joyce8/EMBER2024-capa huggingface dataset:
Function at 0xda2d99
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x28a7e7e2], ecx
mov cl, byte [ebp + ecx*2 - 0x514fcfc2]
rol word [esp], 0xa4
jae 0x1116262
call fcn.01197982

Function at 0xdad848
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ecx
neg byte [esp + 0xe]
call fcn.00d3cd7b
ficomp word [ecx + 0x1a]
mov al, 0xea
or byte [ebp + eax*8 + 0x224bea3a], ah
rol dword [esi + 0x61d1bd82], 1
pop ebp
dec ecx
neg ecx
sal dx, 0x4f
sub eax, 0xd09eb2b3
dec ecx
xor eax, eax
xor ebx, ecx
not dl
shl dl, 1
bts eax, edx
adc ebp, ecx
call fcn.010f34a5
xlatb
pop eax
push cs
mov ecx, 0xc4b80ef1
push cs
cwde

Function at 0xdaf820
Capabilities:
Encrypt data using speck

Disassembly:
shr byte [esp + ecx - 0x6b3d7ff8], 0x24
movzx edx, word [esp + ecx - 0x6b3d7ff8]
bswap eax
neg dx
jno 0xf79858
jg 0x19c53f6
add dl, 4
not dl
lea ecx, [ecx*4 + 0x382bb1bc]
mov dword [esp], eax
xor bl, dl
mov dword [esp + 4], eax
lea edx, [esp + edx + 0xc]
and al, 0x99
mov ecx, dword [edx]
sbb edi, 4
or dword [esp + 2], 0x1fb68501
or eax, dword [esp + 8]
cbw
mov dword [edi], ecx
xor eax, eax
lea edx, [eax*4 - 0x114633cb]
pop edx
pop eax
pop ecx
jp fcn.00e5d080
mov ecx, 0xeb3d0490
movzx eax, cx
mov edx, eax
movzx ax, byte [eax + esi - 0x490]
xadd dx, cx
btr ecx, 0x1f
not edx
mov dl, byte [ecx + esi - 0x6b3d048e]
sal cx, 0x4b
lea esi, [esi + ecx - 0x6b3d7ffe]
btc ecx, ecx
jae 0xe64fb1
xchg ebx, eax
inc edx
add byte [ecx - 0x4be1818a], bl
dec edi
cdq
pop ss
popfd
neg dword [esi - 0x67]
invalid
adc al, dl
push ecx
mov word [esi + ecx - 0x6b3d8001], ax
mov eax, dword [ebp + ecx - 0x6b3d8001]
shr byte [esp + ecx - 0x6b3d7ffe], cl
lea ebp, [ecx + ebp - 0x6b3d7ffd]
xor cl, cl
xor eax, ebx
rol eax, 1
push ecx
jmp 0xfd0947
xor edx, ebx
mov ecx, eax
push ecx
inc ecx
sub edx, 0xba9afa80
bswap edx
sal byte [esp], 0x64
lea edx, [edx + ecx - 0x1b2bdda1]
rol eax, 0x65
not dword [esp]
ror edx, 2
dec ecx
xor ebx, edx
inc dword [esp]
neg cx
jno 0xff6b3d
mov edx, 0x53168d94
movsx eax, dl
imul edx
sbb esi, 3
movsx ecx, dl
mov edx, dword [esi]
shl ax, 0xe4
lea ecx, [eax*4 + 0x13b6909d]
setns al
xor edx, ebx
not ax
dec cx
sar ecx, 0x3c
neg edx
shr cl, 0xc6
xor edx, 0x7f1096ae
btr ecx, 0x9b
neg edx
ror edx, 1
xor ebx, edx
add ebp, edx
imul eax, ecx
jb 0xf2f25c
mov eax, dword [edi + eax - 0x6acef6fa]
lea edx, [ecx - 0x6c49f07d]
movzx cx, byte ss:[eax]
adc edi, 1
lea eax, [edx + edx*8 - 0x4fd56dc2]
cwde
mov word [eax + edi - 0x14f4], cx
sar ax, 0xc3
inc edx
jmp ebp
shr dword [esp + 8], 0x61
inc ecx
call fcn.01a33e91
push ecx
lea eax, [eax + ecx - 0x73c3d182]
jmp 0xd0bf01
add esi, edx
mov eax, dword [ebp]
ror ecx, 0x7c
btc ecx, ecx
adc cx, word [esp + 1]
movzx cx, byte [eax]
adc ebp, 2
jmp 0x19cdcaa
lea eax, [ecx + eax + 0xfd8d030]
not eax
call fcn.00e7a349
sub edi, 4
mov eax, 0xadae853c
mov edx, dword [edi]
jmp 0xebeaad
push 0xdea26d08
pop eax
mov word [ebp + eax*2 + 0x42bb25f0], cx
shr al, 0xe5
dec dword [esp + eax*2 + 0x42bb2600]
push eax
mov dword [esp + eax*2 + 0x42bb2600], esi
ret 4
Function at 0xdb4d09
Capabilities:
Encrypt data using speck

