joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2651946
Capabilities:
Encode data using xor

Disassembly:
bt ecx, ecx
setb cl
adc cl, byte [ecx + edi - 0xfef8]
jmp 0x26123da
call fcn.0156a0ef
add eax, 0xe79e4846
sbb al, 0xc2
xor byte [ebx + 0x42745fce], al
js 0x261244d
sbb al, 0x70
invalid
invalid
pop edi
test byte cs:[ecx], ch
or eax, 0x4166158b
push eax
das
mov eax, 0x1bdaa992
push 0xe4b01e28
leave
xlatb
xchg edi, eax
dec esp
push edi
jae 0x2612445
popal
shr byte [edi], 0x5b
xor al, 0x18
dec eax
cld
out 0x69, eax
xchg esi, eax
movsd dword es:[edi], dword [esi]
jl 0x26123e6
push es
pop ss
jnp 0x261240e
enter 0x7a39, 0xffffffffffffffb7
cmp dword [edx - 0x49], edi
xor ah, byte [esi]
cmp dword [eax], ecx
or byte [ecx - 0x72a9ec07], al
mov ebx, 0x61051743
push esp
pushfd
pop ds
cmp ecx, 0xbb8d5613
inc ebx
pop ss
add eax, 0x1f9c5461
loop 0x2612416
pop es
dec ecx
test eax, 0x8dd59699
mov ecx, 0x2a00bbe5
mov dword [edi + ecx*8 - 0x2ad1ee69], 0xff6a96
add bl, ch
outsd dx, dword [esi]
mov cl, 0x27
or bh, byte [ebx + 0x61]
dec ebx
adc dword [ebp + 0x52142bc6], ebp
aam 0xdc
fisttp dword [eax + edi*4]
jae 0x2612443
pop edx
imul esp, ebp, 0xffffffe4
mov dword [0xe1d23964], eax
sub dword [0xe4aaf963], esp
fist word ds:[esi + edx*8 - 0x35]
and edi, 0x176014f8
and byte [eax], cl
shl dword [edx], 0x1c
and ah, byte [ebx - 0x15]
in al, 0xa2
mov word [ecx], fs
jle 0x26124b6
je 0x261244c
xor dword [ebx - 0x2126d00], edi
xchg ebx, eax
in eax, dx
std
push dword [eax]
ret
xor cl, 0x32
add cl, 0x3a
not cl
not dword [esp + edx*4 - 0x412c]
sub cl, 0xa0
btr eax, edx
dec eax
xor bl, cl
btc eax, edx
jb 0x28396b7
lea edi, [edx + edi - 0x104e]
xor dl, al
mov word [edi + edx - 0x1007], cx
and al, byte [esp + edx - 0xffe]
dec eax
pop eax
pop edx
pop eax
jnp fcn.0229206a
cmovo ecx, edx
xor eax, ebx
push ecx
rol eax, 1
sub byte [esp + edx - 0x242fc800], cl
setno cl
and cl, 0x14
sbb eax, 0xcf9a3e23
pop ecx
bswap eax
dec eax
neg eax
add dx, cx
xor ebx, eax
add esi, eax
rol dl, 0xc2
shr ecx, 0x96
mov edx, dword [edi + edx*2 - 0x485f0200]
dec cx
movsx eax, cl
sal eax, 0x3d
mov eax, dword [edi + ecx - 0xfffb]
jb 0x15a5084
cbw
inc sp
mov dword [ebp + edi - 0x642ea81f], ebp
push edx
inc esi
sbb dword [esp + edx - 0x551288ae], esi
dec esi
lea ebp, [ecx + ebx + 0x2c1acd88]
inc ecx
pop ebp
pop esi
jb fcn.027a8c5b

Function at 0x265d9a7
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
call eax
mov esi, 0x7924f00c
lea ecx, [esi + esi*4 + 0x6b1996bf]
push esi
mov ebp, dword [esi + ebp - 0x7924f010]
btc cx, cx
mov dword [ebp + esi - 0x7924f00c], eax
mov edi, ebp
xor cx, word [esp + esi - 0x7924f00a]
call fcn.0282cdaf

