joyce8/EMBER2024-capa huggingface dataset:
Function at 0x165a5f6
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + eax - 0x19c32214], edx
movzx ecx, byte [edi + eax - 0x19c32214]
sub eax, dword [esp + eax - 0x19c32214]
inc dx
and edx, edx
lea edi, [edi + eax*4 - 0x670c8d5b]
add edx, 0x5a32ca38
shr word [esp + eax - 0x19c32356], 0x26
ror dx, 0x81
xor cl, bl
mul edx
and al, al
sbb dword [esp + eax*2 - 0x2f1bed9a], 0x252cbc13
dec cl
pop eax
dec dl
ror edx, 0x37
rol cl, 1
call fcn.015d2dec

Function at 0x2238e4b
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x275f977
xor eax, ebx
lea eax, [eax + ecx*2 - 0x6c2247fe]
lea ecx, [edx + 0x55b9998d]
xor eax, 0x4c9a4508
dec eax
btc edx, edx
not eax
sar ecx, 0x9d
bt dx, dx
xor ebx, eax
sub cx, dx
lea edx, [ecx + edx + 0x212dda1d]
add ebp, eax
sub dl, dh
jmp ebp
mov dword [esp], esi
mov esi, 0x4e8d24ba
and esi, 0xfd13d784
not si
movzx esi, byte [edx + esi - 0x4c01fb7f]
xor esi, ecx
push 0x410c2129
or dword [esp], 0x551a9b9d
jae 0x1552f23
mov ecx, 0x8b3c1b88
mov cx, word [eax]
add esi, 2
mov eax, 0x58a05229
mov word [eax + esi - 0x58a05229], cx
movsx ecx, al
lea edx, [eax + eax*2 - 0x6b45d3e3]
shl edx, 0xa4
lea edi, [edi + eax - 0x58a0522d]
sete al
add al, 0x87
btr dx, 0x9c
mov eax, dword [edi + ecx*2 - 0x52]
sbb ecx, edx
jge 0x232742e
jmp 0x157ab54

Function at 0x22406ab
Capabilities:
Encode data using xor

Disassembly:
shl ax, 0x48
cdq
rol eax, 0xf7
rol ecx, 2
or dx, ax
lea ecx, [ecx + eax + 0x6886350e]
cwde
xor ebx, ecx
ror edx, 0xbc
add esi, ecx
ror eax, 0xef
lea ecx, [eax + eax - 0x50f44cc6]
not ecx
lea ebp, [ebp + ecx - 0x51144cc8]
movzx eax, byte [ebp + ecx - 0x51144cc7]
dec cl
xor al, bl
rol al, 1
xor al, dl
bts cx, dx
jae 0x287b929
mov eax, 0xa6a737b6
push eax
mov eax, dword [ebp]
jmp 0x25c1d05
push 0x8a975e01
lea esp, [esp + 0xc]
call eax
mov edx, 0x5d97c781
movsx ecx, dx
movzx edi, cl
mov ebp, dword [ebp + edx - 0x5d97c785]
shr edi, 0xa5
je 0x15a6e99
mov dword [edx + ebp - 0x5d97c781], eax
movzx ebx, dl
mov esi, edi
mov esi, ebp
imul bx, di
mov eax, 0x6011e8b7
pop ebx
pop ebp
xchg edi, ecx
pop edi
cwde
adc cl, 0x33
call fcn.01652c86

Function at 0x224396e
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + ebp*2 - 0x18b34], 0xf89bd71a
dec ebp
lea eax, [eax + ebp*4 - 0x31664]
inc ebp
xor edx, ecx
call fcn.022369f8
xor eax, 0xedf7d480
ficom word [eax]
stc
out dx, eax
dec ebp
dec esp
xchg esp, eax
lock add edx, dword es:[eax - 0x3d]
push cs
sbb byte [ecx + 0x5cfcee41], 0x25
invalid

