joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd7ebb6
Capabilities:
Encrypt data using speck

Disassembly:
dec dx
mov dword ss:[ecx + edx - 0x7b61c601], eax
movzx eax, dx
neg edx
mov eax, dword [edi + eax*8 - 0x63008]
xor eax, ebx
jmp 0xa756b4
movsx edx, al
mov eax, dword [ebp + eax - 0x4d196a96]
sub edx, 0x849e3998
jae 0xa236ff
movsx ecx, dl
jmp 0xe50ab1
mov dword [esp + edx], eax
add cl, 0x16
sal al, 0xa4
not cl
shr ax, 0xa3
sal edx, 0x97
mov dword [esp + edx*4], 0x61a9a724
xor cl, 0x27
xor ax, ax
push eax
setne byte [esp + edx*2 + 4]
neg cl
not cl
ror word [esp + edx*2 + 5], 0xcc
add word [esp + edx + 6], 0x2800
sub eax, 0x6e0c4631
xor bl, cl
add byte [esp + eax*4 - 0x6c32e73b], ah
xchg dword [esp + eax - 0x1b0cb9cb], eax
ror word [esp + edx*2], 0x68
lea ecx, [esp + ecx + 8]
call fcn.00a25ea2
mov eax, 0x4d196a9a
mov ecx, dword [ebp + eax - 0x4d196a9a]
jmp 0xa2fdce
xor eax, ebx
call fcn.00d63757
inc ecx
rol bh, 0xe1
dec edi
lea ecx, [ecx - 0x5ffa]
dec ebp
lea edi, [edi + edx*2 + 0x15390d84]
call fcn.00a685b4
not dword [esp]
lea eax, [ecx + ecx*4 - 0x2a7194f6]
lea edi, [edi + eax*2 - 0x53f8b1d3]
neg al
xor dl, bl
sal cx, 0x61
sal ax, 0x68
dec dl
shl ecx, 0x54
sar cl, 0x83
and eax, eax
ror dl, 1
inc al
or word [esp + eax*2 - 0x53f83202], 0x940c
sbb dl, al
xchg byte [esp + eax*2 - 0x53f83202], cl
rol dl, 1
or eax, eax
xor bl, dl
dec al
neg word [esp + eax*2 - 0x53f831fe]
call fcn.00d581e9
add byte [eax + 0x4c570056], dl
jnp 0xe34b68
dec eax
cli
fst qword [ecx + edx*4]
push edi
and ecx, dword [ebp - 0x6f96bcf7]
sub eax, 0xd434a816
pop esi
pop esp
js 0xe34b67
inc edx
sub eax, 0x63034a69
xchg edx, eax
sbb eax, dword [edx]
salc
mov ah, 0xce
xchg ebp, eax
dec ecx
adc byte [esi - 0x19], bl
retf 0x4d24
mov dl, 0x36
in eax, dx
in eax, dx
cmp al, 0x3e
inc esi
aaa
pop esp
or al, 0x37
xchg ebp, eax
and ebp, dword [esi]
pop ebp
xchg ebp, eax
dec esp
pop ss
jecxz 0xe34b24
dec eax
lea eax, [eax + edx*2 - 0x77812aea]
ror eax, 2
rol ecx, 0xd1
call fcn.00e4b7b1
inc cx
mov ebp, dword [ecx]
inc ecx
movzx edx, dh
inc ecx
mov cl, byte [ecx + edx*8 - 0xee]
inc esp
mov eax, edx
inc ebp
movzx esp, dh
inc ebp
mov edi, esi
dec ebp
lea ecx, [ecx + edx*2 - 0x3a]
inc ecx
add ebx, 0xb72630a7
inc esp
movzx ebp, dl
dec ecx
rol esi, 0xdd
shr bp, cl
dec ecx
sar edi, 0x3e
inc ecx
movzx esi, dh
inc cx
inc ebp
inc dx
mov dword [edx + ecx - 0x1e], ebp
inc ecx
movzx eax, sp
inc ecx
mov ebp, ebx
dec edi
lea edx, [edx + eax*4 - 0x7c]
inc ecx
mov eax, dword [edx + edx - 0x1e]
inc ecx
push edi
inc ecx
movzx ecx, bl
jno 0xe2db93
dec edx
xor dword [esp + ebp - 0x6409dba7], ecx
inc edi
mov dword [ecx + ebp - 0x6409dbb7], esi
dec edx
and dword [esp - 0x5ff0], 0xd43a2508
jae 0xe34a94
Function at 0xd81ca6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
jnp 0xd94493
and dword [esp + edx - 0x397c5de1], 0xde26771a
mov cx, word [esi + edx - 0x397c5dea]
not dl
mov ax, word [edx + esi - 0x397c5d0b]
adc cx, ax
shr dword [esp + edx - 0x397c5d01], 0xe2
jbe 0xa3462c
setp dl
mov word [esi + edx*2 - 0x72f8b9fc], cx
jp 0xe4d045
neg al
dec ecx
setns byte [esp + ecx*2 - 0x2a0002]
not al
shr dl, cl
push ecx
xor bl, al
lea eax, [esp + eax + 0xc]
call fcn.00dc78d5
neg edx
xchg ecx, eax
or ecx, eax
xor edx, 0x23302d29
xor ebx, edx
add esi, edx
call fcn.00dc8690
lea esi, [edx + esi - 0x397c5cfb]
call 0xa3cb16
bswap edx
mov ecx, dword [esp + eax*8 - 0x5f8]
dec edx
pop eax
jmp 0xe10c06

