joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12a3bfe
Capabilities:
Encrypt data using speck

Disassembly:
lea ebp, [eax + ebp - 0x48479d22]
xor edx, ebx
mov dword [esp + eax - 0x48479d26], 0x5d8174aa
rol al, 0x87
neg edx
movzx ecx, byte [esp + eax - 0x48479d0f]
dec cl
dec byte [esp + eax - 0x48479d12]
ror edx, 1
xadd byte [esp + ecx*4 - 0x17a], ch
add eax, 0x5623001c
jo 0x176cedd
ror byte [edi + 0x2f], 1
cmc
push edx
add cl, byte [esi + 0x225b6ae6]
cmc
cmp di, bx
cmp eax, 0xd5bb98ea
js 0x12a3cb2
inc ecx
xor eax, eax
call fcn.01276232
insb byte es:[edi], dx
sbb al, 0x2e
push 0xfe9a31b6
jbe 0x12a3c97
retf 0x9a31
add eax, 0x36dc9473
jp 0x12a3d05
mov ch, 0x7f
pop ds
sal byte [ebx + 0x614d2d5b], 0x7c
lds edi, [ebp + 0x2c]
sub eax, 0xc57c614d
jge 0x12a3cca
sbb eax, 0x49d300f5
push edx
cld
out dx, eax
pop ds
mov edi, 0xd74eff43
cmp eax, 0xb442ec07
pop ebp
jnp 0x12a3ccc
pop es
stosb byte es:[edi], al
xchg esp, eax
inc edx
dec eax
inc eax
pop ebx
fisttp dword [eax + 0x69]
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
invalid
pop esp
sub ah, 0xcb
cmpsd dword [esi], dword es:[edi]
sahf
jge 0x12a3c8a
in al, dx
retf
xor al, 0x9e
fnsave dword [edx + 0x78]
scasb al, byte es:[edi]
xchg ebx, eax
mov al, byte [0xc7f488c]
mov dword [0x4a8f6e0c], eax
invalid
sbb cl, byte [ecx - 0x3b771d08]
mov eax, 0xde6ccafe
or eax, 0x4e8e44b8
std
cmc
stosb byte es:[edi], al
and dh, byte [ebp - 0x74828d01]
invalid
dec edx
ror edx, 1
call fcn.012a3131
mov eax, 0x2fa162ba
mov edx, dword [esi + eax*2 - 0x5f42c574]
sar eax, 0xc9
push eax
mov eax, dword [esi + eax*2 - 0x2fa15e]
mov ecx, dword [esp]
mov dword [esp + ecx*4 - 0x5f42c4], 0xb8258a1a
mov ecx, dword [esi + ecx - 0x17d0a9]
ja 0x1232706
Function at 0x133d5ce
Capabilities:
Get number of processors

Disassembly:
not cl
xor eax, ebx
sar dl, 0x85
lea eax, [eax + edx - 0x3c2f0faf]
setbe cl
not ecx
not eax
je 0x128e65c
xor edx, edx
dec ecx
xor eax, 0xae1f0d9d
rol ecx, 0x8b
sal edx, 0x37
setp dl
sbb eax, 0x9f14f4a9
bswap eax
add dx, cx
xor ebx, eax
ror cl, 0x42
xadd ecx, edx
adc edi, eax
mov eax, ecx
neg edx
not ecx
mov ecx, dword [edx + esi - 0x5ae817f2]
mov ax, word [esi + edx - 0x5ae817ee]
add dx, dx
neg dx
xor dx, 0x8c25
lea esi, [esi + edx - 0x5ae85c33]
and edx, edx
sal dl, 0xa6
sete dl
mov word [ecx + edx - 0x5ae85c00], ax
lea ecx, [edx + edx + 0xd90fc06]
cmovns dx, cx
movzx eax, dl
jmp edi
neg edx
xadd ax, cx
inc edx
not cl
xor ebx, edx
sal dword [esp + 4], cl
or eax, 0x7a92a01f
call fcn.01228d03
mov ecx, 0x19938b81
mov edx, ecx
mov eax, dword [ebp + ecx - 0x19938b81]
sal cx, cl
lea ecx, [ecx + edx*8 + 0x12bbea0e]
or cl, 0
lea ebp, [ebp + edx*4 - 0x664e2e00]
setl dl
jae 0x126ce06
ficom word [edx + 0x22]
out dx, eax
pop esp
and eax, 0x7f7cfbb3
and ebx, eax
jbe 0x133d670
cmp eax, ebp
and edx, esp
test ah, bl
fimul dword [ecx + 0x3a]
inc byte [edi + 0xb]
movsd dword es:[edi], dword [esi]
in al, dx
jb 0x133d67e
sub bl, ch
jno 0x133d68b
into
and al, 0xe6
cwde
test al, 0xa6
mov eax, 0x80081bb9
mov edx, dword [ebp]
movzx ecx, ax
lea ebp, [ecx + ebp - 0x1bb5]
push eax
not dword [esp + ecx*8 - 0xddc8]
xor edx, ebx
call fcn.0136f513
mov esp, 0x12ef1b2d
sub eax, 0xf721e981
mov esp, ecx
test byte [esi], dl
xor eax, 0xe9e9089e
outsd dx, dword [esi]
inc esi
add eax, 0x3c1c100

