joyce8/EMBER2024-capa huggingface dataset:
Function at 0x752268
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
push esp
dec edx
sar dword [esp + ecx - 0x1b9], 0x15
inc ecx
xor ecx, ebp
inc ecx
mov edx, 0x3f2f323b
inc ebp
mov eax, esp
ror ecx, 1
inc ecx
or eax, 0x1795ef39
dec edx
dec dword [esp + ecx - 0x1b9]
inc bp
xadd eax, esp
bswap ecx
inc esi
mov byte [esp + ecx - 0x1b2], al
dec edx
inc dword [esp + ecx - 0x1b9]
ror ecx, 1
dec edx
shr dword [esp + ecx*2 - 0x372], 0xe4
neg ecx
inc edx
shl byte [esp + ecx - 0x1b9], 0xc6
call fcn.00b466eb
inc ecx
dec edx
inc ecx
rol edx, 3
dec eax
mov dword [esp + 8], 0xcd1f0db3
inc ecx
mov eax, 0x8daf4617
inc ecx
neg edx
dec ebx
lea ebx, [eax + eax - 0x14d2d8c4]
jmp 0x7f807c
inc ebp
mov esp, dword [ebx + eax*2 - 0x54]
inc esp
movzx edi, dx
dec eax
mov dword [esp + eax*2 - 0x34], edx
inc ebp
xor esp, ebp
mov ebp, edx
dec ecx
xchg edi, ebp
dec eax
mov dword [esp + eax*2 - 0x4c], 0x9c07303a
inc ecx
bswap esp
dec eax
not eax
inc edi
lea esp, [esp + ecx - 0x166996cf]
inc esp
movsx edx, word [esp + eax*2 + 0x53]
dec ecx
lea edi, [edi + ebp + 0xc11612a]
inc ecx
ror esp, 3
dec eax
and ebp, eax
inc ebp
movzx eax, dl
ror ax, 0x85
inc ecx
inc esp
rol di, 3
inc ecx
push edi
dec esp
mov dword [esp + eax + 0x3022], ebp
jae 0x73f844
dec eax
lea edx, [edi + edi - 0x36f39ded]
inc esp
xor dword [esp + eax*2 + 0x6024], esp
dec esp
mov ebp, dword [esp + eax + 0x3022]
dec ebp
arpl sp, sp
dec eax
inc edx
dec ebp
add esi, esp
inc ebp
movzx esp, byte [ebx + eax*8 + 0x18007]
movsx ecx, byte [esp + eax*4 + 0xc022]
dec ebp
lea ebx, [ebx + eax + 0x2ff9]
neg cl
sub ecx, ebp
inc ebp
xor ah, ch
dec eax
bswap ebx
inc ecx
rol ah, 1
add bx, 0xfeb6
push ebx
js 0x81c035
inc dword [esp + 6]
inc esp
movsx esp, bx
inc ecx
bswap edx
call fcn.00b32799
mov dword [esi - 0x37], 0x71ff2565
in al, 0x18
mov dl, 0x32
sub eax, 0x238fa8e
or al, byte [0xda38fa8e]
ljmp 0x628a
inc ecx
not al
inc ecx
sub edx, 0xe78f212a
jmp 0x75fefc
inc ecx
xor ah, 0x87
inc ecx
dec ah
inc ecx
rol dl, 0x46
not di
dec esp
xchg dword [esp + eax*8 + 0x18025], eax
inc ecx
xor ah, 0x8e
dec eax
mov dword [esp + eax*4 + 0xc030], eax
inc ebp
xor ch, ah
xadd word [esp + eax*4 + 0xc031], cx
jge 0x82ba5e
dec esi
lea esp, [esp + 0x30]
xchg word [esp + eax*2 + 0x602f], cx
dec eax
xor edi, edi
inc si
movzx eax, byte [eax + 0x3002]
dec eax
ror dword [esp + eax*8 + 0x18025], cl
inc sp
mov dword [esi + eax + 0x2ffa], eax
dec ecx
xchg edx, ecx
dec eax
lea esi, [esi + eax + 0x2ffa]
inc ecx
pop edi
inc ecx
pop esp
pop ecx
pop ecx
inc ecx
pop esp
pop eax
jns fcn.007a084f
inc ecx
xor bl, ch
inc ecx
movzx eax, cl
add bl, 0xf
inc esp
or al, dl
inc ecx
sar al, 0xc6
ror bl, 1
and byte [esp + edx*2 - 0x7824], dl
inc ebp
xor esp, eax
mov ebp, dword [esp + edx*4 - 0xf050]
inc ecx
xor bl, al
rol bl, 1
inc bp
add edx, esp
shr cl, 0xa5
inc esp
xor ch, bl
dec eax
lea ebx, [esp + ebx + 8]
dec ecx
sub eax, 0x2f869482
inc byte [esp + edx*8 - 0x1e0a0]
inc ecx
neg cl
dec esp
mov esp, dword [edx + ebx - 0x3c14]
sar dword [esp + edx - 0x3c14], 0x64
dec esp
mov dword [esi + edx - 0x3c14], esp
call fcn.0074c019
pop ecx
pop eax
jmp edi
Function at 0x754f37
Capabilities:
Execute syscall