Disassembly:
mov word [ebp + edx*2 - 0x13440000], ax
sub edx, 0x8d9eccad
bts edx, edx
shr edx, 0xa7
mov edx, dword [esi + edx*2 - 0x1f02ccc]
mov ecx, 0x269f109b
lea esi, [esi + ecx - 0x269f1097]
xor edx, ebx
lea eax, [ecx*8 + 0x2c084209]
bt ecx, eax
neg edx
dec eax
or eax, eax
lea eax, [eax + ecx*8 - 0x70f1bde7]
lea edx, [edx + eax + 0x149f9c45]
dec ecx
ror edx, 1
and ecx, ecx
inc eax
not edx
sbb edx, 0x609358a0
xor ebx, edx
add edi, edx
rol eax, 0x9a
movsx edx, al
sub dx, ax
jmp edi
call fcn.019e391c
mov ecx, 0x9f240aa0
mov eax, dword [ebp]
add cl, cl
mov cx, word [ebp + 4]
mov edx, 0x42031024
lea ebp, [ebp + edx - 0x4203101e]
adc edx, edx
sub edx, edx
jno 0xf24119
mov eax, 0x6a8ef18a
lea edi, [edi + eax - 0x6a8ef18e]
rol eax, 0x69
mov ecx, dword [edi + eax*2 - 0x3bc629aa]
lea edx, [eax + eax*4 - 0x2655d35c]
xor ecx, ebx
cdq
ror ecx, 1
sub ecx, 0x912a2cb4
rol ecx, 2
imul eax
inc ax
setne al
xor ecx, 0x8c14f4bc
dec dx
neg ecx
bts eax, eax
xor eax, edx
shr dx, 0x61
dec ecx
shl dx, 0x67
cwde
not ecx
neg dl
inc edx
or ax, 0x1486
bswap ecx
lea edx, [edx*4 + 0x59a83235]
push eax
sal word [esp + edx - 0x679c5637], 0x2e
xor ecx, 0xb6be0625
or edx, dword [esp + edx - 0x679c5639]
and edx, 0xdc3feb1a
bswap ecx
dec eax
jl 0x105e9f7
inc dword [esp + edx*4 - 0x28]
bt edx, eax
mov ecx, dword [ebp + eax*2 - 0x5e4532f6]
mov ax, word [ecx + eax*2 - 0x5e4532f6]
xchg byte [esp + edx*8 - 0x4f], dl
sar edx, 0x31
jae 0x10d5f10
jno 0xd815af
not eax
inc ecx
lea edx, [edx*8 + 0xe3c780e]
jmp 0x10672f9
not ecx
neg dx
lea ecx, [edx + ecx + 0x5cfed487]
dec dl
neg dword [esp + eax - 0x2a5a]
xadd eax, edx
xor ebx, ecx
shr edx, 0x6a
add esi, ecx
jmp 0xf05bea
lea ebp, [ebp + edx*8 + 2]
add edx, 0x1ca3ad9b
mov word [ebp + edx - 0x1ca3ad9b], ax
xadd dword [esp + edx*2 - 0x39475b36], edx
movsx eax, dl
mov dword [esp + edx - 0x3fff0a5b], esi
ret

