joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bc05c
Capabilities:
Encrypt data using speck

Disassembly:
push eax
xor dl, 0x37
add word [esp + eax*2 - 0x50b988], ax
neg dl
rol byte [esp + eax*2 - 0x50b987], 0x81
dec dl
not dl
xor eax, eax
sal eax, 5
xor bl, dl
mov dword [esp + eax*2], esi
neg al
dec eax
push ebp
dec al
push ebx
movsx ebx, ax
mov ebp, edi
push ebx
xchg dword [esp], ebx
adc word [esp + 1], bx
mov ebx, edx
dec eax
movzx edx, al
mov edx, ebx
shl eax, 0xd3
dec al
inc ax
shl edx, 2
mov eax, ebp
dec byte [esp + 2]
add eax, edx
neg dword [esp]
jns 0x709959
lea edx, [eax + edx - 0x20a6586a]
neg eax
sub dword [esp + ecx], eax
neg edx
sub dword [esp + ecx], eax
ror ecx, 0xb0
inc ecx
ror edx, cl
sal ax, cl
xor ebx, edx
xadd dword [esp + ecx - 1], eax
rol word [esp + ecx - 1], cl
call fcn.00747439
xor ecx, ebx
mov eax, dword [esp + 4]
neg ecx
neg eax
inc ecx
dec al
not ecx
sub ecx, 0x3db7032c
shr word [esp + eax - 0x46639f79], 0x2b
movsx edx, word [esp + eax - 0x46639f7a]
lea eax, [edx + eax + 0x3e299418]
neg ecx
rol dword [esp + edx - 0x137d], 0x90
jb 0x558d60
xor ebx, ecx
pop eax
add ebp, ecx
pop eax
mov edx, edi
movsx ecx, ax
sub al, ch
sub edi, 2
lea ecx, [eax - 0x62799800]
call fcn.00608287
sub dl, dl
or ax, cx
sal dx, 0x62
push edx
sub word [esp], dx
mov word [edi + 2], ax
rol word [esp + 1], 7
movzx eax, word [esi - 2]
call fcn.0073de6e
mov edx, edi
mov eax, 0x48be1536
xor eax, eax
mov dword [edi + eax - 4], edx
mov ecx, eax
mov edx, dword [eax + esi - 4]
or cl, al
add eax, 0x352bca82
lea esi, [eax + esi - 0x352bca86]
push ecx
and ecx, eax
xor edx, ebx
not word [esp + eax*2 - 0x6a579503]
xor edx, 0xd6b00524
not dword [esp + eax*2 - 0x6a579504]
xchg byte [esp + eax - 0x352bca80], al
not edx
sal cl, 0x81
je 0x55bf7e
xor eax, 0x3923cf3d
sar edx, cl
jns 0x7451cc
add bl, dl
dec eax
xchg dword [esp + eax - 0x2000], ebp
sub edx, 0x2c138f28
xor bl, 0xaf
inc ecx
pop eax
rol ax, cl
ror bl, 1
call fcn.0063a154
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x709983
mov eax, 0xcc3e6e0d
mov eax, dword [ebp + ebx*4]
push eax
push 0xa1967391
dec ebx
lea esp, [esp + 4]
jne 0x709969
mov eax, dword [ebp]
call eax
mov esi, 0x9f1ad91a
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edi, esi
mov edi, ebp
movzx ebp, si
pop ebx
pop ebp
pop esi
mov eax, 0xcb3d800d
lea edx, [eax*2 - 0x74e11e67]
lea esi, [esi + edx - 0x2199e1b7]
neg eax
sub edx, edx
adc al, ah
mov eax, dword [esi + eax - 0x34c27f72]
lea ecx, [edx - 0x5dc0c5fd]
sbb dl, cl
xor eax, ebx
rol eax, cl
dec dl
js 0x6c0c98
inc ecx
xor bl, cl
ror bp, cl
jb 0x708b75
dec edx
sub dword [esp - 0x7f00d83f], 0x3f2b0c02
ror esi, 3
neg esi
inc edx
lea esi, [esi + eax*4 + 0x471feb30]
call fcn.007298d4
sar ecx, 0xf9
not eax
rol eax, 3
ror cl, 0xa4
shl edx, 0xa8
sbb edx, 0xda837ab6
xor ebx, eax
push ecx
rol dword [esp + edx*2 - 0x4af94894], cl
sal ecx, cl
add ebp, eax
ror dword [esp + edx - 0x257ca44a], 0xff
mov dword [esp + edx - 0x257ca44a], ebp
ret
Function at 0x6bc13b
Capabilities:
Encrypt data using speck

