joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe82cbb
Capabilities:
Encrypt data using speck

Disassembly:
add dl, 0x22
xor bl, dl
lea eax, [ecx + 0x110d35a2]
neg cl
mov dword [esp + ecx - 0x105e], 0xd9bb5fb2
lea edx, [esp + edx + 8]
movzx ax, byte [edx + ecx*2 - 0x20bc]
jbe 0xeedfcb
dec ecx
lea esi, [ecx + esi - 0x105f]
mov word [esi + ecx*4 - 0x4174], ax
movzx eax, cx
shl byte [esp + ecx*8 - 0x82e8], 0xe6
not dword [esp + ecx*2 - 0x20b7]
pop ecx
pop edx
jae fcn.01713832
call [esi]
mov ch, byte [eax - 0x1beeb00e]
mov ebp, 0x37c0b09e
popfd
Function at 0xe88d70
Capabilities:
Encrypt data using speck

Disassembly:
or word [esp + 5], cx
not eax
movsx edx, cl
neg eax
xor byte [esp + 0xb], cl
jp 0xfd8770
xor dl, 0x9e
ror dl, 1
neg dl
mov eax, 0xa357439
ror al, 0xe2
not dl
xchg dword [esp + 0x10], eax
adc eax, 0xcf9ad
jmp eax
call fcn.01811fe4

Function at 0xe8bcc7
Capabilities:
Encode data using xor

Disassembly:
inc esi
sub byte [esp + eax*4 + 8], al
dec edx
mov dword [esp + eax + 0x20], edi
rol cx, 0xc9
inc ebp
and ebx, ebx
or ax, 0xb23f
inc esi
xor dword [esp + eax + 0x20], esp
dec edx
mov dword [esp + eax], 0x3809911b
dec ebx
lea edx, [edi + edi*2 + 0x2301bcad]
dec edx
mov edi, dword [esp + eax*2 + 0x20]
dec ebp
arpl sp, sp
inc edx
sal dword [esp + eax*4 + 7], 0x5a
inc ebp
xadd edx, edi
dec edx
xor dword [esp + eax*2 + 3], eax
dec ecx
adc esi, esp
inc edx
shl byte [esp + eax*8 + 0x1c], 0xa5
movsd dword es:[edi], dword [esi]
inc ecx
push ebx
dec ecx
xor ebp, edi
inc ebx
movzx edx, word [eax + ebp - 8]
call fcn.01676c62
sbb esp, dword [edx]
inc esi
test edx, ecx
jbe 0xe8bd10
mov bl, cl
jae 0xe8bd95
jp 0xe8bd16
mov bl, cl
jg 0xe8bd7f
push ds
out 0x88, al
retf
cmp dword [ecx + 0x1dc9ee13], ebp
in eax, dx
inc edx
clc
inc eax
cmp dword [ebx - 0x1130cb7], ecx
push ebx
xchg ebx, eax
inc eax
invalid
bound edx, qword ds:[eax + 0x7d306b86]
sbb ebx, dword [ebp + 0x52]
pop ebp
push edx
sub dword [ecx + 0x4a9c8bbc], edi
mov edi, 0x3cc1e98a
jno 0xe8bdc2
jne 0xe8bdef
cmpsb byte [esi], byte es:[edi]
lds eax, [ebx + 0xdabe98]
push ebx
je 0xe8be26
invalid
test eax, 0x93b956c2
xchg edi, eax
dec esp
lahf
sub edi, ebp
adc byte [esi], bh
or ecx, dword [edi - 0x7c7c9476]
jg 0xe8bdd7
popfd
out dx, eax
push 0x22
xchg ebp, eax
push ecx
push 0x77
dec ebx
xlatb
jo 0xe8bd9d
int 0x9b
or bh, byte [esi + 0x33]
mov dl, 0x19
inc ebx
pop esp
ja 0xe8be66
out dx, eax
fstp qword [esi]
xor byte [eax - 0x3c], ch
dec esi
sub eax, 0x47dbd6b6
cmp bl, byte [eax + eax*8 - 0x1c716d92]
outsb dx, byte [esi]
xchg edx, eax
mov fs, ebx
xlatb
lodsb al, byte [esi]
inc edi
xchg ebp, eax
pop esi
cli
jae 0xe8bdfe
inc edi
cdq
pop esi
push 0xffffffffffffffae
adc dword [esp + ebx*2 - 0x433e41d3], ebp
rcr ebp, 0xbd
mov dword [edi + 0x7d], ebx
cmc
aam 0x69
aaa
ret
sbb byte [ebx], al
outsd dx, dword [esi]
and dword [eax - 0x6a6f1e20], 0x44
and dword [edi - 0x43], eax
stosd dword es:[edi], eax
jge 0xe8bde3
add al, 0xde
movsd dword es:[edi], dword [esi]
push ds
mov dl, bl
pop eax
test al, 0xfe
and ebx, esi
jb 0xe8bdf1
and ebp, ecx
sbb al, 0x76
inc esi
inc ebx
enter 0x4d8d, 0xffffffffffffffea
xor byte [ecx + 0x73938efb], dl
sbb ebp, dword [ebx + 0x1f]
dec ebp
jmp 0xe8be90
imul ebx, dword [edi], 0x4d
imul eax, dword [eax + 0x1b], 0x2e
push edi
rol ecx, 1
dec esp
and al, 0x12
fimul dword [ecx - 0x297cf7b2]
or byte [ecx - 0x71c45163], bh
lea eax, [ecx + ecx*2 - 0x29cbeb5e]
sub word [esp], ax
pop edx
pop ecx
pop edx
pop eax
pop ecx
pop ecx
add ecx, ebp
jmp ecx
Function at 0xe8ffb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + edx], 0x4da2b0ab
and edx, 0x37a1063d
neg eax
sub ecx, dword [esp + edx]
sub eax, 0x8dba4107
bswap eax
xor word [esp + edx*2 + 2], 0xc16
jno 0x173a9b3
rol ecx, 1
xor ecx, 0x4e22232a
or dl, 0x2e
bswap ecx
push edx
neg ecx
xor ebx, ecx
add ebp, ecx
xor dword [esp], 0x6d2f828f
and dl, al
shr word [esp + 1], 0xa
movzx eax, byte [edi - 5]
mov ecx, 0xac8ef38f
adc edi, 0xfffffffb
xor al, bl
sub ecx, edx
call fcn.01732a8c
rol eax, 3
call fcn.00ea684f