Function at 0xdd5947
Capabilities:
Authenticate hmac

Disassembly:
not ecx
shr dl, 0x46
rol ecx, 1
and ax, dx
mov dword [esp + edx*2 - 0x250dbdfe], edx
neg ecx
ror edx, 0x8e
imul dword [esp + edx - 0x7c044a13]
cdq
xor ecx, 0x2aa17ab6
lea ecx, [edx + ecx + 0x1d12cc3d]
neg ecx
xor ebx, ecx
cwd
mov dword [esp + edx*8], edx
add edi, ecx
movzx ecx, dx
jmp 0x1a0c8b7
mul word [esp + edx + 3]
xor cx, word [ebp + edx - 0x6e]
lea ebp, [eax + ebp - 0xacbfffe]
mov dl, byte [esi + edx - 0x6e]
shl dword [esp + eax*2 - 0x1597fffb], 0x74
xor eax, 0xf9958736
adc esi, 1
xor eax, eax
cmove eax, dword [esp + eax*4 + 8]
sete byte [esp + eax*8 - 0x7d35d]
xor dl, bl
sub eax, 0x2e284d81
jle 0xd6afc7
Function at 0xde3ad5
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, 0xc49d9f9c
lea edi, [ecx + edi - 0xb244]
shr eax, 0xbf
jp 0x11865bc
mov edx, dword [edi + ecx - 0xb240]
sub cx, 0x3990
rol cl, 0x86
adc ecx, eax
xor edx, ebx
sub edx, eax
cbw
jmp 0xdd2c10
neg al
not edx
sbb edx, 0x9f09e9ba
not edx
sub ax, cx
jg 0xf0215f
adc cx, 0xef3b
xor edx, 0x6586ac0a
xor ebx, edx
or eax, 0x75b5b093
adc esi, edx
shl cl, 0x46
jmp esi
neg dword [esp + 4]
mov dword [esp], 0x902c560d
xor edx, edx
sar dword [esp + 4], 0x9c
ja 0xe0873b
shr dword [esp + 4], 0x8c
test ecx, ecx
lea esp, [esp + 8]
je 0xfa2897
call fcn.019c5ea0
mov ecx, dword [ebp]
mov ax, word ss:[ecx]
mov edx, 0x94803a26
movsx ecx, dl
xadd dl, dh
lea ebp, [ebp + ecx*2 - 0x4a]
imul cx, dx
mov word [ebp + ecx*2 - 0x16480], ax
jo 0xdb5b50
mov edx, 0xc0aef88e
mov ecx, edx
push ecx
movzx eax, word [edi]
sar cx, cl
inc dword [esp]
adc edi, 1
xchg ecx, edx
add dword [esp], edx
xor ax, bx
push ecx
call fcn.019fc22e
not cx
call fcn.00ff5e8d
not edx
mov ecx, 0x65a41931
mov dword [ecx + ebp - 0x65a41931], edx
movzx eax, cx
lea edi, [edi + eax*2 - 0x3266]
mov edx, ecx
push edx
add ecx, edx
mov edx, dword [edi + eax*2 - 0x3262]
xor edx, ebx
xadd dword [esp + eax*2 - 0x3262], ecx
sar al, 0xa2
sbb edx, 0xd4aef2bf
bswap eax
btc ecx, 0x95
sbb al, 0xaa
xor edx, 0x3ea05198
neg edx
xor ax, cx
dec edx
pop eax
imul ax, cx
xor edx, 0xc526572d
push eax
xor ebx, edx
sub cx, word [esp + eax*2 - 0x61d9a444]
add esi, edx
ror eax, cl
mov dword [esp + ecx - 0x6584e845], esi
ret

Function at 0xe181fc
Capabilities:
Encrypt data using speck

Disassembly:
not al
xor ebx, ecx
inc edx
mul eax
add edi, ecx
inc dword [esp + edx - 0x5a3fffb]
mov eax, dword [edx + esi - 0x5a3ffff]
lea ecx, [edx + edx*4 + 0x5997c783]
mov dword [esp + ecx - 0x75cbc77e], edx
jge 0x109e5bf
mov edx, dword [edx + esi - 0x5a3fffb]
ror dword [esp + ecx - 0x75cbc77e], 0x79
lea esi, [esi + ecx - 0x75cbc776]
mov dword fs:[eax + ecx - 0x75cbc77e], edx
movzx edx, cx
mov dword [esp + ecx - 0x75cbc77e], edi
ret 4
Function at 0xe25885
Capabilities:
Encrypt data using speck

Disassembly:
adc ebp, 4
div ecx
call fcn.00e6ae86

Function at 0xe258a4
Capabilities:
Encrypt data using speck

Disassembly:
inc edi
mov esp, dword [edi]
sub byte [esp + 0x1c], 0xa1
dec eax
mov dword [esp + 0x10], 0x45a610b5
shr ebx, 8
sar byte [esp + 0x16], 0xa7
setp byte [esp + 0x1f]
inc ecx
xor ebx, esp
sal word [esp + 0x14], 0x84
dec eax
mov dword [esp], 0x631f1001
dec eax
inc edi
dec eax
rol dword [esp], 0xa9
jae 0xfadcb3
dec eax
not dword [esp + 0x18]
xor ebx, 0x333513ba
dec eax
dec edx
call fcn.0105fb3b