Function at 0x267e9c5
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], ecx
movzx eax, cx
mov eax, dword [eax + edi - 0xc041]
push ecx
call fcn.02600ecb
Function at 0x2682e74
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
ror eax, 0x2b
bts eax, edx
shl dl, 0x22
sbb ecx, 0xeb80201a
mov dword [esp + eax - 0x55c3faf7], 0x27be332e
neg ecx
div ax
xor ecx, 0xb1a9c33e
dec eax
imul byte [esp + eax - 0x55c30010]
push edx
xor ebx, ecx
or dword [esp + eax - 0x55c302e0], eax
add ax, 0x9234
adc ebp, ecx
movsx ecx, ax
pop edx
sal dword [esp + edx - 0x55c352f0], 0xda
mov ecx, dword [eax + esi - 0x55c39514]
lea edx, [eax + eax - 0x496ab87d]
xadd word [esp + eax - 0x55c39513], dx
shr ax, 0xca
mov eax, dword [eax + esi - 0x55c30021]
lea esi, [esi + edx - 0x621bfffc]
or dl, 0x9c
or dx, 0xcf80
not ecx
push edx
dec edx
not eax
sar edx, 0x78
or ecx, eax
call fcn.016157cc
mov edi, 0x42f6ba4f
xor byte [ecx + 0x3b740a0b], 0x53
sbb esi, esp
mov dl, 0x54
jno 0x2682ea6
invalid

Function at 0x2687d49
Capabilities:
Encrypt data using speck

Disassembly:
jl 0x268c52f
call fcn.02322b17
movzx ecx, byte [ebp]
mov eax, 0x96a87bac
add ebp, 1
xor cl, bl
ror eax, 0xf4
sal eax, 0x6b
lea edx, [eax + eax*2 + 0x162dccb1]
adc cl, al
sal eax, 0x25
btc dx, 0x88
bt eax, edx
rol cl, 1
mul edx
sal eax, 0xac
bswap edx
adc cl, 0xbe
xadd edx, eax
xor cl, 0x1d
div eax
shl ax, 0xa5
bts edx, edx
xor bl, cl
add eax, edx
sal ax, 0xaa
bt edx, edx
add ecx, esp
bt eax, eax
dec ax
push eax
mov dx, word [ecx + eax - 0x38a89fff]
lea ecx, [eax + eax*4 + 0x2599e60c]
lea eax, [ecx*4 + 0x6c927eaa]
ror cx, cl
lea edi, [edi + ecx - 0x40e50e0e]
adc dword [esp + ecx - 0x40e50e0c], 0x83a885
add eax, eax
shr ecx, 0x4a
mov word [edi + ecx*2 - 0x207286], dx
sbb al, ch
bswap eax
mov eax, dword [ebp + ecx*2 - 0x207286]
not cl
ror dword [esp + ecx - 0x1039bc], cl
lea ebp, [ebp + ecx - 0x1039b8]
xor eax, ebx
ror eax, 1
sub eax, 0x8f3299bf
sar ecx, cl
lea edx, [ecx + ecx*4 + 0x30a9d89d]
push ecx
bswap eax
dec dx
imul ecx, dword [esp + ecx + 3]
xor eax, 0xcb263f27
btr edx, 0x87
xor ebx, eax
add cx, cx
adc esi, eax
xadd edx, ecx
pop edx
pop edx
jno fcn.022ad6bc
mov dx, word [esi]
mov ecx, 0x8229a69a
mov eax, 0x838aea1f
mov cl, byte [esi + 2]
add esi, 2
dec al
sal eax, 0xb0
sal dx, cl
lea eax, [eax + eax + 0x8a7b98b]
mov word [esi], dx
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
ror ecx, 1
lea edx, [eax*8 - 0x197f3dea]
xor edx, 0xd1012238
push edx
sbb ecx, 0xcea3ce8d
xadd eax, edx
shr eax, 0xad
rol eax, 0xb8
ror ecx, 3
inc ecx
sal dl, 0x64
xor ecx, 0xee24b439
sal al, 0xc6
and eax, 0x7ab2350e
neg ecx
shr dword [esp + eax*2 - 0x34000a00], 0x42
xadd edx, eax
inc ecx
bts eax, 0xaa
inc dx
mul eax
xor ebx, ecx
xadd dl, dh
mul dl
bts edx, edx
adc ebp, ecx
mov dword [esp + eax - 0x72ad0000], ebp
ret