Function at 0x133eb7a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
neg ebp
push eax
call fcn.01398d83
mov ecx, dword [edx + esi - 0x7141e8e]
add eax, ecx
mov ecx, edx
add edx, edx
jns 0x13523c5

Function at 0x1349bf2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edi, 0x3f3754be
dec edi
inc ecx
dec ch
call fcn.0137c540

Function at 0x134a0a1
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
inc eax
movzx esi, ch
inc ecx
sub edi, 0x93330a2c
inc ecx
neg edi
mov ecx, eax
call fcn.012904d2
xor dl, bl
neg dl
mov dword [esp], eax
add eax, eax
jp 0x134ad93
add dl, 0xb0
dec al
setnp al
neg dl
dec dword [esp]
not dword [esp]
rol dl, 1
call fcn.0136731a
inc edi
lea edi, [edi + 0x50249a71]
inc edx
inc byte [esp - 0x21b5b903]
inc ecx
xor edi, 0x613e319d
inc ecx
movzx ebx, ah
jmp 0x12a3bce

Function at 0x134cd0a
Capabilities:
Encrypt data using speck

Disassembly:
sub ebp, 0xf706941c
neg ebp
dec esp
mov dword [esp + eax*2 - 0x7e73a37e], esp
dec eax
ror dword [esp + eax - 0x3f39d1bf], cl
lea ebp, [eax + ebp - 0x576943c3]
mov esi, dword [esp + eax - 0x3f39d1bb]
jae 0x17c18fd
xor ebp, 0x3f86b4bc
inc ecx
inc esp
je 0x1351854
dec esp
mov dword [esp + eax - 0x3f39d1bf], eax
xor dword [esp + eax - 0x3f39d1bf], ebp
inc ebp
mov ebp, esp
inc ecx
pop eax
dec eax
arpl bp, bp
inc ecx
movsx edi, di
dec eax
sal ecx, cl
dec esp
adc ebx, ebp
rol ax, 0xa2
inc ecx
jmp ebx
jae 0x1390a9d
popfd
rdtsc
nop
pushfd
push ebp
mov ebp, 0xbb9316a7
add ebp, ebp
push dword [esp + 4]
popfd
mov dword [esp + 4], 0x66aedf35
mov ebp, dword [esp]
lea esp, [esp + 4]
call fcn.0176c44c
Function at 0x134e2cb
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
not esp
xor dword [esp + edx - 0x5eb4fa77], edi
inc ebp
mov edi, ecx
mov ebp, 0xf88a3bb7
dec edx
mov dword [esp + ecx - 0x5a2ca911], eax
dec esi
mov eax, dword [esp + ecx - 0x5a2ca909]
inc edx
xor dword [esp + ecx - 0x5a2ca911], 0x2225e24
dec eax
arpl di, di
dec esp
adc ebx, edi
inc eax
movzx esi, ch
rdtsc
dec si
dec esi
lea edx, [esi + edx - 0xbe]
dec eax
lea edi, [esi*2 - 0x7b76ad5a]
ror ebx, 0x36
inc ecx
mov dword [edx + ebx*4 - 0xa9118ac], eax
dec ecx
lea ebp, [edi + ebx*2 - 0x40d87857]
call fcn.01761520
inc di
mov dword [esp + edx - 0x76172293], ebp
inc ecx
movzx ebp, bh
inc ecx
mov esi, dword [esi + ebp*2 - 0xe4]
dec edx
lea eax, [edi*2 + 0x293c588c]
mov edi, ebp
shr eax, 0xaf
dec edi
lea esi, [esi - 0x7617228f]
inc ecx
xor esi, eax
xor esi, 0xe6254531
sub ebp, 0xb98333af
call fcn.0127f593