Function at 0xe2d456
Capabilities:
Encode data using base64

Disassembly:
cwde
mov dword [esp + eax*2], edx
mov word [edi + eax*2], cx
mov ecx, dword [ebp + eax*4]
lea ebp, [ebp + eax*2 + 4]
shr ax, 0xb
setnp al
xor ecx, ebx
cwde
push eax
bswap ecx
cdq
sub ecx, 0x979cf036
sub dx, dx
xadd dword [esp + eax*2 + 4], edx
not ecx
neg dword [esp + eax + 4]
imul ax
lea ecx, [ecx + edx - 0x76181a65]
xor ax, 0xc10f
shl dx, 0x6e
cwde
ror ecx, 2
bswap ecx
ror ecx, 2
push edx
xor ebx, ecx
and eax, 0x201878b7
xchg edx, eax
sbb dword [esp + edx*2 - 0x4030800c], 0x68190ba1
add esi, ecx
mov ecx, dword [esp + edx - 0x20183fff]
sar byte [esp + ecx - 0x6d516c2], 0xe2
pop ecx
pop edx
pop ecx
jb fcn.00f18fc4
mov ecx, 0x4217c182
mov ax, word [ecx + esi - 0x4217c182]
neg ecx
lea edx, [ecx*2 - 0x6acc5a4c]
mov dx, word [edx + esi - 0x110422ae]
mov cl, byte [esi + 4]
push 0xc087749f
or word [esp + 1], 0x4798
adc esi, 4
rol word [esp + 1], 0xe3
shrd ax, dx, cl
mov ecx, dword [esp]
sub ecx, dword [esp]
xadd word [esp + ecx], cx
mov word [esi + ecx*4 - 0x39a7c], ax
lea eax, [ecx + ecx*2 - 0x6963e8dd]
mov eax, dword [edi + ecx - 0xe69f]
lea edi, [edi + ecx - 0xe69b]
lea ecx, [ecx + ecx*4 + 0x3786db91]
xor eax, ebx
inc dword [esp + ecx*2 - 0x6f16b958]
lea edx, [ecx - 0x62d280e8]
not eax
pop ecx
neg eax
xor eax, 0x89804388
shl dx, 0xe7
bswap eax
inc ecx
xadd dx, cx
xor ebx, eax
shr ecx, 0xef
push ecx
call fcn.00d98f95
Function at 0xe4d1fe
Capabilities:
Encrypt data using speck

Disassembly:
btc edx, 0xa3
and ecx, 0x9615e70a
not eax
xor ebx, eax
btr cx, dx
not edx
inc cx
adc esi, eax
imul edx, ecx
mov eax, dword [ebp + edx*2 - 0x6f3bc562]
bts edx, 0x8b
ror edx, cl
lea edx, [ecx*2 - 0x777fd075]
mov edx, dword [ebp + 4]
sub cl, 0x29
shr cl, 0x43
adc ebp, 4
neg cx
or eax, edx
mov edx, ecx
not eax
xchg dx, cx
lea ecx, [edx*4 + 0x5eadf225]
mov dword [ebp], eax
movzx eax, dx
jmp esi
mov dword [esp], 0x85387680
call fcn.00e22dda
mov ecx, 0xc10ac118
mov edx, 0x39246eb3
lea esi, [esi + edx*2 - 0x7248dd6a]
movsx eax, dl
mov edx, dword [esi + edx*2 - 0x7248dd66]
sar eax, 0xbe
xor edx, ebx
neg cl
call fcn.010d52d7
mov edx, 0xf1b13a02
mov ecx, dword [edi]
jmp 0x1225da4
add ebp, ecx
lea ecx, [eax + eax*4 - 0x6d4b205b]
bswap edx
idiv eax
rdtsc
push ecx
add dword [esp + ecx - 0x1de7f110], 0xde9bfd05
bswap ecx
lea esi, [ecx + esi - 0x10f1e725]
sbb ecx, dword [esp + ecx - 0x10f1e71d]
mov dword [ecx + esi - 0x146df904], eax
and cl, 0xbd
mov dword [esi + ecx*4 - 0x51b7e420], edx
shr cx, cl
shl dword [esp + ecx - 0x146d00f9], 0xd8
pop ecx
jp fcn.00de3977
rol eax, 0x72
ror ecx, 2
not ecx
and ax, dx
sal eax, 0x81
sbb ecx, 0xef08573e
sal ax, 0x2a
btr eax, edx
cbw
xor ecx, 0x2794f913
rol ecx, 1
sar edx, 6
lea eax, [eax*2 + 0x4f2436af]
xor ebx, ecx
jmp 0xe6e52d
not edx
movsx eax, dl
lea edi, [edi + edx*8 - 0x72762fe4]
shr dl, 0x83
rol eax, 0x9e
xor ecx, ebx
neg ecx
dec eax
jne 0x116bf4d
mov ecx, 0x332c2b11
mov eax, ecx
lea edi, [edi + ecx*2 - 0x66585626]
ror ax, 0x8e
rol ecx, 0xfd
mov eax, dword [edi + ecx - 0x26658562]
movsx edx, cx
not ecx
xor eax, ebx
and dx, dx
dec cl
not eax
or edx, edx
neg edx
inc eax
btc ecx, 2
neg eax
jmp 0xcef128