Function at 0x26afbe3
Capabilities:
Encrypt data using speck

Disassembly:
shr eax, 0x8d
bswap edx
mov dword [esp + eax*4 - 0xd4d1c], 0x8fa25090
xor ebx, edx
pop ecx
add ebp, edx
push ecx
xchg byte [esp + eax - 0x35345], ch
mov eax, dword [esi + eax*4 - 0xd4d1c]
jmp 0x27a0743
movzx edx, word [esp]
mov word [esp + edx*2 - 0xa11e], 0x5b0f
mov cx, word [esi + edx*2 - 0xa11c]
shr dx, 0xe3
lea esi, [esi + edx*4 - 0x2846]
or dl, dh
shr cx, 1
rcr eax, cl
and edx, 0x9b00450b
movsx ecx, dl
call fcn.0283f60a
Function at 0x270d00e
Capabilities:
Encrypt data using speck

Disassembly:
and dword [esp + ecx + 4], eax
ror edx, 2
sar ax, 0xa1
ror eax, 0x1b
call fcn.025cb56b

Function at 0x273a67a
Capabilities:
Encrypt data using speck

Disassembly:
ror si, 0x21
lea edi, [edi + esi - 0x7683fb75]
bswap edi
mov dword [esp + esi*8 - 0x74a60], esi
not edi
lea eax, [eax*8 - 0x52e94cc3]
ror edi, 3
xor al, al
xchg esi, ebx
ror dword [esp + eax - 0x2d2547f9], 0x32
not edi
rol bl, 5
cwde
sbb esi, 0x24297abc
neg edi
inc edi
pop ebx
call fcn.0288e391

Function at 0x273dbeb
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x1a2e163c
mov ecx, dword [edi + edx*4 - 0x68b858f0]
cmp al, 0x16
sbb cl, byte cs:[ebx - 0x58ef6874]
inc edi
xchg edi, eax
mov dword [esp + edx*4 - 0x68b858f0], 0xd007bab4
rol word [esp + edx*2 - 0x345c2c76], 0x42
lea edi, [edi + edx*4 - 0x68b858ec]
mov eax, 0x77aecd99
sar edx, 0xc
rol al, 0x61
xor ecx, ebx
not ecx
inc edx
shl edx, 0x69
call fcn.015f2e26
aad 0xe7
sbb ebx, edi
wait
pop ebx
add dword [esi + eax*8 + 0x6d], 0xffffffa9
push esi
sbb ecx, eax
mov edx, 0x5fef2714
sbb byte [ebx - 0x56], 0x57
sub al, 0xf2
mov dword [0xbb0d8f09], eax
in eax, dx
mov dword [0xf00f0b9b], eax
dec ebp
xchg dword [ecx + esi*8 - 0x56], ebx
jg 0x273dbec
jno 0x273dc5b
mov edx, 0xe40113f2
add esp, esp
hlt

Function at 0x276a1be
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
xor ecx, 0x639fa38d
call fcn.025a403b
mov edx, 0x2cb10233
movsx eax, dx
shl edx, 0xcf
mov eax, dword [edi + eax*4 - 0x8cc]
movzx ecx, dl
dec ecx
sar cl, 0xa1
adc edi, 3
jmp 0x277e6af
xor eax, ebx
dec ecx
xchg ecx, edx
neg edx
bswap eax
not eax
shr ecx, 0xb6
sub cl, dl
xor eax, 0xe0b8c41c
xadd edx, ecx
rol edx, 0xf6
sub cx, 0x7db4
rol eax, 3
neg dl
add edx, edx
lea eax, [eax + edx - 0x74ad1432]
setl cl
xchg dh, cl
xor ebx, eax
shl dl, 5
adc ebp, eax
lea eax, [ecx + 0x7d1b6c32]
dec dl
mov esi, dword [esi + edx - 0x20001ff]
jno fcn.022c6764

Function at 0x27768c9
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], 0x6d483476
call fcn.02633259

Function at 0x2792bec
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jne 0x15baf28
Function at 0x2797245
Capabilities:
Encrypt data using speck