Disassembly:
not bl
dec esi
lea esi, [esi + ebp*2 + 0x2d0bcb90]
inc ecx
not al
dec eax
mov dword [esp + esi*2 - 0xa3e4a70], esi
inc ecx
or bl, al
inc cx
inc edi
call fcn.005f1d09
dec ecx
xor ebx, ecx
inc ecx
xadd bh, al
inc esp
movzx ebp, word [esp + eax - 0xc0ee]
jnp 0x6e332d
dec eax
dec ebx
jmp 0x6db69e

Function at 0x6bc26b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec eax
xchg dword [esp + eax*2], ebx
pop eax
jbe fcn.005e92fc
pop ebx
inc ecx
xor dl, cl
sal cx, cl
dec ecx
or edi, 0xde33cb8d
inc ebp
and edi, esi
sbb dl, 0x3c
neg dl
dec ecx
ror ebp, 0xd2
rol dl, 1
not dl
dec ebp
xadd esi, eax
dec esp
mov dword [esp + eax], edi
dec dl
inc esp
xor cl, dl
dec eax
lea edx, [esp + edx + 8]
dec esp
mov eax, dword [edx + eax*2]
dec esi
mov dword [eax + ebx - 0x18], eax
dec eax
lea edx, [ecx + ebp + 0x482cb69a]
dec eax
and ecx, dword [esp + eax*2]
inc ecx
sal ebp, 0x7c
dec ebp
lea ebx, [ebx + eax - 0x18]
mov ebx, ecx
jp 0x5ffa0c

Function at 0x6bcb55
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
lea edx, [ebp + edx - 4]
not dl
inc ecx
not eax
neg si
inc esi
mov esi, dword [ebp + edx]
inc ebp
xor esi, ecx
neg ecx
rol esi, 0x95
add edx, 0xff0c05bd
inc ebp
lea esi, [esi + ebp*2 + 0x2e3fd406]
sal word [esp + ebp + 0x10], 0xa9
ror al, 0xc7
inc dl
inc ecx
ror esi, 3
call fcn.0073b1a0

Function at 0x6be968
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0062e612
mov eax, 0x722d0732
inc esi
mov eax, dword [eax + ebx - 0x722d0732]
inc esi
mov esi, dword [eax + ebx - 0x722d072e]
dec eax
lea edx, [eax*8 + 0x5b18b8c]
inc esp
movsx ebp, al
inc sp
sub ebp, eax
inc ecx
not eax
dec eax
lea esi, [eax + eax*8 - 0x41fa95e6]
dec ecx
bswap ebp
dec ax
inc ecx
not esi
movzx ecx, dl
inc ebp
and eax, esi
add dl, 0x11
dec eax
lea ebp, [esi + edx*2 - 0x2dc2c34b]
inc esi
mov dword [eax + ebx - 0x722d072d], eax
inc ecx
mov edx, dword [edx + ecx - 0x20]
dec eax
adc eax, 0xacbd9299
inc ecx
xor edx, ecx
inc ecx
sar ch, 0x61
inc esp
movsx edi, ch
neg edx
call fcn.005670b7

Function at 0x6c06e4
Capabilities:
Get number of processors

Disassembly:
ror ecx, 3
call fcn.00704574
inc ecx
push esi
dec ebx
mov dword [ebx + esi - 0x500e354d], esi
inc ebx
mov ecx, dword [edx + esi - 0x500e354a]
dec eax
lea ebp, [ebx*2 + 0x1511f9b3]
dec esi
mov dword [esp + esi - 0x500e353d], esp
inc esi
movzx eax, word [esp + esi - 0x500e3539]
inc ecx
xor ecx, ecx
dec eax
lea eax, [ebx + ebx*4 + 0x209c0eaf]
jmp 0x6473d3

Function at 0x6cc962
Capabilities:
Encode data using base64

Disassembly:
inc ecx
neg ch
dec ecx
inc esi
inc ecx
shl al, 1
inc ecx
rol ch, 1
inc ecx
not ch
dec eax
mov dword [esp + ebx - 0x11ec], 0x61916b07
dec esp
xadd dword [esp + ebx - 0x11ec], eax
inc ecx
dec ch
inc cx
sub edx, esp
inc ebp
xor cl, ch
mov byte [esp + ebx*2 - 0x23d8], bl
dec esi
lea ebp, [esp + ebp + 8]
jmp 0x6de121
Function at 0x6ccd2f
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
lea eax, [esp + ebp + 0x7b117c0d]
dec ebp
lea edx, [edx + ebx*2 - 0x5110eeea]
inc edx
mov ecx, dword [ebx + edx - 0x28887773]
inc cx
xchg esp, ebx
inc ecx
pop esi
inc ecx
xor ecx, ecx
call fcn.006defe4