Function at 0xd85b31
Capabilities:
Encrypt data using speck

Disassembly:
lea esi, [ecx + esi - 0x4f01dc44]
setnp cl
sar cl, 0x85
mov word [esi + edx - 0x5e9769ac], ax
mov eax, edx
neg dl
setae dl
lea edi, [edi + edx - 0x5e976904]
sub word [esp + edx - 0x5e9768fa], 0x8423
pop ecx
mov dword [esp + edx - 0x5e976900], 0x46385600
mov ecx, dword [edi + edx - 0x5e976900]
push eax
sar dword [esp + edx - 0x5e9768fc], 0xa1
jbe 0xd881f4
xor ecx, ebx
and word [esp + edx - 0x5e9768fc], 0xd71d
setge dl
neg ecx
ror ecx, 1
xor al, 0x2d
sar edx, 0x7d
xor ecx, 0xf0a67fbb
neg ecx
lea eax, [edx + eax + 0x599c0d80]
inc al
xor byte [esp + edx*8 - 0x10], dh
inc ecx
xor ebx, ecx
call fcn.00a4ed9e
movsx edx, cx
inc ecx
mov eax, dword [ebp + edx*4 - 0x170e0]
rol ecx, 0x13
add edx, ecx
call fcn.009c0dad
inc ecx
mov edi, 0xc2a53f90
inc ebp
movsx eax, bh
inc ecx
movsx ecx, ax
dec ebp
mov esi, dword [ecx]
movzx eax, cx
dec edx
mov edx, dword [eax + ecx - 0xff88]
call fcn.00e1a370
not ecx
xor eax, eax
dec eax
neg ecx
xor ebx, ecx
movsx edx, ax
bswap eax
dec eax
add esi, ecx
movsx ecx, dx
movzx ecx, byte [edi]
jmp 0xdcc2ba
add edi, 1
xor cl, bl
inc dx
push edx
ror cl, 1
inc cl
add dword [esp], edx
neg cl
xor ax, 0x2586
not cl
xor bl, cl
lea ecx, [esp + ecx + 4]
neg word [esp]
sbb eax, edx
adc dl, byte [ecx + eax*2 - 0x1b4f0]
lea ebp, [eax + ebp - 0xda7a]
push eax
mov word [ebp + eax - 0xda78], dx
call fcn.00da6e01
mov dword [edx + esi - 0x3938], eax
mov dword [esp + edx*8 - 0x1c9bc], edx
not byte [esp + edx*4 - 0xe4e0]
mov dword [esp + edx*2 - 0x7270], ebp
ret 0x10