Disassembly:
mov ebx, 0x5536500b
xadd bl, bh
movzx ebx, byte [ebx + ecx - 0x55360b5b]
xor ebx, edx
call fcn.015cc858
neg dword [esp + 2]
jge 0x262ef54
dec eax
not byte [esp + 9]
push 0x95bc0b86
lea esp, [esp + 0x18]
jne 0x15ad557
mov ebx, 0xba29e124
pop ebx
mov eax, 0x25b4ff05
bt eax, 0x90
call fcn.027c85ea
xor ebx, edx
sal dword [esp + 8], 0x62
inc word [esp + 6]
add esi, edx
call fcn.0288467e
mov edx, 0x3e225d38
movzx eax, dl
mov eax, dword [edx + edi - 0x3e225d38]
lea edi, [edi + edx*2 - 0x7c44ba6c]
xor eax, ebx
movzx ecx, dl
not eax
bt ecx, ecx
setae cl
lea eax, [eax + ecx*8 - 0x79bc173f]
xor dx, 0x68ae
bt ecx, ecx
ror eax, cl
lea edx, [edx + ecx*4 + 0x7ea4b085]
sub cx, cx
add ecx, 0x6eb6c582
inc eax
xor dl, cl
xor ebx, eax
jmp 0x28200d2
inc dword [esp + 8]
inc ecx
shl byte [esp + 0xb], 0xc4
xor edx, 0xd95abaa
jmp 0x22ffff5
sar dl, 0x45
sbb dl, ch
adc ebp, eax
shl edx, cl
ror dx, cl
and ecx, 0x632a9a88
mov eax, dword [esi + ecx - 0x62228080]
shl edx, 0xc9
sbb cx, cx
adc cl, byte [esi + ecx - 0x6221fffc]
and dl, 0xa2
bswap edx
lea esi, [esi + edx - 0x6c4c34]
shl eax, cl
mov dword [esi + edx*8 - 0x36261b0], eax
movsx eax, dl
jmp ebp

Function at 0x27b0566
Capabilities:
Encode data using xor

Disassembly:
inc ecx
sub esp, 0x85a3e23f
dec esp
mov dword [esp + ecx - 0x6782bc82], edi
dec esp
mov dword [esp + edx - 0x5d8012e9], ecx
inc esp
xor dword [esp + ecx - 0x6782bc6a], esp
inc eax
sar ch, 0xc7
dec esi
mov ecx, dword [esp + edx*2 - 0x14230]
dec esp
mov dword [esp + edx - 0x5d8012e9], edx
Function at 0x27bb543
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [ebp]
call fcn.02778e2c
mov eax, 0x9b33008
mov ecx, dword [edi + eax*8 - 0x4d998040]
ror ax, 0xae
mov edx, dword [edi + eax*8 - 0x4d9e00fc]
adc ax, ax
lea edi, [edi + eax - 0x9b3803d]
bt eax, eax
adc ecx, edx
neg ax
sub eax, 0x9daa332b
lea edx, [eax*4 + 0x50018201]
mov dword [edx + edi - 0x26b451], ecx
ror edx, 0x79
movzx ecx, al
lea ebp, [ebp + edx - 0x135a2884]
mov ecx, dword [eax + ebp - 0x6c094c94]
rol eax, 0xf5
xor ecx, ebx
xor eax, edx
xor ecx, 0x2b3ddbab
btc dx, 0x3c
shr dl, 0x41
inc ecx
cbw
neg ecx
or al, 0xa1
sbb ecx, 0xae86c9a9
neg ecx
shl eax, 0x33
not ecx
sal dl, 0xe4
sete al
or ax, 0xb1b4
dec ecx
btr eax, edx
adc eax, 0xc7af8893
bt dx, ax
xor ebx, ecx
add esi, ecx
jmp esi
lea esp, [esp + 0x10]
je 0x162b307
mov eax, 0x41018317
shr al, 0xa5
mov eax, dword [ebp + ebx*4]
push eax
jns 0x287aba9
inc ebx
fsubr qword [0xd799f7d4]
rcl dword [eax]
cmpsb byte [esi], byte es:[edi]
and al, 0xb3
push ecx
dec ecx
add byte [ebx + 0x35], cl
sbb bl, byte cs:[0xe52e297f]
push eax
cdq
and eax, 0x8f69752e
xchg edi, eax
invalid
push 0x1f0744ba
dec ebx
call fcn.0162b2f1
mov ecx, dword [edi]
add edi, 4
mov eax, 0x9b0abb88
xor ecx, ebx
bswap ecx
or eax, eax
not ecx
mov edx, 0xe728199c
rol al, 0x43
sbb ecx, 0x2b2cf620
ror ecx, 1
call fcn.015f6cd3
sbb di, word [ebx + 0x59]
xchg esp, eax
sbb cl, byte [edi + eax*2]
test dword [esi + 0x6c], esi
cmp al, 0xee
aaa
cli
aaa
in eax, 0xe
cmpsd dword [esi], dword es:[edi]
mov cl, byte [ecx - 0x7c2a6e37]
xor eax, 0xf1895ff9
test dword [edx + 0x22], edx
sbb eax, dword [ebp + 0x392cb0c2]
stc
fcompp
add al, 0xbc
jge 0x2811937
in al, dx
test eax, 0x52d37176
arpl word [eax], di
ljmp 0x25c0
imul edx, dword [esp + ecx*4 + 0x7fa1590f], 5
and byte [ecx - 0x7f], 0xe5
bound ebx, qword [edi + 0x10e5d6a]
xor ebp, dword [ebp - 0xc]
retf 0x5be
je 0x28118b8
mov ecx, 0xab0e733a
xor cl, 0xb
mov edx, 0x13a59aa
movzx ecx, byte [edi + edx - 0x13a59aa]
lea edi, [edx + edi - 0x13a59a9]
lea eax, [edx*4 - 0x14c9fb53]
xor cl, bl
imul eax, edx
call fcn.024d07c3