Function at 0x6cdcdb
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov dword [esp], 0xf09a40ba
sub esi, 4
dec byte [esp]
mov ecx, dword [esp]
mov edx, dword [esp]
mov ecx, dword [esi]
shr byte [esp + 2], 7
shr dx, 0x4d
sete dl
xor ecx, ebx
push edx
dec ecx
bswap ecx
ror dword [esp], 0x97
sbb ecx, 0xf988fe30
ror ecx, 1
mov eax, edx
neg edx
neg ecx
xor ax, dx
not eax
inc ecx
shr edx, 0x3d
inc edx
xor ebx, ecx
xadd dword [esp + edx + 3], edx
adc ebp, ecx
movzx ecx, dl
inc dword [esp + eax*4 - 0x3d97fff9]
shr dword [esp + eax*4 - 0x3d97fff8], 0xb4
mov dx, word [edi + eax - 0xf65ffff]
shl cl, 0x45
mov cl, byte [edi + eax - 0xf65fffd]
call fcn.00565200

Function at 0x6cef3f
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
xor dword [esp + eax - 0x4e831891], eax
dec eax
shr ebp, 8
inc ecx
dec bh
inc ebp
xor cl, bh
inc edx
and byte [esp + eax - 0x4e83d3bd], ch
dec esi
lea edi, [esp + edi + 0x20]
dec eax
mov dword [esp + ebp*8 - 0x11be4a08], ebp
inc ecx
inc eax
dec edi
mov esi, dword [eax + edi - 0x4e83d3c7]
dec edi
lea ebp, [esp + 0x3add803]
inc esp
cmovae esp, ebp
jl 0x611d82
dec edi
mov dword [eax + ebx - 0x4e83d3bf], esi
inc edx
rol dword [esp + eax - 0x4e83d3b7], 0x49
movzx edx, al
dec ebp
lea ebx, [ebx + eax - 0x4e831894]
xchg cx, bx
dec eax
mov dword [esp + eax - 0x4e83189c], edi
ret 0x18

Function at 0x6d000f
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 0xc]
rol eax, 1
movzx edx, cx
mov dword [esp + edx - 0xe398], edx
inc eax
xchg word [esp + edx - 0xe39c], dx
not eax
neg dx
rol word [esp + edx - 0xbb57], 0xe5
sar edx, 0x5f
inc eax
neg eax
xor ebx, eax
call fcn.0055e78b
inc ecx
neg esi
inc ecx
inc esi
dec edx
shl dword [esp + eax + 0x18], 0x73
dec esi
mov dword [esp + eax + 0x30], ecx
inc esi
xor dword [esp + eax*8 + 0x30], esi
inc edx
movzx edx, word [esp + eax + 0x29]
inc ecx
mov edi, 0xdaac0795
dec esi
mov ecx, dword [esp + eax + 0x30]
dec ebp
arpl si, si
push eax
dec ecx
add edi, esi
inc edx
not dword [esp + eax*2]
inc edx
shr dword [esp + eax], cl
dec edx
mov dword [esp + eax], edi
ret 0x38
cmova ecx, edx
jbe 0x606ec5
xor eax, 0x8a9ea31b
xchg byte [esp + 6], dl
or edx, edx
lea eax, [eax + ecx + 0x1444d8c1]
ror eax, 3
not ecx
mov dword [esp + ecx - 0x52b7fa29], ecx
inc dword [esp + ecx - 0x52b7fa25]
not eax
and dword [esp + ecx - 0x52b7fa28], edx
rol eax, 1
rol dl, 0xe1
jno 0x74c5a0

Function at 0x6d4ac2
Capabilities:
Encrypt data using speck

Disassembly:
ror edx, 0x7d
inc esp
movsx esp, dx
inc ecx
xor ebx, ecx
pop esi
sub ebx, 0xd6b7dc15
inc esp
movzx esi, dh
neg ebx
dec ecx
sal edi, 0xc1
jg 0x6d00d0
dec edi
lea edx, [eax + edx - 0x30b7]
je 0x64aab4
call fcn.00608eff

Function at 0x6d5fb0
Capabilities:
Encrypt data using speck

Disassembly:
rol eax, 1
bswap eax
dec ecx
lea edx, [eax + ebx*8 + 0x7f25ff83]
call fcn.00720c49
Function at 0x6d5fc1
Capabilities:
Encrypt data using speck

