joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16d8017
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, eax
inc cx
inc edx
mov dword [esp], ecx
xor edx, eax
xor dword [esp + 3], 0xcfa6321a
adc dword [esp + 4], 0xe7a8381b
shl word [esp + 6], cl
lea edx, [edx + eax - 0x9ed65d3]
rol edx, cl
xchg ecx, eax
xor ecx, ecx
xor ebx, edx
add edi, edx
mov edx, dword [ebp + ecx*2]
xchg byte [esp + ecx*8 + 7], ch
inc cx
ror eax, cl
mov eax, dword [ecx + ebp - 0xdffd]
ror ecx, 0x16
xor ecx, ecx
or cl, byte [ebp + ecx + 8]
add ebp, 6
call fcn.0250f6a4

Function at 0x16e0735
Capabilities:
Encode data using xor

Disassembly:
dec cl
pop ecx
add esi, edx
mov ecx, dword [edi]
mov edx, 0xf31cfb2d
add dx, dx
mov edx, dword [edi + 4]
add edi, 4
jmp 0x249ac65
push 0xa2082cb4
xor eax, eax
jmp 0x257ac7f
test edx, edx
lea esp, [esp + 4]
je 0x24b23f3
push ebx
mov ebx, 0xef2cc211
push ebx
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
rol dword [esp + 3], 0x91
and ebx, 0xff
or byte [esp + 3], 0x2f
mov ebx, dword [ebx*4 + 0x2512b8c]
shr eax, 8
xor eax, ebx
not word [esp + 4]
inc ecx
xor eax, 0x8ca1ed06
dec edx
lea esp, [esp + 8]
jne 0x257ac8c
mov ebx, 0x59aace12
movzx ecx, bx
call fcn.024b23e8
ror eax, 3
pop edx
add edx, 0xff1deebb
jmp edx

Function at 0x16f0708
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
lea eax, [ecx + eax - 0x18ec85e1]
jae 0x256f240
lea ecx, [ecx*4 - 0x624e52e0]
call fcn.0157a460
sub esi, 4
mov ecx, dword [esi]
shl dword [esp], 0x3e
mov edx, dword [esp + 4]
add edx, 0x1b9f3
jmp edx

Function at 0x16f3d18
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, ebx
ror ecx, 1
mov edx, eax
not ecx
mov dword [esp + edx - 0x70a18c8f], edx
lea ecx, [eax + ecx - 0xa07fe87]
xor ecx, 0xb2959713
rol ecx, 2
rol dword [esp + edx - 0x70a18c8f], 0xeb
mov dword [esp + edx - 0x70a18c8f], edx
xor ebx, ecx
ror edx, 0xc9
not ax
rol word [esp + eax - 0x70a1736e], 0xc4
add edi, ecx
lea ebp, [ebp + edx - 0x47b850c7]
lea ecx, [edx + eax*8 - 0x585acee6]
movzx eax, byte [ebp + ecx - 0x74691d60]
not edx
xor al, bl
xor al, 0xac
dec dword [esp + ecx - 0x74691d60]
dec al
shr word [esp + ecx - 0x74691d5f], 0x6b
sal cx, 0xcc
not al
sal dword [esp + ecx - 0x74690000], 0x44
xor cl, byte [esp + ecx - 0x7468ffff]
adc al, 0x33
dec ecx
xor bl, al
lea eax, [esp + eax + 4]
xchg dword [esp + ecx - 0x74690027], edx
call fcn.024cea1a
mov ecx, 0xf49afda3
mov eax, dword [edi]
sub cx, cx
lea edx, [ecx*4 - 0xa4f0c76]
adc cx, word [edi + 4]
rol dx, 0xa8
xor dx, dx
jno 0x242383e
sub edx, 0xea314f15
rol edx, 1
neg edx
or al, 0xa3
rol ax, 0xc8
sal ecx, 0xaa
xor ebx, edx
add esi, edx
push eax
pop eax
jmp esi
adc edi, 6
or edx, 0xb5257532
sar dl, 0x61
mov word ss:[eax], cx
mov edx, dword [ebp]
mov ecx, 0xf6878139
adc ebp, 4
dec cx
xor edx, ebx
lea ecx, [ecx*2 - 0x75d4b0d6]
lea eax, [ecx + ecx*2 + 0x3fa4aa3c]
neg edx
jmp 0x23cac43

Function at 0x16f3dd4
Capabilities:
Encrypt data using speck

Disassembly:
add cl, 0xb3
not cl
mov eax, 0x13183205
neg cl
call fcn.02537e23

Function at 0x16f3de5
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp - 4], eax
inc dword [esp + 4]
test ebx, ebx
call fcn.02454485
Function at 0x1700750
Capabilities:
Encode data using xor

