577e2
mov esi, dword [ebp + 0xc]
cmp cx, 0x929c
test esi, esi
jmp 0xfc70a4

Function at 0xef185e
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
adc ecx, ebp
dec esi
lea eax, [ecx + eax - 0x2ebbc841]
dec eax
mov dword [esp + ecx - 0x2ebbc83f], edx
call fcn.015e6434
jae 0xee99db

Function at 0xef9cd9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.0175be9a
inc esp
xor esi, ebx
inc ecx
neg edi
inc eax
xchg bh, cl
dec eax
sbb edi, eax
inc ecx
xor esi, 0xacbae837
inc ecx
inc ebp
dec eax
sar edi, 0x3a
inc ebp
lea esi, [esi + ecx*8 + 0x59d5b2f8]
dec ecx
inc edi
inc ebp
movzx ebx, bh
inc ecx
xor esi, 0x7d8f4691
jmp 0xf66232

Function at 0xefa012
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + ebp*2 - 0xc3e], ebx
setg byte [esp + ebp*2 - 0xc44]
inc esp
xor dword [esp + ebp*4 - 0x188c], ebp
inc ecx
mov esi, 0x7a2b93bc
dec eax
bswap edx
inc eax
ror bh, 0x81
dec eax
mov ebx, dword [esp + ebp - 0x617]
dec ebp
arpl bp, bp
inc ebp
movsx esp, dh
inc eax
sub ch, cl
dec edi
lea esi, [esp + ebx*4 + 0x5b3e231a]
dec ebp
add ecx, ebp
inc cx
add edi, ebx
inc edx
shr byte [esp + edi + 0x1a], 0xe5
dec ebp
lea eax, [eax + ebp*8 - 0x37ba]
inc ebp
movzx esp, word [eax + ebp*2 - 0xdee]
call fcn.01756ec6
rol byte [esp + eax - 0x1d10f67], 0x66
neg dword [esp + eax - 0x1d10f6a]
inc cl
mov edx, eax
add ax, dx
or byte [esp + eax - 0x1d11ed4], dl
not cl
add byte [esp + eax - 0x1d11ed4], dh
sbb cl, 0xa6
push edx
xor bl, cl
rol eax, 0xbf
lea ebp, [ebp + eax - 0xe88f6c]
mov word [ebp + eax - 0xe88f6a], cx
pop ecx
not dx
pop ecx
jae fcn.00ef1ac1
dec eax
mov dword [esp + ebp*2 - 0xc4e], 0xa124dc07
jbe 0xef80c6
test byte [edx + esi*4 - 0xd], ch
invalid
sub bh, byte [ebp + 0x7a]
call 0x165a9295
cmp ebp, dword [ebx]
cmp eax, 0xcb008e8a
jecxz 0xefa014
mov cl, byte [esi - 0x5204b500]
mov cl, byte [esi - 0x5a28ed00]
mov cl, byte [esi - 0x22187500]
mov cl, byte [esi - 0x3a50ad00]
mov cl, byte [esi - 0xa58c100]
mov cl, byte [esi - 0x3a301900]
mov cl, byte [esi + 0x95f9300]
invalid
Function at 0xf09909
Capabilities:
Encrypt data using speck