Function at 0xea684f
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
sub ecx, ecx
xor ebx, eax
add ebp, eax
neg ecx
dec edx
movzx edx, byte [edi + ecx*2 - 5]
xor dl, bl
not dl
xor cl, 0xc

Function at 0xeac1a3
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [edi + 0xc], eax
call fcn.017060b6
dec ecx
call fcn.00f88500
neg dl
add dl, 0x25
mov eax, dword [esp]
ror dl, 1
sub dl, 0xb3
rol ax, 0x89
shr ax, 0xf
rol dl, 1
sub dl, 0x93
and dword [esp + eax*2], eax
sbb ax, 0xa21
mov dword [esp + eax*2 - 0x1ebbe], 0xa93184ae
neg dl
pop eax
sub al, 0x33
sbb dl, 0xa1
push eax
sub al, al
je 0x16fc979
mov edx, 0x2609dfae
call fcn.01684dd1
ror al, 1
ror dl, 0x42
xadd edx, ecx
sal ecx, cl
adc al, 0xa4
call fcn.00ff457d
mov edx, 0x792a543d
mov eax, dword [edi + edx - 0x792a543d]
add dl, dl
xchg dh, dl
push ebx
cpuid
sbb edi, 0xc
call fcn.01773592
shl edx, 0x73
jp 0x1767637

Function at 0xeae8a4
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
movzx esp, dl
inc ecx
xor eax, 0xdb09050d
dec eax
lea eax, [esp + eax + 0x28]
inc ecx
or al, 4
inc esi
mov dword [eax + edi*2 - 0x18a609c6], ecx
inc ecx
pop esp
sbb bl, dl
inc edi
mov eax, dword [ebp + edi*4 - 0x314c1392]
inc ecx
ror bh, 3
inc esp
xor eax, edi
pop ebp
inc ecx
push edx
dec edi
lea ecx, [ebx + edx - 0xc67945]
inc ecx
neg eax
dec esi
mov dword [esp + edi*2 - 0x18a608f0], ecx
inc ecx
xor eax, 0x2a29383b
dec esp
lea esp, [ebx + edx*4 + 0x560c690d]
dec ecx
ror edx, 0xcb
dec edx
and dword [esp + edi*2 - 0x18a608f3], 0x55b44909
inc ecx
rol eax, 2
inc ecx
neg eax
dec edx
mov dword [esp + edi*2 - 0x18a608e0], edi
mov eax, 0x780a4820
inc cx
sar edi, 0xaf
inc ebp
sbb ah, cl
inc esi
xor dword [esp + edi*2 - 0x18a5ffe8], eax
dec edx
sar dword [esp + edi - 0xc52fff0], 0x81
jae 0x1031d26
sub esi, 4
call fcn.010a360b
mov edx, 0xf0be187
call fcn.0179c0ab
inc ecx
inc esp
dec ebp
arpl ax, ax
inc cx
ror ebx, 0x69
dec ecx
adc esi, eax
call fcn.01669946
dec edx
mov edi, dword [esp + edi - 0xc52ffe8]
dec esi
sub dword [esp + edi - 0xc52fff0], ecx
jbe 0xfdb048