Disassembly:
pop ecx
cli
fsub qword [esi - 0x77]
inc esp
push edi
mov dword [esp + ecx*8 - 0x16050], esi
ret 4
call fcn.025299a6
xchg edi, eax
nop
xchg edx, eax
aam 0xc4
jo 0x17006f1
aas
outsd dx, dword [esi]
xlatb
jg 0x17007d5
dec ebp
cmpsd dword [esi], dword es:[edi]
invalid
add al, 0xed
and ebx, 0x21
mov edi, 0xbdfc6619
mov ebp, 0x3fd3ce39
add eax, 0x36441bb3
sal al, cl
invalid

Function at 0x1707d1a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.01595a61
inc esp
add byte [edx + 0x79c30454], dl
loopne 0x1707d26
das
sbb dl, byte [eax]
rcl byte [eax - 0x4d740543], 0x8c
dec ebp
pop esi
push es
fisubr word [edi]
fmul dword [ebx]
xchg edi, eax
invalid

Function at 0x1e2188d
Capabilities:
Authenticate hmac

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
mov dword [esp], 0xc41125b7
lea esp, [esp + 4]
je 0x24bfca3

Function at 0x1e2463c
Capabilities:
Encode data using xor

Disassembly:
fimul dword [edi]
invalid
mov ecx, dword [ebp + ecx - 0x53ba1892]
xor ecx, ebx
sub ecx, 0x9c812105
bswap ecx
dec ecx
mov dword [esp], 0xfb25c035
call fcn.016344fc
cwde
rol dword [eax], 1
aam 0xcb
jg 0x1e24635
lodsd eax, dword [esi]
outsd dx, dword [esi]
fdivr dword [esi]
out 0x4d, al
test al, 0x78
repz ret 0xd0b3

Function at 0x23d18bd
Capabilities:
Encrypt data using speck

Disassembly:
not eax
sar edx, 0xe4
sub dl, cl
xor ebx, eax
mov dword [esp], edx
xor cx, 0x52bd
shl cx, 0x29
adc edi, eax
mov cx, word [ebp]
mov ax, word [ebp + 2]
call fcn.0164463e
mov eax, 0xdaa22817
mov edx, dword [esi]
call fcn.016d5375
mov eax, 0x290565bb
sar ax, 0xc2
lea edi, [edi + eax*2 - 0x520a32d8]
xor ecx, ebx
push eax
call fcn.025a0a01

Function at 0x23ec3a6
Capabilities:
Execute syscall

Disassembly:
call fcn.023c6cc5
inc ecx
ror al, 1
dec edx
mov dword [esp + esi + 0x55aa3e2], 0x3608ab
inc ebp
xor bl, al
inc cx
ror ecx, 0xc1
dec esi
lea eax, [esp + eax + 8]
jae 0x240ba42
mov eax, dword [esi + edx]
sar edx, 0x21
xor eax, ebx
call fcn.0169b74e
inc bx
mov dword [eax + esi*4 + 0x156a8f88], edx
dec edx
sub dword [esp + esi*2 + 0xab547c4], edi
dec edx
mov dword [esp + esi*2 + 0xab547c4], ebx
inc edi
mov esi, dword [ebp + esi*8 + 0x2ad51f10]
dec eax
lea ecx, [ebx*4 + 0x233d500e]
dec esi
lea ebp, [ebp + ebp - 0xf7]
dec eax
not ecx
jge 0x2473847
or ecx, eax
inc ebp
xor esi, ebx
xor eax, dword [esp + ebp*2 - 0x1f2]
dec eax
sal dword [esp + ebp - 0xfb], 0x5f
inc ecx
rol esi, 1
xchg bp, ax
jmp 0x16716dc

Function at 0x23ffea3
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
rol edi, 3
inc ecx
bswap edi
inc ecx
sal edx, 0x8d
dec eax
mov dword [esp + eax*2 - 0x14302], eax
dec esp
mov dword [esp + eax*2 - 0x14302], ebx
jb 0x248eee7
inc esp
xor dword [esp + eax*2 - 0x14302], edi
movsx ecx, di
inc ecx
pop ebx
dec ebp
arpl di, di
dec ecx
add esi, edi
call fcn.015a5f94
Function at 0x240576e
Capabilities:
Encode data using xor