Function at 0x134e95f
Capabilities:
Encrypt data using speck

Disassembly:
neg al
dec ebp
add ebx, edi
dec ecx
sar esp, 0x70
pop edi
dec ebx
mov eax, dword [esi + 8]
dec eax
lea edi, [ebx*8 + 0x79324ea0]
dec edi
lea esi, [esi + 9]
xchg ebx, ebp
movzx ecx, si
inc ecx
or esp, 0xdc82d4a4
dec ecx
xor eax, eax
dec eax
sal esi, 0x7a
inc esp
movzx edi, si
dec eax
lea eax, [ebx + eax + 0x73c616e]
inc eax
setne dh
dec eax
neg eax
dec eax
bswap eax
inc ecx
mov ebp, 0x4a3fab1a
inc esp
add ah, cl
dec eax
rol eax, 7
sal bl, cl
jb 0x178b061
dec esp
lea ebp, [ebx*8 - 0x767486e3]
dec eax
not eax
inc ecx
xor ecx, 0x84848b13
dec ecx
shl ecx, 0xca
dec eax
ror eax, 6
call fcn.0138156d

Function at 0x134e9ce
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], eax
call fcn.012607e3
dec edx
lea ebp, [ebp + ecx + 1]
call fcn.012984b6
shr edx, 0x1d
neg ecx
xor ebx, ecx
rol dx, 0x87
rol ax, 0xa1
neg dx
add edi, ecx
call fcn.0177230f
mov edx, 0xe38b2438
call fcn.01765be9

Function at 0x134eace
Capabilities:
Encrypt data using speck

Disassembly:
xor dword [esp + ecx - 0xc8], eax
call fcn.013499c3

Function at 0x1351743
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + ebp*4 - 0xd5800e0], esp
dec ebx
inc ecx
ror cl, 0x23
ror ebx, 2
jmp 0x139872d
lea ebx, [ebx + edi*2 + 0x5ef83d9c]
dec edx
neg dword [esp + ebp - 0x3560038]
push esi
dec esi
mov dword [esp + ebp - 0x3560030], eax
inc edx
xor dword [esp + ebp*2 - 0x6ac0068], ebx
inc edx
sal dword [esp - 0x3c34da18], 0x81
dec esi
mov eax, dword [esp + ebp - 0x3560030]
dec edx
mov dword [esp + ebp*2 - 0x6ac0068], ecx
call fcn.013681c6

Function at 0x13535ff
Capabilities:
Encrypt data using speck

Disassembly:
or cx, word [esp + ecx - 0x3191fa]
mov dword [esp + ecx*2 - 0x637ffe], 0xa195f481
xor ebx, eax
xchg dword [esp + ecx - 0x31bffc], edx
shr cx, 0x82
add edi, eax
call fcn.0123061c
test ax, si
Function at 0x136e5aa
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
mov dword [edx + edx - 0x8e], eax
dec ecx
lea ebx, [edi + ecx*2 + 0x480b5817]
not edx
inc ecx
sar bh, 0x27
inc edx
mov esi, dword [ecx + esi + 0x26401bc4]
inc ecx
movzx eax, ah
dec edi
lea esi, [esi + 0x1e4d0f70]
inc ecx
push esp
mov edi, 0x3f8906ab
inc ecx
xor esi, eax
jmp 0x125eca1
dec esi
mov dword [esp + edi - 0x74], edi
movzx eax, bx
xor ebp, 0x2d385109
inc esp
mov ebp, dword [esp + ecx - 0x1491b57f]
call fcn.01371d5c
inc ecx
mov edi, 0xc6b49a8e
inc ecx
mov eax, dword [edx]
inc ecx
mov cl, byte [edx + 4]
dec ecx
add edx, 2
inc ecx
movzx edx, bh
shr eax, cl
dec eax
lea ecx, [edx*4 - 0x26401dfc]
dec ebp
lea esp, [edi + ecx*8 + 0x63b8ffb7]
jmp 0x123724a

Function at 0x1372bab
Capabilities:
Encrypt data using speck

Disassembly:
push 0x212beb80
adc esi, 4
div ecx
dec byte [esp + 2]
sar byte [esp], 0x42
mov dword [esi], edx
jne 0x12375f9
xor al, 0x8e
neg edx
push edx
movsx ecx, dl
sub al, 0x2a
pop ecx
not al
call fcn.0122e721
jae 0x126253e

Function at 0x1374e10
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + ebp + 8], eax
dec esi
add dword [esp + ebp*2 + 8], eax
dec edx
lea ebp, [ecx*4 - 0x1bd36156]
dec esi
mov dword [esp + ebp*2], ecx
inc esi
xor dword [esp + ebp + 8], esp
dec esi
mov eax, dword [esp + ebp + 8]
dec ebp
arpl sp, sp
jmp 0x175917c

Function at 0x1379efe
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, edx
mov dword [esp + eax], eax
xchg dword [esp + eax], ecx
call fcn.012383cf