Function at 0x224bc55
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x7c17db2e
or dword [esp], 0xd192cf11
dec ebx
jmp 0x277fda9
Function at 0x224cdc6
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0xc]
jne 0x275f97b
mov eax, 0xf3b71bb7
call fcn.02278e4a
or cx, 0xf222
ror edx, 3
xor ecx, ecx
xadd cx, ax
inc edx
shr eax, 0x6d
xor ecx, ecx
imul eax, eax
xor ebx, edx
sal eax, 0x1e
adc esi, edx
movsx edx, ax
add edx, dword [ebp + ecx*2]
shr cx, 0x2b
add cl, byte [ecx + ebp + 4]
lea eax, [eax + eax*4 + 0x790e1914]
and eax, eax
or eax, eax
lea ebp, [eax + ebp - 0x790e1912]
add ax, ax
shr edx, cl
ror ax, 0x2b
sar eax, 0x8d
je 0x156bd4b
mov dword [ebp + eax*2 - 0x790e4], edx
mov ecx, eax
xor ecx, ecx
add ecx, esi
jmp ecx
inc edx
mov dword [esp], 0x8b9ea21e
xor ecx, 0x12b94505
not dword [esp + 8]
dec eax
jmp 0x1605071

Function at 0x2262528
Capabilities:
Encrypt data using speck

Disassembly:
mov ebx, dword [esp + 4]
mov ebx, dword [esp + ebx*2 - 0x635f6b68]
lea esp, [esp + 0xc]

Function at 0x2264458
Capabilities:
Encode data using xor

Disassembly:
cli
pop es
fiadd dword [eax + 0x39dbfd5a]
js 0x226443e
fisubr dword [eax - 0x3ff2241f]
rcr ebx, cl
loop 0x226443d
jne 0x2264461
cld
stosb byte es:[edi], al
salc
enter 0xffffffffffffc39e, 3
xchg dword [ebp + edi*8 - 0x71], edx
xchg edx, eax
out 0x5a, al
outsd dx, dword [esi]
cwde
add byte [edx - 0x1d218c7], bh
inc edi
ret
ret
jno 0x2264421
loop 0x22644a4
shl dl, 0xc2
shl dl, 0xc2
loop 0x2264405
mov edx, dword [ecx + ebp - 0x4f6e41d3]
xor edx, ebx
lea edx, [ecx + edx + 0x352b60c5]
call fcn.015c36ec
push 0xa7392b06
mov esi, dword [esi*4 + 0x28e51cc]
push ecx
mov es, word [edx]
dec dword [esp]
sets byte [esp + 1]
jno 0x260d07b
mov ecx, 0xbc8b4e9d
sal ecx, cl
sbb edi, 3
push ecx
mov ecx, dword [edi]
mov edx, 0xc716a1a4
not dl
or dl, dl
xor ecx, ebx
rol ecx, 2
shr word [esp], 0xad
and al, 0
lodsd eax, dword [esi]
dec edx
neg ecx
push edx
call fcn.0261e16b
sahf
jo 0x2264473
retf 0x3b9c
loopne 0x2264441
lodsb al, byte [esi]
jbe 0x2264495
cld
sub dword [esi], esi
popal
loopne 0x22644f8
and byte [edi], 0x71
fdivrp st(1)
xchg byte [edi - 0x56], dh
jne 0x22644c3
inc edi
insd dword es:[edi], dx
jnp 0x226449d
cmc
lahf
xchg ecx, eax
mov dword [0x4129f73c], eax
imul dword [ecx]
inc ecx
lodsb al, byte [esi]
mov edx, 0xe53f81cd
push cs
int1
lodsb al, byte [esi]
ret
retf 0x10fd
shr edx, 8
call fcn.015c1ed9
mov eax, 0x9a3c6a9d
mov edx, dword [edi]
and al, al
movzx esi, ax
bswap esi
adc edi, 4
sal ax, 0xca
xchg edx, edi
mov esi, edx
mov edx, eax
movsx ecx, dl
jae 0x2925f8c

Function at 0x2264eb5
Capabilities:
Encrypt data using speck

Disassembly:
xadd dword [esp + eax*4 - 0x10f30], eax
call fcn.0267054d

Function at 0x227c48a
Capabilities:
Encrypt data using speck

Disassembly:
or edx, dword [esp + edx - 0x6f82fa13]
sal edx, 0x1a
sbb ecx, 0x971edd30
call fcn.016118ef
Function at 0x228f8be
Capabilities:
Execute syscall