Function at 0xeaf9bd
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
shr ecx, 8
xor ecx, ebx
inc edx
xor ecx, 0xdd00fa8d
dec eax
jmp 0xf1c988
jmp 0x1795da1
rol edx, 1
sub edx, 0xb431ef3e
mov ecx, 0xdd3d72aa
movsx eax, cx
ror edx, 2
not al
call fcn.016f5146
mov ebx, 0x1d280ea7
movzx ebx, byte [ebx + edx - 0x1d280ea7]
call fcn.0175111d
lea esp, [esp + 0x10]
jne 0x178ab3e
mov ebx, 0xa4333c85
pop ebx
mov edx, 0xa9a27801
movsx eax, dx
call fcn.00eee3b0
xor edx, ebx
jmp 0x17556cf
Function at 0xeb212b
Capabilities:
Encrypt data using speck

Disassembly:
movzx cx, byte [eax + ecx - 0x41baa68e]
call fcn.00f9b84a
inc ecx
mov ecx, 0x4fbd8b05
inc ecx
push ecx
dec ebx
mov edx, dword [esi + ecx - 0x4fbd8b05]
call fcn.01679045
add esi, eax
shl ecx, cl
jae 0x17d9685
mov eax, dword [edi]
movsx edx, cx
mov edx, dword [edi + 4]
xor cx, cx
ror cl, 1
or cl, cl
adc eax, edx
mov edx, eax
xor cx, word [edx]
mov word [edi + 6], cx
mov edx, 0xa53629a1
mov ecx, 0x5f9b971a
movzx eax, cx
lea edi, [edi + eax - 0x9714]
call fcn.00f1cfac
Function at 0xeb49e7
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
inc edi
lea ecx, [ecx + 0x5f93f95c]
inc edx
xor dword [esp - 0x4e7f165a], 0x68362632
dec eax
mov dword [esp + ebx - 0x1b3d771d], 0x3130699e
inc ecx
xor ecx, 0xe1245d91
inc esp
movzx edi, byte [esp + ebx*4 - 0x6cf5dc67]
inc ecx
ror ecx, 2
inc cx
sal ebx, 0x6d
inc eax
movzx ecx, ch
inc ecx
bswap ecx
dec edx
mov dword [esp - 0x4e7f165c], edi
inc ecx
movzx eax, dl
jne 0xd0f7e5
dec eax
mov dword [esp + edx - 1], 0x712e9c3b
inc edi
movzx ebx, word [ebp + ebx - 0x662c0008]
dec ebp
lea ebp, [ebp + edx*2 - 9]
inc sp
xor ebx, edi
inc ecx
mov eax, esp
dec eax
shl edx, cl
pop ebx
inc cx
adc ebx, 0x8d4da80a
mov esp, 0x37feba18
jns 0xeb4ad0
inc ecx
rol ebx, 1
inc ecx
movsx ebp, ah
inc cx
dec ebx
dec word [esp + edx - 0xfffa]
shl dword [esp + edx - 0xfff4], 0xc7
rol byte [esp + edx - 0xfff8], 0x26
inc cx
rol ebx, 1
inc cx
xor edi, ebx
dec eax
sar ebp, 0xfd
jae 0xedff4e
shl ebx, cl
inc edx
neg byte [esp + ebx + 0x6e35cfc4]
inc ecx
inc edx
inc cx
and ebx, ebx
inc ecx
not edx
dec ebp
xadd ecx, ebx
inc esp
add al, bl
inc cx
shr ebx, cl
inc ecx
ror edx, 1
pop eax
inc cx
neg edi
dec esp
lea esp, [eax + ecx*4 - 0x3f70417b]
inc ecx
inc edx
dec eax
mov dword [esp], edi
inc cx
rol eax, 0xcd
jae 0x189531e
ret 0x8948
dec esi
lea ebx, [esp + ebx + 0x10]
inc edx
mov ebx, dword [edx + ebx - 0x10000]
dec esp
xadd dword [esp + edx*8 - 0x7fff8], eax
inc esp
mov esp, ebx
inc esp
xchg byte [esp + edx - 0xfff7], dl
sar dword [esp + edx*2 - 0x1fffa], cl
dec esp
lea ecx, [esp + edx*4 - 0x3ff20]
jne 0x1888d39
inc esp
xor dword [esp], edx
dec eax
sal eax, 0xa5
pop edi
inc sp
xadd ecx, ecx
movzx edx, al
inc ecx
inc ah
dec ebp
arpl dx, dx
sar edx, cl
dec ecx
sub ebx, edi
movsx ebp, al
dec ecx
adc esi, edx
inc ebp
movzx edx, bl
inc sp
add esp, eax
dec ebp
adc eax, edi
inc ebp
mov dl, byte [ebp + ebx*2 - 0x38ed7849]
dec ebp
lea ebp, [ebp + edx*4 - 7]
inc ecx
inc cl
inc esp
xor dl, bh
call fcn.00ec2170
mov eax, 0x34b855b9
mov edx, dword [eax + edi - 0x34b855b9]
movzx ecx, ax
inc ecx
neg al
movzx cx, byte ss:[edx + eax*2 - 0x6970aa8e]
sbb ax, ax
not eax
rol ax, 0xc2
adc edi, 2
mov word [edi], cx
mov eax, dword [esi]
mov ecx, 0x6b8afba4
movsx edx, cx
lea esi, [ecx + esi - 0x6b8afba0]
neg cl
inc edx
xor eax, ebx
sal edx, 0xfc
ja 0x17762ad
inc ecx
movsx edx, ax
inc ecx
movzx ecx, sp
inc bx
mov dword [esp + esi - 0x783fd9e], ebp
inc ecx
mov ebx, esp
dec edi
lea edx, [eax + eax*8 + 0xeaaca9b]
inc edi
mov ecx, dword [ebp - 0x783fda4]
inc esp
xor ecx, edi
inc ecx
movzx ebp, al
inc ecx
neg ecx
inc ecx
neg al
xor bx, bx
dec edx
mov dword [esp - 0x783fda0], 0xc12a39ba
inc ecx
rol ecx, 1
inc ecx
push esp
call fcn.00ecce9c
sub edi, 4
mov edx, 0x229eb5bc
mov ecx, edx
push ecx
mov ecx, dword [edi + ecx*2 - 0x453d6b78]
xor ecx, ebx
jmp 0x161a287
jae 0xf2638e