Disassembly:
sub esi, 4
mov ecx, 0x95a7b2a9
movsx edx, cl
and cl, dh
mov ecx, dword [esi]
xor ecx, ebx
rol ecx, 1
lea edx, [edx*4 + 0x253ce239]
not edx
xor ecx, 0xc9a5bd05
shl dx, 0x23
dec ecx
sar dx, 0xe9
neg ecx
neg dl
not ecx
mov eax, edx
rol eax, 2
lea ecx, [ecx + eax + 0x7e983800]
sbb ax, 0x6ea4
ror ecx, 2
jmp 0xf81d62
jne 0x15de03d
ror dl, 1
movzx eax, cx
not dl
add cx, cx
adc ecx, eax
lea ecx, [ecx - 0x62f12944]
ror dl, 1
shr ecx, cl
jp 0xee6dd2
sar ax, 0xef
inc dl
jmp 0xf71bcb
call fcn.00f6c9af
xor bl, dl
call fcn.01835e84
fidivr word [0xca80092]
sbb eax, 0xe8009637
fadd st(2)
leave
imul edi, edi, 0xc9724c4c
imul edi, edi, 0xc9f2a060
imul edi, edi, 0xc9225cec
imul edi, edi, 0xc9521890
imul edi, edi, 0xc94a601c
imul edi, edi, 0xc9aa848c
imul edi, edi, 0xc91a74d4
imul edi, edi, 0xbc7e1cec
cmp edi, edi
adc byte [ebx + ebp*4 - 0x5c], dh
sahf
push esi
bnd jle 0xf71be6
dec dx
neg ecx
xor ebx, ecx
shr ax, 0x2a
neg eax
add edi, ecx
shl dl, 0x41
mov cx, word [ebp]
sub eax, eax
lea ebp, [eax + ebp + 2]
call fcn.00f11921
neg al
ror al, 1
dec esi
lea esp, [esi*8 + 0x408e1b97]
dec eax
ror edx, 0xe0
sbb al, 0x22
neg al
inc ebp
sub ch, ah
xor bl, al
movsx edi, cl
dec eax
lea eax, [esp + eax + 8]
dec ecx
mov dword [ebx + eax - 4], ebp
inc ecx
push ebx
inc ecx
pop edi
inc edi
mov ebx, dword [ebx + eax - 9]
dec edi
lea eax, [ebp + eax - 0x4c2accf3]
inc esp
xor ebx, ebx
dec edx
mov dword [esp + edi - 4], edi
inc esp
add ebx, edx
inc ecx
bswap ebx
sub di, 0xde3a
inc cx
xchg esp, edx
call fcn.01810c81
mov edx, 0x1633fd11
sar dl, 0x65
movsx ecx, dx
lea esi, [esi + edx*4 - 0x58cff404]
mov ecx, dword [esi + edx*4 - 0x58cff400]
xor ecx, ebx
bswap ecx
movsx eax, dl
jmp 0x1758897
inc ecx
ror ebx, 0x88
sbb ecx, 0x8c9bfa8b
jmp 0xf5ca6b
call fcn.01727492
dec edx
ror dh, 1
ror byte [eax + 4], 1
bound esi, qword [edi + 0x66]
cmc
sbb byte [eax + 0x12], bl
ja 0x174b980
cmc
pushal
insb byte es:[edi], dx
jl 0x174b989
pop esp
xor dword [ecx], ebx
adc edi, dword [edi - 0x75c49d5a]
bound edx, qword [eax]
sub byte [esi - 0x6b], al
sub esi, dword cs:[ebx]
aas
maxps xmm1, xmm5
stosb byte es:[edi], al
cmp dword [eax], ebp
xchg ebx, eax
lea eax, [edi + 0x31b4308d]
jp 0x174b8f2
sti
push 0x26f97dd1
mov dl, 0xfe
popfd
sub byte [edi + 0xc0034f3], dh
sub eax, 0x739b22ef
invalid
pushfd
fidiv dword [edi + eax + 0x23415585]
rcl ebp, 1
insd dword es:[edi], dx
aad 0x6d
paddw mm6, qword [edi - 0x80]
sti
ljmp 0x4aef
lea ecx, [ecx + edx*4 + 0x70bf12b4]
neg ecx
jmp 0x174b906
Function at 0xf0b378
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00fd86c0
xor eax, 0x2a343425
inc cx
rol ebx, 0x21
inc ecx
seto bh
inc esi
xor byte [esp + ebp - 1], bl
ror eax, 3
neg eax
dec edx
dec dword [esp + ebp - 5]
inc ecx
movzx esi, bx
dec edx
mov dword [esp + ebp - 5], ebx
inc ecx
movzx edi, bh
jnp 0xf4f4c5
inc edx
xor dword [esp + ebp*4 - 0x14], eax
inc ebp
movzx esp, ch
pop ebx
dec esp
lea esi, [edi*4 + 0x1402ae89]
dec ebp
add esi, esi
sub dx, 0x8623
dec eax
arpl ax, ax
dec esp
adc ecx, eax
sal dl, 0x81
jbe 0xf94fe5
dec edx
lea esi, [0x843c1036]
dec ebp
add ecx, ebx
dec esi
mov dword [esp - 0x6220422d], esp
dec esp
mov edi, dword [esp + 8]
dec ecx
add edi, 0xfffe0ae4
inc ecx
jmp edi