Function at 0xd8ea80
Capabilities:
Authenticate hmac

Disassembly:
inc cx
sub esp, 0x8b478b84
imul ebx, dword fs:[eax + 0x1c44c74a], 0x1bd51833
inc ebp
inc ecx
inc ch
dec edi
lea ecx, [ecx + ebp*4 - 0xce]
mov edx, esi
jge 0xe0584f
popfd
call fcn.00dde878
inc bx
add edx, dword [ebp + edx - 0x3c]
dec edi
lea edx, [ebp + edx - 0x3c]
xor dx, bx
dec ecx
inc edi
inc dx
inc ecx
not ch
neg dx
shl si, 0xce
ror dx, 1
xor dx, 0x5109
inc ecx
inc ebp
jns 0x9aa76e

Function at 0xd8ffc8
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov word [esp + 9], 0x6833
dec eax
lea esp, [esp + 0x28]
jne 0xa64fb4
mov eax, 0xf2a29624
inc ecx
pop edx
Function at 0xd906cd
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
setne dh
dec ecx
mov edx, dword [eax + ebp*2 - 0x253fac02]
inc ecx
and bh, 0x99
inc ecx
not bl
dec ecx
mov dword [ecx + ebp*4 - 0x4a7f5808], edx
dec esi
lea ecx, [ebp + ecx - 0x129fd605]
inc ecx
shl esp, cl
shr cx, 0xa2
inc ebp
mov esp, dword [edx + ebp*2 - 0x253fac09]
inc ecx
push edi
inc ecx
bswap ebx
dec edi
lea edx, [edx + ebx*8 - 0x3389fef]
mov eax, 0x6bbac49d
inc esp
xor esp, ebx
dec edx
neg dword [esp + ebx*2 - 0xce27e5]
inc sp
and edi, ebp
dec ecx
adc esi, 0x37b56f04
inc edi
lea esp, [esp + ebx*2 - 0x5d7f1d34]
inc ecx
not esp
inc ecx
movzx edx, bh
inc dx
and eax, dword [esp + ebx - 0x6713f6]
inc edi
lea esp, [esp + ebx*2 - 0x29e3a002]
dec edx
not dword [esp + ebx*2 - 0xce27f8]
dec esi
lea ebx, [ebx*4 + 0x4486a2a0]
inc ecx
bswap esp
inc ecx
ror esp, 1
dec eax
sal edx, cl
sub dword [esp + ebp - 0x129fd5f9], 0x3984fa8d
inc edx
adc dword [esp + ebx - 0x4622f275], 0xe8ad7d39
inc ecx
neg esp
inc dx
shr dword [esp + ebx - 0x4622f279], 0xab
call fcn.00e0d3e6
inc esp
xor al, bl
xor dword [esp + ecx*2 - 0x11c], ebp
inc ecx
xor al, 0x9f
inc esp
xadd ebp, esp
inc sp
xadd dword [esp + ebp - 0x129fd6a6], ebx
inc esp
xchg dword [esp + ebp - 0x129fd69c], ebp
inc ecx
inc al
dec eax
mov dword [esp + ebp - 0x129fd6b0], ebp
inc ecx
xor al, 0x96
inc ecx
not al
inc ecx
rol ebx, 0x99
inc ecx
dec al
inc ecx
inc esi
inc eax
setne ch
inc esp
xor dh, byte [esp + ebp - 0x129fd5ef]
inc ebp
xor al, bl
inc esp
sub al, ch
sar cl, 0xc5
sar cl, 0xa5
inc ecx
xor bl, al
dec esp
xadd dword [esp + ebp*2 - 0x253fabf2], edi
dec esi
lea eax, [esp + eax + 0x18]
push esi
jne 0xa4e2da

Function at 0xd91f73
Capabilities:
Encode data using base64

Disassembly:
xor ebx, ecx
ror dword [esp + eax - 0x79971d08], 0x11
sub dword [esp + eax - 0x79971d08], eax
adc esi, ecx
mov dword [esp + eax - 0x79971d0c], eax
dec eax
pop eax
movzx eax, word [edi + eax - 0x79971d08]
jnp 0xa484b4

Function at 0xd93603
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
inc ecx
ror ax, 0x43
sub eax, eax
not ecx
xor edx, 0x9287fabf
add edx, edx
neg ecx
jmp 0xa7cd9d
and ecx, 0xb93db20d
lea eax, [ecx*4 + 0x5c10fd9e]
mov word [esi + ecx - 0x2039a20b], dx
jle 0x933679
add eax, 0xb9aba107
and ax, 0x3717
mov ecx, dword [edi + ecx*2 - 0x40734420]
movzx edx, al
lea edi, [edi + edx - 0x17]
xor ecx, ebx
xor ecx, 0x12373689
call fcn.00d4e6f1