Function at 0x27d3db6
Capabilities:
Encrypt data using speck

Disassembly:
not edx
mov byte [esp + eax + 2], ah
ror dword [esp + eax*2 + 4], cl
neg cx
xor ebx, edx
shl byte [esp + eax*2 + 3], 0x65
call fcn.015e1c3b
bswap edx
jmp 0x290f093
mov dword [esp], 0x3527e529
cbw
sub edx, 0xc8ebbb1
cwde
rol dword [esp + eax - 1], cl
xor edx, 0x529330b
mov dword [esp + eax + 3], eax
ror edx, 2
cbw
jmp 0x274f0a3
shr eax, 0x25
jbe 0x24dc765

Function at 0x27d6de0
Capabilities:
Encode data using xor

Disassembly:
mov dword [edx + esi - 0x7d034305], eax
mov ecx, dword [edi + edx - 0x7d034305]
mov eax, edx
lea edi, [edx + edi - 0x7d034301]
sar dl, 0x82
or al, byte [esp + eax - 0x7d034300]
sbb edx, 0x841f15b0
xor ecx, ebx
mov dword [esp + eax - 0x7d034347], eax
xchg word [esp + eax - 0x7d034343], dx
neg ecx
add al, 0xb9
mov esp, 0x876682fc
xchg esp, eax
add al, 0xbd
mov esp, 0xd9f782fc
neg dword [esp + eax - 0x7d034346]
xor eax, 0xe79f1225
inc ecx
btr dx, dx
neg edx
call fcn.028e47ce
lea ebx, [esi + eax - 0x17]
jb 0x27d6e0b
invalid
Function at 0x27ddbf1
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x1219c226
sal esi, 0xde
movzx esi, byte [edx + esi - 0x80000000]
call fcn.0231a319
xor eax, 0x38be50b9
not ecx
cdq
lea ecx, [ecx + eax + 0x121ca2a4]
sal eax, 0x4e
xor ebx, ecx
add ebp, ecx
mov ecx, 0x76a52197
mov edx, dword [edi + ecx - 0x76a52197]
xor al, al
mov eax, dword [edi + ecx - 0x76a52193]
bswap ecx
mov dword [edi], ecx
leave
setle cl
mov ecx, dword [edi + 8]
call fcn.01569547
salc
mov al, 0x9a
lds esp, [ebx + 0xf6ab099]
fcomp dword [esi]
test al, 0xe
xor dh, 0x95
ficom word [ebx]
fdiv st(0), st(0)
jne 0x26b10da
mov eax, 0x9a3a2147
push edi
add edx, 0x6f
push 0x2d
xor al, 0x8e
or eax, 0xa68e1606
or cl, byte [edi]
xchg edi, eax
cwde
mov edx, 0xda13f15d
stosd dword es:[edi], eax
jo 0x26b1124
pop ds
iretd
add dword [edi - 7], esi
dec edx
popfd
or edi, ecx
das
invalid
lea esp, [esp + 0x10]
jne 0x26b109b
mov eax, 0xa28f26a4
movzx edx, ax
pop esi
push 0xce8269a8
not ecx
mov eax, 0x728ac813
bt ax, 0x11
mov dword [eax + ebp - 0x728ac813], ecx
lea edx, [eax*8 + 0x5d0bb484]
mov ecx, dword [esp + eax - 0x728ac813]
adc dl, 0x94
mov dword [esp + eax - 0x728ac813], esi
ret