Disassembly:
xor dx, bx
dec cl
call fcn.0070aab1

Function at 0x6d74f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc eax
shl dh, 1
inc ecx
inc eax
dec esp
mov dword [esp + 0x18], ecx
inc eax
movsx ebx, dh
inc esp
movsx ebp, ax
inc esp
xor dword [esp + ebx*2 - 8], eax
dec esp
mov ecx, dword [esp + ebx*2 - 8]
inc esp
movzx edi, word [esp + ebx*8 - 0x70]
inc ecx
or eax, ebp
inc ecx
movsx ecx, di
dec ebp
arpl ax, ax
dec eax
mov dword [esp + ebx*4 - 0x40], 0xd406240a
call fcn.00703eb4

Function at 0x6da136
Capabilities:
Encode data using xor

Disassembly:
pop dword [eax]
add byte [ecx + 0x3e6a1494], cl
mov dword [esp + edx - 0x1a10c196], edx
not al
or word [esp + edx - 0x1a10c18a], 0x261a
xor bl, al
mov dword [esp + edx - 0x1a10c196], edx
not al
or word [esp + edx - 0x1a10c18a], 0x261a
xor bl, al
lea eax, [esp + eax + 0x10]
mov byte [eax + edx*2 - 0x3421832c], cl
mov ecx, dword [esi + edx*4 - 0x6843065d]
xor ecx, ebx
lea eax, [edx + edx - 0x494c9df0]
neg word [esp + edx - 0x1a10c189]
neg ecx
ror dword [esp + edx*2 - 0x3421832c], 0x90
lea ecx, [edx + ecx + 0x19014876]
call fcn.006fdde9
jp 0x6da153
jl 0x6da133
retf
salc
loope 0x6da1c3
wait
pushal
adc al, 0x29
pushfd
enter 0x112d, 0x3f
sub dword [eax + 0x3f1125f8], ebp
sub eax, esi
loopne 0x6da21a
adc dword [edi], edi
sub eax, esi
pushfd
pop ecx
adc dword [edi], edi
sub dword [eax - 0x13e08127], esp
pop ds
pop ebx
mov eax, 0x6c8a920a
mov bl, 0x9c
fld qword [0xa3dcf274]
xchg esi, eax
pushfd
fnstsw word [edi - 0x7f]
add ah, byte [ebx]
sbb al, 0x48
sbb al, 0x48
cmp byte [edi - 0x356a4e75], al
cmp byte [ebx - 0x60], 0xf9
xchg ebx, eax
mov dword [esi - 0x48007a91], ebx
mov ebx, 0x856fb2b1
call dword [edi + 0x1a1ea0d1]
invalid
and al, 0x62
pop eax
push ecx
insb byte es:[edi], dx
test edi, edi
inc edx
push ss
mov dword [0xbe411a1e], eax
inc ecx
mov esi, 0x36be2f87
dec ecx
mov dword [ebx + ebp*2 - 0x420e2410], esi
inc edx
movsx ebx, word [esp + esi - 0x36be2f7e]
inc bl
dec esp
mov dword [esp + ebp - 0x21071208], edi
dec ebp
lea edx, [edx + ebp - 0x2107120c]
shr dword [esp + ebp - 0x210711f6], 0xd1
call fcn.0061a88e
call fcn.0062bd9f
mov eax, dword [0x84d6de01]
cmp dword [esi - 0x334fd6bc], edi
add dword [edx], ebx
jae 0x6da247
hlt

Function at 0x6e2284
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp ah, 2
stc
sub esp, 0x114
push esi
test edx, edx
jmp 0x5f848c
Function at 0x6e6639
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
pop ecx
dec eax
arpl dx, dx
mov eax, 0x8ba05b98
dec ebx
lea ebp, [edi + eax*8 + 0xaaef48d]
dec ecx
lea esi, [esp + ebp*8 + 0x281c9516]
dec eax
add edi, edx
inc ecx
rol ch, 0xc5
dec ebx
mov ebp, dword [ebx + edi - 0x7a939bb3]
inc ebp
movzx esi, di
dec ecx
lea edx, [ebp + esi*2 + 0x6db0a1a0]
inc ecx
xor esi, edi
dec ebx
mov edx, dword [ebx + ebp*4 - 0x26e50]
dec ecx
inc esp
inc ebx
mov cl, byte [ebx + ebp*8 - 0x4dca0]
dec eax
sub esi, 0x808d5f8e
inc bp
adc esp, eax
dec edi
lea ebx, [edi + ebx - 0x7a939ba9]
dec ecx
or edi, 0xe19ab28d
inc ecx
push esp
dec eax
shld ebp, edx, cl
dec esi
xor dword [esp + edi + 0x4644441], esi
dec eax
sal eax, 0x1c
dec ebx
mov dword [ebx + edi*2 + 0x8c88882], ebp
dec edx
neg dword [esp + edi + 0x4644441]
jne 0x61db17
inc edx
or byte [esp + ebp - 0x9b94], 0x18
dec edx
mov dword [esp + edi*4 + 0x11911104], edi
ret
inc edx
xor dword [esp + edi - 0x7a939bb3], edx
jmp 0x61d09a
bswap edx
inc ecx
mov eax, 0x9c1a94bc
not edx
pop eax
inc ecx
shl esp, 0x6b
inc ecx
dec edi
bswap edx
dec esi
mov dword [esp + ebp - 0x9bb4], ecx
inc cx
sar esp, 0x62
inc ecx
mov ecx, edi
jp 0x6d1278