Function at 0xd93642
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
dec eax
lea ebx, [ebp + ebx + 0x75212235]
push ebp
dec eax
mov edx, dword [esp + edx - 0xec27]
xchg byte [esp + 0x1a], bh
dec eax
mov ebp, dword [esp + 0x90]
call fcn.00e3a44f

Function at 0xd936d1
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
dec edx
lea esi, [ecx + edi - 0x3ed43f61]
call fcn.00a76f2c
Function at 0xd9372f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec esp
lea esi, [esi + ecx*4 - 0x25608cd1]
bswap eax
inc bp
add eax, 0xe415fc88
dec ebp
lea eax, [esi - 0xb48dadb]
rol eax, 3
shr ebp, cl
inc eax
movzx edx, cx
push ebx
inc edx
xor dword [esp + ebx - 5], eax
inc cx
not eax
pop ebx
call fcn.00dc8f6e
ror cx, 5
xor edx, ebx
sub ecx, 0x79318323
jnp 0xd748f6
xor ebx, edx
rol ecx, cl
rol byte [esp + ecx - 0x43f22803], 0x27
mov dword [ebp + ecx - 0x43f22803], edx
mov dword [esp + ecx - 0x43f22803], esi
ret
sub edx, 0x77012f16
shr word [esp + 2], 5
ror edx, 3
lea eax, [ecx + ecx*8 + 0xa1ce702]
sub edx, 0x7507d5ab
inc byte [esp + 3]
sets cl
ror edx, 3
rol al, 0x26
inc ecx
jle 0xa60c3f
neg eax
mov dword [esp + ecx*4 - 0x541dbfc0], ecx
movsx edx, cl
shl dl, 0xe4
dec eax
sub cl, 0x20
call fcn.00e061eb
inc ecx
movsx ebp, sp
inc ecx
mov eax, dword [edx + ecx - 0x14b3]
xor eax, ebx
dec ecx
add esi, 0x57a6683a
dec ecx
shr ebx, 0xe3
dec eax
dec esi
rol eax, 3
inc ebp
movzx eax, bl
jmp 0xa2f49c

Function at 0xd945d8
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
adc esi, ecx
lea edx, [esp + edx*2 + 0xc]
push eax
mov ecx, dword [edx + eax - 0x3193c2a3]
mov edx, eax
shr byte [esp + edx*2 - 0x63278545], 0xa1
mov dword [ebp + edx*2 - 0x6327854a], ecx
not dx
inc dword [esp + eax*2 - 0x63278546]
rdtsc
mov ecx, 0xf7929dab
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
pop eax
lea ebp, [ebp + eax - 0x319361b0]
sal al, 4
movsx edx, al
and edx, 0xb38d9b4
jae fcn.00a61cb3
neg esi
dec eax
mov dword [esp + edx*2 - 0x60908c], edx
inc esp
mov esp, edx
movzx eax, byte [esp + edx - 0x30483e]
dec esi
dec eax
mov dword [esp + edx - 0x30483a], ebx
inc ecx
pop esp
inc esp
movzx ebp, dx
xor dword [esp + edx - 0x304842], esi
dec eax
mov ebx, dword [esp + edx - 0x304842]
call fcn.00df993a
shl dl, 0x83
dec ecx
xor edx, 0x72892e35
xor ecx, 0xd12a9d93
lea eax, [edx*4 - 0x29eb09d8]
lea ecx, [ecx + edx - 0x178dd71a]
ror dl, 0xc6
not ecx
not eax
xor ebx, ecx
xor edx, edx
jns 0xd936de