Disassembly:
dec ecx
add ebp, 1
inc ecx
xor al, bl
inc ecx
mov eax, 0x78c4930
ror al, 1
dec edx
mov dword [esp + eax - 0x78c4930], 0x48877ba
mov ecx, 0x763e57b1
dec al
inc ecx
push eax
inc dx
shr dword [esp + eax*4 - 0x1e3124c0], 0x6a
not al
inc ecx
push eax
xor al, 0x8e
inc edx
shl byte [esp + eax - 0x78c4930], 0x46
dec esi
xadd dword [esp + eax - 0x78c4926], eax
inc al
dec esp
add dword [esp + ecx - 0x763e57a1], eax
dec esp
xchg ecx, eax
inc esp
xor bl, al
inc edx
mov ebp, dword [esp + eax - 0x763e57a2]
dec esp
lea edi, [ecx*2 - 0x38521668]
dec eax
lea eax, [esp + eax + 0x18]
inc ecx
movzx edi, ax
inc esp
xchg byte [esp + edi - 0x57a1], al
or di, bp
inc sp
movzx ecx, byte [edi + eax - 0x57b1]
dec edi
lea esp, [eax - 0x763e5748]
call int.025c373e
mov eax, 0xbbbdee89
movsx ecx, al
mov edx, dword [esi]
mov ax, word [esi + 4]
mov esi, 0x66168bc8
mov eax, dword [esi + 4]
add esi, 6
xor cl, ch
lea ecx, [ecx*4 - 0x575406d4]
sub cl, 0x8e
mov word ss:[edx], ax
jns 0x246a1b6
call fcn.023cabb6
imul ebp, dword [ebp - 0x37c56257], 0x23
out dx, eax
sub al, 0xdf
inc ebp
mov dl, 0xf6
jne 0x2405808
dec ebx
adc bh, byte [ecx + 0x78a142c6]
int1
stc
stosd dword es:[edi], eax
mov ebx, 0x743605a8
sahf
rol dword [edx - 0x4f], 1
fmul qword [esi - 0x71]
iretd
sub ebp, 4
mov eax, dword [ebp]
lea edx, [ecx*2 - 0x27e0ea71]
push ecx
sub dx, 0x532a
xor eax, ebx
ror eax, 1
push ecx
rol cx, 0xcb
or cx, 0x233b
lea eax, [eax + ecx + 0xdda674]
sar word [esp + edx*2 - 0x52ef629e], 0xa5
pop edx
ror word [esp], 0xe2
bswap eax
shr edx, 0xc9
neg edx
neg eax
and dword [esp], 0xae067906
add byte [esp + 1], dl
dec eax
sub dword [esp], ecx
xor ebx, eax
sal ecx, 0x52
adc edi, eax
or dword [esp], edx
call fcn.0247e90c
jnp 0x246a236
xchg byte [ebx + 0x5f61ecb6], ch
inc esp
aas
sti
jp 0x246a264
fdiv qword [ebx]
loope 0x246a25b
out 0x66, al
or ebp, edi
cmp dword [ebx + 0x48d33345], esi

Function at 0x2408dc8
Capabilities:
Encrypt data using speck

Disassembly:
lea ecx, [ecx + edx - 0x1148a59e]
jns 0x250d208
not ecx
sar edx, 0x42
mov dword [esp + 0xc], edx
sub ecx, 0x29bef4a9
lea eax, [edx - 0x27f186e]
shr ax, 0x24
and dl, byte [esp + 4]
xor ecx, 0xc80c67bd
sub ax, 0x23b8
call fcn.015aca39

Function at 0x240c735
Capabilities:
Encode data using xor

Disassembly:
mov word [esi], ax
neg ecx
lea eax, [ecx*4 + 0x6b28ca0d]
lea edx, [eax*8 - 0x3148af46]
lea ebp, [ebp + ecx - 0x4bd60004]
mov dword [esp + ecx - 0x4bd60000], 0x800a7109
lea eax, [ecx + ecx*4 - 0x3da8d62]
mov ecx, dword [ecx + ebp - 0x4bd60000]
xor ecx, ebx
jmp 0x256e5ac
mov word [esp + eax - 0x7753729d], ax
rol ecx, 1
neg dword [esp + eax - 0x7753729e]
inc dx
dec ecx
sub dl, 0x9d
neg ecx
dec eax
bswap eax
bswap ecx
dec dl
add ax, 0xe907
xor ecx, 0x7e350a29
and edx, eax
sal eax, 0x67
call fcn.0163f050
mov eax, dword [edi + 4]
push 0xe08f6899
mul ecx
mov dword [edi], edx
call fcn.02433e03
Function at 0x2420c87
Capabilities:
Encrypt data using speck