Function at 0x27f31da
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ebx, ecx
xadd edx, eax
adc ebp, ecx
cdq
jmp ebp
mov dword [esp + esi*2 - 0x1010e], 0x970a72b4
je 0x261c7a1
mov esi, dword [esp + esi*4 - 0x201f8]
shl dword [esp + edx - 0x7e997f79], 0xd0
dec dword [esp + edx - 0x7e997f79]
lea edi, [edx + edx*4 - 0x404f4500]
ror esi, 1
inc byte [esp + edi - 0x38b0385c]
shr dl, 3
neg esi
call fcn.02680165
sub esi, 1
movzx eax, byte [esi]
xor al, bl
mov edx, 0x8a243784
not edx
ror dl, 0x45
adc al, 0x89
rol dx, 0x2a
inc edx
sets dl
neg al
xadd dl, dh
inc al
ror al, 1
shl edx, 0x48
sar dl, 5
xor bl, al
push esi
sar edx, 0x46
push ebp
push edx
call fcn.02819b62
sysenter
call fcn.027768c9
mov eax, 0x5734d99e
mov eax, dword [edi + eax - 0x5734d99e]
mov ecx, 0x18b92c38
movzx edx, cx
rol dx, 0xca
mov ecx, dword [edi + ecx*2 - 0x3172586c]
sub dx, dx
ror edx, 0xbf
push ebx
movzx ebx, dl
shl bl, 0xa5
neg edx
cpuid
push 0x97a22f0e
push 0x617fab4
sbb edi, 8
neg dword [esp + 4]
mov dword [edi + 0xc], eax
mov eax, 0xc265322
sar eax, 0x5a
mov dword [edi + eax*2 + 2], ebx
sbb al, byte [esp + eax + 3]
mov dword [eax + edi - 0xa2], ecx
mov ebx, eax
mov dword [edi + eax - 0xa6], edx
shl eax, 0x54
mov ebx, dword [esp + eax*4 - 0x297ffff8]
pop eax
lea ebp, [ebp + eax - 0x617fab8]
mov dword [esp + eax - 0x617fab0], eax
mov edx, 0x5caf9513
cdq
mov ecx, dword [ebp + edx]
xadd word [esp + eax*2 - 0xc2ff563], dx
cdq
add edx, dword [esp + eax - 0x617fab0]
xor ecx, ebx
sub ecx, 0xd59630b3
call fcn.025d1745
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edx, 0x63002db2
or dx, dx
lea ebx, [edx + edx*8 - 0x7bc45169]
pop ebx
movzx ecx, dl
neg ecx
pop esi
jns 0x26906a0
pop edi
and dx, dx
mov eax, dword [edi + edx - 0x63002db2]
lea edi, [edx + edi - 0x63002dae]
jge 0x2595b6d
Function at 0x27f339f
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], eax
dec ebx
push 0x5da43388
push 0xe8ac4ea7
push 0x6883dd12
lea esp, [esp + 0xc]
jne 0x27f33d8
mov eax, 0x2b0a616
mov eax, dword [eax + ebp - 0x2b0a616]
jmp 0x155d225
add eax, edx
push 0x609ca5a5
mov dword [ebp - 4], eax
push 0x66af032e
mov dword [esp + 8], 0xcaa0e922
rol word [esp], 0xee
test ebx, ebx
push 0x78803313
push 0xf783b68e
push 0xea8cd01f
lea esp, [esp + 0x18]
je 0x2798414
mov eax, dword [ebp + ebx*4]
push 0x2fb56808
jmp 0x27983f6

Function at 0x27f790b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x72bf21ad
mov eax, dword [ebp + eax - 0x72bf21ad]
call fcn.02790bd7
adc esi, 1
or edx, edx
and cx, ax
not cx
sub dx, dx
mov word [esi], cx
jmp ebp
lea esp, [esp + 0xc]
je 0x27f7947
mov eax, 0x5f05e030
neg al
mov eax, dword [ebp + ebx*4]
push 0xf2296095
rol dword [esp], 0x5d
mov dword [esp], eax
push 0x7cb13a94
xor byte [esp], 0x21
dec dword [esp]
dec ebx
lea esp, [esp + 4]
jne 0x27f7915
jmp 0x16476db

Function at 0x27f9c88
Capabilities:
Encrypt data using speck

Disassembly:
bts eax, edx
adc ax, 0x7485
mov dword [eax + edi - 0x7892cc0], ecx
adc edx, eax
movzx ecx, ax
jmp esi
push 0xa33ddebc
mov dword [esp + 0xc], 0xb3b2f694
lea esp, [esp + 0x24]
jne 0x28d4902
mov edx, 0xada2a08b
movzx edi, dl
shr dx, 0x85
pop edi
mov eax, 0x689b83b
mov edx, eax
rol edx, 0xd8
not ecx
jae 0x22c2bb8