Function at 0x6e6758
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
mov esi, dword [ebx]
call fcn.006eeeed
inc ebp
mov dword [ebx + edx + 0x67417d4d], esp
inc ebx
movzx ecx, byte [edi + edx - 0xf]
movzx ebp, al
inc ecx
mov esp, 0x9827c68b
dec eax
mov dword [esp + edx + 0x67417d4d], eax
dec edi
lea edx, [edi + edx - 0xf]
inc ecx
xor cl, cl
dec ecx
not esp
inc ecx
add ch, ah
add cl, 0x2d
inc esp
xadd dword [esp + edx + 0x67417d5f], edi
dec esp
xchg edx, eax
inc ecx
xor cl, bh
sub cl, 0xab
pop eax
dec ecx
ror esi, 0x72
inc ecx
xor cl, bh
inc cx
inc eax
dec edx
lea edx, [edx + edi*4 + 0x6714143d]
call fcn.00720ec2
jmp 0x5e877c

Function at 0x6e7b3b
Capabilities:
Get number of processors

Disassembly:
mov ebp, eax
inc ecx
ror eax, 1
call fcn.006d74f1

Function at 0x6e7b45
Capabilities:
Get number of processors

Disassembly:
inc cx
xadd eax, edx
inc edx
xor dword [esp + ebp - 0x39], ecx
dec esi
mov ecx, dword [esp + ebp*8 - 0x200]
sar bl, 0x47
inc ecx
movsx ebp, ch
call fcn.00728f99
cli
rol byte ss:[edi], cl
cmc
push ebp
cmp al, 0xce
bound ebp, qword [eax + 0x43]
cmp eax, 0xa7be4194
mov edx, ebx
inc ecx
movsx ebx, dh
dec ecx
sub edx, 4
inc ecx
mov edx, dword [edx]
call fcn.00567b3f
Function at 0x6e7b89
Capabilities:
Get number of processors