Disassembly:
sub eax, 0xff1c9334
rol eax, 1
dec eax
lea ecx, [edx + ebx*2 + 0x3ea7c29c]
add edx, 0x33b3ef92
call fcn.00b38047
syscall
call fcn.00b4c420

Function at 0x755984
Capabilities:
Authenticate hmac

Disassembly:
sub cl, 0x3c
not edx
add cx, ax
mov dword [esp + eax*2 - 0x44edfef4], ecx
bswap edx
xor ebx, edx
add edi, edx
xchg word [esp + eax*2 - 0x44edfef4], cx
and byte [esp + eax*2 - 0x44edfef2], 0x2d
mov cx, word [esi + eax - 0x2276ff80]
lea esi, [esi + eax*2 - 0x44edfef8]
jg 0xc830ec
xor ebx, ecx
sar edx, 0x5d
call fcn.008244a1
not edx
mov al, byte [esi + 2]
add esi, 2
add cl, al
mov eax, edx
and ax, 0xe6b8
mov word [esi], cx
mov ecx, dword [ebp]
adc eax, 0xd6240402
add ebp, 4
sar dx, 0xab
rol ax, 0x4a
xor edx, 0xf21479be
xor ecx, ebx
push eax
shr dl, 0xe1
lea ecx, [edx + ecx + 0x4e3c8d02]
not ecx
bswap ecx
not ax
shl dx, 0xe1
pop edx
dec ecx
rol ecx, 2
not ecx
jmp 0xbede38
jae 0xce62cd
mov edx, 0x2e8c7914
movzx cx, byte [edx + esi - 0x2e8c7914]
shr dl, 0x45
je 0xc6b58b
or eax, 0xd5847aad
movzx eax, byte [ebp - 0xa]
mov edx, 0xe1fa1a3
not dx
call fcn.00867fb5

Function at 0x763738
Capabilities:
Encode data using xor

Disassembly:
inc esi
xchg dword [esp + eax*8 - 0x37023], ecx
inc edx
lea edi, [edi + eax*2 - 0x552b7eb9]
inc ecx
inc eax
ror edi, 1
xor edi, 0x9828198
sar ax, 0x83
inc ecx
setp cl
dec edi
dec ecx
shr edx, cl
call fcn.0087b38f
not eax
jbe 0xc62e62

Function at 0x76b723
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
xor bx, ax
mov edx, ecx
shr ecx, cl
adc edx, edx
mov word [ecx + ebp - 6], ax
mov eax, dword [edi + ecx + 2]
mov dword [esp + ecx*2 + 4], edx
xor eax, ebx
shr dword [esp + ecx + 4], 0xd1
dec dx
xadd cx, dx
inc eax
bswap eax
inc cl
dec eax
xadd edx, ecx
bswap eax
xor ebx, eax
or dword [esp + ecx*2 - 0x1fffc], 0xb39f3d8a
jno 0xc85903
jmp 0xc00c0c
lea edi, [edi + edx*4 + 0xa]
xor ecx, ebx
call fcn.00b7f4d0
dec dl
mov dword [ebp + ecx*2 - 0x2000a], eax
sub dword [esp + ecx - 0xfffc], 0x803002be
sbb edx, edx
lea ebp, [edx + ebp - 0xa]
mov ecx, dword [edi + ecx*8 - 0x7fffa]
movsx eax, dl
jae 0xc389ce
Function at 0x76d02d
Capabilities:
Encode data using xor