Function at 0xe53d7a
Capabilities:
Encrypt data using speck

Disassembly:
setne cl
jb 0xf2ee04
rol eax, cl
pop ecx
add ecx, 0xffcbb0c4
jmp ecx

Function at 0xe6620b
Capabilities:
Encrypt data using speck

Disassembly:
not byte [esp + 8]
mov dword [esp], 0x3424788f
neg edx
neg word [esp + 1]
mov dword [esp + 4], 0x69108509
push 0xe6a9bf29
dec edx
call fcn.00ce480f
lea ecx, [edx + ecx*8 - 0x24f12b43]
inc ecx
rol eax, 3
neg eax
jmp 0xec7bc8
shl cx, 0xe9
rol eax, 2
rol edx, 0x73
push ecx
not eax
xchg cl, dl
shl edx, 0x25
rol eax, 3
xor edx, ecx
ror byte [esp + ecx - 0x254974d7], 0xa6
inc cx
lea eax, [eax + edx*2 - 0x1970487f]
xadd ecx, edx
xor ebx, eax
push ecx
add esi, eax
sub dx, 0xf696
call fcn.0110e9d4

Function at 0xe69f7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror cx, cl
xor ebx, eax
imul edx, dword [esp + ecx - 0xdbfc]
mov word [esp + ecx*2 - 0x1b7fa], cx
adc edi, eax
call fcn.00e1a7f9
call 0x4fc3b1d8
test dword [esi], edi
push ds
cmp eax, 0x3e0d834d
push ds
cmc
inc edi
pop esp
cmc
loope 0xe69f84
or al, 4
and al, 0xff
jmp dword [esi - 0x77]
movsb byte es:[edi], byte [esi]
std
invalid
Function at 0xe6e57b
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + ecx*2 - 0x5b7965e0], 0xbc9f1535
sal dword [esp + ecx - 0x2dbcb2ee], 0x4b
bswap edx
mov dword [esp + eax - 0x4ce51292], eax
pop eax
and word [esp + eax - 0x4ce51290], cx
dec edx
ror edx, 2
cwde
add ecx, ecx
xchg cx, ax
xor ebx, edx
call fcn.0121a198
inc ecx
mov eax, 0xb601e397
inc ecx
movzx eax, al
inc ebp
movzx ecx, ax
dec ebp
mov eax, esi
movsx ebp, ax
inc ecx
mov edi, ecx
dec eax
lea edx, [edi + 0x2f1c4484]
dec esi
lea esi, [eax + esi - 0x99]
inc esp
movzx ebx, bh
inc bp
mov dword [esi + eax - 0x97], eax
dec esi
lea edx, [eax + edx - 0x9b]
mov ecx, edi
inc esp
xadd dl, cl
sal cx, 0xc3
inc ecx
mov ecx, dword [edx + eax*4 - 0x25c]
bt ebp, ebp
inc ecx
xor ecx, ebp
call fcn.00d1d875
mov edx, 0xa53b4637
add edx, edx
mov ax, word [esi + edx - 0x4a768c6e]
mov ecx, 0x7f246c37
sar edx, cl
neg dl
mov cl, byte [esi + edx*2 - 0xd6]
neg dx
btc edx, edx
rol dx, 0x41
lea esi, [esi + edx*8 - 0x87f946]
sar dx, 0xeb
sal ax, cl
movsx ecx, dl
shl edx, cl
mov word [esi + edx - 0x80000000], ax
mov ecx, dword [ebp + edx - 0x80000000]
movzx eax, dx
js 0xf81572
or edx, edx
not al
jbe 0x1a13884
neg dl
rol edx, 1
rol al, 1
rol dl, 0x85
xor al, 0x27
xor bl, al
call fcn.0107f4c8
rol edx, cl
sub edx, 0x843c2c1a
neg cl
sar eax, cl
xor ebx, edx
add ebp, edx
rol ax, 0x26
sbb eax, ecx
mov eax, dword [ecx + esi - 0x29df0e3e]
mov edx, ecx
setnp dl
mov edx, dword [esi + ecx - 0x29df0e3a]
mov cl, byte [esi + ecx*2 - 0x53be1c74]
push 0x780ae396
shr word [esp + 1], 0xac
adc esi, 5
shld eax, edx, cl
mov dword [esi], eax
mov eax, 0x459b1a93
mov dword [esp + eax - 0x459b1a93], ebp
ret
lea ebp, [ebp + eax + 4]
adc eax, 0x3a8e55a6
sbb eax, edx
xor ecx, ebx
lea edx, [eax*4 + 0x53955385]
btc ax, ax
add ax, 0xdf96
rol ecx, 3
xadd edx, eax
neg ecx
cwde
btr dx, 0x39
bt edx, eax
dec ecx
xor ecx, 0x5e01ef84
sar edx, 0x9f
btc dx, ax
idiv ax
inc ecx
bswap ecx
sar eax, 0x2b
xor ecx, 0x332b5d35
xor ebx, ecx
inc edx
call fcn.010e4734
push 0xaeb31824
mov eax, 0xa79c690f
mov dx, word [esi]
mov ecx, 0x7d91ce07
shr word [esp + ecx - 0x7d91ce06], cl
adc ax, 0xa79e
lea esi, [ecx + esi - 0x7d91ce05]
lea edi, [ecx + edi - 0x7d91ce08]
xchg dword [esp + ecx - 0x7d91ce07], eax
xor cl, byte [esp + ecx - 0x7d91ce05]
movzx ecx, byte [edi + ecx - 0x7d91ce9b]
xor cl, bl
bswap eax
dec cl
cbw
xor cl, 0x30
not cl
mov dword [esp + eax*2 - 0x48cdff5c], eax
pop eax
add cl, 5
xor eax, eax
jg 0xf39321
rol cl, 1
inc cl
inc ax
sar eax, 0x92
shr al, 4
xor bl, cl
imul ax, ax
sub ax, ax
sar eax, 0xda
adc ecx, esp
push eax
and al, byte [esp + 1]
ror dword [esp], 0x45
mov byte [ecx], dl
movzx edx, byte [esp]
lea edi, [edx + edi - 4]
adc eax, dword [edx + edi]
dec edx
push edx
xor eax, ebx
pop edx
neg dword [esp]
shr edx, 0xc
xor eax, 0x71ab7537
shr dl, 0x66
mov ecx, dword [esp + edx - 0xfff03]
adc eax, ecx
not byte [esp + edx*8 - 0x7ff816]
bswap eax
not eax
xor ebx, eax
pop edx
not ecx
add ebp, eax
sar dl, 5
jmp ebp
btr eax, edx
or edx, eax
not ecx
and al, dh
or dl, 0x33
inc ecx
bswap edx
xor ebx, ecx
or dl, 0x8a
or al, dh
sar edx, 0x39
add ebp, ecx
bt edx, 0xbd
shr ax, 0xc3
mov dword [esp + edx - 0x1f], ebp
ret 4
Function at 0xea7a32
Capabilities:
Encode data using base64