Disassembly:
wait
xor eax, 0xff664b0b
inc ax
xor ebx, edx
mov dword [esp + eax*2 - 0x47e76646], 0xcd1f932f
and word [esp + eax - 0x23f3b321], 0x13b4
adc esi, edx
add ecx, 0x5bb69d05
mov eax, dword [edi + eax*2 - 0x47e76646]
mov cl, byte [edi + 4]
adc edi, 6
call fcn.01604a44
mov dword [esp], eax
jb 0x2507253
mov cl, 0xba
inc edi
out 0x48, eax
pop eax
inc eax
aad 0x28
and al, 0x42
jl 0x2420c4b
cmp byte [esi + 0x3ec64234], al
push es
mov cl, 0x4d
or dl, byte es:[eax]
jle 0x2420d24
retf
invalid

Function at 0x242878e
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x6c110ba8], 0x8321b3b2
movsx ecx, ax
lea ebp, [ebp + ecx - 0xba4]
push ecx
sar al, 4
push eax
xor edx, ebx
rol edx, 1
and ecx, 0xa59de283
call fcn.024d569a
inc ecx
mov eax, dword [ebp]
mov edx, 0xeb911fa6
dec ecx
add ebp, 4
call fcn.0246a3ad
jle 0x242878f
test byte [eax + ebx*2], al
hlt
out 0xcf, al
xchg ebp, eax
push ds
add cl, byte [ebp + esi + 0x46a05a8d]
popfd
invalid

Function at 0x242ca24
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
mov edx, 0xab899c3f
shl dl, 0x26
call fcn.0253e921
call fcn.014c17a1
sub ebp, 4
mov cl, byte [ebp + 2]
mov eax, 0xd1b05f86
shr eax, 0x37
lea ebp, [ebp + eax - 0x1a1]
shl eax, 0x2d
adc ax, 0x7338
shr dl, cl
mov word [ebp + eax*2 - 0x69a670], dx
movzx edx, al
lea esi, [esi + eax*4 - 0xd34ce4]
mov eax, dword [esi + eax*4 - 0xd34ce0]
pop ecx
xor eax, ebx
shl edx, 0xf0
ror eax, 1
not eax
call fcn.015a581a
sbb cx, cx
neg eax
xor ebx, eax
sal ecx, cl
add edi, eax
mov eax, ecx
push ecx
jmp 0x254b116
mov eax, dword [esi + eax - 0x7ffffffc]
imul ecx
mov dword [esi], edx
call fcn.015d1d70
jmp 0x16c88a4
mov ecx, dword [esi + eax - 0x80000000]
neg eax
jbe 0x2534047
jmp 0x1678c53

Function at 0x242ffa5
Capabilities:
Authenticate hmac

Disassembly:
neg cl
call fcn.014c2aac
jns 0x242ffc5
xchg esi, eax
mov ah, 0xa7
std
sbb dword [bp + di], esi
ret
lea eax, [ebp + 0x411febc1]

Function at 0x2436211
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
dec ecx
inc ecx
not ecx
inc ecx
dec ecx
shl byte [esp + edx + 0xa], 0x47
inc ecx
bswap ecx
call fcn.01665c52
inc ecx
sal dh, 0xe5
inc ebx
movzx eax, byte [ebp + edx*2 - 0x20]
dec edi
lea ebp, [ebp + edx*2 - 0x1f]
inc ecx
sal dl, 0x61
dec esp
mov dword [esp + edx*2 + 0x27a378a0], edx
inc ecx
xor al, bl
inc esp
sub byte [esp + ebx + 0x62d06016], dl
inc si
xchg dword [esp + edx*4 - 0x73], edx
inc ecx
movzx ebp, dl
ror al, 1
add al, 0x9f
inc esp
xor ecx, edx
ror al, 1
inc ebp
movzx eax, dh
inc al
sub dx, dx
shr ebp, 0xfd
inc esp
xor bl, al
inc ecx
movzx ecx, dh
dec eax
lea eax, [esp + eax + 0x10]
dec eax
inc edx
dec edx
sal dword [esp + ecx - 0x5ee8d471], 0xd8
dec ecx
inc esi
inc si
add edx, dword [eax + ecx - 0x5ee8d476]
dec ebp
lea esp, [esp + edx*2 + 0x27a3fffc]
inc cx
xadd ecx, edx
inc ecx
movzx edi, al
inc si
mov dword [ebx + 0x62d06015], edx
or word [esp + ebx + 0x62d06020], bx
inc sp
mov dword [esp + ebx + 0x62d06016], eax
inc ecx
pop esi
pop ebx
jno fcn.0159a611
Function at 0x24362c4
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, 0x7e90850d
xor ebx, ecx
add edi, ecx
rol eax, 0x7d
call fcn.014f687d
mov dword [esp + eax*2 - 0x2f7c2d32], ecx
add ecx, ecx
rol edx, 1
sal cx, 0x84
inc byte [esp + eax - 0x17be1699]
setge byte [esp + ecx - 0xd320]
bswap edx
ror byte [esp + eax - 0x17be1692], 0x62
xor word [esp + eax*4 - 0x5ef85a5f], 0x9390
inc edx
xor edx, 0x69277829
ror edx, 3
call fcn.016b7f69
mov eax, 0xd4a4b2b6
inc ecx
mov ebx, dword [ebp]
dec ecx
add ebp, 4
dec esp
lea esi, [eax + 0x6c02d0a7]
call fcn.015a4ee9
sub word [esp + eax - 0x2ebd0cb3], ax
bswap ecx
jne 0x14ca79a
lea ebp, [ecx + ebp - 0x30ba]
pop edx
mov dword [ebp + ecx - 0x30b6], eax
sub ecx, 0x609b6e1d
sal edx, cl
and dx, 0xfb99
pop eax
jge fcn.01577f93
call fcn.01676112