Disassembly:
invalid
ret 0x948a
dec esp
mov dword [esp + eax], eax
dec esp
mov dword [esp + eax], ebp
inc ebp
movsx esp, ax
not ebx
xor dword [esp + eax], ecx
dec ecx
shl eax, 0xab
loopne 0x76cfed
shl di, 0x6d
inc ecx
pop ebp
call fcn.00b668f1
and edx, dword [esi + 0x69ae65a4]
push cs
enter 0x78ec, 0xffffffffffffffb9
sub dword [esi + 0x7938f5e0], esi
loope 0x76cffe
mov ecx, 0xf5e0b629
cmp byte [ecx - 0x1f], bh
jns 0x76d040
sahf
loopne 0x76d057
cmp byte [ecx - 0x17], dh
push ds
loopne 0x76d05d
cmp byte [ecx], dh
mov ecx, 0x38f5e016
leave
test eax, 0x38f5e01e
xor dword [ecx], edi
salc
loopne 0x76d06f
cmp byte [ecx], bl
add dword [esi + 0x1138f5e0], edi
sbb dword [ecx], eax
mov esi, 0x1138f5e0
pop ecx
loopne 0x76d07b
cmp byte [ecx - 0x2dc6be87], bh
pop edi
lea ebp, [edx - 0x1ae5f23b]
mov esp, 0xb8edbcb8
xor byte [edx], bh
lodsd eax, dword [esi]
mov dword [edi], esp
jecxz 0x76d0fc
adc dword [eax + 0x7a23a33], ebp
loopne 0x76d0ef
push ebp
out dx, al
test eax, 0xe866e714
xchg esp, eax
fiadd dword [eax + 0x21187081]
xchg ecx, eax
call fcn.0077ab50
add byte [eax], al
cmp bl, al
inc esp
add byte [esi], bl
and ch, byte [ebx - 0x50]
js 0x76d10b
mov dh, 0x23
mov al, byte [0xe63ebc7a]
div dword [ecx - 0x212144a1]
dec edi
mov cl, 0x5f
mov ebx, 0xb1076626
pop edi
mov ebx, 0xb13f565e
pop edi
mov ebx, 0xb16f3656
pop edi
mov ebx, 0xb1d75e36
pop edi
mov cl, 0x5f
mov ebx, 0xb147866e
pop edi
mov ebx, 0xb1cf8eee
pop edi
mov ebx, 0x76141eeb
inc ecx
shl esp, cl
and bx, 0xe79e
bswap eax
dec esp
cmovp edx, ebp
inc sp
enter 0xf4c, 0x4a
aad 0x66
inc esp
or esp, edx
inc ecx
push ebp
inc edx
xor dword [esp + edx - 0x3d833cc1], eax
shr ebp, cl
call fcn.00b1692b
push ecx
call fcn.00bf6a96

Function at 0x775e3d
Capabilities:
Get number of processors

Disassembly:
mov dword [esp + edx - 0x640e5010], eax
xor cl, 0xb2
sal dl, 0xe5
call fcn.00bf1d44
Function at 0x776408
Capabilities:
Encode data using xor