Disassembly:
movsx ecx, dl
sub dx, word [esp + ecx - 0x75]
mov edx, dword [esi + ecx - 0x7b]
js 0x24d340f
movsx eax, word [esp + ecx*4 - 0x1e8]
sete al
mov cl, byte [esi + ecx - 0x77]
lea eax, [eax - 0x636e4266]
mov dword [esp], 0xd59cab00
add eax, eax
lea esi, [esi + eax*2 - 0x72485266]
and byte [esp + eax - 0x39242933], al
shr word [esp + eax*2 - 0x72485263], 0x83
inc eax
shr edx, cl
dec eax
mov dword [eax + esi - 0x39242934], edx
mov dword [esp + eax - 0x39242934], ebp
ret 8
sbb ebp, 3
movsx edx, al
mov edx, dword [ebp]
sub eax, ecx
xor edx, ebx
bswap edx
btr eax, 0xab
neg edx
not ecx
rol cx, 0xce
lea edx, [edx + ecx*2 - 0x509f1c7c]
shr eax, cl
sar cx, 0xcc
xor edx, 0xddb0161d
sal cl, 3
xor ebx, edx
not al
btr ecx, eax
add esi, edx
mov ecx, edi
mov edx, eax
lea edi, [edi + eax*8 - 0x782]
shl ax, 0x6c
xadd dx, ax
bts edx, 0x3c
mov word [edi + eax - 0xf0], cx
lea ecx, [edx + eax + 0x6806c38b]
dec cx
bt cx, 0xa7
jae fcn.026935ed

Function at 0x22a7602
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec ebp
lea eax, [eax + ecx - 0x5bb95fac]
inc ebp
xor ebp, ecx
inc ecx
ror ebp, 1
dec eax
mov dword [esp + edx - 0xe401], 0x9dabb824
inc ecx
bswap ebp
inc ecx
rol ebp, 1
inc esp
sub byte [esp + edx - 0xe3fc], dl
cbw
idiv word [esp + ecx - 0x5bb95fb0]
inc edi
lea ebp, [ebp + ebx - 0x75e6065d]
dec edx
lea ebp, [edx*2 - 0x7556c2f4]
cbw
inc ecx
not ebp
inc ecx
mov esi, 0xbb21f594
inc edi
lea ebp, [ebp + esi + 0x1101570d]
inc eax
sub dl, ch
dec esi
lea edi, [edx*4 + 0x2e1d3e35]
xor dword [esp + edx - 0xd916], eax
dec esp
mov dword [esp + edx - 0xd918], ecx
inc esp
and bl, al
inc cx
mul ebx
inc ebp
sbb bh, bh
inc esp
xor dword [esp + edx - 0x789b], ebp
dec ecx
xor esi, 0xffb23b8c
dec ax
inc ecx
pop ecx
inc ecx
div esp
dec ebp
arpl bp, bp
jmp 0x25e958c
neg ecx
dec ecx
add ebx, ebp
inc bp
btr esi, edx
jae fcn.027a8c5b
inc ecx
xor ecx, 0x3280368a
ror ax, 0x2b
neg dx
cwde
sbb ecx, 0xefa72219
btc edx, eax
or eax, eax
btc dx, 0x94
xor ebx, ecx
jmp 0x281d5fa
bts ax, dx
adc esi, ecx
sal edx, 0xb9
jae 0x228f758
jmp esi

Function at 0x22bbdd8
Capabilities:
Encrypt data using speck

Disassembly:
push 0x18038f3f
and esi, 0xff
mov esi, dword [esi*4 + 0x25bb358]
shr eax, 8
jmp 0x24b896c

Function at 0x22d8efb
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 4], 0x1e9ef537
mov dword [esp + 4], eax
dec ebx
jmp 0x29161b2
Function at 0x22e66fc
Capabilities:
Encrypt data using speck

Disassembly:
push 0xd8af260e
ror dword [esp], 0x9f
xor esi, eax
call fcn.022bbdd8
sal edx, 0x5c
adc esi, eax
mov ax, word [edi + edx*4]
lea edi, [edx + edi + 2]
lea ebp, [ebp + edx*8 - 1]
sar edx, 0x73
movzx ecx, byte [ebp + edx*2]
sbb edx, edx
or dx, 0x2c04
xor cl, bl
add cl, 0xa2
ror cl, 1
call fcn.015dff74
xor eax, 0x951a3638
dec word [esp + 0xa]
dec ecx
lea esp, [esp + 0xc]
jne 0x2726220
mov edx, 0x77bb2ba0
push edx
mov esi, dword [esp + edx - 0x77bb2b9c]
lea esp, [esp + 8]
mov ecx, 0x39015226
push ecx
not eax
jmp 0x25a279d
jmp 0x24b8961
dec eax
push 0xc6ad8618
call fcn.026bee0b
not word [esp]
mov dword [esp + 4], 0x1ea8a336
xor eax, esi
jmp 0x259915b
inc edx
sar dword [esp + 8], 0x27
adc dword [esp + 8], 0x23179daa
jp 0x15bb9b3
push ecx
movzx edx, cx
mov dword [esi + ecx - 0x39015226], eax
sar dword [esp + ecx - 0x39015224], 0x13
rol dl, cl
lea eax, [edx - 0x5ffb22c2]
mov dword [esp + ecx - 0x39015226], ebp
ret 4
movzx esi, byte [edx]
jmp 0x158691b