Disassembly:
shr ecx, cl
xor ebx, edx
call fcn.00e04591

Function at 0xeab195
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xf5143486
jmp 0xed750d
add ebp, 4
sal dword [esp], 0xad
neg dword [esp]
push 0x6a93a0a7
xor edx, edx
call fcn.019ecb40
mov edx, 0xed00a224
movzx ecx, dl
lea esi, [ecx + esi - 0x28]
mov edx, dword [esi + ecx - 0x24]
mov eax, ecx
or eax, 0x1b824290
xor edx, ebx
sub cx, ax
neg eax
not edx
not eax
jl 0xda2d7c
mov edx, dword [edi]
add edi, 4
mov ecx, 0x3fb81a23
movzx eax, cx
xor edx, ebx
dec edx
shr ax, 0x6a
sal al, 0x21
xchg ecx, eax
bswap edx
push ecx
rol eax, cl
dec edx
bswap edx
not eax
not ecx
btc ecx, ecx
not edx
xor ebx, edx
not dword [esp + eax - 0x7e5dcc04]
jmp 0x1160f9a
add ebp, edx
xadd dword [esp + eax - 0x7e5dcc04], eax
mov edx, dword [esi]
jp 0x10d481f
not cx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
adc esi, 3
inc word [esp]
div ecx
mov dword [esi], edx
mov dword [esi + 4], eax
pop eax
jmp ebp

Function at 0xeb30dd
Capabilities:
Encrypt data using speck
Manually build aes constants

Disassembly:
mov dword [esp + 0x10], 0xfc2de104
xor ecx, 0x5617722e
mov dword [esp + 0x14], 0x351d770c
dec edx
lea esp, [esp + 0x1c]
jne 0x10d5ce1
mov edx, 0x649006a4
pop edi