Function at 0xeb5875
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp + 8], ebx
pop ebx
call fcn.0170767f
Function at 0xeb7ced
Capabilities:
Encrypt data using speck

Disassembly:
inc ebx
movzx ebp, word [edx + ebp - 0x1f]
inc ecx
movzx ebx, dx
inc esp
mov eax, dword [esp + ebx - 0x11]
xor bp, di
inc ebp
movzx edi, ah
dec ecx
xor esp, 0x3daecbb3
not bp
xor bp, 0x93a1
inc ecx
sar esp, 0xfe
dec esi
mov dword [esp + edx - 0x1d], edx
neg bp
call fcn.00f4b993
cmc

Function at 0xeb98c7
Capabilities:
Encrypt data using speck

Disassembly:
sub al, dh
lea ecx, [esp + ecx + 0x18]
mov edx, dword [ecx + eax - 0x66eeda]
call fcn.0173c695

Function at 0xebd260
Capabilities:
Encode data using xor

Disassembly:
call fcn.00e66312
xor ebx, ecx
mov eax, 0x7cb7e735
or dl, dl
bswap edx
adc edi, ecx
xor al, ah
movzx ecx, dl
add dx, cx
mov edx, dword [ebp + ecx - 0x60]
lea ebp, [ebp + ecx - 0x5c]
sub cl, 0x33
jne 0x1830e7a
sar dx, 0x21
adc edx, ecx
xor eax, 0xc3a2087
neg eax
lea eax, [eax + edx + 0x18c2e3a7]
rol eax, 3
inc dl
xor ebx, eax
call fcn.00d054f9
xor edx, ebx
lea eax, [ecx + ecx*8 - 0x7249b7dc]
xor edx, 0x63bf7729
rol eax, cl
sar al, 0x67
inc eax
inc edx
lea eax, [eax - 0x4a7b7ffc]
neg edx
dec eax
bswap edx
jnp 0xe5e25b
xadd ecx, eax
xor ebx, edx
add eax, eax
or ecx, ecx
adc esi, edx
lea eax, [eax + eax + 0x61abe1b7]
mov dx, word [ebp + ecx*4 - 0x29fc70c8]
or al, cl
movzx eax, byte [ecx + edi - 0xa7f1c2e]
shl cl, 0x42
ror dword [edi], 0xb6
test byte [ecx], bh
shl bl, cl
xor ch, 0xc0
loope 0xebd33b
adc cx, cx
sal ecx, 0x3a
xor al, bl
not al
not cx
inc al
inc ecx
ror ecx, 0x61
xor al, 0x3b
push ecx
sal byte [esp + ecx*2 - 0x4000ffff], 3
xor ecx, 0x55acd12e
ror al, 1
dec ecx
or word [esp + ecx - 0x75ac512c], cx
xor bl, al
call fcn.01751db8
pop ecx
mov ecx, 0xf20a4df0
pushfd
jge 0xebd2db
fdiv qword [edx - 0x5c820faa]
fsubr qword [esi - 0x5e]
aam 0x7d
mov dword [0xece65adc], eax
jge 0xebd2ed
invalid
fcom qword [edx - 0x58fcb602]
sbb al, 0xae
daa
dec edi
mov dword [0xede6bda4], eax
invalid
xor edx, 0xf012acab
sub ecx, eax
xchg ecx, eax
dec edx
not edx
jmp 0x17158f1
bswap edx
add ecx, ecx
xor ax, cx
neg eax
rol edx, 3
xor ebx, edx
and ecx, ecx
or ecx, ecx
mov dword [esi + eax - 0x7cb7280d], edx
and ecx, 0x19a5afab
lea esi, [esi + eax - 0x7cb7280d]
jg fcn.01713832
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jmp 0x1761ce9
mov eax, 0xdcb0113b
jmp 0x171591d
jmp 0x172f0a3
jne 0x174a686
mov eax, 0xb09d988d
mov eax, dword [ebp]
call eax
mov edx, 0x8f2678b9
sar dx, 0x67