Function at 0x22fb35e
Capabilities:
Encrypt data using speck

Disassembly:
dec ebx
push 0x9733c31b
call fcn.015af282
jmp 0x2503bec
jmp 0x1605a80

Function at 0x24bed3f
Capabilities:
Encrypt data using speck

Disassembly:
xor al, bl
add dl, dl
dec al
add dx, dx
ror al, 1
call fcn.0223a39f
lea edi, [edi + eax - 0x2e17]
pop ecx
xor edx, ebx
rol edx, 1
lea ecx, [eax - 0x3475916f]
btc ecx, 0xb0
adc cx, 0x192a
bswap edx
btc eax, 0xb6
xor edx, 0x5c9a2794
cwde
bt eax, 0x98
inc edx
btc ecx, ecx
cwde
bswap edx
sub eax, ecx
xor ebx, edx
xor cl, 0x95
sub cx, cx
adc ebp, edx
xor cx, word [esi + eax*2 - 0x6868f08a]
lea esi, [eax + esi - 0x34347843]
cwde
movsx edx, ax
movzx eax, byte [edi + eax*2 - 0xf08a]
lea edi, [edi + edx*8 - 0x3c227]
jmp 0x227fa2f

Function at 0x24d4485
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + ebp - 0x5908400], 0xba3cd718
inc edx
setp byte [esp + ebp - 0x59083fd]
dec eax
adc ebx, eax
or dx, 0xe928
pop eax
jle fcn.027a8c5b
Function at 0x24f44c4
Capabilities:
Execute syscall

Disassembly:
xor edx, dword [esp + eax*8 - 0x7fc00]
mov eax, dword [eax + ecx - 0xff80]
xchg byte [esp], dl
btr dx, 0x3c
movzx ecx, dl
lea ebp, [ebp + ecx - 0xaa]
shr ecx, cl
rol byte [esp + ecx - 2], 0x43
ror ecx, 0xe2
mov dword [ebp + ecx - 0x80000000], eax
mov ecx, dword [ecx + edi - 0x80000000]
lea eax, [edx + edx + 0x2e8d42b7]
mul eax
lea edi, [edi + edx - 0x7ed507b]
call fcn.028aed8e
xor ebx, edx
and ax, cx
shr eax, 0xc9
adc esi, edx
cdq
ror cl, 0x63
lea edx, [ecx + eax + 0x20a9b5b9]
mov ecx, dword [eax + edi - 0x128019]
sal eax, 0x55
lea edi, [edi + eax*2 - 0x63ffffc]
call fcn.0257e594
sysenter
push esi
pushfd
mov esi, 0x5d195a88
cmp esi, 0x2b8fe21d
mov esi, dword [esp + esi - 0x5d195a84]
mov dword [esp + 4], 0x6ffd61a4
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.02633259
mov dword [esp + 0x10], 0xbb962f35
add esi, ecx
lea esp, [esp + 0x18]
push 0xa58cfa0d
call fcn.02717f35
retf
mov dword [esi + 4], eax
sub edi, 4
mov ecx, 0x7492b007
movzx eax, word [esp + ecx - 0x7492b003]
sub word [esp + eax - 0x4b1d], ax
mov eax, dword [edi + eax*2 - 0x9646]
lea ecx, [ecx + ecx - 0x33e44165]
mov dword [esp + 8], ecx
xor cl, 8
xor eax, ebx
rol eax, cl
call fcn.01562c92
ror ecx, 1
xor ebx, ecx
dec byte [esp]
jnp 0x2270fb3
movzx ecx, byte [edi]
add edi, 1
mov eax, 0xed8ee30f
lea eax, [eax + eax - 0x3a464547]
cwde
xor cl, bl
cdq
sub edx, edx
dec cl
bt edx, 8
btc dx, ax
rol cl, 1
dec edx
shr al, 0xc2
push eax
xor cl, 0x3d
ror byte [esp + edx - 0x7f], 0x43
div dword [esp + edx - 0x7f]
sub cl, 0x3c
and dx, ax
neg cl
sub byte [esp + eax - 0x7d], dh
xor bl, cl
lea ecx, [esp + ecx + 4]
xchg word [esp + eax - 0x7f], ax
jmp 0x16236ce