Disassembly:
shld eax, edx, cl
pop edx
mov dword [ebp], eax
mov edx, 0x67aa812e
mov eax, dword [edi + edx - 0x67aa812e]
lea edi, [edx + edi - 0x67aa812a]
movsx ecx, dl
lea ecx, [edx + 0x7706c78e]
sal dx, 0xc9
xor eax, ebx
dec eax
and cx, 0x7c92
neg eax
sal dx, 0x43
shl edx, cl
xor eax, 0xb292fa29
not cx
shl ecx, 0x22
xor edx, 0xb537fe26
inc eax
xor ebx, eax
sar dl, 4
not edx
adc esi, eax
movzx eax, dl
add cl, 0x3e
call fcn.00d04204
cmpsb byte [esi], byte es:[edi]
mov dword [0x5068c70f], eax
aam 0xe2
inc ebp
add dword [ecx + 0x38e4a386], ebx
sub ecx, esp
outsb dx, byte [esi]
mov dword [0xb1b138e4], eax
mov esi, 0x7138e4a3
mov esi, edx
mov dword [0x290938e4], eax
mov fs, word [ebx + 0x215138e4]
out dx, al
mov dword [0xa13138e4], eax
jbe 0x77643a
in al, 0x38
mov ecx, 0xe4a3fe01
cmp byte [ecx], ah
mov eax, dword [0x52dc7d19]
cmp esi, edx
stosd dword es:[edi], eax
push ds
cmp esi, ebp
cwde
pop ss
jp 0x7764c0
and eax, 0xffffffff
jl 0x77651a
dec esp
pop esi
out 0x6a, al
mov esi, 0x49a4b7b
pop esi
mov ebx, 0x4020bc3
pop esi
add al, byte [esi + ebx*2]
mov ebx, 0x4627bab
pop esi
mov ebx, 0x43a631b
pop esi
mov ebx, 0x452c393
pop esi
mov ebx, 0x4822b7b
pop esi
mov ebx, 0x46a8bab
pop esi
mov ebx, 0x4221343
pop esi
mov ebx, 0x7615ab06
push ss
or al, 0xd1
js 0x776512
into
sbb esp, edx
sbb cl, bl
add dword [esi], ebp
mov dword [0xb9c138e3], eax
push ds
mov dword [0x79d138e3], eax
mov dword cs:[0xe9e138e3], eax
mov dword ds:[0xa1e138e3], eax
salc
mov dword [0x211938e3], eax
out dx, al
mov dword [0x392138e3], eax
jecxz 0x776554
and dword [ecx], edi
jbe 0x7764c3
jecxz 0x77655a
fst dword [ecx - 0x1fd6e9cf]
cmp cl, dl
in eax, 0x85
pop edi
in al, dx
xor dword [ebx - 0x6711c75a], esi
scasd eax, dword es:[edi]
jnp 0x776548
and eax, 0xffffffff
mov ah, 0xe4
les ecx, [esi]
out 0x6a, eax
mov esi, 0x5dabb2b
pop esi
fiadd dword [0xf373bb5e]
inc edx
add eax, 0x2bebbb5e
jp 0x776558
mov ebx, 0x542f373
pop esi
mov ebx, 0x57a2beb
pop esi
mov ebx, 0x5928b23
pop esi
add eax, 0x13cbbb5e
add byte [0xc3dbbb5e], 0xb2
add eax, 0x83cbbb5e
add byte [0x4bebbb5e], 0xba
add eax, 0xaa9ebb5e
adc eax, 0xa2d40c76
aad 0xb8
dec edx
mov ch, 0xe2
fsub dword [ebp + 0x75]
ret 0xfe05
mov ebx, 0x58213cb
pop esi
mov ebx, 0x5b2c3db
pop esi
mov ebx, 0x58283cb
pop esi
mov ebx, 0x5ba4beb
pop esi
mov ebx, 0x7615aa9e
or al, 0xd4
mov byte [0xb54ab8d5], al
loop 0x776558
jne 0x776545
add eax, 0x65edb8fe
jns 0x776560
mov bl, 0xa8
invalid
Function at 0x78b96e
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
lea esi, [esi + edx*2 - 0xba43c]
rol word [esp + eax + 0x6c9844d8], 0x61
dec esp
or dword [esp + edx - 0x5d211], ecx
dec ebp
adc esp, eax
inc esi
movzx ecx, word [eax + ebx + 0x6c9844b6]
dec esi
lea ebx, [eax + ebx + 0x6c9844b6]
inc bp
xor ecx, ebp
inc bp
xor ecx, eax
dec eax
and edi, 0xad311b16
adc byte [esp + eax + 0x6c9844d2], 0xa3
inc cx
neg ecx
inc ecx
push edi
or dword [esp + edx - 0x5d204], edi
sal edi, cl
inc cx
rol ecx, 1
dec eax
inc edi
inc bp
xor ecx, eax
inc ecx
pop eax
dec esp
mov dword [esp + eax + 0x6c9844c2], eax
inc cx
neg ecx
xchg byte [esp + edx - 0x5d216], bl
sar al, 5
sub byte [esp + ebp*2 - 0x19c01], 0xb2
inc cx
inc ecx
dec eax
mov dword [esp + eax + 0x6c984517], edx
inc esp
xor bh, byte [esp + eax + 0x6c98451c]
inc bp
xor ebp, ecx
call fcn.00851039
mov edx, 0x44859e1b
mov edx, dword [edx + edi - 0x44859e1b]
mov ecx, 0x439ac794
movzx eax, cx
mov eax, dword [edi + eax - 0xc790]
call fcn.00b96e8a