Function at 0xec7c03
Capabilities:
Encrypt data using speck

Disassembly:
lea edx, [edx*2 - 0x4879f27f]
or cl, al
not cl
movzx eax, dl
mov word [esi + eax*2 - 0x102], cx
sub eax, edx
bt edx, edx
mov dword [esp + edx - 0x77860d81], 0x5279782
mov ecx, dword [edi + edx - 0x77860d81]
lea edi, [edi + edx - 0x77860d7d]
adc byte [esp + edx - 0x77860d80], dh
add al, 0xb5
xor ecx, ebx
lea ecx, [ecx + edx*2 - 0x24557c57]
bswap ecx
cwde
xor eax, eax
lea ecx, [edx + ecx + 0x51a65ba4]
adc dl, dh
call fcn.019ac2f5
mov ecx, 0xe49ae4ac
mov ecx, dword [ebp]
mov edx, 0x749a3515
lea ebp, [ebp + edx - 0x749a3511]
call fcn.00efcedd

Function at 0xefe7a0
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x11a4768
mov dword [esi + edx - 0x60b1f801], eax
jmp edi
mov dword [esp], edi
call fcn.019be472
add edx, edx
lea esi, [esi + edx - 0x7450f9fa]
xadd dl, dh
setp dl
imul edx, edx
shr eax, cl
and dx, dx
js 0x107f641
Function at 0xf01648
Capabilities:
Authenticate hmac

Disassembly:
setae byte [esp + 2]
adc edi, 3
call fcn.0102d7f4
mov dword [esp], eax
call fcn.019a8b82
mov edx, 0xfe952ca7
xor dl, dl
mov ecx, dword [ebp]
bt edx, 7
adc ebp, 4
push edx
sal edx, 0x42
jne 0x104704b
jb 0xd99525
mov eax, 0xeb10a94
call fcn.01210f6f
mov edx, 0xc9acb99f
lea ecx, [edx + edx*4 + 0x6e201685]
lea ecx, [ecx + edx*2 + 0x25b26588]
mov eax, dword [ebp + ecx*2 - 0x2f171ecc]
imul edx, ecx
xor edx, ecx
lea ebp, [ebp + ecx - 0x178b8f62]
xor eax, ebx
xadd cl, dl
xor eax, 0xc494929c
push ecx
jmp 0xfed334
inc eax
bswap eax
xor dword [esp + ecx*4 - 0x5e2e3e88], 0xd487af87
lea eax, [eax + ecx + 0x5b0f5d60]
dec byte [esp + ecx - 0x178b8fa0]
neg eax
xor eax, 0xa68f851f
xor cx, 0x979b
dec dword [esp + ecx - 0x178b1839]
lea ecx, [ecx*8 - 0x65050c3]
xor ebx, eax
add esi, eax
not dword [esp]
movzx ecx, byte [ebp]
inc dword [esp]
not dl
sal edx, 0x5c
adc ebp, 0
movsx eax, dl
lea edx, [edx + eax*2 + 0x448a6195]
xor cl, bl
not cl
inc eax
sub cl, al
not dl
or dword [esp + eax*2 - 2], 0xdf15f21d
sub byte [esp + eax*8 - 6], dl
ror cl, 1
and ax, 0xdd89
or ax, word [esp + eax*4 - 2]
xor dword [esp + eax - 0xff8b], eax
xor cl, 0x31
xor bl, cl
dec byte [esp + eax*2 - 0x1ff15]
lea edi, [edi + eax - 0xff8f]
shl byte [esp + eax - 0xff8a], 0x84
mov dword [edi + eax - 0xff8b], ecx
pop ecx
jp fcn.00f18fc4
mov eax, 0xd13fbf9b
mov ecx, eax
mov eax, dword [ebp]
xor ecx, ecx
and cx, cx
call fcn.00d833c2
not al
push eax
add ebp, edx
mul dword [esp + eax*4 - 0x3fc]
adc edx, dword [edi + ecx - 0x5f971c0d]
sar cl, 0xa2
mov cx, word [edi + eax*8 - 0x7f004]
imul ax, ax
lea edi, [edi + eax*2 - 0x1f800]
shl al, 0xe1
shr cx, 1
not eax
jmp 0x19b74d0
xor ecx, ebx
movsx eax, byte [esp]
cdq
rol byte [esp + edx + 2], 0xa3
adc ecx, 0xfb395914
and byte [esp + edx + 1], ah
lea edx, [eax*4 + 0x628ea50c]
bswap ecx
sbb word [esp + eax + 2], 0x571f
lea ecx, [ecx + edx + 0x258ad7a7]
sub al, byte [esp + eax + 1]
ror ecx, 3
sub ax, dx
xor ebx, ecx
cbw
not dl
add edi, ecx
imul eax
mov byte [esp + edx + 2], 0x90
movzx eax, byte [ebp + edx*2]
or byte [esp + edx + 1], dh
sar edx, 0x36
lea ebp, [edx + ebp + 1]
xor al, bl
lea ecx, [edx + edx*8 - 0x65ce6152]
mov word [esp + edx + 1], dx
call fcn.010d9399
cwde
rcr edx, cl
xchg word [esp + eax - 0x3fb], ax
ror dword [esp + eax], 0x8a
bts eax, eax
mov dword [edi + eax*8 - 8], edx
mov edx, eax
div byte [esp + eax + 2]
sub word [esp + eax*2 - 0x1fe], dx
mov dword [esp + eax - 0x100], ebp
ret