push edx
mov ebp, dword [ebp - 4]
xor dword [esp], edx
mov dword [ebp], eax
movzx edi, word [esp]
mov ebx, dword [esp + edi*4 + 4]
mov esi, dword [esp + edi + 8]
mov dword [esp + edi + 4], edi
shl byte [esp + edi + 6], 5
movsx eax, dl
mov edi, dword [esp + edi*2 + 0xc]
sar ax, 0xa2
sub word [esp + 6], ax
pop ecx
pop ecx
pop edx
pop ecx
jmp esi
xor edx, ebx
jmp 0x10af8f3

Function at 0xec2170
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
mov dword [esp + ebx*4 - 0x71daf084], eax
inc ecx
ror dl, 1
call fcn.018460d3
shr dx, 0xc8
bswap eax
neg dx
neg eax
lea eax, [eax + edx*2 + 0x7edf3845]
shl cx, 0xaf
call fcn.016d8148
mov edx, 0x6d8f831a
call fcn.017d0888
Function at 0xed618e
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp + ecx*2 - 2], eax
movzx eax, byte [esp + ecx*2 + 6]
mov dword [esp + ecx*2 + 0x11], eax
sar ecx, 0x3c
xor edx, dword [edi + ecx*4 + 8]
lea edi, [edi + ecx*4 + 0xc]
bswap ecx
xor edx, ebx
neg word [esp + ecx*2 + 0xd]
rol eax, 0x1d
ror edx, 1
mov dword [esp + ecx], 0xc59f34bb
dec edx
sal eax, 0x9c
neg edx
rol dword [esp + ecx + 0x15], 0x31
dec edx
rol edx, 1
lea eax, [eax*8 + 0x2db9d5a4]
sar byte [esp + ecx + 0x19], 0xa5
xor ebx, edx
mov dword [ebp + ecx - 4], edx
lea ebp, [ecx + ebp - 4]
lea eax, [ecx*8 - 0x784c7553]
xor cl, byte [esp + ecx*2 + 3]
jp 0x165d4f6
js 0xed61f0
mov edx, 0xad05c5be
mov eax, 0x11b6ac27
mov eax, dword [eax + ebp - 0x11b6ac27]
mov ecx, edx
mov edx, dword [ebp + 4]
add ebp, 8
mov dword ss:[eax], edx
mov ecx, dword [edi]
mov edx, 0x3aa58528
lea edi, [edx + edi - 0x3aa58524]
xor ecx, ebx
bswap ecx
add edx, edx
lea ecx, [edx + ecx + 0x6165bfb6]
movsx eax, dl
call fcn.0188a4b0
jecxz 0xed61ee
sub dword [esi], esi
cmp dword [eax - 0x35a6583f], ebp
daa
arpl bp, si
sar byte [ebx - 0x38], 1
sbb dword [ebx + 0x76ef29b7], 0x48
xchg ebx, eax
fcmovnu st(0), st(7)
jne 0xed623d
jbe 0xed6298
iretd
xlatb
outsb dx, byte [esi]
mov dword [edi - 0xed7ca93], esi
or eax, ecx
push cs
xor eax, dword ds:[edx - 9]
dec ecx
test dword [eax], eax
int 0xff
fild dword [ecx + ebx]
invalid
inc ecx
xor bl, bl
inc cx
ror ecx, 1
inc cx
add ecx, 0x8b41e598
retf 0x33e9
sub al, 0x70
add dh, 3
cmpsb byte [esi], byte es:[edi]
invalid
pop eax
pop ecx
pop eax
pop ecx
pop edx
pop eax
pop edx
jne fcn.016b7643
sti
add byte [eax + 0xa46e7ab], al
loop 0x165d49f
pushfd
lcall 0xe734, 0x7df03bdd
jbe 0x165d56d
inc esi
xor eax, 0xca8b21ff
inc ecx
movsx ebx, dx
inc ecx
mov eax, 0x6cb43234
dec ebp
lea ebx, [ebx + ebx*2 - 0x5546cbcb]
inc sp
xor ecx, edi
jmp 0x163cd5f