Function at 0x7921a1
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
mov dword [esp + edx - 0x35dc], 0x8e018028
or byte [esp + edx - 0x35da], ch
bswap eax
adc ecx, edx
xchg ch, dl
xor word [esp + edx*4 - 0xd4d2], dx
ror eax, 2
or edx, dword [esp + edx*2 - 0x6a6a]
js 0xbd6cdd
sbb eax, 0x8d30ae3c
xor cx, word [esp + 2]
adc edx, 0x13271a92
bswap eax
call fcn.0077c8bd
jmp 0xc06e25
jmp 0xc15b1c
mov edx, dword [edi + edx - 0x601175fc]
mov eax, 0xcdad9b2f
push eax
jmp 0xcdc295
add edi, 8
rol eax, 0xf1
mov dword ss:[ecx + eax - 0x365f9b5b], edx
call fcn.0080b634
add edi, edx
movzx edx, ax
call fcn.007c7a5d
mov word [edi + eax - 0x281c4ef], cx
pop ecx
pop edx
jge fcn.007d4ecd
Function at 0x79a9a3
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sbb dl, 0xab
inc al
pop eax
xor bl, dl
pop eax
or byte [esp + 2], 0xbf
lea edx, [esp + edx + 4]
setl al
mov dword [edx], ecx
mov edx, dword [edi]
jle 0x79ceaa
mov edx, dword [eax + ebp - 0x22c165cc]
push eax
neg dword [esp + eax*2 - 0x4582cb98]
lea eax, [eax*4 - 0x5c56f100]
xor edx, ebx
jmp 0xc045b1
movzx ecx, ax
sub cx, 0x7497
lea edi, [edi + ecx - 0x5d66]
sar al, 0xa5
sar cx, 4
dec cx
xor edx, ebx
lea eax, [ecx - 0xce5e1ec]
not dword [esp + ecx*2 - 0xbaa]
not edx
and ecx, ecx
lea edx, [edx + ecx*2 - 0x99a05c3]
not dword [esp + ecx - 0x5d5]
jne 0x829fea
mov ecx, 0x5713a483
movzx cx, byte [esi + ecx - 0x5713a483]
movzx eax, dx
and edx, 0x200ce20e
dec eax
mov dl, byte [esi + edx*2 - 0x108412]
ror eax, 0x84
not ax
add esi, 2
not cl
not dl
and cl, dl
movsx edx, al
call fcn.00bf4b5a
bswap edx
sete dl
sbb ebp, 0xfffffffb
ror edx, 0x66
adc edx, 0x13b836b5
xor cl, bl
sub cl, 0x95
xor edx, 0x9d2f5f08
sar edx, 0xe4
rol cl, 1
ror edx, 0x86
rol dx, 0x2e
adc dl, dl
add cl, 0x97
inc edx
call fcn.00b33f51
je 0x85713a
mov esi, dword [ebp + 0xc]
jmp 0xcf8e24
je 0x85713a
mov eax, dword [eax + 0x7c]
push ebx
jmp 0x7f1ef2
xor edx, 0xd88253ab
shr cl, 0xe5
sub edx, 0xbb1e54bf
xadd dword [esp + ecx*2 - 0xa0c], ecx
xor ebx, edx
add esi, edx
movzx edx, word [esp + ecx - 0x7fffe40c]
sar cx, 0xec
mov dword [esp + edx*8 - 0x74890], esi
ret
mov eax, dword [edx + 0x3c]
clc
lea eax, [eax + edx]
cmc
test di, 0x1b04
stc
cmp dword [eax], 0x4550
jne 0x85713a
mov ecx, dword [eax + 0x78]
test edx, esp
mov dword [ebp - 4], ecx
clc
test ecx, ecx
jmp 0x7c35cd
je 0x85713a
mov eax, 0x5a4d
cmc
cmp word [edx], ax
je 0x8485a8
xor eax, eax
pop esi
jmp 0xbbf1d6
mov esp, ebp
pop ebp
ret
ror edx, 3
not ax
call fcn.00c33687
test esi, esi
jmp 0x857125

Function at 0x7a4095
Capabilities:
Encrypt data using speck

Disassembly:
ror al, 1
bswap ecx
dec al
xor bl, al
mov dword [esp], edx
add ecx, 0x8219900a
neg dx
sub ebp, 2
ror edx, cl
mov byte [esp + edx - 0x5e956216], ch
mov word [ebp + edx - 0x5e95621f], ax
lea esi, [esi + edx - 0x5e956223]
mov eax, dword [esi + edx - 0x5e95621f]
jae 0xc40597
cmp edi, 0xb8990b3f
test al, 0x16
sal ecx, 5
call fcn.00be7b2d

Function at 0x7a5f2f
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp - 0x81c0000], 0x54a58015
dec ebx
mov dword [esp + ecx - 0x81c0000], ebp
call fcn.0083fb86
Function at 0x7a5f48
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + edi*8 - 0x1f0], 0x71179b0e
dec eax
lea esi, [edi + esi - 0x3e]
dec esp
mov dword [esp + edi*4 - 0x108], esi
ret 0x20
dec eax
mov ebx, dword [esi + ebx*2 - 0x1ff3a]
inc esp
mov bh, byte [esi + ebp*2 - 0x12]
sar cx, 0x4b
inc ecx
and cl, 0x20
dec eax
lea esi, [ebp + esi - 3]
inc esp
mov byte [ebx + ebp*4 - 0x34], bh
dec eax
mov dword [esp + ebp*2 - 0x1a], 0x8b22d689
inc cx
and esp, 0x894ce030
je 0x7a5fe6
out 0xc2, al
sbb byte [eax], al
cmp al, byte [ecx - 0x68]
xor eax, 0xf3134cf2
inc edx
mov ebx, dword [esi + 0x6b308264]
inc edx
not byte [esp + 0x3598413c]
inc esi
mov edx, dword [esi + 0x1acc209d]
inc cx
neg ecx
inc ecx
or ebx, edx
jmp 0xb8e1c8
inc ecx
neg cl
pop edi
not ebx
mov dword [esi + edi*2 - 0x80], ebx
jnp 0x740117
mov ax, word [eax + ebp - 0x623d2f1c]
mov ecx, 0x8594ef34
call fcn.00c361bb