Function at 0x1379f0b
Capabilities:
Encrypt data using speck

Disassembly:
push ebx
movzx ebx, al
push ebp
mov ebp, esi
mov dword [esp + ebx*2 - 0x34], ebx
or byte [esp + ebx - 0x17], al
dec al
mov ebx, edx
call fcn.017825dd
cld
jecxz 0x125c3f0
push 0xfe95ce26
out dx, al
test byte [esi - 0x32], ch
xchg ebp, eax
invalid
inc edi
add ebx, dword [ebx]
jne 0x125c41b
mov cl, 0xda
clc
lea ebx, [ebp + 0x2f35659c]
mov bl, bl
cmc
jg 0x125c3ef
inc ebp
pushal
mov al, byte [0xdc4958b9]
xchg ecx, eax
xor cl, dl
clc
or ah, byte [edi - 0x36]
or eax, 0xf8723516
rcr byte [esi - 5], 1
sti
lodsd eax, dword [esi]
sub eax, 0x8d3e1581
add eax, 0xb59d9f36
xchg ebx, eax
in eax, 0xb0
push ebx
mov cl, 0x51
mov cs, word [ebx]
push esi
xchg ebx, eax
jmp 0xa6cd5994
movzx ebp, al
mov dword [esp + ebp*2 - 0x34], edi
jb 0x125c3b4
aam 0x42
cmp bl, al
pop edx
or ah, byte [edi + 0x24f77ee]
std
jno 0x1379f77
sbb eax, 0x33d9f7ab
fld1
outsb dx, byte [esi]
inc ebx
std
dec dword [ecx + ecx*4 + 0x4c]
or al, 0xeb
dec ebp
lea edx, [edx + edx - 0x6406fc13]
inc esp
mov esp, dword [esp + edx - 0x6406fc13]
dec eax
xor dword [esp + edx - 0x6406fc17], 0xfebf87ab
not dl
inc ebp
movzx esp, word [esi + esi - 2]
mov dword [esp + edx - 0x6406fcdc], 0x1b137b00
call fcn.0177187f
cmpsd dword [esi], dword es:[edi]
ljmp 0x442c
dec esp
mov dword [esp + ebp], eax
inc esp

Function at 0x1379f28
Capabilities:
Encrypt data using speck

Disassembly:
neg ecx
xor ebx, ecx
call 0x134e29f
Function at 0x1379f7a
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
mov eax, dword [edx + ebp + 2]
inc cx
neg ecx
inc ecx
add cl, byte [edx + ebp + 0xa]
dec eax
shr eax, cl
jmp 0x17abae7
mov edi, esi
inc esp
mov eax, edx
inc ecx
pop eax
inc ecx
xadd esp, edi
sub si, ax
dec ebp
arpl di, di
movsx ebx, si
dec eax
sbb edi, 0xe0883a33
dec ebp
add ebx, edi
jmp 0x125ffc9
dec esp
mov dword [esp + ebp], eax
inc esp
xor dword [esp + ebp], edi
jmp 0x128debb
call fcn.0123f8cd
call fcn.0127f238

Function at 0x137ce97
Capabilities:
Encrypt data using speck

Disassembly:
mov edi, dword [esp + edi + 0x7f62d9ee]
mov dword [esp + 0xc], 0xe6acfc37
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.0176c44c

Function at 0x13825a3
Capabilities:
Encode data using xor

Disassembly:
dec eax
dec esi
dec edx
ror dword [esp + ebp*4 - 0x264], cl
dec ebp
arpl cx, cx
dec edx
sar dword [esp + ebp - 0x91], 0x78
inc ebp
sbb ebp, esi
dec ebp
add ebx, ecx
inc edx
dec dword [esp + ebp*8 - 0x4e8]
call fcn.0122df53
inc ecx
mov ecx, 0xdba88834
inc ecx
push ecx
inc ebp
xor esp, eax
call fcn.017b79b3
inc ecx
xor ecx, 0xe317700f
inc ecx
or eax, esp
inc ecx
dec ecx
inc ecx
shl bh, 0xe5
inc ecx
ror ecx, 1
inc ecx
bswap ecx
pop ebx
dec edx
mov dword [esp + ebp*2 - 0x132], ecx
dec esi
mov dword [esp + ebp*4 - 0x25c], eax
dec edx
ror dword [esp + ebp*2 - 0x12d], 0xe0
jb 0x176c61e
inc esi
xor dword [esp + ebp - 0x85], ecx
inc edx
ror dword [esp + ebp*2 - 0x127], cl
dec eax
shl edx, 0xb7
dec edx
mov dword [esp + ebp*8 - 0x4e8], 0x2ca77632
dec esi
mov eax, dword [esp + ebp*8 - 0x4d0]
jns 0x127892e