Function at 0x243b9ff
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, edx
mov edx, dword [esi]
mov dword [esp], eax
xor edx, ebx
call fcn.01e206bb

Function at 0x2444ea4
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ecx
push eax
pop edx
add esi, ecx
shl al, 0x86
add edx, dword [esp + 4]
movzx cx, byte [edi]
adc eax, eax
mov dl, byte [edi + eax - 0x1693537e]
call fcn.02598395
lahf
mov bl, 0xb5
fdiv qword [ecx]
rcr byte [eax], cl
mov edi, 0xad731ebc
sbb al, 0x44
add al, 0xc0
mov al, byte [0x4a676c14]
pop edi
dec esi
cmpsb byte [esi], byte es:[edi]
sahf
insb byte es:[edi], dx
mov dh, 0xa
sar dword [edx], cl
inc ecx
daa
adc ecx, dword [edx + 0x5c87375c]
cmp dword [edi + 0x614ed65], ebp
scasd eax, dword es:[edi]
in eax, dx
adc al, 6
outsd dx, dword [esi]
dec ebp
cli
and ebp, dword [eax + 0xb]
xor al, 0xbd
sbb al, 8
fld xword [edx + 0x30]
and al, 0xf5
out dx, al
cmpsd dword [esi], dword es:[edi]
inc ebx
and cl, ah
jbe 0x2444eea
sub cl, al
in al, 0x1f
iretd

Function at 0x24450d8
Capabilities:
Execute syscall

Disassembly:
or dx, dx
mov dword [esp], edx
mov word [ebp], cx
mov ecx, dword [edi]
adc edi, 4
xor ecx, ebx
shr word [esp], 0x6f
neg ecx
lea ecx, [ecx + edx - 0x19cca869]
xchg dword [esp], edx
xor ecx, 0xcc3c5590
mov eax, edx
xchg al, dl
sal dword [esp], 3
lea ecx, [eax + ecx - 0x629ca571]
ror ecx, 3
jmp 0x2532b8e

Function at 0x244cf0c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], eax
xor ebx, ecx
add ebp, ecx
lea ecx, [eax*8 - 0x6fcc79ee]
sal byte [esp + ecx - 0x5084a1f8], 0xc6
mov ax, word [edi + ecx - 0x5084a1fa]
mov dx, word [edi + ecx - 0x5084a1f8]

Function at 0x2452c65
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
shl word [esp + eax - 0x4712a87f], 0x87
xor ebx, ecx
not dword [esp + eax - 0x4712a87b]
mov dword [esp + eax - 0x4712a883], 0x973f8a8e
call fcn.016bbb45
mov ecx, 0xc21b2f2a
mov eax, 0x593f7ca3
mov edx, edi
call fcn.015d53cc
Function at 0x245776b
Capabilities:
Encode data using xor