Function at 0x24f4608
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], edi
push esi
mov edi, 0x9c95771e
jmp 0x2647795
pushfd
mov esi, edi
rol edi, 0x79
mov esi, eax
or di, di
mov edi, edx
jns 0x2293dc5
inc ecx
mov ebp, dword [eax]
inc ecx
mov ebp, 0x9da8b208
dec edi
lea esp, [ebp + ebp*8 + 0x66291b2f]
inc ecx
bts esp, 0x14
dec ecx
adc eax, 3
dec esi
lea esi, [0xd20e6d05]
inc ecx
movzx edx, bp
inc ecx
xor ebp, ecx
dec ebx
lea esi, [ebp + ebp - 0x6af3b079]
inc bp
bts esp, esp
bswap ebp
inc ebp
mov ebx, ebp
inc ecx
shl bl, 0xa4
dec ebp
movzx ecx, si
dec eax
sub esi, edx
call fcn.0157711e
sub edi, 4
mov ecx, 0xff87971f
mov eax, dword [edi]
lea edx, [ecx + ecx*4 - 0x6cc51841]
call fcn.0283892a

Function at 0x24f7542
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec eax
mov dword [esp], 0x9d951e07
inc esp
movzx esp, byte [ebp]
inc ebp
xor esp, ebp
dec byte [esp + 1]
neg byte [esp + 5]
inc ecx
and esp, 0xff
sal byte [esp + 2], 0x62
inc esi
mov esp, dword [edi]
inc ecx
shr ebp, 8
rol byte [esp + 2], 0xc4
inc ebp
xor ebp, esp
sar dword [esp + 4], 0xa
push 0xf8bb3321
dec eax
inc ebp
neg word [esp + 5]
inc ecx
xor ebp, 0x40fc19f
dec ecx
dec esi
dec eax
lea esp, [esp + 0x10]
jne 0x2528b5a
inc ecx
mov esp, 0x7983418c
inc ecx
movsx edi, sp
pop edi
Function at 0x2517ca6
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp + ebx*4]
jmp 0x273f080
lea esp, [esp + 8]
jne 0x162192f
mov eax, 0x5928100e
jmp 0x265fe81
cwde
mov eax, dword [ebp + eax - 0x100e]
jmp 0x287000c
call fcn.025d9030
push 0x1c0a4daf
call fcn.027bb132
neg ecx
neg eax
and ecx, 0xac031d31
call fcn.0271a18a
mov eax, 0xa6b11509
shl al, 0xe5
mov eax, dword [edi]
adc edi, 3
mov ecx, 0xa1b8b03b
ror cl, 0x45
setae cl
xor eax, ebx
movzx edx, cx
neg eax
sal ecx, 0xc2
sar dl, 0xe2
bswap eax
ror eax, 1
rol dx, 0x4f
sub dl, 9
dec eax
xor ebx, eax
call fcn.025c73e4

Function at 0x2535771
Capabilities:
Encrypt data using speck

Disassembly:
movzx ebx, byte [ecx]
jmp 0x266e7f6
dec edx
lea esp, [esp + 0x20]
jne 0x2292c0b
push 0xa814a2a2
mov edx, 0xf2b41cb7
mov ebx, dword [esp + 4]
lea esp, [esp + 8]