Function at 0x280c7df
Capabilities:
Encode data using xor

Disassembly:
call fcn.02585310
xor esp, esi
rol ax, 0xa
adc ecx, edx
shr ax, 0x47
add edx, 0xf12db206
cwd
neg ecx
jmp 0x26c3353
push 0x96a34f38
ror ecx, 1
mov dword [esp + 0xc], 0xf604493e
dec edi
mov dword [0xc7c9d196], eax
inc esp
and al, 0xc
dec ecx
add al, 0xf6
inc ecx
ror ecx, 1
push 0xb1382a06
mov dword [esp + 8], 0x76a6402e
shl dword [esp + 6], 0xd5
xor ebx, ecx
call fcn.0261d454
xor eax, 0xe7d1ceb0
dec ebp
jnp 0x280c7e1
addps xmm1, xmmword [ebx + 0x67]
cwde
int1
loopne 0x280c7c4
mov al, 0xd1
invalid

Function at 0x281ec53
Capabilities:
Encode data using xor

Disassembly:
shl dword [esp + 8], 0xaf
adc eax, edx
push 0xa8a5b732
push 0x30e798d
dec byte [esp]
mov dword [ebp - 4], eax
mov dword [esp + 8], 0x96362388
push 0xbd1ef7b0
test ebx, ebx
lea esp, [esp + 0x18]
je 0x27cbcf5

Function at 0x2822242
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, 0x9309bc06
neg dx
push edx
not ecx
xor dword [esp], 0x19270a93
mov dword [esi], ecx
adc dx, dx
movsx eax, byte [esp]
div al
mov dword [esp + eax - 1], ebp
ret
lea esp, [esp + 0x10]
je 0x258b6c6
push esi
mov esi, 0xaf38ea10
sar esi, 1
inc esi
movzx esi, byte [edx]
call fcn.0256bd60
mov dword [esp + 4], 0xbd19c410
jmp fcn.015e3250
test eax, eax
push 0xc71a8f1d
jmp 0x27628d2

Function at 0x2825c96
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], ebx
mov dword [esp], 0xfb0e4093
jmp 0x2604bb4
Function at 0x284f7f5
Capabilities:
Encode data using base64
Encrypt data using speck
Manually build aes constants

Disassembly:
neg dword [esp + edx*8 - 0x68da1f4c]
inc ecx
xor dword [esp + edx - 0xd1b43e6], 0x1685a02f
xor ebx, ecx
mov dword [esp + edx*2 - 0x1a3687d4], 0xd63bf
call fcn.0287b758
mov edx, 0xdf1a0684
shr edx, 0x7b
call fcn.0228aeec
adc edi, 1
neg cl
imul ecx, ecx
xor al, bl
not cx
sar cl, 0x42
add al, cl
btr ecx, 0x25
neg ecx
add cx, cx
ror al, 1
neg cx
push ecx
jnp 0x27f31f7
xor al, 0x27
bts ecx, ecx
not al
ror cx, 0xa1
adc al, 0xa8
xchg byte [esp + 3], ch
rol dword [esp], cl
xor bl, al
jmp 0x269fc63