Disassembly:
dec edx
lea edi, [ebp + eax + 0x3aa5ef0b]
dec eax
lea ebx, [ebp + 0x5847ebb]
dec eax
add esi, eax
jmp 0x1644039
dec edi
lea esp, [esi - 0x7cce6ecb]
inc esp
movsx ecx, bl
dec esp
xchg edi, eax
inc cx
rol edi, 4
inc bx
mov dword [esi - 0x7cce6ec9], ecx
inc esi
sub byte [esp + edx*2 - 0x6c3b8402], al
pop eax
pop edx
jno fcn.0159a611
neg edx
inc edx
mov ebx, dword [esp + edi*2 - 0xc1]
sub edx, 0x978e6482
dec esp
lea edi, [ebx*2 + 0x5103e096]
jmp 0x162e9f1
dec esp
mov dword [esp + ebx - 0x62], ebx
inc esp
xchg bl, dh
inc edx
xor dword [esp + ecx - 0x628d733d], edx
inc ecx
pop ebx
call fcn.024dbfc0
dec ecx
mov edx, dword [esp + ebp*2 - 0xf31e]
dec ebp
lea esi, [eax + ebp*8 + 0x6029b7a1]
dec ecx
mov ebp, dword [esp + ebp - 0x7987]
inc ecx
mov cl, byte [esp + 0x10]
inc ebp
or dh, al
dec ecx
adc esp, 0xa
inc ecx
shr esi, 0xb7
ja 0x24b08a9
dec esp
mov ebx, dword [esp + ebp*8 - 0x2a8]
dec eax
arpl ax, ax
jle 0x14fee7d
mov edx, 0xdfa420b7
and dx, 0x1334
mov ecx, dword [edi]
rol dl, 0xe1
lea eax, [edx + edx*8 + 0x5e134f83]
shl ax, 0xe9
lea edi, [edi + eax*2 - 0x75aeabfc]
xor ax, dx
xor ecx, ebx
dec dx
shr al, 0x61
lea ecx, [eax + ecx - 0x4e5ac2e4]
sal eax, 0xe1
call fcn.0159f457
dec ecx
lea eax, [edx + edi*2 + 0x1283263d]
inc esp
movsx edi, al
inc ebx
movzx eax, byte [ebp + edx - 0x3ba24112]
dec ecx
sar esi, 1
dec edi
lea ebp, [ebp + edx - 0x3ba24111]
inc ecx
xor al, bl
ror al, 1
add al, 0x9f
jmp 0x259d7fc
inc ecx
mov ecx, ecx
dec ebp
lea ebp, [ebp + ecx - 0x628d7339]
inc ecx
xor edx, ebx
inc edx
dec edx
mov dword [esp + ecx - 0x628d733d], ecx
rol edx, 1
not edx
inc ecx
mov esi, 0x681c12a9
neg edx
inc cx
ror esi, 0x89
inc esp
movsx edi, byte [esp + ecx - 0x628d733a]
sbb edx, 0x90b30fb1
jmp 0x15dca09
inc ecx
movsx eax, ax
dec eax
shrd edx, ebp, cl
mov edi, eax
mov ecx, 0x1f2f1ab9
call fcn.014f8e3f
inc ecx
push edi
ror al, 1
pop edi
movzx ecx, bp
inc al
inc ecx
rol eax, 0x96
inc esp
sub edx, ebx
inc esp
xor bl, al
dec edx
mov dword [esp + esi - 0x7cce6ec1], ebp
dec eax
lea eax, [esp + eax + 0x10]
inc edx
mov dword [esp + esi - 0x7cce6ec9], ebp
inc dx
mov ecx, dword [eax + eax*2 - 0x15d0d4dc]
jmp 0x157c2a1
Function at 0x246716a
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + edx - 0x23c2156], ebx
dec ecx
neg edx
inc esp
movzx edi, ch
inc edx
xor dword [esp + edx*4 + 0x8f08558], ecx
dec ebp
lea ebx, [eax + ebp*8 + 0x5cace493]
inc ecx
pop ebx
dec eax
arpl cx, cx
dec eax
add esi, ecx
inc ecx
xadd dh, al
dec ebp
mov eax, esp
and bp, 0xf36
jne 0x24c4fb9
aas
test eax, 0x20128afd
jne 0x24c4fb3
sub al, 0x82
mov bh, 0x5a
imul edx, esp, 0xd76f7e02
xor byte [edi + 0x2d4695a], 0x7e
outsd dx, dword [esi]
xlatb
jge 0x24c4f7f
sbb eax, 0x7d11833e
mov eax, 0x3a173f93
mov ecx, eax
mov edx, dword [edi + eax*2 - 0x742e7f26]
bswap eax
ror al, 0x41
neg ax
lea edi, [ecx + edi - 0x3a173f8f]
call fcn.024d3a15
vsubps xmm5, xmm2, xmm2
add byte [eax], al
dec edx
lea edx, [eax + esi*2 + 0x553bf93e]
dec edi
lea esp, [esp + edx*2 + 0x47842a4]
dec edi
mov dword [edx + 0x23c2156], eax
jg fcn.0159a611
jbe 0x24c4f86
cmpsd dword [esi], dword es:[edi]
or ecx, dword [edi - 8]
enter 0xffffffffffff8969, 0x6b
cdq
mov cs, word [esi - 0x7eb93478]
dec ebx
aaa
or byte [ecx + 0x5c4376a8], al
or ch, byte [edi + esi*2 + 0x3f]
mov edi, 0xb7728fbd
pop ebp
dec ecx
xchg ebx, eax
dec ebx
xor dword [0x7692db2e], edi
jne 0x24c4ffc
push ds
lea esi, [esi + 0x6cd100eb]
dec edx
pushfd
ret