Disassembly:
call eax
ret
jg 0x708d08
inc ebx
mov eax, dword [edx + edi*4 - 0x7cf22844]
inc ebp
movzx eax, di
dec edi
lea edx, [eax + edx - 0x8a14]
inc esi
movsx esi, word [esp + eax - 0x8a10]
inc ecx
neg al
dec edx
lea edx, [esi*2 + 0x24143f8b]
inc ecx
xor eax, ecx
ror eax, 1
inc eax
call fcn.006115ea
push eax
dec esp
mov ecx, dword [esp + ecx*4 - 0x2cc]
dec ecx
not ebp
dec ebp
arpl di, di
inc ecx
shl ch, 0x46
dec eax
shl dword [esp + ecx*2 - 0x166], cl
inc sp
or esi, ebx
dec ecx
adc edi, edi
push ecx
dec eax
mov dword [esp + ecx*2 - 0x156], 0x4bbc3b3a
inc ecx
add edx, dword [ebx + ecx*2 - 0x16a]
dec eax
shl dword [esp + ecx - 0xa8], cl
rol dword [esp + ecx - 0xab], 0x31
inc ecx
mov esi, dword [ebx + ecx*4 - 0x2d4]
add edx, esi
mov esi, 0x95adb98c
dec esp
lea esp, [esi*8 - 0x4c7749f3]
inc ecx
mov dword [ebx + ecx*2 - 0x166], edx
xor bx, 0xfb8c
dec ebp
lea eax, [ebx + eax*2 + 0xa]
dec esi
mov dword [ecx + ebx - 0xb7], eax
inc ecx
ror ebp, 0xff
dec eax
mov dword [esp + ecx*4 - 0x2dc], edi
ret 0x18
dec ecx
sub edi, 0x25a5b01b
inc ecx
dec esp
inc cx
sub eax, ebp
dec ebp
lea ebp, [ebp + eax*2 - 0x1c6251fc]
mov ecx, esi
inc ecx
ror esp, 2
dec eax
ror edx, cl
inc eax
movzx ebx, ch
inc ecx
neg esp
inc ecx
rol esp, 1
inc esp
movsx eax, al
inc ecx
push ecx
inc esp
xor dword [esp + esi - 0xa26b3b5], esp
inc ecx
pop ecx
dec ecx
neg ebp
jb 0x5f9a6a
inc si
mov dword [eax + ebx - 0x7401], eax
inc ecx
sar bh, 0x64
ror ecx, 0x33
inc ebp
movsx ebp, di
jns fcn.005e92fc
movsx ecx, ax
xor edx, 0x84a53082
shl eax, 0xd5
dec ecx
dec edx
rol edx, 1
push eax
lea edx, [edx + eax - 0x6c011608]
mov dword [esp + eax*2 + 8], 0xec3d1f86
xor ebx, edx
add ebp, edx
xor dword [esp + eax], ebp
ret 0xc
inc ecx
mov cl, byte [ebx + esi*4 - 0x289aced2]
inc ecx
pop esp
mov eax, esi
dec esp
lea edi, [eax*4 - 0x7bce7b53]
dec esi
lea ebx, [esi + ebx - 0xa26b3b3]
inc cx
shl ebp, cl
inc ecx
movsx edx, bh
inc bp
mov dword [ebx + esi*2 - 0x144d676a], ebp
dec esi
lea edx, [esi + edx - 0xa26b3b9]
inc ecx
push edi
inc ecx
movsx ebp, di
inc esp
movsx esp, ax
inc ebp
mov esp, dword [edx + esi - 0xa26b3b5]
inc ecx
pop ebp
inc cx
inc edi
inc ebp
xor esp, ecx
xadd al, dh
jb 0x61b0dd
mov eax, dword fs:[0x30]
setns dl
xchg edx, edx
mov edx, 0x68333813
mov edx, dword [eax + 0x18]
jmp 0x70e47d
dec ebp
arpl sp, sp
or ebx, ebp
dec eax
sar edx, cl
dec ecx
adc edi, esp
inc cx
and ecx, eax
dec esp
lea ebp, [ecx*8 + 0x68737af]
dec eax
or edx, edi
jmp edx
push ecx
cbw
setno al
bswap ax
push 0
not ah
movsx eax, bx
push edx
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x5f7362
Function at 0x6e7c94
Capabilities:
Encode data using xor

Disassembly:
inc ebx
movzx esi, word [eax + edx - 0x2db9db9f]
dec edi
lea edx, [edx + eax*2 - 0x5b73b738]
inc edx
shr byte [esp + eax*2 - 0x5b73b724], 0x66
inc esi
and dword [esp + eax*2 - 0x5b73b723], eax
inc cx
xor esi, ecx
dec edx
shr dword [esp + eax*2 - 0x5b73b731], 0x4e
not si
inc eax
shl ch, 0x41
add si, 0xdaba
dec ecx
lea eax, [edi - 0x94d5751]
jmp 0x6354b6
shld eax, esi, cl
mov esi, 0x3dae5ba5
inc ebx
mov dword [ebx - 0x56], eax
dec edx
lea edx, [ebp*8 - 0x68e8acd8]
dec edi
lea edx, [edx - 0xb0]
inc edi
mov esi, dword [esp + edx - 0x2b]
adc al, 0xd5
inc eax
shl dh, 0xa1
inc ebp
xor esi, ecx
shr si, 0xe1
inc cx
sar ebp, 0xe
mov eax, edx
inc ecx
ror esi, 3
inc ecx
not esi
movsx ecx, dl
inc eax
shr dh, 0x82
inc ecx
neg esi
inc eax
sal dh, 0xc1
ror ax, 3
inc ecx
not esi
or ecx, 0x5bbfe993
inc ecx
push ecx
inc esi
xor dword [esp - 0x158], esi
inc esp
or esp, ebp
inc ecx
pop ecx
dec ebp
arpl si, si
dec esp
lea edi, [esi + 0x138e9f19]
call fcn.00721f2b
syscall
inc ecx
push edi
pushfd
dec ecx
mov edi, 0xd0b24e21
xchg esi, eax
loopne 0x6d6644
sahf
in al, dx
dec esp
mov edi, dword [esp + 8]
dec eax
mov dword [esp + 8], 0x13121507
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.00735f71
pop ebp
inc esp
and byte [ecx], ch
xor byte [ecx + ecx*2 - 0x45], al
jb 0x6d66a5
xlatb
push eax
inc eax
in eax, dx
pop edi
mov al, byte [0xc17c24d6]
pop edi
mov al, byte [0xc9a41cd6]
pop edi
mov al, byte [0xf90434d6]
pop edi
mov al, byte [0x291018d6]
mov dh, 0x51
jae 0x6d66cd
ljmp 0xd7df:0x2268eda2
inc ecx
xor esi, esp
inc edi
mov dword [eax + ebx - 0x2db9db95], esi
inc cx
ror esp, 0x67
inc ecx
pop ebp
dec edx
mov edx, dword [esi + ebx - 0x2885edf0]
dec ebp
adc edi, esp
inc ebx
mov cl, byte [eax + ebx - 0x2db9db8d]
inc edx
sub dword [esp + eax - 0x2db9db90], eax
inc eax
shr dh, 0x81
dec eax
mov dword [esp + esi - 0x2885ed7a], 0x5203a385
dec eax
shr edx, cl
shr ax, 0x8c
dec ecx
mov dword [ebx + esi*2 - 0x510bdaee], edx
dec edx
lea ebp, [ebx + 0x49344dac]
inc esp
movsx esi, si
jb 0x6372d5
mov ebp, 0xb7b1742b
inc esp
movzx esp, ch
inc ebx
mov eax, dword [ebx - 0x56]
inc ebx
mov esi, dword [ebx - 0xa8]
inc ebx
mov cl, byte [ebx - 0x4e]
dec edi
lea ebx, [esp + ebx - 0x25]
dec esp
lea ebp, [ebp + ebp + 0x1cae9626]
jmp 0x6d6624
Function at 0x6eb37c
Capabilities:
Encrypt data using speck