Function at 0x1385f67
Capabilities:
Encrypt data using speck

Disassembly:
pop esi
pop edx
inc ecx
pop ecx
pop ebx
pop ebp
jns fcn.0123d4f8

Function at 0x1385f73
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp + ecx - 0x1ca4d03f]
call 0x1363ffe
mov ebx, 0x4d3932bb
dec eax
mov dword [esp + ebx - 0x4d3932bb], 0x21993293
inc bp
mov ecx, dword [edx + ebx - 0x4d3932b9]
inc edx
mov cl, byte [ebx + edx - 0x4d3932b7]
inc esp
movzx esp, byte [esp + ebx - 0x4d3932b8]
dec edi
lea edx, [esp + edx - 0x1d]
inc ebp
movsx edi, sp
dec eax
not dword [esp + ebx - 0x4d3932bb]
call fcn.012782e1
mov ecx, 0x1ca4d03f
jmp 0x1780e15
jmp 0x122e745
Function at 0x13863d6
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
ror ebx, 6
dec eax
lea ebx, [ebx + ebp + 0x1084a680]
bswap esi
or ecx, 0xf4259c12
dec eax
not ebx
not dx
dec eax
dec ebx
dec eax
xor ebx, 0x5939bd17
inc eax
xadd bh, dh
inc esp
xadd ecx, esp
shr edx, cl
dec esp
xor eax, ebx
dec esp
lea edi, [ebp*4 + 0x488492a]
jmp 0x129bd66
dec eax
arpl cx, cx
dec edx
mov dword [esp + ebp + 0x4ab2de7a], eax
dec edi
lea esp, [ebp + ebp*4 - 0xfe1a446]
pop edx
dec esp
add ebx, ecx
inc ecx
dec edx
mov dword [ebp + edx - 0x101e], ebx
sal ecx, 0x31
dec ecx
mov edi, dword [esi + ebp*2 - 0x2020]
dec ebp
lea esi, [esi + ebp - 0x1002]
and si, word [esp + ebp - 0x1012]
inc cx
shl edi, 0xc
dec ecx
xor edi, eax
inc ecx
ror bh, 1
dec eax
lea edi, [edi + ebp + 0x73c5798]
dec eax
neg edi
dec eax
bswap edi
movzx eax, bp
dec eax
rol edi, 7
inc ecx
dec esp
jle 0x1362413
dec esp
lea ebx, [0x4e90a7]
inc ebp
xor edi, eax
inc ecx
dec edi
dec eax
mov dword [esp + ebp*8 - 0x4058], ebp
inc ecx
neg edi
movsx edi, bp
dec eax
lea ebx, [ebp*2 - 0x73595cfc]
mov edx, ebx
inc ecx
dec edi
inc ecx
ror edi, 1
sub bl, dl
dec esp
mov dword [esp + ebp - 0x80b], eax
adc ebp, edi
inc esp
movzx ecx, bx
movsx esi, bl
inc esp
xor dword [esp + ebp - 0x1016], edi
inc ecx
pop eax
dec eax
lea edx, [ebp*2 + 0x313c0f25]
inc ecx
xor ebx, ecx
inc ecx
inc ecx
dec ebp
arpl di, di
sub di, bp
dec eax
sbb edi, edx
dec ebp
add ebx, edi
jmp 0x17c6d30
dec edx
mov ebx, dword [ebp + esi - 0x1012]
dec eax
lea esi, [ebp + edi + 0x27bc243e]
inc esp
movzx ebp, di
dec ecx
xor ebx, eax
push esi
dec eax
lea ebx, [ebx + ebp*2 + 0x73c4782]
inc ecx
mov esp, 0xf33d159a
inc esp
movsx edi, di
dec eax
neg ebx
inc bp
sub ebp, ebp
dec eax
bswap ebx
inc ecx
shr ebp, 0x63
inc eax
movsx ecx, ch
dec eax
rol ebx, 7
inc esp
xadd byte [esp + ebp*2 - 0x202c], cl
jne 0x17ca64d
dec eax
not ebx
inc ecx
adc ebp, 0xd4141788
jl 0x1243808
dec esp
mov eax, dword [esp + eax*2 - 0x1313f544]
dec ecx
lea edx, [ebp + eax*8 - 0x4a7dadd6]
pop eax
jno 0x125bcf9