Function at 0x2467965
Capabilities:
Encrypt data using speck

Disassembly:
bswap eax
inc ecx
push ebx
inc dl
dec ebx
lea edi, [edx + edi*4 + 0x62037002]
call fcn.0165323f
jmp 0x14d5acd
movsx ecx, dl
dec ebp
lea ebp, [ebp + ebx - 0x3e9f4790]
inc ecx
inc cl
dec ebp
lea edx, [edi - 0x634f38f1]
jnp 0x24aedd5
dec ebp
lea esp, [esp + ebx - 0x3e9f478e]
inc ebp
shld edx, edi, cl
dec esp
lea ecx, [ebx + ebx + 0x4cb3d814]
inc ecx
pop eax
inc ebp
movzx edi, cl
inc ebp
mov dword [esp + ebx - 0x3e9f4794], edx
sub dl, 0xb5
inc edx
mov eax, dword [ebx + ebp - 0x3e9f4794]
js 0x16f63bb
inc ecx
xor eax, ebx
inc ebp
movsx esi, bh
inc eax
inc cx
shl esi, 0xe8
ror eax, 1
lea eax, [ebx + eax - 0x7c3ffdd1]
jmp 0x165ec30

Function at 0x246ec51
Capabilities:
Encrypt data using speck

Disassembly:
rol ecx, 2
add dword [esp + eax*2 - 0x126], eax
sar al, 0xa7
xor ebx, ecx
lea eax, [edx + eax + 0x4d92e390]
call fcn.015fd304
Function at 0x2470f93
Capabilities:
Encode data using xor

Disassembly:
or ecx, edx
mov edx, dword [edx + edi - 0x4a2a83be]
ror ecx, 0xf6
sub ecx, 0xc7386624
call fcn.015dbca0
lea edx, [edx + eax*2 - 0x65329ffa]
xadd ax, cx
shl dword [esp + eax - 0x280741d9], cl
shl dword [esp + eax - 0x280741d9], cl
xor ebx, edx
call fcn.0251bd32
inc ecx
push ebx
dec esp
lea edx, [ebx + ecx*8 + 0x1f169d8f]
mov ebp, ecx
push ecx
inc esp
xor dword [esp + edx - 0x6bb50599], edi
inc eax
rol ch, 0x84
dec esp
mov ebx, dword [esp + edx - 0x6bb50599]
xchg ecx, ebx
mov eax, dword [esp + edx - 0x6bb505a1]
dec ebp
arpl di, di
inc cx
xadd edx, ecx
inc ecx
sbb ch, al
dec ecx
add esi, edi
inc esi
movzx eax, byte [edx + ebp - 0x6bb505a1]
jmp fcn.0257f9e2
inc ecx
not ecx
mov dword [esp + eax - 0x61], edx
xor ebx, ecx
add esi, ecx
sal al, 0xe2
lea ecx, [edx + 0x2da5cb1e]
mov eax, dword [edi + edx - 0x4a2a83c2]
js 0x25c238e
syscall
inc ecx
push edx
dec eax
mov dword [esp], 0x175fedb8
call fcn.024b48c8
cli
mov dh, 0x6a
ja 0x2471039
mov ch, 0x45
mov byte [eax - 0x22], cl
pop ds
inc esp
mov ch, byte [eax + 0x70ca2a8d]
mov bh, 0xe9
in eax, 0xf8
push ebp
xchg bh, dh
jmp 0x52bf8564
sub ah, byte [edx - 0x73]
lodsb al, byte [esi]
or eax, 0x9dd5f2cd
movzx edx, cl
lea edx, [edx*4 + 0x3ab4b86]
mov eax, dword [edx + ebp - 0x3ab4c42]
xor eax, ebx
shr edx, cl
dec edx
not ecx
rol eax, 1
shl dl, 0x42
neg eax
xadd dl, ch
xor eax, 0x1c19b302
neg ecx
sub eax, 0xbd23103a
sub cl, ch
inc ecx
xor ebx, eax
jmp fcn.01631723
jne 0x15b3a27
not edx
call fcn.024b3da2
xor edx, ebx
not edx
mov eax, 0x2807d5b9
dec edx
mov ecx, 0x75226c20
sar dword [esp + eax - 0x2807d5b9], 0xc2
not edx
jb 0x15dba92
dec ecx
add ebp, 4
inc ebp
xor edi, ebx
dec eax
lea edi, [ebx + ebx*2 - 0x256ea351]
inc ebp
lea edi, [edi + ebx - 0x54124383]
push ebx
dec eax
or dword [esp], edi
inc ecx
rol edi, 2
inc ecx
pop eax
inc ecx
xor edi, 0x460b442a
mov edx, edi
inc ecx
movsx ecx, al
inc ecx
bswap edi
jmp 0x23ec1ee
Function at 0x2472c3c
Capabilities:
Authenticate hmac