Function at 0xd99fff
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edx
mov dword [esp + edi*2 - 0x1010e], edi
ret
inc dx
mov ecx, dword [edx + eax - 0x79]
dec edi
lea ecx, [ecx + eax*2 - 0xec]
dec esi
mov dword [esp + eax*8 - 0x3c8], esi
inc ebp
add edi, ebp
inc bx
mov dword [ecx + eax*2 - 0xf2], ecx
jp 0xd4ea5e
cmc
Function at 0xd9c9f6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
add dx, word [esi + eax - 0x533f1815]
lea ecx, [eax*8 - 0x1a5fc849]
call fcn.00d56b4e
inc dl
xor al, 0x29
add al, 0x2b
movzx ecx, dx
xor al, 0xb3
not edx
add byte [esp + ecx - 0xbfa], 0x32
xor bl, al
lea eax, [esp + eax + 4]
mov ecx, dword [eax + edx - 0x3bd1f403]
mov dword [ebp + edx*2 - 0x77a3e80e], ecx
mov edx, dword [edi + edx - 0x3bd1f3fe]
pop ecx
movzx eax, cl
push ecx
xor edx, ebx
rol dword [esp + ecx - 0xcbb000], 0xa3
bswap edx
xchg cx, ax
call fcn.00a8f217
dec ebp
arpl ax, ax
dec ecx
adc edi, eax
dec ebp
lea eax, [ebx + 0x38130211]
push eax
dec ebp
mov esi, dword [ecx + edx - 0xe118]
mov byte [esp + edx - 0xe113], 0xad
jmp 0xa6fcd1
jmp 0x917403
pop edx
jmp esi
inc ecx
push edi
dec eax
lea ecx, [esp + edx - 0xe0c8]
dec ecx
neg eax
inc ecx
sbb edi, 0x9006c538
dec esp
adc dword [esp + edx*2 - 0x1c228], edi
dec esp
mov dword [edx + ecx - 0xe118], esi
call fcn.00dc58aa
dec eax
mov dword [esp + ebp - 0x87], ebx
push eax
inc esp
xor dword [esp + edx - 0x6a9b587e], esi
dec esp
mov dword [esp + edx - 0x6a9b5886], eax
dec eax
mov ebx, dword [esp + ebp - 0x7f]
inc edx
and byte [esp + eax*2 - 0x115], 0xa1
dec esp
lea edi, [eax*4 + 0x1a8493aa]
dec ebp
arpl si, si
inc ebp
xadd edi, esp
dec ecx
adc edi, esi
neg dl
xadd cx, dx
dec edi
lea esi, [esp + edi + 0x3b6ab03]
dec edi
lea edx, [edx - 0x6e099845]
inc bp
xchg eax, esi
inc ebp
movzx ebp, byte [edx + edx - 0x6a9b6811]
inc esp
xor ch, bl
jmp 0xd92100
inc edx
xchg byte [esp - 0x3704cc1b], ch
dec esi
lea ecx, [ebp + ecx - 2]
inc bp
mov dword [ecx + ebp*4], ebp
pop eax
inc ecx
pop ebp
pop ecx
jmp fcn.00d6eae8
or dl, 0xb
or al, 0xad
bswap ecx
bswap edx
jb 0xa67d67
and eax, eax
inc ecx
dec edx
ror ecx, 1
neg ecx
shr ax, 0xc3
rol ecx, 2
xor ebx, ecx
xor dx, dx
adc ebp, ecx
jmp 0x92f2ae
dec esi
mov dword [esp - 0x3704cc12], esp
inc ecx
neg ch
inc ecx
inc eax
dec eax
sal edx, 0x2a
inc ecx
xor ch, 4
inc ecx
not ch
shr bp, cl
inc ecx
ror ch, 1
inc ecx
xor bl, ch
jmp 0xa9008b
dec ecx
mov dword [ecx - 4], edx
dec esp
mov dword [esp + 0x18], esi
dec eax
lea edx, [eax*8 + 0x4ebc2e9d]
setnp byte [esp + 0xa]
inc ebp
mov ebx, dword [edx - 4]
dec ecx
sub edx, 4
inc ecx
sal edi, 0xfa
inc esp
xor ebx, ebx
inc ecx
pop edi
mov esi, 0x9f0b7794
inc ecx
neg ebx
dec eax
rol dword [esp + 0x10], 7
push edx
inc esp
sub byte [esp + 6], al
inc ecx
sub ebx, 0x351dd087