Disassembly:
bswap ebx
inc esp
mov eax, dword [esp + esi - 0x14]
inc esp
adc al, byte [esp + esi*8 - 0xe5]
dec ecx
shr esi, 0xa9
rol ebx, 2
inc ebx
dec ecx
lea eax, [eax + esi*2 + 0x7233c3b7]
dec esi
mov dword [esp + esi*4 + 8], ecx
call fcn.005f200a
inc ecx
dec dh
inc cx
mov dword [eax + eax - 0x51359102], ebp
inc esp
sbb esp, edx
dec eax
lea ebx, [edx*2 + 0x40e11b1]
dec edi
lea edx, [edx + edi - 4]
inc edi
mov ebp, dword [edx + edi*2]
inc ebp
xor ebp, ecx
dec esp
xor dword [esp + eax - 0x513590f3], esi
inc ecx
not ebp
inc cx
ror edi, 0x44
sub bl, byte [esp + eax - 0x513590fb]
inc ecx
rol ebp, 2
inc ecx
or al, dh
call fcn.0071e6a8
dec eax
mov dword [esp], 0x1d0cfc22
dec ecx
add ebx, 0x10
dec ebp
mov dword [esp], ebp
mov ebx, dword [esp + 2]
dec ebp
lea edx, [edx + ebx*8 - 0xe864]
inc edx
mov ebx, dword [ebx + edx - 0x1d0c]
inc ecx
xor ebx, ecx
inc ecx
mov esi, 0x4a0d7b06
inc edx
movzx esi, word [esp + esi - 0x4a0d7b03]
inc ebx
inc ecx
push esi
dec eax
neg dword [esp + esi*2 - 0x32]
jno 0x6264fa
test ebp, 0x4d22c18f

Function at 0x6ed336
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + ebp - 0x4386a8f], ebp
inc sp
xchg dword [esp + ebp - 0x4386a86], ebp
inc ecx
bswap eax
ja 0x626708
inc ecx
rol eax, 1
inc cx
neg ebp
inc esp
or dword [esp + ebp - 0x4386a84], ebp
inc esi
lea eax, [ebp + eax + 0x146f2c9b]
inc ecx
ror eax, 1
dec dx
inc esp
movsx esp, ch
shr dx, 0x44
inc ecx
dec eax
mov eax, edx
dec ecx
sal esp, 0x81
rol byte [esp + ebp - 0x4386a8d], 0xe5
inc ecx
xor eax, 0xc8a7e682
call fcn.0055d169