Function at 0xee2b66
Capabilities:
Encrypt data using speck

Disassembly:
inc edi
mov dword [esi + ecx*2 - 0x4206], edx
dec esi
lea esi, [eax + esi - 0x6821710f]
inc ecx
not ecx
shr bx, 0xe2
inc esp
and cl, bl
inc ecx
pop eax
inc ecx
pop eax
jns fcn.018803b6

Function at 0xee57aa
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.018785ef
mov edx, 0x6a8b0c2e
mov ecx, edx
lea eax, [ecx - 0x20f12152]
movzx dx, byte [edx + ebp - 0x6a8b0c2e]
mov cl, byte [ebp + eax - 0x4999eada]
shl ax, 0x8c
sete al
and dl, cl
not dl
dec al
mov word [ebp + eax - 0x4999c0fd], dx
movzx cx, byte [ebp + eax - 0x4999c0fd]
mov edx, eax
inc dl
mov al, byte [ebp + edx - 0x4999bffc]
dec dl
xor cl, dl
jmp 0xd358ac
inc edi
mov eax, dword [ebp + edi - 0x2b]
inc ebp
movsx ebx, di
inc esp
xor eax, edi
inc ecx
dec eax
inc ecx
ror eax, 1
inc ecx
neg eax
dec esi
mov dword [esp + edi - 0x2b], ebx
movzx ecx, bl
inc ecx
inc eax
or ecx, ebx
inc ecx
movzx ebp, di
inc dx
adc dword [esp + edi - 0x27], 0x894a6432
mov esp, 0xffff54bc
inc dword [ebp + 0xf]
mov dh, 0xd1
inc esi
xor dword [esp + edi*2 - 0x56], eax
dec esp
lea esp, [ebx*2 + 0x12387412]
jmp 0xcdf011
Function at 0xeea798
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp - 4]
mov dword [esp], 0x2197361b
add ebp, 0xfffffffc
xor eax, ebx
mov byte [esp], pe_nt_image_headers32
ror eax, 2
bswap eax
mov edx, 0x44bc6c30
lea eax, [eax + edx + 0x3b0042fd]
sar edx, 0x8d
mov ecx, edx
add dword [esp + edx - 0x225e3], edx
xor eax, 0xd59b2ca2
neg dword [esp + edx - 0x225e3]
add eax, 0x89a04927
shl cl, 0x47
shl dl, 0xe1
inc cl
rol eax, 3
bswap eax
sar cx, 0x66
inc eax
shr edx, 0xc4
jb 0x16a5750
bswap eax
neg eax
pop ecx
xchg cx, dx
xor ebx, eax
add esi, eax
ror cx, 0x4f
movzx dx, byte [edi + edx - 0xa39b]
inc ecx
mov al, byte [edi + 4]
push ecx
sar cl, 0xa1
push ecx
or dl, al
not dl
neg ecx
mov eax, 0x49bf1daf
mov word [eax + edi - 0x49bf1dab], dx
ror ax, 0xc1
sar dword [esp + ecx - 0x2199bb20], 0x31
js 0x18057b7
lea eax, [edi + ecx - 0x2199bb20]
or cx, 0x2e39
dec dword [esp + ecx - 0x2199bf39]
mov dword [ecx + edi - 0x2199bf3d], eax
not word [esp + ecx*2 - 0x43337e77]
movzx edx, cx
mov dword [esp + edx - 0xbf3d], esi
ret 4