Function at 0xf0b4e9
Capabilities:
Encode data using xor

Disassembly:
xadd edx, eax
mov dword [esp], eax
xor ebx, ecx
add edi, ecx
push eax
sal eax, 0x86
pop ecx
pop edx
js fcn.00fb91bb
jmp 0xfaf63c
inc edi
add ebx, dword [eax + ebx*2 - 4]
dec esi
lea eax, [esi + eax - 0xe8a54cc]
inc esp
xor ebx, ebx
inc ecx
bswap ebx
call fcn.00fd7361

Function at 0xf113ef
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0x5bcc90f
call fcn.00fcdf77
jg 0xf1143a
fisttp dword [eax]
mov eax, 0x3dfc3fdc
les ebp, [ebx]
cld
jl 0xf11472
dec edi
inc edi
add cl, byte [edx]
invalid
test al, 0xff
mov word [ebx + esi*8], cs
idiv dword [ebx - 0x78]

Function at 0xf1140b
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
cmovb edx, esp
dec eax
mov ebx, dword [esp + edx*8]
jne 0x17801f6
mov cl, byte [ebp + ecx*4 - 0x4c11da9a]
shr ax, 0x4f
sub ax, 0xf39b
add ebp, 2
xadd al, ah
ror eax, 0xa
shr dx, cl
jmp 0x177be8f
mov word [ebp], dx
movsx ecx, ax
jmp edi
dec esp
mov dword [esp + ecx*2 - 0x5d779076], esp
shl dword [esp + ecx*2 - 0x5d779073], 0x76
dec eax
arpl bp, bp
inc ecx
and dh, 0x1e
call fcn.00ef185e
push edx
pushfd
mov edx, 0xf81b7bf
and dl, dl
xor dl, 0xb9
not dx
shl dx, 0x48
call fcn.00fe6d47
mov eax, 0x790acd96
rol eax, 0x9a
lea esi, [esi + eax - 0x59e42b3a]
lea ecx, [eax*2 - 0x70f7ba58]
lea edx, [eax + eax*2 + 0x2605b62e]
not edx
mov eax, dword [eax + esi - 0x59e42b36]
adc edx, ecx
not edx
xor eax, ebx
dec eax
rol eax, 3
rol dl, 0x24
sal ecx, cl
ror ecx, 0xe1
bswap eax
add edx, 0x438d1eb4
sbb dx, dx
dec eax
and dl, dh
adc edx, edx
xor ebx, eax
lea ecx, [edx + edx*4 + 0x6ae76b1]
add edi, eax
mov dx, word [ecx + ebp - 0x130476a7]
movsx eax, cl
jmp 0xfc7b35