Function at 0x7b3cad
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
mov dword [esp + edx - 0x7d], ebx
dec eax
mov esi, dword [esp + edx*2 - 0xc2]
inc ecx
pop ecx
push edx
dec esp
mov esp, dword [esp + edx - 0x35]
inc ebp
movsx edi, bl
inc ecx
pop ebx
dec eax
mov ebx, dword [esp + edx - 0x35]
dec esp
mov edx, dword [esp + edx*4 - 0x1bc]
dec esp
mov ebx, dword [esp + edx*4 - 0x1b4]
inc esp
movsx ecx, byte [esp + edx - 0x63]
inc esp
xchg byte [esp + edx*2 - 0x105], cl
dec esp
mov ecx, dword [esp + edx*2 - 0xa2]
inc ecx
xchg edi, edx
call fcn.00b1cedd

Function at 0x7c011e
Capabilities:
Encrypt data using speck

Disassembly:
inc edi
lea esp, [esp + ecx - 0x7b7b0712]
call fcn.007f34b6

Function at 0x7c16ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr edx, 8
jmp 0xca35c4
mov dword [esp], 0xe5198083
xor edx, edi
inc eax
xor edx, 0x1e33ebaa
dec ecx
lea esp, [esp + 8]
jne 0xb12e6a
mov edi, 0x56a1cc29
sub di, di
pop edi
jmp 0xc2a705

Function at 0x7c785c
Capabilities:
Encrypt data using speck

Disassembly:
inc byte [esp + ebx*2 - 0xca65]
pop edi
neg dl
sub dl, 0x31
inc ecx
mov esp, 0xc30b10c
inc esp
movzx edi, bx
inc ecx
push edx
ror dl, 1
dec esp
mov dword [esp + ebx*2 - 0xca72], eax
neg word [esp + ebx - 0x6536]
inc ecx
sub dl, al
add word [esp + ebx*2 - 0xca64], 0x7823
movsx edi, al
inc esp
xor ch, dl
and byte [esp + ebx - 0x6527], 0x26
push edi
dec eax
lea edx, [esp + edx + 0x20]
inc esp
mov dword [ebx + edx - 0x653d], ecx
inc ecx
mov ebx, dword [ebx + ebx*2 - 0xca80]
inc ecx
xor ebx, ebp
ror ebx, 1
not ebx
inc ecx
pop eax
inc esi
xadd dword [esp + eax*2 - 0xed], edx
dec edx
xor dword [esp + edx*2 - 0xc4], 0x6f8d5292
inc edx
lea ebx, [ebx + edx*4 + 0x222c686e]
call fcn.0077fca1
Function at 0x7d47d9
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, 0xb2bb4c09
xor ax, ax
or edx, 0x2f928e33
neg dl
rol ecx, 1
dec ecx
rol ecx, 1
bswap eax
xor ebx, ecx
dec eax
rol edx, 0xd5
add esi, ecx
sub edx, 0x11877d8f
mov ecx, edx
mov di, word [edi + eax*4 - 0x5f00]
jne 0xc03e76
mov edx, dword [edi]
add edi, 4
mov ecx, 0xfd103e8c
mov eax, ecx
xor edx, ebx
lea ecx, [ecx + eax*2 - 0x40cdd14e]
inc al
not ecx
mov dword [esp + edx - 0x43b98500], edx
ja 0xb44572
mov ecx, 0x2b2d1119
inc cl
mov ecx, dword [ebp + ecx*2 - 0x565a2234]
mov eax, 0xc117f33d
movzx edx, al
lea ebp, [ebp + edx*2 - 0x76]
xor ecx, ebx
neg ecx
lea ecx, [ecx + eax + 0x2aa2c160]
jmp 0x7164a7
rol ecx, 1
rol ax, 0x22
sub ecx, 0x858b828d
shr al, 0x47
jnp 0xb1be97

Function at 0x7d4bef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xd49c9921
adc ebp, 4
xor edx, edx
test ecx, ecx
jmp 0xb12e5f
lea esp, [esp + 4]
je 0xc2a729
push edi
mov edi, 0xbc92ad33
movzx edi, byte [eax]
call fcn.00785b71
mov eax, 0x59059c93
not edx
mov dword [eax + ebp - 0x59059c93], edx
movzx edx, al
jmp edi