Function at 0x28521b6
Capabilities:
Encrypt data using speck

Disassembly:
sub eax, eax
bt eax, ecx
lea ebp, [ebp + eax + 4]
call fcn.025835df
push ecx
mov edx, dword [edi + ecx - 0x11bd3971]
shl ecx, cl
dec dword [esp + ecx - 0x72e20000]
sub cl, byte [esp + ecx - 0x72e1fffd]
lea edi, [edi + ecx - 0x72e200eb]
sub cl, ch
movsx eax, cl
xor edx, ebx
inc edx
dec byte [esp + ecx - 0x72e200ef]
and ecx, dword [esp + ecx - 0x72e200ef]
dec ecx
bswap edx
xor edx, 0xeb9efb3c
xchg word [esp + ecx*2 - 0x214000dc], ax
neg word [esp + ecx - 0x10a0006c]
lea edx, [edx + ecx*4 - 0x2774e81a]
imul ax, ax
xor al, ch
not edx
xor ax, word [esp + ecx*2 - 0x214000da]
dec al
ror edx, 1
btr eax, 0x11
not byte [esp + ecx - 0x10a0006c]
and cx, 0xe31a
lea edx, [edx + ecx*4 + 0x11b2fc8e]
xor ebx, edx
add esi, edx
mov edx, eax
xor dword [esp + ecx*4 - 0x42800028], 0xd73eb736
shl byte [esp + ecx*4 - 0x42800027], 0x43
mov dword [esp + ecx*4 - 0x42800028], esi
ret
not eax
sar al, 0x25
mov dword [ecx + eax*2 - 0x4e7fe200], edx
add eax, eax
lea edx, [eax - 0x3a57c97b]
lea edi, [eax + edi - 0x4e7fe204]
ror ax, 0xa9
sar eax, 0x97
jnp 0x286e68a
mov ecx, dword [edi + eax*4 - 0x270]
xor ecx, ebx
bswap eax
sub ecx, 0xd39be689
bswap ecx
div eax
inc edx
cwde
not ecx
btc eax, 0xa5
sbb ecx, 0x4aaaab9a
cwde
xor ebx, ecx
add ebp, ecx
inc eax
jl 0x230f0a3
add ebp, edx
lea esp, [esp + 0x14]
call fcn.024deca4
mov edx, 0x21b625b3
movsx eax, dl
or eax, eax
mov ax, word [ebp + edx*2 - 0x436c4b66]
mov dx, word [ebp + edx - 0x21b625b1]
mov ecx, 0x9ae2f2d
adc cx, cx
rol ecx, cl
lea ebp, [ebp + ecx - 0x6826b977]
rol ecx, cl
ja 0x2896bce
setnp cl
not ax
not dx
or ax, dx
mov edx, 0xe113138f
sub ecx, edx
mov word [ebp + ecx*4 - 0x46f4e5c4], ax
jns 0x25c5dde
mov ecx, 0x610eca1e
rol cx, 0xe4
lea eax, [ecx*4 - 0x6ce5d77e]
lea ebp, [ebp + eax*4 - 0x5d52c0cc]
mov eax, dword [ebp + eax - 0x1754b032]
jb 0x27dad36
lea edx, [ecx + ecx - 0x68c1fd60]
setb dl
xor eax, ebx
sub ecx, edx
add dl, dh
and dl, dh
rol eax, 3
not eax
btc cx, dx
btr dx, dx
inc eax
sub ecx, edx
ror ecx, cl
ror dl, 0x24
neg eax
imul dx, dx
xor ebx, eax
dec edx
jo 0x156c241
add esi, eax
bt edx, ecx
ror cl, 0x61
movzx ax, byte [edx + edi - 0x595ba3ff]
xor dl, ch
mov cl, byte [edi + edx - 0x595ba39d]
inc dl
shr dl, 0xa6
lea edi, [edi + edx - 0x595ba300]
neg dx
imul dx, dx
inc edx
shr al, cl
mov word [edi + edx - 0x595b8c05], ax
jmp esi
Function at 0x285d2e3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg edx
cwde
pop ecx
xor ebx, edx
add byte [esp + eax*2 + 3], al
idiv byte [esp + eax + 3]
add ebp, edx
btc cx, ax
mov dword [esp + eax*8], ebp
ret 4
call fcn.02681259
mov edx, 0x731e5d09
mov edx, dword [esi + edx - 0x731e5d09]
mov eax, 0xbf31e697
movzx ecx, al
mov cx, word [esi + ecx - 0x93]
push eax
bt eax, 0x9c
adc esi, 5
push eax
push eax
mov word [edx], cx
movsx edx, ax
dec eax
movzx ecx, word [esp + 3]
mov edx, dword [edi + ecx - 0x97bf]
or byte [esp + ecx - 0x97ba], al
lea edi, [edi + ecx - 0x97bb]
xor edx, ebx
sal dword [esp + ecx - 0x97b7], cl
rol edx, 1
and ax, cx
add dword [esp + ecx*2 - 0x12f7b], eax
dec edx
lea ecx, [ecx*2 - 0x297db0ff]
shl eax, 0xd2
sub dword [esp + eax*2 - 0x34affffd], eax
not edx
inc ecx
adc ecx, dword [esp + eax*4 - 0x69600000]
jno 0x2325d52
mov ecx, 0x90260697
mov ecx, dword [edi]
add edi, 4
mov edx, 0xe2a82e01
bswap edx
mov eax, edx
xor ecx, ebx
xor ecx, 0xed1a28a0
sar edx, 0xba
not byte [esp + edx]
xor ebx, ecx
add ebp, ecx
not word [esp + edx + 2]
cbw
lea edi, [edx + edi - 6]
btr eax, 0x9e
imul edx, dword [esp + edx]
and dx, word [esp + edx - 0xf08ea93]
movzx edx, byte [edi + edx*2 - 0x1e119514]
bswap eax
jae 0x25d5a35