Disassembly:
adc edi, eax
ror dword [esp + edx - 0xaffffa], 0xc6
mov dword [esp + edx*8 - 0x5800000], edi
ret 8
xor ebx, edx
xadd ecx, eax
adc esi, edx
mov edx, dword [ebp]
xchg cx, ax
call fcn.01670fc4
pushfd
dec eax
add dword [esp + 8], 0xfeafd4c7
dec eax
mov dword [esp + 8], 0x18875d8a
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.024b48c8
dec word [esp + ecx - 0xd4]
add ebp, edx
add ecx, ecx
lea eax, [ecx + ecx*2 - 0x1276acf6]
movsx edx, ax
pop ecx
pop ecx
pop eax
pop edx
jns fcn.025001a0
mov edx, dword [edi]
mov ecx, 0x8c015daf
add edi, 4
movzx eax, cx
rol eax, cl
xor edx, ebx
not edx
ror edx, 2
rol ax, 0xeb
not edx
lea edx, [edx + eax - 0x65dbca32]
shr cx, 0x2f
jp 0x15a10c1
add ecx, esp
jmp 0x250da05
push 0x698dce3f
mov word [ecx], ax
mov edx, dword [esp]
xor dl, byte [esp + edx - 0x698dce3d]
lea ebp, [ebp + edx - 0x698dceb6]
push edx
lea eax, [edx*8 - 0x30d9de76]
movzx ecx, dl
mov edx, dword [ebp + edx - 0x698dceb2]
sal ecx, 0xcd
neg word [esp + eax - 0x1b949719]
xor edx, ebx
and eax, ecx
sbb edx, 0xf1045790
pop ecx
add ecx, ecx
pop ecx
not edx
sar cx, 0xc1
sub edx, 0x9e1dd80f
xor ecx, 0x812d68a9
bswap edx
neg al
not ax
sbb ecx, ecx
dec edx
shl cl, 0xa6
add ax, cx
sar eax, 0xdd
ror edx, 1
sal eax, 0x36
jp 0x2516a07
shrd ax, dx, cl
pop edx
mov word [ebp], ax
mov ecx, 0xfc1faab0
sub esi, 4
dec dword [esp]
mov eax, dword [esi]
xor eax, ebx
movzx edx, cl
shl edx, cl
and dx, cx
neg eax
sal cl, 0xe2
lea eax, [edx + eax + 0x2c888290]
push ecx
inc word [esp + edx*8 - 0x57ffffc]
neg eax
add ecx, dword [esp + edx - 0xaffffd]
inc eax
sub dword [esp + edx*2 - 0x15ffffe], 0x603db93a
push edx
xor ebx, eax
shr cx, 0x6a
neg dl
jae 0x157c213
inc eax
neg byte [esp + edx - 0x49a817ff]
sete dl
neg eax
and dword [esp + ecx*2 - 0x1673a], ecx
xchg dword [esp + ecx*4 - 0x2ce78], edx
neg ecx
bswap eax
jb 0x252a612
xor ebx, edx
jmp 0x254857b
sub ecx, ecx
sbb cx, 0x7e9d
add edi, edx
rol eax, 0x9b
xchg ecx, eax
or ecx, edi
jmp ecx

Function at 0x2474191
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0x573d0a9e
dec eax
call fcn.0240921b
shr edx, 8
xor edx, ebx
inc ecx
push 0x8e2ca78a
jmp 0x16606a6