Function at 0x6ede0c
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
mov ecx, edi
inc ecx
sub ah, 0xab
inc ecx
mov esi, 0x8b31ebb1
sal si, 0x2c
inc ecx
not ah
mov ebx, ecx
or si, bx
inc ecx
rol ah, 1
xor si, cx
call fcn.00710669
inc ecx
movsx ebp, di
inc ecx
not ah
inc ecx
shl eax, 0x91
jb 0x6257a2
mov dword [esp + eax*2 - 0x16e029d6], 0xd9595aa
adc ebp, ecx
xchg dword [esp + eax*2 - 0x16e029d6], eax
movsx ecx, byte [esp + eax - 0xd9595a6]
mov ecx, dword [edi + eax*2 - 0x1b2b2b54]
mov eax, dword [edi + eax*4 - 0x365656a4]
push 0xa5aaa72a
dec word [esp + 1]
add edi, 4
mov edx, dword [esp + 8]
call fcn.00631475
inc ebp
movzx esp, byte [edx - 1]
dec esp
lea edi, [esi*2 + 0x3605cb2a]
movzx edx, si
inc ebp
xor ah, cl
inc ecx
add ah, 0x2d
inc ebp
movzx eax, di
jmp 0x6e5b62

Function at 0x6f3570
Capabilities:
Encrypt data using speck

Disassembly:
or dx, dx
and al, cl
mov word [edi], ax
neg edx
mov dword [esp + edx*4 - 0x437e1c38], edx
lea esi, [esi + edx*4 - 0x437e1c3c]
call fcn.00731c9b

Function at 0x6f358d
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
lea eax, [esp + ebx - 0x59e2df4f]
push ebx
inc esp
adc esp, eax
sbb word [esp + edx*4 - 0x1426c], cx
inc ebp
mov dword [eax + ebx - 0x59e2dfaf], ebp
dec eax
shl dword [esp + ebx - 0x59e2dfaf], 0x75
inc ecx
push esi
dec esp
lea ebp, [esp + edx*2 - 0xa0c6]
inc edx
mov edx, dword [ebx + ebp - 0x59e2dfaf]
inc esp
movzx eax, bl
add ax, 0x7980
dec edx
mov dword [esp - 0x4a2293ff], ecx
inc edx
mov dword [eax + ebx - 0x4a220d28], edx
dec esi
lea eax, [eax*8 + 0x309ad0b4]
call fcn.00628ab1
Function at 0x6f4c40
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor ebp, ecx
dec eax
mov dword [esp + eax*8 - 0x12110], 0x99025e31
sub ebp, 0x82008412
inc esp
movzx esi, bx
rol ebp, 2
inc ebp
inc ecx
shr esi, 0xe1
sal al, 1
xor ebp, 0x8f3e47b9
inc ecx
mov eax, 0x8b17206
push edx
inc eax
rol dh, 0x61
dec esi
mov dword [esp + edi*2 - 0x7680], ecx
call fcn.00726786
sbb cl, byte [ebp + 0x25]
and ch, byte [ecx]
les edi, [ebx + 0x2f]
ja 0x6f4c63
test ah, al
invalid
invalid
mov edx, 0xa2745bee
salc
xchg dh, dh
or esi, dword [edx - 0x2a]
adc eax, 0xa27403ee
salc
cli
ficomp word [ebx]
je 0x6f4c45
salc
mov byte [ebp - 0x6b], 0xc
jp 0x6f4d1b
loopne 0x6f4cfc
mov edi, ebp
push 0xf7fc51b4
fsubr qword [ebx - 0x38]
fidivr dword [ebx - 0x6e6e6e57]
cld
neg esp
imul ecx, eax, 0xffffffda
mov ebx, 0x919191a9
fsubr dword [edi + 0x79]
mov al, byte [0xece5fdf9]
add byte [edi - 0x6a687201], 0x98
add byte [edi + 0x4de3a9ff], 0x1c
sbb cl, byte [ebx + 0x29230f1f]
add byte [edx + 0x57], bl
jbe 0x6f4cb4
add eax, 0xa275d02d
salc
or eax, 0xa275908e
salc
mov cl, 0x35
sal byte [ebp - 0x5e], 1
salc
push ecx
sar dword [ebp + esi*2 - 0x5ef6295e], 1
or byte [edi - 0x341f8e85], dl
mov bh, ch
push 0xf7fd96db
fsubr qword [ecx + ecx*8 + 0x5268bbda]
and byte [edx], dh
outsd dx, dword [esi]
outsb dx, byte [esi]
jns 0x6f4cb1
retf
inc esp
and byte [edx], al
add eax, dword [ebx + 0x5a62ff87]
dec esp
inc edi
add dword [edi + 0x4c144aff], 0x1c
sbb bl, bh
rcr dword [edx - 0x68d5c1aa], cl
lahf
mov bh, 0xa8
invalid