inc edx
dec esp
lea edi, [esi*8 + 0x7eb153a2]
inc ecx
not ebx
dec eax
sar dword [esp + edx - 0x2fe5f86e], 0xc6
inc ecx
xor ebx, 0x188c549b
push eax
inc ebp
lea ebx, [ebx + edx - 0x7772d32a]
dec eax
mov dword [esp + edx*2 - 0x5fcbf0d4], 0x1d959792
dec ecx
ror esi, 6
dec eax
sal dword [esp + edx - 0x2fe5f86e], 0x4e
inc ecx
not ebx
call fcn.00d9705b
mov ecx, 0x8602fc0f
lea eax, [ecx + ecx - 0x71550ff7]
sal cx, cl
sub edi, 4
shr cl, 0x61
add eax, 0xb1a9a
movzx edx, cl
mov eax, dword [edi + edx*2]
ror ecx, 0x36
jnp 0xe4f67e
xor ecx, ebx
dec dx
or dl, dh
lea ecx, [ecx + edx*2 + 0x49f10dc]
ja 0xdc4219
not ecx
jno 0xd62118
mov edx, 0xff317816
movsx ecx, dx
mov dl, byte [esi + ecx - 0x7816]
call fcn.0099d19e
Function at 0xd9cbc6
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
movzx ebp, bp
inc edi
lea edi, [edi + ebp*8 + 0x73a7257d]
inc ebp
movsx esp, bp
inc ecx
xor edi, 0x7c3d4327
sub dword [esp + eax - 0x73c3202], 0x73961d33
inc ecx
neg esi
inc ecx
or dl, dh
inc ecx
neg edi
push ebp
dec eax
not dword [esp + eax*2 - 0xe7863fc]
jmp 0xd5fc15
shr ecx, 0xaa
ja 0x9bceeb
mov eax, 0x73c3202
inc esp
movzx esi, ax
dec ebp
lea edx, [edx + eax*4 - 0x1cf0c80c]
inc ecx
movzx edx, si
inc esi
mov edi, dword [eax + edx - 0x73c3202]
dec esp
lea ebp, [eax + edx - 0x5e616d]
push eax
inc esp
xor edi, ebx
inc ecx
rol edi, 1
inc esp
movsx ebx, word [esp + eax - 0x73c31ff]
jmp 0xa632cc
dec ax
not edx
sal eax, cl
sbb ecx, 0x570a1b0e
ror edx, 3
xor ebx, edx
sub eax, ecx
not ecx
call fcn.00a7dbdf
dec esi
lea ebp, [esp + ebp + 0x38]
sar cl, 0x84
dec eax
sal eax, cl
dec eax
neg eax
inc esi
mov esp, dword [esi + ebp - 0x563d01af]
adc eax, 0x130d5bf
inc ecx
mov cl, byte [ecx + eax*8 - 0x986adfa]
dec eax
not dword [esp + eax*2 - 0x261ab6a]
inc ecx
shl esp, cl
dec ecx
sub esi, 0x9a1c288f
inc ebp
mov dword [ecx + eax*2 - 0x261ab82], esp
call fcn.00a6ca9d
shrd dx, ax, cl
mov dword [esp], 0xc4086f3c
mov ecx, 0xa92fe6bf
ror cl, 0x45
mov word [ebp], dx
lea eax, [ecx*4 - 0x68d70cd3]
sub eax, 0xe609bc89
sub word [esp + eax - 0x55ded296], ax
mov ecx, dword [edi + eax - 0x55ded298]
rol eax, 0x92
mov edx, dword [esp + eax - 0x4a61577b]
lea edi, [eax + edi - 0x4a615777]
xor ecx, ebx
xchg byte [esp + eax - 0x4a61577b], al
xadd byte [esp + eax - 0x4a615739], ah
jae 0xa79c35
xor ecx, 0xb3a152bf
rol dword [esp + eax - 0x4a61f13c], 0x44
call fcn.00d7bf93
sub cx, cx
ror al, 1
pop edx
bswap ecx
sub al, 0x94
xor bl, al
dec edx
not cx
lea esi, [esi + edx*2 - 0x1d02]
mov word [esi + edx - 0xe80], ax
lea eax, [edx + 0x1221f427]
lea edi, [edi + edx*2 - 0x1d04]
xadd eax, ecx
mov edx, dword [edi + edx - 0xe80]
xor edx, ebx
shr cx, cl
sar eax, 0xb0
add ax, 0x1b27
lea edx, [edx + ecx*8 + 0x5313da76]
bswap ecx
rol edx, 3
jmp 0xd58933