Function at 0x7e1bb5
Capabilities:
Encrypt data using speck

Disassembly:
add edi, 2
pop edx
mov edx, dword [esp]
not cx
call fcn.00c3efbd

Function at 0x7e1c38
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
neg ecx
jp 0xb1eecf
lea ebp, [ebp + eax - 0x57869b85]
xor ax, ax
mov dword [esp + edx - 0x1db0c8a0], eax
xor ecx, ebx
neg ecx
sub eax, eax
add edx, 0x871094ad
dec ecx
sar dx, 0x64
add ax, word [esp + eax*2 + 1]
xor ecx, 0x183a92b
shl al, 0xe3
not ecx
jbe 0xc97305
dec eax
inc ebp
movsx esp, dx
inc cx
xor edx, 0xd8f7f80d
dec eax
dec edi
dec ecx
shr esp, cl
dec edx
lea edi, [edi + 0x302d5619]
bswap eax
jp 0x789dcd
mov ebx, ecx
dec ecx
shl ecx, cl
dec eax
mov ebp, dword [esi + ebp - 0x7490]
ja 0xbbf191
neg eax
inc bp
xchg esp, edx
inc ecx
push ebp
xor dword [esp + ecx + 0x7e], eax
jmp 0xcb54ac
or edx, 0x1d93e88d
call fcn.00cba270
xor ebx, 0x77a421b6
inc edx
not byte [esp + edi - 0x98]
inc edx
lea ebx, [ebx - 0x3c7b1f81]
dec esi
mov dword [esp - 0x42403aca], ebp
shr eax, 0xd5
inc ebp
movsx ebp, ah
inc ecx
movsx ecx, sp
inc edx
xor dword [esp + edi*2 - 0x13e], ebx
inc ecx
inc esp
jns 0xcf7f68
call fcn.00734302
call fcn.00c62537
inc ecx
or byte [ecx - 0x2c], ch
inc edi
imul ecx, dword [esi + 0x3a], 0xffffffc5
xor byte [eax - 0x71], ah
inc esi
cmp al, 0x38
push eax
mov al, byte [0x383c46f7]
pop eax
add bh, al
inc esi
cmp al, 0x38
or al, dh
iretd
enter 0xffffffffffffffd4, 0xffffffffffffffff
sbb ah, 0xc
xchg ecx, eax
mov eax, dword [esp + edx*8 - 0xacfb]
pop ecx
pop edx
pop edx
pop ecx
pop eax
jnp fcn.00c6975d
dec edi
lea ebp, [ebp + ebp*8 + 0x732c5086]
inc ecx
pop ebp
dec eax
shl ecx, cl
dec eax
arpl bx, bx
dec esp
adc esi, ebx
dec ecx
shl edi, 0xe0
dec eax
mov esi, dword [esi + eax*4 - 0x12c4]
dec eax
rol ecx, 0x76
call fcn.0075edc7
and al, 0x18
dec edx
add bh, bh
push edi
int 0xbb
insd dword es:[edi], dx
out 0x9f, eax
daa
int 0xbb
insd dword es:[edi], dx
mov bh, 0x87
dec edi
int 0xbb
insd dword es:[edi], dx
jmp 0xcf7f4e
Function at 0x7e29ae
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + edi*2 + 8], ecx
inc ecx
xor ebp, ebp
inc ecx
movzx ebx, di
inc ecx
push edi
inc ecx
pop eax
rol ebp, 3
lds eax, [ebx]
not ebp
inc ecx
xor eax, 0xe28fe684
inc ecx
movsx ecx, ah
inc edx
movsx eax, word [esp + edi*4 + 0x18]
inc edx
lea ebp, [ebp + edi - 0x7aa08204]
sal bx, 0xce
dec edx
sar dword [esp + edi*8 + 0xf], 0x8a
xor ebp, 0xb412d383
dec esp
sub esp, ebx
inc ebp
inc ax
inc esp
mov edx, eax
not ebp
inc cx
sub ecx, 0xc042341d
je 0x7e29bf
or al, 0x64
dec esi
mov dword [esp + edi], edi
dec esi
mov dword [esp + edi*4 + 0x18], ebp
dec edx
ror dword [esp + edi + 0x10], 0xb7
inc edx
xor dword [esp + edi + 0x18], ebp
inc edx
and eax, dword [esp + edi + 0xf]
inc ebp
sbb edi, esp

Function at 0x7e408f
Capabilities:
Encrypt data using speck

Disassembly:
rol al, 1
xor al, 0x35
rol al, 1
xor bl, al
call fcn.0078f5c6
call fcn.007216fd

Function at 0x7eb24f
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
call eax
call fcn.00c4ba33

Function at 0x7ec900
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0074859d
jmp 0xcd98b0
dec eax
lea edx, [ecx + edx + 0x149d6352]
setle al
xor ebx, edx
add esi, edx
shr eax, cl
jbe 0xbddbb9

Function at 0x7edf5a
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp + eax - 0x20]
call fcn.00bd5dbc
call fcn.0087b2f5

Function at 0x7ef179
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + edx - 0x36aced28], ebp
call fcn.00731297
Function at 0x7f5a9c
Capabilities:
Encrypt data using speck