Function at 0x138cde4
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
not dword [esp + 4]
push 0xdc911c16
lea esp, [esp + 0xc]
jne 0x17bcecd
mov edx, 0x8f0cb924
mov edi, edx
bswap edi
pop edi
mov edi, dword [edi*4 + 0x133d6d0]
shr eax, 8
xor eax, edi
inc edx
mov dword [esp + 4], 0x8c9be533
sar word [esp + 6], 0xe3
xor eax, 0xf1ed79a
jmp 0x129a742
jmp 0x136322f
Function at 0x139519d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xfb71a511
jno 0x1395129
inc ebx
pushal
invalid
mov cr6, esi
sub eax, 0x9acd8b69
bound ebp, qword [ecx + ebp*4 - 0x64]
and edi, dword [ebp + 0x4460fb05]
fbld tbyte [ecx - 0x676cfa3f]
inc ebp
inc esi
cmc
cmp eax, 0xfdc12d7a
loopne 0x139512c
adc al, dl
mov esi, 0x89586529
add eax, 0xd96045e9
mov byte [0xbdf41b05], al
aam 0x25
or bh, byte [edx - 0x53]
push ecx
insb byte es:[edi], dx
daa
pop ebp
cli
jmp fcn.01395191
dec esp
mov dword [esp], edx
push 0x7d137683
call fcn.0124f7e4
ror al, 1
inc edx
sal byte [esp + edi*2 - 0x3f50d670], 0xa7
inc esp
xor al, al
dec esp
lea esp, [ebp + ebp*8 + 0x1b43496]
dec eax
lea eax, [esp + eax + 0x10]
jmp 0x13951aa
call eax
enter 0xffffffffffffc042, 0xffffffffffffffb4
jl 0x1395142
sub dword [edi + 0x3244a7c0], ebp
ror byte [ebp + ecx*4 - 0x5c], 0xed
xchg esi, eax
xor al, 0xb4
add dword [eax - 0x73], ecx
inc esp
add al, 0x10
inc ecx
movzx edi, ah
inc edx
dec dword [esp + edi*2 - 0x3f50d671]
dec ebp
xadd esp, edi
mov edi, dword [edi + eax - 0x1b]
inc ecx
movsx edx, ah
inc esp
movsx ebp, dx
inc edx
mov dword [edx + edx - 0x56], edi
dec esp
mov dword [esp + edx - 0x4c], ebp
dec ebp
lea edx, [edx + edx*2 - 0xaa]
inc ecx
mov eax, dword [esi + edx*8 - 0x29f]
jae 0x12327ed
dec ebp
add ebx, ecx
call fcn.0126e11f
cmp dh, byte [edx + 0x3d]
push 0xfe895fe0
and edx, esp
pop edi
mov esi, edi
adc eax, dword [esi - 0x70]
pop edi
mov esi, edi
push esp
jp 0x13951a9
pop edi
mov esi, edi
xor al, 0x7e
inc ecx
lock xchg byte [ecx], al
mov al, byte [0xff0845ab]
and bl, bh
sub esi, dword [edi]
or ebx, dword [ecx + 0x30c137e3]
xor dword [ebx + 3], ecx
ficom word [edx + 0x6f3d2e91]
bound esi, qword [ebp + 0x2e260cfd]
cmc
jno 0x139522e
jmp dword [eax]
pushal
cmp eax, 0x4bc710e5
iretd

Function at 0x1398795
Capabilities:
Encrypt data using speck

Disassembly:
sbb esi, 0xc
mov dword [esi + 0xc], eax
jmp 0x17996c2
mov dword [esi], edx
mov eax, 0x1b084887
shl ax, 0x6c
mov ebx, dword [esp + eax*4 - 0x6c21bffc]
pop ecx
pop edx
ja fcn.0128ae71
add dl, 0x38
dec eax
not ebp
inc eax
movzx eax, dh
neg dl
rol dl, cl
dec eax
mov dword [esp + ecx - 0x61], ebp
dec eax
sar eax, cl
dec eax
neg ebp
dec dl
shr cx, cl
call fcn.0133df59
inc esp
movzx ecx, bh
dec ecx
not edi
dec eax
lea ebx, [edi + ecx*2 - 0x15545961]
dec ecx
dec edi
shl edx, cl
dec eax
neg ebp
dec ecx
xor edi, 0x5939bd17
dec esp
lea esp, [edi + 0x6ca252a6]
dec ebp
xor eax, edi
dec esi
mov dword [ecx + edx - 0x14], edi
call fcn.0124ca02
neg eax
dec eax
or edx, 0xb338b8a7
not eax
push edx
sbb dl, byte [esp + ecx - 0x4aecdabd]
and cl, 0x27
inc eax
bswap eax
xor ebx, eax
sar dword [esp + ecx - 0x4aecda22], 0x90
adc edi, eax
mov eax, dword [ecx + esi - 0x4aecda26]
shr ecx, 0xf0
xor word [esp + ecx - 0x4ae9], dx
mov dword [esp + ecx*2 - 0x95d4], ebx
cpuid
jne 0x1222a37
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
jmp 0x1252453
Function at 0x17438c5
Capabilities:
Encode data using xor