Function at 0xda0334
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec esi
mov dword [esp + ebx - 0xb0b], esi
inc ecx
neg edi
inc edx
mov ecx, dword [esp + ebx - 0xaef]
inc dx
rol dword [esp + esi - 0x7d130b0a], 0x62
inc edi
lea edi, [esi + edi + 0xeaa5423]
jae 0xdbde84
mov dword [0x8441006f], eax
cmp eax, 0x304babd0
cwde
push ecx
shr byte [ebx + 0x79b08c4b], 1
shr byte [ebx + 0x65ac904b], 1
shr byte [ebx + 0x39b4b44b], 1
push edi
mov dh, 0x4b
call dword [edi - 0x65]
xor ebx, esi
push cs
mov word [esi - 0x6d], cs
rcr byte [0x868c395], cl
or al, 0x37
inc esi
popfd
lodsd eax, dword [esi]
outsd dx, dword [esi]
fadd dword [edi]
popfd
dec edi
xchg edi, eax
adc al, 0xa5
insb byte es:[edi], dx
pop eax
cld
cmpsd dword [esi], dword es:[edi]
inc ebx
invalid

Function at 0xda6fb1
Capabilities:
Encrypt data using speck

Disassembly:
not cl
rol cl, 1
call fcn.00d62cdc

Function at 0xda9227
Capabilities:
Encrypt data using speck

Disassembly:
pop ecx
rol dword [esp], 0x18
xor bl, dl
call fcn.00926245
Function at 0xdac7a1
Capabilities:
Encrypt data using speck

Disassembly:
add dl, dh
call fcn.00e37362
inc esi
xor dword [esp + ebp*4 - 0x4ed38], eax
dec edx
not dword [esp + ebp*2 - 0x27699]
dec esi
lea esi, [edi*8 - 0x6a4d7b4d]
dec esi
mov dword [esp + ebp - 0x13b54], ebx
dec edx
mov ebx, dword [esp + ebp*4 - 0x4ed38]
inc cx
dec ebx
call fcn.00ddcc81
lea eax, [eax + ecx - 0x49cbc08]
push ecx
lea ecx, [edx - 0x50786244]
neg eax
sar dword [esp + edx*2 - 0x1fe], cl
ja 0xa364c7
bswap eax
dec dx
xor ebx, eax
or byte [esp + edx - 0xfd], ch
adc ebp, eax
neg ecx
mov ecx, dword [esi + ecx - 0x50786143]
call fcn.00a6b5e4

Function at 0xdad6d9
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
movsx eax, dx
inc edi
mov ebx, dword [eax + ecx - 0x3e2f]
dec ecx
add eax, 0xee078fb4
inc ebx
mov eax, dword [ecx + eax + 0x11f83221]
dec edx
mov dword [esp + eax*4 + 0x47e0c874], 0x73024aa8
jne 0x9b7c18
inc ecx
pop eax
inc ecx
pop esp
jmp fcn.00d6eae8

Function at 0xdb34d3
Capabilities:
Encode data using xor

Disassembly:
ror al, 1
bswap ecx
push edx
ror edx, 1
xor bl, al
mov dword [esp + 4], 0x3122cf01
mov word [ebp - 2], ax
inc dx
or cl, cl
mov ecx, dword [edi + 1]
jle 0xd63785

Function at 0xdb6b0d
Capabilities:
Encrypt data using speck

Disassembly:
cmp eax, edi
inc ecx
pop ebp
push edx
inc edx
xor dword [esp + ebx - 0xfa5a], eax
dec edx
xor dword [esp + ebx - 0xfa6a], esi
dec edx
mov ebx, dword [esp + ebx - 0xfa5a]
dec eax
arpl ax, ax
dec ebp
lea esp, [esi + esi + 0x1a236d82]
dec eax
adc edi, eax
inc esi
movzx eax, byte [esp + ebx - 0xfa8a]
inc esp
or edi, edx
inc ecx
pop esp
inc ecx
pop ebp
pop ebp
pop ebp
pop edx
pop esi
inc ecx
pop esi
jle fcn.00d6eae8
or ah, dl
add eax, dword [esi - 0x25c1f154]
jo 0xdb6af1
lodsb al, byte [esi]
or ch, byte [esi]
invalid