Function at 0xf11419
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + ecx - 0x14f44323], 0x56b74708
neg eax
sub dl, 0x1b
push ecx
sal ecx, cl
sbb eax, 0x2f82ffa7
shr word [esp + 9], 0xec
or dword [esp + 2], 0xf58e220c
bswap eax
not eax
sbb cx, 0xc519
lea ecx, [ecx + edx*8 - 0x744fe341]
xor ebx, eax
add edi, eax
mov eax, dword [ebp + ecx - 0x7784a12e]
xor dl, dl
not cx
setns byte [esp + ecx - 0x77845ec9]
mov edx, dword [ebp + ecx - 0x77845ecd]
and cx, 0xa839
dec dword [esp + ecx - 0x7784080d]
setae cl
mov cl, byte [ebp + ecx - 0x778407f9]
adc ebp, 6
call fcn.00f0b378
Function at 0xf14341
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov edi, esi
call fcn.01820132
mov edi, 0xb3383d87
inc cx
mov ecx, dword [edx]
movzx eax, di
dec ebp
lea edx, [edx + eax*2 - 0x7b0c]
dec eax
inc esp
movzx ebx, di
dec eax
lea edx, [edi*8 + 0x1809c31f]
dec esi
lea eax, [eax + eax - 0x3d88]
inc ecx
movzx ebp, word [eax + eax - 0x3d86]
inc esp
movsx esp, bh
xor bp, bx
call fcn.0161742f
mov edx, 0xa96954d6
insb byte es:[edi], dx
jl 0xf14374
pushfd
jecxz 0xf143d6
js 0xf143a9
hlt
pop ds
inc eax
mov edx, 0x22dcde7b
cmp ch, dl
lock xchg dword cs:[edx], esi
jo 0xf143b8
mov ecx, 0x51d5fc70
shl dh, 7
movd esi, mm4
out 0x55, al
enter 0x6c90, 0x4d
and bl, byte [ecx]
leave
dec edx
jg 0xf143b8
mov es, word [ecx + 0x288f36a6]
into
or ah, ah
mov bh, 0x96
mov dword [ebx + 0x36], ecx
add al, al
hlt

Function at 0xf1d57d
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp + ecx - 0x271511], eax
mov dword [esp + ecx - 0x271511], ecx
movzx eax, byte [esi + ecx - 0x27151a]
movzx edx, cl
inc dl
lea esi, [esi + ecx - 0x27151a]
sar word [esp + ecx - 0x271510], 0x61
xchg dword [esp + ecx - 0x271511], edx
xor al, bl
and cx, 0x4db6
pop ecx
dec al
not al
movzx ecx, byte [esp + edx - 0x138a15]
shr edx, 0x7a
inc dword [esp + edx]
dec al
ror cx, 0x87
not al
or dword [esp + edx], 0x29389e17
dec al
or dl, 0x84
pop ecx
jl 0x1781b47
rol al, 1
xor bl, al
push edx
and dl, ch
shr edx, cl
lea eax, [esp + eax + 4]
call fcn.00f5a376

Function at 0xf1fc71
Capabilities:
Encrypt data using speck

Disassembly:
bswap ecx
lea eax, [edx*2 + 0x4097e238]
shl al, 0xe5
call fcn.00ef6dfa
push 0xc89b5fb9
mov eax, dword [ebp + 4]
and edx, eax
not edx
mov ecx, 0xd33250f
shr ecx, cl
mov eax, 0x86352c8a
mov dword [ebp + ecx - 0x1a62], edx
mov edx, dword [esi + ecx*4 - 0x699c]
rol byte [esp + ecx - 0x1a65], cl
lea esi, [esi + ecx - 0x1a6a]
mov dword [esp + ecx - 0x1a62], 0x712ea32b
xor edx, ebx
rol dword [esp + ecx - 0x1a62], cl
ror edx, 1
add ecx, ecx
dec edx
dec ecx
neg dword [esp + ecx*2 - 0x6992]
bswap edx
xor edx, 0x651b029a
or ax, cx
jae 0xf31eaf
add cl, 0xb0
jmp 0xf3b8ac
add ecx, dword [esp + ecx - 0x34ca]
xor ebx, edx
xadd byte [esp + ecx - 0x24c8d09f], ah
sbb ax, 0x9bb
dec al
adc edi, edx
mov eax, dword [ebp + ecx*2 - 0x4991a140]
movzx edx, byte [esp + ecx*2 - 0x4991a144]
mov cl, byte [ebp + ecx - 0x24c8d09a]
shr eax, cl
sub byte [esp + edx - 0xb3], dh
call fcn.00f78833
mov ecx, 0xfd88da3a
dec cx
push ecx
mov ecx, dword [edi - 4]
xor ecx, ebx
not ecx
add ecx, 0x44b2f201
mov edx, dword [esp]
jmp 0xeed1da