Function at 0x2573d09
Capabilities:
Encode data using xor

Disassembly:
mov word [edi], cs
mov al, 0xd4
lahf
loopne 0x2573ced
mov ax, word [ecx + eax*2 - 0x15d98]
add edi, 2
or dword [esp + 3], 0xc92f662c
mov ecx, dword [esp]
mov word [edi + ecx*2 - 0x58015d9a], ax
movzx edx, cx
mov dword [esp + ecx*2 - 0x58015d9a], esi
ret 0xc
not al
pop edx
neg edx
dec byte [esp + edx - 0x5880a351]
xor bl, al
dec dl
dec dx
lea eax, [esp + eax + 4]
call fcn.025f5a0e
or edx, edx
bswap eax
shl ecx, 0x47
xadd dl, dh
xor eax, 0xab000ba2
sub dx, 0xe8b5
dec word [esp + ecx - 0x760960fc]
ror eax, 2
xor ebx, eax
sar cx, 0xe3
xor ecx, 0xed9a3ab9
rol cx, 0x87
stc
jecxz 0x2573cb0
int1
mov ecx, 0x66ed9a3a
rol ecx, 0x87
add ebp, eax
sar ecx, cl
pop eax
pop eax
jne fcn.0285d32e
les esi, [eax]
cld
daa
push eax
jae 0x2573d2c
invalid

Function at 0x25835df
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor edx, ebx
bt cx, cx
lea ecx, [eax*4 + 0xf2af78d]
sub al, ch
rol edx, 2
inc edx
not edx
mov dword [esp + ecx - 0xf2af78d], eax
sub edx, 0xc7b61638
dec cl
js 0x2724fa8
not edx
cbw
sal al, 0x43
not dword [esp + ecx - 0xf2af78c]

Function at 0x258b6b6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x1c]
jne 0x27628dd
mov eax, 0x6120ea28
pop esi

Function at 0x25971ae
Capabilities:
Encrypt data using speck

Disassembly:
shl dword [esp + 8], 0x15
xor eax, 0x8706a935
push 0xdd8d9508
mov dword [esp + 8], 0xcaac5009
inc dword [esp]
dec eax
mov dword [esp + 4], 0xe7b6440b
jmp 0x25e6e84
rol eax, 2
call fcn.02633ea7
stc

Function at 0x25990af
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.022867c6
sal cx, 0x63
xor eax, ebx
bswap eax
xor cx, 0x11b0
mov dword [esp + ecx - 0x1488], 0x336168f
inc eax
not eax
sub eax, 0xce3f36ad
sub byte [esp + ecx - 0x1486], 0xa4
xor ebx, eax
rol word [esp + ecx*2 - 0x2910], cl
sar ecx, 0x87
sar edx, cl
add ebp, eax
not cx
rol byte [esp + ecx*8 - 0x7feb0], 0x81
mov eax, dword [edi + ecx*8 - 0x7feb0]
mov ecx, dword [edi + ecx - 0xffd2]
dec word [esp]
neg edx
mov dword [esp + edx - 0x2670d5], ebx
movsx ebx, dx
add dx, 0x8110
cpuid
ja 0x229f65d
Function at 0x25ac2b9
Capabilities:
Encode data using xor

Disassembly:
dec eax
sal eax, 0xd0
inc ecx
xor esi, ecx
ror esi, 2
dec ecx
inc edi
inc ecx
lea esi, [esp + esi + 0x27a4e5a0]
xor esi, 0xb2035524
rol esi, 2
inc ebp
or edi, ebp
inc ecx
movsx ebp, bx
neg al
inc esi
inc cx
dec edx
dec edx
mov dword [esp + edx - 0x780ca011], 0xde9153b5
mov ecx, 0x57157e2f
neg esi
shl cx, cl
inc ecx
or ebx, 0xcc35d381
lea esi, [esi + edx + 0x797a846e]
inc sp
xchg ebp, edi
dec esi
mov dword [esp + edx - 0x780ca009], ecx
call fcn.02838888
add byte [eax + 0x2e7a0206], bh
add eax, 0xc67940d
xchg esp, eax
add dl, byte [edi + 0xb]
jecxz 0x25ac2ce
ret 0x7d6f