Function at 0xef34ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror cx, 0x8c
not dl
mov dword [esp + ecx - 0x4d2de52d], ecx
neg cx
xor bl, dl
bswap ecx
xor ecx, 0x908d0711
sbb cl, 0x9a
lea edx, [esp + edx + 4]
sal word [esp + ecx - 0x43972ac0], 0xc7
add ecx, ecx
mov dword [edx], eax
and byte [esp + 2], cl
xadd word [esp], cx
mov eax, dword [esi - 5]
jns 0x1776bb1
mov ecx, dword [esp + 1]
ror ecx, 9
not eax
adc cx, cx
lea eax, [eax + ecx*4 + 0x815987c]
call fcn.01749de8
clc
xor al, bl
sar edx, 0xc5
sal word [esp + edx*4 - 0x75fdffe], 0xeb
sbb al, 0x9b
neg al
xor al, 0xb0
inc al
xadd byte [esp + edx*8 - 0xebfc000], cl
sbb dword [esp + edx*4 - 0x75fe000], edx
xor bl, al
call fcn.00fde925
xor eax, ebx
ror eax, 1
sub byte [esp], ch
seto byte [esp + 2]
xor eax, 0x893f6cb5
rol eax, 1
movzx edx, word [esp]
or dx, 0x223b
bswap eax
xor ebx, eax
add edi, eax
sal word [esp + edx - 0x3afe], 0xec
ror edx, 0xd0
neg dword [esp + edx*2 - 0x75fe0000]
movzx eax, byte [esi + edx*2 - 0x75fe0006]
rol ecx, cl
xor ecx, dword [esp + edx - 0x3aff0000]
lea esi, [esi + edx - 0x3aff0006]
shl dx, 0xef
and dl, 0x92
jle 0x1001a1c

Function at 0xef3d61
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, 0x4a869283
neg ecx
mov dword [esp + eax*2 + 0x73f6abca], edx
lea ecx, [eax + ecx - 0x228755c7]
push eax
rol ecx, 3
xor ebx, ecx
not eax
add ebp, ecx
xor dl, 0x1e
jb 0x16734c9
rdtsc
jle 0xff71ad
call fcn.016d7073
sub edi, 4
mov ecx, dword [edi]
jmp 0x189fac1
Function at 0xef6f66
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ecx], ebx
cmc
add ecx, ebp
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
dec ch
bswap ecx
shr ecx, cl
mov ecx, dword [eax + 4]
lea ecx, [ecx + esi]
btc ax, 0x21
mov eax, 0x300
jmp 0xe91e94
shl eax, cl
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
test esp, 0x63b9e62f
mov dword [ebp - 0x10], edi
cmc
clc
add eax, 0x736
jmp 0x100752c
sub ebx, ebx
cmc
cmp esi, 0x71818f3d
mov dword [ebp - 0x20], edx
clc
cmp esp, 0xc115f116
sub esi, edi
clc
mov dword [ebp - 0x44], esi
mov esi, edi
cmc
test dh, 0
shl esi, cl
sbb cx, ax
mov ecx, dword [ebp + 0xc]
clc
jmp 0xf50dc0
mov dword [edx], ecx
sar eax, 0xe7
mov ecx, dword [esi - 8]
jns 0x1640d19
mov dword [ebp - 0x18], ebx
cmc
mov byte [ebp - 1], bl
sub esi, edi
jmp 0x167ba2a
inc ebx
mov edx, dword [edx + ebp - 0x821b]
call fcn.010a08a3
push ebp
sub ecx, edi
mov ebp, esp
rcl dx, cl
sub esp, 0x48
mov ecx, dword [eax + 8]
mov edx, edi
rcr edx, cl
adc dx, 0x4a30
mov edx, dword [eax + 0xc]
stc
test eax, esp
push ebx
stc
clc
push esi
push edi
dec si
shr esi, 0x85
mov edi, 1
bt esi, ebp
mov esi, edi
shl esi, cl
ror ch, 0x93
and ch, bl
shld ecx, ebx, 0x13
mov ecx, dword [eax + 4]
jmp 0xeeca02
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
jmp fcn.00eb2158
add esi, 0xfffffffc
neg word [esp + 4]
and al, al
movzx edx, byte [edi - 6]
mov dword [esp], 0x3f340918
sbb edi, 6
call fcn.016fb657
jnp 0xfa4015
mov dword [ebp - 0x48], esi
sar si, 0xb0
btr esi, ebx
mov esi, dword [eax]
test ax, bx
jmp 0xd3b347

Function at 0xf030ba
Capabilities:
Encrypt data using speck

Disassembly:
ror dl, 1
dec esp
xchg dword [esp + ebx - 0xf3468ff], edx
xor dl, 0xa8
inc ebp
movzx ebx, dl
dec esp
lea esp, [ecx + ecx*4 - 0x1654d46b]
call fcn.00ef42b5