Disassembly:
sal al, 0xe7
dec ebp
lea edx, [edx + ebx*8 - 0x57e]
inc eax
shr ch, cl
dec eax
bswap ebx
dec esp
lea esp, [ebx + eax*4 + 0x140c209d]
inc cx
mov dword [edx + eax - 0x3a997700], ebp
inc ecx
add ebx, dword [esi + eax*2 - 0x7532ee00]
dec ebp
lea esi, [esi + eax*2 - 0x7532edfc]
jmp 0x1376767
jmp 0x126f454
and edi, 0xff
call fcn.0138cde4
mov ecx, 0xfc9ded32
movzx edi, cl
inc ecx
mov edx, dword [esi + edi*8 - 0x190]
dec ebp
lea esi, [esi + edi*2 - 0x60]
dec eax
lea esi, [ecx + ecx*4 - 0x61dde8f2]
inc ecx
xor edx, eax
inc ecx
mov edi, 0x9838ec34
dec eax
xor esi, edi
or si, 0x8bab
inc edx
movsx eax, cl
neg edx
sub edx, 0xa28ddabd
or cx, ax
inc esp
movsx ebp, cl
movsx ebp, cl
neg edx
inc esp
movsx esp, cl
dec edx
push ecx
not edx
dec eax
mov dword [esp + edi*2 - 0x64], 0x2aea8
dec esp
mov dword [esp + edi - 0x32], eax
xor dword [esp + edi*8 - 0x190], edx
dec edx
lea ebx, [0x118c2725]
inc ebp
movzx eax, ch
inc ecx
pop eax
dec eax
dec ebx
dec esp
lea ebp, [edi*4 + 0x62132597]
inc eax
sets dh
dec eax
arpl dx, dx
jg 0x175e920
aaa
jge 0x1375d3d
push 0xfe8750ed
daa
inc edi
lodsd eax, dword [esi]
push eax
xchg esi, edi
or ecx, ebp
push eax
xchg esi, edi
sub eax, 0x8750fd00
invalid
jmp 0x2f35e46c
jbe 0x1375d4b
cmp bl, byte [edx + 0x6f0c7bbc]
and ebp, dword [edi + esi]
cld
xor ch, byte [edx - 0x12c0736c]
sbb bl, cl
xchg edi, eax
test bh, ch
loopne 0x1375d49
xchg esp, eax
invalid
mov edx, 0xf3d96ab4
jecxz 0x1375d17
adc dword [edx - 0x4d8480d4], ebx
xchg edx, eax
cmp eax, 0xb27b7f1c
ljmp 0x31b2
mov edi, 0x31032908
inc ecx
xor ebx, eax
call fcn.01340cde
jmp 0x1375c71
call fcn.013766fa
inc cx
movzx ebp, byte [edx]
mov eax, 0x3a9977b0
movsx ecx, al
movzx ebx, cl
inc ecx
mov cl, byte [edx + eax*2 - 0x7532ef5e]
jmp 0x1295505
Function at 0x1744095
Capabilities:
Encrypt data using speck