Function at 0x25afc62
Capabilities:
Encode data using xor

Disassembly:
call fcn.02624bf3
mov edx, 0xb1a43a24
mov ecx, edx
jmp 0x25a07e5

Function at 0x25c39de
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
dec edx
mov dword [esp + ebx*2 - 0x3d20a828], ebx
ret
dec edx
lea edi, [edi + ebx*2 - 0x3d20a820]
dec esi
lea esi, [ebp + edx*4 + 0x7a1ca60c]
dec eax
adc edx, eax
dec eax
shr ecx, cl
dec edx
mov dword [esp + ebx*2 - 0x3d20a820], 0x86bae413
inc ebp
or ebx, ebx
dec edx
mov dword [edi + ebx*4 - 0x7a415050], edx
inc ecx
pop edx
jp 0x15c10ea
mov ecx, 0xcb31a695
lea eax, [ecx + ecx*2 - 0x5dcaa3d0]
cdq
movzx ecx, byte [edi + eax*2 - 0x7949fde]
dec al
lea edi, [edi + eax - 0x3ca4fed]
jl 0x26501db
xor eax, 0x76b1d891
fdiv dword [edi]
mov edx, 0x451a7711
ror dword [0x726e370e], 0xf
into
jmp 0x25c3a01
xor cl, bl
push edx
xor cl, 0x9d
not eax
dec word [esp + edx]
sar dword [esp + edx], 0xf1
dec cl
add edx, edx
sal dx, 0xef
sar dword [esp + edx], 0x9b
wait
not cl
cdq
or dword [esp], 0xf81ec634
push eax
xor cl, 0x8c
dec dx
sete dl
call fcn.01591960
scasb al, byte es:[edi]
bound esi, qword [edi - 0x4350ac0a]
or ebx, dword [ebx]
jno 0x26501f6
jle 0x2650234
hlt
mov byte es:[0xc4448c0d], al
mov ah, 0x26
seta byte [edx]
test al, 0x71
int1
stosd dword es:[edi], eax
mov al, 0xb9
pop esp
add esi, dword [ebp - 0x23]
add dword ds:[ebx], ebx
jnp 0x26502a6
mov cl, 0xb
pop edi
adc eax, 0xf41b8912
int 0x95
stosd dword es:[edi], eax
xchg esp, eax
invalid
neg byte [esp + ebp*2]
insb byte es:[edi], dx
leave
sbb dword [ebp + 0x17c5229], ecx
imul esi, dword [edi - 0x3e], 0x3a8a4abb
sbb eax, 0x44e7aa16
dec ecx
loop 0x26502a3
invalid

Function at 0x25cb33e
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], ecx
call fcn.025c4827
Function at 0x25d228e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg cl
ror eax, 0x56
and edx, edx
xor cl, dl
ror cl, 1
sal dl, 0xa4
mov dword [esp + eax - 0x3ffdffc], eax
jns 0x25835f1
xor cl, 0x38
xor bl, cl
pop eax
ror dword [esp], 0xc1
lea ecx, [esp + ecx + 4]
inc byte [esp + 2]
sar edx, 0x38
movzx dx, byte [ecx]
sbb esi, 2
pop ecx
sal ecx, 0x95
mov word [esi + ecx*8], dx
movsx edx, cx
sar ecx, 0x73
sbb dx, 0x181b
jbe fcn.028b2c8b
clc
adc byte [esi + 0x356469fd], al
ror dword [edx], cl
lodsd eax, dword [esi]
in al, dx
pop es

Function at 0x25d5b38
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor eax, ebx
shl cl, 0x22
lea eax, [eax + edx + 0x6d8abfce]
xor eax, 0xafbedaa1
xor cl, dl
call fcn.015d0b3c
lea esp, [esp + 8]
call eax
mov ecx, 0x8bb45aa9
movsx ebx, cl
movsx esi, cx
mov ebp, dword [ebp + esi*2 - 0xb556]
rol ecx, cl
mov edi, 0xb136a129
jae 0x2595b6d
mov dword [ebp + esi*2 - 0xb552], eax
push edi
mov edi, ebp
lea ebp, [ecx + esi*4 + 0x817d933]
dec esi
mov eax, ebp
mov ebx, dword [esp + esi*2 - 0xb54c]
lea edx, [esi*4 + 0x1e3e58bf]
mov esi, dword [esp + ecx - 0x68b5530f]
mov ebp, dword [esp + ecx - 0x68b5530b]
call fcn.01575d76

Function at 0x25dbb96
Capabilities:
Encrypt data using speck

Disassembly:
or dx, ax
xor ebx, ecx
not eax
push edx
add ebp, ecx
neg edx
adc word [esp], 0x8fac
mov ax, word [esi]
mov dword [esp + 4], 0x7db08927
mov ecx, 0x4b29e298
mov dx, word [esi + ecx - 0x4b29e296]
bswap ecx
mov cl, byte [esi + 4]
inc dword [esp + 4]
adc esi, 3
shld ax, dx, cl
mov word [esi], ax
call fcn.027e535b