Function at 0xf11bbf
Capabilities:
Encrypt data using speck

Disassembly:
add edi, eax
mov dword [esp + ecx*4 - 0x3014354], 0xb51cbb20
movzx ecx, byte [ecx + ebp - 0xc050d5]
pop edx
or edx, 0xeb38db1d
sbb edx, edx
lea ebp, [ebp + edx*2 + 1]
xor cl, bl
movzx eax, dl
call fcn.010d2fba
Function at 0xf14b7b
Capabilities:
Encode data using xor

Disassembly:
adc ebp, eax
movzx ecx, byte [edx + edi]
neg dword [esp + edx*2 + 4]
sal dword [esp + edx + 4], 0x44
lea edi, [edi + edx*8 + 1]
pop edx
xor cl, bl
not cl
add cl, 0x2d
pop eax
cbw
rol cl, 1
movsx edx, al
dec edx
setg al
sub cl, al
xor bl, cl
lea esi, [esi + eax*4 - 0x3bc40006]
jmp 0x11568db
div eax
mov word [esi + eax*2 - 0x64c], cx
movzx ecx, dl
inc edx
jno fcn.00f82f13

Function at 0xf16c13
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
and dx, dx
or dword [esp + edx - 0x60e8742a], ebp
ret 4
not cl
rol dword [esp + edx + 4], 0x34
sar dl, 0xa6
bts edx, 0x3c
or al, cl
ror byte [esp + edx - 0x10000000], 0xe5
mov word [edx + esi - 0x10000000], ax
xchg dword [esp + edx - 0xffffffc], edx
jae 0xd447d1
mov eax, 0xf4023fa6
movsx edx, al
sar ax, 0xaa
mov ecx, dword [esi]
adc eax, edx
mov eax, dword [esi + 4]
adc esi, 3
bt edx, edx
adc ecx, eax
movzx eax, dx
mov dword [esi + eax*2 - 0x1ff4c], ecx
add ax, 0xed8f
mov eax, dword [eax + edi - 0xed35]
shl edx, 0x7d
movzx ecx, dl
lea edi, [ecx + edi + 4]
or dx, 0x63bd
xor eax, ebx
rol dx, 0xcf
neg eax
dec eax
xchg dh, cl
xor eax, 0xf292a034
call fcn.011a0a4a
xor ebx, ecx
pop edx
mov word [esp], ax
add ebp, ecx
movzx ax, byte [esi]
sub byte [esp + 3], 0xb0
mov ecx, 0x29a28312
lea edx, [ecx + ecx*4 - 0x33f002e8]
mov cl, byte [ecx + esi - 0x29a28310]
setl byte [esp]
btr edx, edx
ror edx, 0x32
lea esi, [esi + edx*2 - 0x46394e1a]
adc dword [esp + edx - 0x231ca70e], edx
sub edx, edx
push edx
not al
bt edx, edx
sar dx, 0xa1
jle 0xef78de

Function at 0xf2d657
Capabilities:
Encrypt data using speck

Disassembly:
add edx, 0x2bbb0322
jmp 0x115d630
jmp 0xfff64d
call 0xe8c184
or word [esp + 9], 0x5b27
shr dword [esp + 4], 0x11
ror edx, 1
mov dword [esp], 0x59335e0d
jmp 0x19bc2b7
neg edx
push 0xeca22fa5
dec edx
rol edx, 3
rol word [esp + 4], 0xae
neg edx
bswap edx
xor edx, 0xd687d50d
sub byte [esp + 2], 0x96
not word [esp + 0xa]
dec edx
neg byte [esp + 5]
xor ebx, edx
sal byte [esp + 0xe], 0xe1
sar word [esp + 0xe], 6
sal dword [esp + 9], 0x30
add esi, edx
lea esp, [esp + 0x10]
jmp 0xf9dc2d