Function at 0xdbde08
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ecx
lea esi, [edi + eax - 0x734492fe]
xor ecx, ebx
call fcn.00d824b2
sub cl, 0x3a
call fcn.00de4953
inc ebx
mov ecx, dword [edx + edi*2 - 0x22501b2a]
dec edi
lea edx, [edx + edi - 0x11280d97]
and eax, 0xd726c18a
xor ecx, ebx
inc ecx
movsx edx, dh
inc ecx
lea ecx, [edi + ecx + 0x6722fa8]
call fcn.00ddae29

Function at 0xdbde17
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec ecx
lea esi, [edi + eax - 0x734492fe]
xor ecx, ebx
call fcn.00d824b2
sub cl, 0x3a
call fcn.00de4953
inc ebx
mov ecx, dword [edx + edi*2 - 0x22501b2a]
dec edi
lea edx, [edx + edi - 0x11280d97]
and eax, 0xd726c18a
xor ecx, ebx
inc ecx
movsx edx, dh
inc ecx
lea ecx, [edi + ecx + 0x6722fa8]
call fcn.00ddae29

Function at 0xdc0136
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov esp, dword [edx + eax - 0xb0]
dec esi
lea edx, [eax + edx - 0xb0]
jnp 0xe3024e
inc esp
xor esp, ebx
pop esi
inc ecx
xor esp, 0x303e4819
inc ecx
movsx esi, bh
movsx ecx, dl
dec ebx
lea esi, [ebp + ebp*2 + 0x3eaf4f8d]
inc ecx
sub esp, 0x9f35a5bc
inc ecx
not esp
inc ecx
rol esp, 1
inc esp
movsx eax, ax
sar eax, cl
push ebx
je 0x934523
Function at 0xdc6d1e
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.00dabf93
shr word [esp + eax*2 - 0x982baff], 0xe6
sar dword [esp + eax - 0x4c15d7c], 8
shl edx, 2
add dword [esp + eax - 0x4c15d7c], eax
mov eax, ebp
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0xc5af3001
lea esp, [esp + 0xc]
je 0xd50f7d
xor bl, cl
push eax
xchg byte [esp + eax*4 - 0x130775b6], al
lea edx, [eax*4 + 0x450dd635]
mov dword [esp + eax*4 - 0x13077654], edi
add al, ah
rol ax, 0x86
not dx
mov dword [esp + eax - 0x4c15dab], esi
setp byte [esp + eax - 0x4c15daf]
mov dword [esp + eax - 0x4c15daf], ebx
mov dword [esp + eax - 0x4c15db3], eax
sal edx, 0x6a
movzx ebx, dl
or ebx, ecx
dec dl
shl al, 0xa7
mov edx, ebx
jbe 0xd70732
cmp edx, 0xd3b694a2
not dx
mov dword [esp + 0xc], 0x41f2601e
mov edx, dword [esp + edx + 0x77e249a4]
jle 0xa47e94
inc ecx
mov esp, 0x6e9d3704
mov ebp, 0x94035b9b
dec edi
lea edx, [edx - 0x6e9d3708]
movzx edx, bp
inc ebx
mov edx, dword [edx - 0x6e9d3704]
inc ecx
mov esi, 0xc60167b4
xor edx, ebx
inc ebp
movsx ebp, sp
call fcn.00dcc09b
dec ebx
lea ebp, [eax + ebp*8 - 0x656915c]
dec esi
lea edx, [ecx + edx + 0xc4]
inc ecx
movzx esi, si
inc edi
movzx ebp, word [edx + eax - 0x1f]
inc ebp
movsx esp, bh
shr cx, 9
inc ecx
setnp ah
inc sp
xor ebp, ebx
inc ebp
xadd esi, eax
inc eax
sal dh, 0x86
inc cx
adc ebp, 0x23e91000
fild word [ebx]
add byte [esi - 0x75], ah
mov cx, word [ebp + ecx - 0xfa32]
not edx
mov word ss:[eax + edx - 0x726405c5], cx
movzx ecx, dx
mov dword [esp + ecx*4 - 0x1714], ecx
movzx eax, byte [edi + ecx - 0x5c1]
mov ecx, dword [esp + 8]
adc ecx, 0xffc60617
jmp ecx