Disassembly:
push ecx
sal dword [esp + ecx - 0x53bf8794], 0x32
xor eax, ebx
mov dword [esp + ecx - 0x53bf8794], 0xe102b0ab
xor eax, 0xb5152122
call fcn.00c06a0f
inc ecx
push eax
inc ecx
sub edx, 0xe484c6ba
dec esi
mov dword [esp + 0x10], ebp
inc edx
or dword [esp + 4], 0xa252c06
inc esi
xor dword [esp + 0x10], edx
inc ecx
mov ebp, 0x7e84678f
dec esi
mov ebp, dword [esp + 0x10]
dec ebp
arpl dx, dx
not ebx
inc ecx
movsx eax, ah
inc edx
inc byte [esp + 5]
dec ebp
add esi, edx
dec esi
mov dword [esp + 8], eax
dec eax
lea ebx, [eax*2 - 0x4e593962]
inc bp
mov edx, dword [esp + esi]
inc edx
neg dword [esp + 9]
jge 0xc9268f
xor ecx, ebx
ror ecx, 3
mov dword [esp + 4], 0x417d8bf
sub ecx, 0x888e44a8
shr byte [esp + 7], 0xa7
bswap ecx
mov edx, dword [esp + 4]
lea ecx, [ecx + edx*4 - 0x740a7b2c]
inc edx
neg ecx
inc ecx
xor ebx, ecx
mov eax, edx
add edi, ecx
pop ecx
mov dword [esp + eax - 0x17d8c0], edi
ret
dec edx
pop eax
neg ax
ror edx, cl
dec ecx
xor ebx, edx
sar eax, 0x84
neg ecx
add esi, edx
lea edx, [ecx*8 + 0x3590da11]
push ecx
pop edx
jmp esi
xor edx, ebx
neg ax
inc edx
jmp 0xbd9817
neg dword [esp + ecx - 0x12320001]
ror edx, cl
or dword [esp + ecx*2 - 0x24640002], 0xd16a211
ja 0x822e26
jmp fcn.00cc2a6f
call fcn.00cafd2d
mov word [ebp + eax - 0x745354bd], dx
mov edx, eax
neg ecx
push ecx
mov edx, dword [edi + ecx*2 - 0x24640002]
sbb eax, ecx
lea edi, [edi + ecx - 0x1231fffd]
jge 0xbadef4
and ecx, ecx
adc ebp, 5
and ecx, ecx
jo 0x775624
xor dl, bl
xor cl, 0x16
sbb dl, 0x95
shr ecx, 0x8a
rol dl, 1
dec cl
add dl, 0x97
xor dl, 0xe
and cl, 0x2e
or cl, cl
sar cl, 0x21
xor bl, dl
add ecx, ecx
adc edx, esp
mov dword [edx + ecx*4 - 0x13350b8], eax
sal ecx, 0x3e
jmp edi

Function at 0x7fa41c
Capabilities:
Encrypt data using speck

Disassembly:
or eax, 0xefa057a1
mov dword [esp + edx - 0x7984a05b], edx
bswap ecx
call fcn.0083018d
mov ecx, 0x81aa7507
mov edx, 0xe7b9a9a7
mov ax, word [ebp]
sal dx, cl
or cl, dh
mov dx, word [ebp + 2]
xor cx, cx
jae 0xbf59ce

Function at 0x7fff8a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi + 2], edx
mov dword [esp], eax
mov edx, dword [esi + 2]
mov eax, dword [esi + 6]
jp 0xbb5001

Function at 0x80268b
Capabilities:
Encrypt data using speck

Disassembly:
not eax
ror byte [esp + 4], 0x46
neg word [esp + 4]
dec eax
mov edx, 0xa2b8380e
neg dword [esp + 4]
xor ebx, eax
neg dx
mov ecx, 0x2189fc23
sbb edx, 0x69a93812
mov dword [edx + ebp - 0x390f8fe1], eax
lea ebp, [ebp + edx - 0x390f8fe1]
sub cx, dx
pop ecx
pop ecx
ja fcn.00c693b9
inc ecx
mov edi, 0x19312194
inc ecx
movsx ebp, bh
dec edx
mov ecx, dword [esi + edi - 0x19312194]
inc ecx
movzx edx, di
dec eax
ror edx, 0xee
inc edi
movzx edx, byte [ebx + edi - 0x19312195]
inc ebp
movsx eax, bh
inc ecx
mov edi, edi
inc ebp
xor dl, ch
inc eax
movsx eax, ch
inc ecx
xor dl, 0x83
inc ecx
neg dl
sal ax, 0xeb
jp 0xb64a4b
inc bp
xor edi, eax
inc ecx
sbb dl, 0x11
inc ebp
movsx esp, bh
inc cx
shr esp, 0x61
call int.00850de1