Function at 0x25dbbde
Capabilities:
Encrypt data using speck

Disassembly:
not eax
lea edx, [ecx*8 + 0x42b519bf]
call fcn.0158be2b
test di, di

Function at 0x25eff1a
Capabilities:
Encrypt data using speck

Disassembly:
rol ecx, 2
and eax, eax
adc dl, ah
call fcn.027ffd95
mov dword [esp], 0x6d21fb18
lea ecx, [esp + ecx + 8]
not dl
mov edx, dword [ecx]
jg 0x15b6702
add al, 0x3c
sbb esi, 4
or dword [esp + 4], eax
mov dword [esi], edx
shr word [esp + 1], 0x4b
lea edx, [eax + eax*2 - 0x51508771]
not edx
sbb edi, 4
movzx ecx, dx
dec al
mov edx, dword [ecx + edi - 0x86bc]
xor ecx, ecx
xor edx, ebx
inc al
jle 0x281b155
shl word [esp + ecx + 1], 0xa5
neg edx
rol edx, 3
lea edx, [edx + ecx - 0x6b0a410]
shr dword [esp + ecx + 2], 0xc5
neg edx
xadd dword [esp + ecx + 4], ecx
xor ebx, edx
add ebp, edx
movzx edx, byte [esp + 4]
call fcn.022f05dd
clc
adc byte [ecx + 0x395975ec], dl
cli
or byte [ebx - 0x9f9417], ch
mov ecx, 0xb30ff990
mov eax, ecx
inc ecx
mov edx, dword [ebp]
mov ecx, dword [ebp + 4]
sal eax, 0x8e
lock xadd dword [edx], ecx
movsx edx, ax
cwd
pushfd
lea eax, [edx - 0x196dd77b]
bt edx, 0xa3
jb 0x15c05b4
pop edx
or ax, ax
sbb al, al
mov dword [ebp + 4], ecx
or eax, 0x663750a1
mov dword [ebp], edx
mov ecx, dword [edi]
lea eax, [eax + eax*8 - 0x2aebeacb]
movsx edx, ax
lea edi, [edx + edi - 0x52da]
bt edx, edx
sbb edx, edx
xor ecx, ebx
ror ecx, 1
not eax
bts dx, 0x1b
lea ecx, [ecx + eax*2 + 0x5a8ed661]
setb al
xchg ah, dl
jae 0x15ac5e4
Function at 0x2645a00
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, ebx
lea ecx, [edx + edx*2 + 0x148b32ba]
sub ecx, 0x42a8269c
call fcn.0156a562
inc ecx
inc edi
dec edx
inc dword [esp + esi - 0x119ede]
jl 0x276e795
inc ecx
ror edi, 1
neg word [esp + eax - 0x108413ce]
inc ecx
inc dl
dec esi
mov dword [esp + esi*2 - 0x233dbc], ecx
inc esi
xor dword [esp + esi - 0x119ede], edi
jmp 0x2907c8a
dec ecx
xadd edx, ecx
dec eax
bswap esi
inc ecx
pop ecx
cbw
inc eax
inc ecx
bt esi, eax
dec ebp
arpl di, di
dec ecx
adc ebx, edi
jmp fcn.027a8c5b

Function at 0x2647811
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + edx - 0x57], 0x5c8f8c98
sub dl, ch
sbb eax, 0xce3f36ac
mov word [esp + ecx - 0x35cfeff6], dx
pop ecx
xor ebx, eax
mov dword [esp + ecx - 0x5c8f8c90], edx
ror cx, 0x25
add ebp, eax
ror dl, 0x66
jae 0x156b9d8
pop eax
pop eax
pop ecx
jb fcn.0229206a
mov eax, 0x9735668b
movsx ecx, ax
neg cx
movzx dx, byte [ecx + edi - 0x9975]
mov cl, byte [edi + ecx*8 - 0x4cba6]
xor ax, ax
dec ax
adc edi, 2
sar eax, 0xf3
lea eax, [eax*4 - 0x6763f7f5]
and dl, cl
dec al
not dl
push eax
jge 0x28c10ea
mov word [edi], dx
sar ax, 0x2b
sbb al, al
neg al
sbb esi, 4
shr word [esp + 2], 0x8e
mov edx, dword [esi]
pop ecx
xor edx, ebx
cwde
add eax, ecx
rol edx, 1
call fcn.028a43e2