Function at 0xf2c6cd
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [esi + edx - 0x4a2db038]
neg dword [esp + edx - 0x4a2db034]
neg dword [esp + edx - 0x4a2db034]
call int.00fcf3bb

Function at 0xf2c91e
Capabilities:
Encrypt data using speck

Disassembly:
dec dword [esp + eax - 0x2cb8a981]
sar word [esp + eax - 0x2cb8a981], 0xc7
inc ecx
sal edx, 6
sub dword [esp + edx - 0x7330407c], edx
rol ecx, 1
inc ecx
call fcn.00ee7da9
Function at 0xf2fa84
Capabilities:
Encrypt data using speck

Disassembly:
not cl
ror al, 1
push ecx
not al
call fcn.0161259d
jmp 0xf87a9a
neg ecx
inc ecx
sub edx, edx
ror ecx, 2
jmp 0xfc8da7
sub edi, 4
mov ecx, dword [edi]
mov edx, 0x8635681d
xor ecx, ebx
sub ecx, 0xe0809aaf
jmp 0xf336a9

Function at 0xf30693
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ebx, ecx
or edx, 0xf0aa3b90
jl 0xf083de
jmp 0x160c93c
jp 0x1781c98
mov dword [esp + eax*2], 0x78b89292
jmp 0xef285a
fld dword [ebp]
sub esi, 4
mov eax, 0xcaa67f19
movzx edx, al
xchg al, dl
mov edx, dword [esi + edx*4 - 0x64]
xor edx, ebx
lea edx, [edx + eax - 0x698357db]
shl ax, 0xc
movsx ecx, ax
ror edx, 2
not edx
dec cx
jl 0x1776e0c
ror cx, 1
dec cx
not cx
sal byte [esp + 7], 2
shr dword [esp + 3], 0xf
dec cx
xor bx, cx
call fcn.00f94154
add ecx, ecx
dec edx
xor ebx, edx
add ecx, 0x9d1a63b5
call fcn.018208e5
adc edi, ecx
pop edx
jmp fcn.00fb91bb
Function at 0xf3b89f
Capabilities:
Encrypt data using speck

Disassembly:
push edx
lea ecx, [ecx + edx*2 - 0x45197846]
call fcn.0160808d
jmp 0x16142ea
mov dx, word [eax + ecx - 0x294427f4]
mov word [ebp + eax*2 - 0x52884fea], dx
shl byte [esp + eax*2 - 0x52884fe7], 0x82
sbb byte [esp + eax - 0x294427f4], 0x84
shr word [esp + eax*2 - 0x52884fe7], 0x63
mov ecx, dword [esi + eax*2 - 0x52884fed]
jns 0x18294df
xor cl, 4
jmp 0x1772f89
call fcn.00f74552
sal dl, 3
inc dx
sbb cl, 3
movsx eax, dx
lea edx, [eax*8 + 0x3724312a]
neg cl
lea eax, [eax + edx*4 + 0x4cb36223]
push edx
xor bl, cl
ror edx, 0x1e
sbb edx, eax
lea ecx, [esp + ecx + 4]
adc edx, dword [esp + eax - 0x294427f4]
jne 0xfb36f5
sub ax, ax
or eax, 0xba8684a1
adc esi, 0xfffffffb
xor ecx, ebx
xor eax, eax
xor ecx, 0xd41a9418
movzx edx, byte [esp + eax*2]
dec dword [esp + eax]
sar eax, 0x21
ror ecx, 1
add edx, 0x6182df10
pop eax
neg ecx
not eax
not ecx
xor ebx, ecx
shr al, 0x21
jp 0x1749913