Function at 0xf030d8
Capabilities:
Encrypt data using speck

Disassembly:
ror eax, 1
shr ecx, 0x1d
inc word [esp + ecx - 1]
mov dword [esp + ecx - 6], 0x99ec703
lea eax, [eax + ecx*2 + 0x180cfd7c]
ror eax, 1
sub dword [esp + ecx*4 - 0x14], 0xa5aaadae
neg ecx
xor eax, 0x17248e27
bswap eax
inc cx
lea edx, [edx + edx + 0x69bfe893]
xor ebx, eax
add esi, eax
movzx cx, byte [edi + edx - 0x3a1627b1]
jmp 0xfbc19e
movzx eax, dx
lea eax, [eax + eax - 0x7f647ecd]
mov al, byte [edi + edx - 0x3a1627af]
sar dx, 1
ror dx, 0xae
adc edx, 0x8e85b102
not cl
jae 0x167b74c
shl dword [esp + edx*8 + 8], 0x3e
mov ecx, dword [ebp + edx*2 + 1]
xor ecx, ebx
call fcn.017c851d
dec edi
mov dword [esi + ecx - 0x779e4e05], eax
inc byte [esp + ebx*2 - 5]
setl byte [esp + ebx]
inc bx
dec eax
mov dword [esp + ebx*2 - 0xc], esi
ret 8
inc dl
call fcn.0163d04d
Function at 0xf04b53
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
lea ebp, [esp + ebp + 8]
dec esp
mov dword [esp + edx*8 - 0x5d8], ecx
dec esp
mov edi, dword [edx + ebp - 0xbb]
inc esp
movsx ebx, word [esp + edx - 0xba]
dec ecx
sal esp, cl
dec ebp
mov dword [esi + edx*2 - 0x17e], edi
inc ecx
mov eax, dword [ebp + edx*2 - 0x17b]
dec ebp
lea ebp, [ebp + edx - 0xc0]
dec ecx
sal edx, 0xed
jne 0xf8752c
xor eax, edi
inc ecx
xadd ah, cl
shl byte [esp + edx*2 - 0x175], 0x64
xor eax, 0xe4b73d14
dec ecx
inc ebx
sub eax, 0xc9a510bd
push ecx
bswap eax
dec edx
lea ebp, [ecx*8 + 0xb206b2f]
dec ebp
lea edi, [ecx + edx*4 + 0x662f5399]
lea eax, [eax + ebp*8 + 0x5a132805]
inc ecx
pop eax
inc ecx
sub al, 0xb4
sbb bp, 0xce11
bswap eax
inc ecx
sub eax, ebx
dec eax
mov dword [esp + edx*2 - 0x176], edi
ror ecx, 0x2b
inc cx
rol ecx, 0xea
xor dword [esp + edx*4 - 0x2ec], eax
dec eax
or ebp, edx
dec esp
xchg ebp, esp
pop edi
inc ecx
not eax
dec eax
arpl ax, ax
dec eax
adc esi, eax
dec ebp
mov esp, dword [esi + edx - 0xc3]
dec ecx
rol eax, cl
inc ebp
xor cl, dl
dec ecx
mov ecx, dword [esp + edx - 0xbb]
dec ecx
or edx, 0x6f05851e
inc ecx
movsx eax, cx
rol dl, 0x47
dec ecx
mov dword [esi + edx*2 - 0x1c2], ecx
inc ecx
setns dl
dec esi
lea esi, [edx + esi - 0xe5]
push edx
sar al, 0x21
inc ebp
movsx esp, cx
inc ecx
pop edi
jno fcn.018803b6

Function at 0xf04b96
Capabilities:
Encrypt data using speck

Disassembly:
sbb ecx, 0x320d0f0c
dec ebp
lea esi, [esi + edx*2 - 0x277d7a08]
inc ebp
mov edi, dword [ebp + edx - 0x13bebd06]
dec ebp
lea ebp, [ebp + edx*2 - 0x277d7a06]
inc esp
xor edi, edi
push eax
not dx
inc esp
movsx esp, al
inc ecx
rol edi, 1
inc ebp
lea edi, [edi + edx*8 + 0x5ea00e3c]
inc ebp
movsx ecx, sp
inc cx
sal esp, 0x6c
push ebx
inc ecx
xor edi, 0xe1245d91
jmp 0xfc7c76
inc ecx
xor bh, dl
dec esi
lea edx, [esp + edx + 0x20]
not al
dec eax
mov dword [esp + edx - 0x13beed85], 0xf3015b37
rol dx, 0xcd
dec ebp
mov eax, dword [edx + edx*4 - 0x4efaf6c0]
dec esp
lea edi, [eax*2 + 0x66a59132]
sal dl, 0x85
dec esi
mov dword [edx + esi - 0x13bebd08], eax
pop ebp
jbe 0xd0a90e

Function at 0xf05b11
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, ecx
push eax
shr eax, 0x8f
call fcn.016634bf