Disassembly:
pop ecx
dec esp
xchg ebp, ecx
inc ecx
pop eax
ror ecx, 0x70
inc ecx
dec ch
dec ebp
arpl sp, sp
inc ecx
not ebp
dec ebp
lea ecx, [ebp + ebx - 0x7c7367b]
dec ebp
add ebx, esp
neg di
inc ecx
sub ch, 0x11
js 0x178bae9
inc bx
mov edi, dword [edx + edi*8 - 0x7f842]
inc bx
adc ecx, dword [edx + edi - 0xff01]
not di
dec eax
lea ebp, [esi + esi*2 - 0x4fa6655]
not cx
xchg esi, edx
or di, cx
dec ecx
add ebp, 0x9f36c203
inc bx
mov dword [ebp + edx - 0x2f6a8300], edi
inc eax
ror dh, 0x42
ja 0x133fd71
dec edi
lea edx, [ebp + edx - 0x2f6a8300]
movzx ecx, dl
jae 0x175cf2c
mov ecx, dword [ebp]
mov eax, 0xd928b3ad
call fcn.0122c54b
inc ecx
xor bl, al
dec eax
mov dword [esp + eax - 0x19f0], ecx
call fcn.0129e9b6
inc ecx
ror esp, 1
inc ecx
push edi
dec edx
mov dword [esp + edi*2 - 0x1fe0a], 0xb9265c2d
inc edx
xadd dword [esp + ebp - 0x6fcc3ee8], ebp
inc edi
lea esp, [esp + ebp + 0x18b76b9a]
not edi
dec esp
mov dword [esp + ebp + 8], eax
not dx
jp 0x179239d
inc esp
xor ch, cl
inc ecx
jmp ebx
inc ebp
xor ecx, eax
dec eax
sal dword [esp + eax - 0x1a00], 2
push ecx
inc ecx
xor ecx, 0xf3a54f3a
dec eax
shl dword [esp + eax*8 - 0xcfff], 0xca
inc ecx
inc ecx
inc ecx
not ecx
dec eax
xor dword [esp + eax - 0x19f8], ecx
xor word [esp + eax - 0x19fb], 0xcb8c
mov edi, eax
inc ecx
rol ecx, 1
inc esp
movzx ebp, byte [esp + eax*4 - 0x67f4]
dec esp
mov dword [esp + eax*8 - 0xcff8], eax
inc esp
xor dword [esp + ecx - 0xffa1], ecx
inc eax
sar bh, 0xe5
dec esp
mov eax, dword [esp + eax - 0x19f8]
dec ebp
arpl cx, cx
dec ebp
adc ebx, ecx
inc ecx
push ebp
inc ecx
movzx ebx, byte [esi + eax*4 - 0x6800]
dec eax
shl dword [esp + eax - 0x1a00], cl
dec ebp
lea esi, [esi + eax - 0x19ff]
movzx esi, al
or si, 0x9d25
jl 0x13832ae
inc ecx
movsx ecx, di
inc esp
xor dword [esp + ebp + 8], esp
jmp 0x129777f

Function at 0x17447b8
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + edx - 0x56b13a29], edx
lea esi, [esi + edx - 0x56b13a27]
shr al, cl
or dl, byte [esp + edx - 0x56b13a27]
movsx ecx, dl
mov word [esi + edx - 0x56b13ab9], ax
rol dword [esp + edx - 0x56b13ab9], 0x85
sets byte [esp + edx - 0x56b13ab8]
mov eax, dword [ebp + edx - 0x56b13ab9]
jae 0x13488f3
cmc
Function at 0x17505fb
Capabilities:
Encrypt data using speck

Disassembly:
ror word [esp + ebx - 0x76], cl
dec eax
or ebx, 0x1894832b
inc ecx
mov dword [edx + ebx*2 - 0x31290762], eax
mov dword [esp + ebx - 0x189483a3], 0x17a6ddb6
inc ecx
sar edi, cl
inc esp
sbb byte [esp + ebx - 0x189483a3], ah
dec ebp
lea edx, [edx + ebx*4 - 0x62520ec0]
inc ecx
mov edx, esp
call fcn.01794997
xor dword [esp + ebx*2 - 0x108], edx
inc ecx
push ecx
inc eax
xor bh, byte [esp + ebx*2 - 0x102]
inc esp
movzx edi, bh
dec esp
mov eax, dword [esp + ebx*2 - 0x100]
dec eax
arpl dx, dx
dec esp
mov dword [esp + ebx - 0x7c], ecx
inc eax
setle bh
dec esp
adc ebx, edx
shl dword [esp + ebx - 0x83], 0x13
sub si, 0x7a0d
dec ebx
xor edi, dword [edx + ecx*4 + 0x38bf4f14]
dec eax
mov dword [esp + ebx*2 - 0x100], eax
inc cx
add ebp, 0xf749ec9d
fnstenv [esi]
add eax, dword [edi + ebx*8 - 0x420]
jmp 0x124ff7e
ror edx, 2
inc ecx
push eax
movsx esi, bp
jmp 0x125769b
inc ecx
mov edx, dword [esi + edx*2 - 0x5e76eb08]
dec ebp
lea esi, [esi + ebx*2 - 0x104]
dec eax
mov dword [esp + eax - 0x2f3b7584], ebx
pop ebx
inc ecx
xor edx, eax
dec esp
lea ecx, [eax - 0x3d6b494b]
jmp 0x17935e9
mov ecx, eax
not edx
lea edx, [edx + ebx*2 + 0x3c9fb0b2]
inc ebp
movzx ebp, cx
mov edi, ebx
bswap edx
movzx ebp, di
inc ebp
movzx esp, cl
inc edx
dec eax
bswap eax
jmp 0x126684e

Function at 0x17542aa
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0xc]
je 0x1225229
push 0x93b9400c
mov dword [esp], esi