joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15dd38d
Capabilities:
Encode data using xor

Disassembly:
inc dword [ecx + 0x4ee]
add byte [ebx + 0x7441e916], cl
xchg esp, eax
dec dword [ebx + 0x2eec0784]
mov eax, dword [edi + eax - 0x6fc8d114]
neg cx
call fcn.01833226
rol eax, 3
not eax
mov dword [esp + ecx - 0x131f0000], ecx
lea eax, [eax + ecx*2 - 0x5d4ea185]
not cx
dec cx
cmovne edx, ecx
xor ebx, eax
add byte [esp + edx*2 - 0x263ffff9], dh
add esi, eax
movzx ax, byte [ecx + ebp - 0x131ffffe]
dec edx
or edx, 0xe72da3ad
call fcn.00f7c4d5
push ds
mov ecx, 0x43002f0c
jnp 0x15dd370
xor cl, bl
outsd dx, dword [esi]
adc ebx, dword [edi]
xor dword [eax], 0xffffffd9
outsd dx, dword [esi]
pop es
outsd dx, dword [esi]
invalid

Function at 0x15f2c9a
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + ebp - 0xf7ed], 0x78861839
inc eax
not bh
inc eax
xor bl, bh
movsx eax, cx
call fcn.00f5bb75

Function at 0x15fa21b
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
jmp 0x180e59b
lea esp, [esp + 0xc]
jne 0xf4be6c
jmp 0x18161d7
pop ebx

Function at 0x15fa31f
Capabilities:
Encode data using xor

Disassembly:
or dl, 8
ror ecx, 1
pop eax
xor ebx, ecx
add esi, ecx
lea ecx, [edx*8 + 0x5eac4b82]
sub edx, 0xa192289b
movzx cx, byte [ebp + ecx - 0x56ad44e2]
jb 0x16006f4
salc
sbb eax, 0xca20c68a
pop eax
rol ecx, 1
shl byte [esp + 1], 0xe6
sal word [esp + 1], 0x81
pop eax
dec ecx
xor ecx, 0x9639b392
mov edx, eax
bswap edx
xor ebx, ecx
sub dl, 0xa2
xadd al, dl
sub edx, eax
add esi, ecx
sal edx, 0xfb
lea ecx, [eax + eax*4 + 0x6a94100e]
mov eax, dword [ebp]
xadd edx, ecx
call fcn.017351d6
sub esi, dword [edx - 0x7f]
and dword [ecx - 0xc1baef3], edx
cmp byte [eax + 0x72], cl
invalid

Function at 0x15fb123
Capabilities:
Encrypt data using speck

Disassembly:
and al, byte [esp + edx - 0x3344b2b6]
mov dword [esp + edx*2 - 0x66896580], edx
dec ecx
sar edx, 0xaf
rol eax, 0x4d
call fcn.00f84f1c

Function at 0x1606599
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
sub eax, 0xc632e83e
inc ax
xor ebx, ecx
call fcn.0182f4e7
add ebp, 4
mov eax, 0xba03593b
sal eax, 0x7e
adc ecx, edx
mov edx, 0xfb0cfd39
mov dword [ebp], ecx
jmp fcn.015e7fc0
mov ecx, dword [edi + edx - 0x300b90b5]
mov dword [esp + edx - 0x300b90b5], 0x2c8a5a28
xor ecx, ebx
dec ecx
movsx eax, dl
add eax, eax
xor ecx, 0xa4273f13
neg eax
xadd byte [esp + edx - 0x300b90b4], al
xchg dword [esp + edx - 0x300b90b5], edx
neg ecx
xadd dword [esp + edx*2 - 0x5915e050], edx
inc dx
jae 0xf0cfe7
dec ecx
shl esp, 0xe0
not ecx
mov edx, 0x67a5711d
je 0xfc56d8
dec eax
mov dword [esp + edx - 0x67a57115], ebx
xor dword [esp + eax - 0x5607db23], ecx
dec eax
mov dword [esp + edx - 0x67a5711d], 0xc7bc9e00
dec eax
mov ebx, dword [esp + edx - 0x67a57115]
dec eax
arpl cx, cx
dec edx
lea ebp, [esi*4 + 0x242ebc2f]
inc ebp
movsx edi, dh
shl byte [esp + eax - 0x5607db29], 0xc1
dec esp
add ecx, ecx
or ax, 0xcc81
inc ebp
xadd esi, edi
inc ecx
not edi
inc si
movzx edi, byte [edx + edx - 0x67a5711d]
jle 0x160ca1e
inc ebx
rcr ebp, 1
mov bh, 0xb9
push edx
pop eax
jle 0x1606684
ret
in al, dx
mov edx, 0x4ffbdfd9
in al, dx
mov edx, 0x6febe3d9
in al, dx
mov edx, 0xcbdfcbd9
add edi, dword [edx + 0x3c]
xchg edx, eax
invalid
Function at 0x1606a0a
Capabilities:
Encrypt data using speck

Disassembly:
mov ebp, dword [esp + 0x20]
push 0xc5b33e2c
call fcn.00f4d4cb

Function at 0x1606a18
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x8198b150
call fcn.0160a088

Function at 0x1606a25
Capabilities:
Encrypt data using speck

Disassembly:
sub esi, 4
call fcn.00eea7db

Function at 0x1606c12
Capabilities:
Encrypt data using speck

Disassembly:
push edx
neg dl
not eax
call fcn.00f61c7a
jmp 0x181f9a0
mov ecx, 0x8390ff3c
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
jmp 0xf2c919

Function at 0x160bedf
Capabilities:
Encrypt data using speck

Disassembly:
dec ebp
adc ecx, edi
dec eax
mov dword [esp + ecx*2 - 0x1ff4a], ebp
neg word [esp + eax*2 - 0xbf28]
inc ecx
setne ah
dec ecx
mov esi, edx
dec ebp
lea edx, [edx + eax*4 - 0x17e62]
inc esp
cmovnp esi, ecx
inc edx
rol dword [esp + esi*2 - 0x1ff49], 0x89
pop ecx
inc bx
mov dword [esi + edx - 0xffa9], esi
pop edi
jnp fcn.00ee9d27
dec bp
dec eax
mov dword [esp], 0xe3b64495
dec eax
mov dword [esp + 8], ebx
sal di, 0xc7
movzx eax, bp
inc esp
xor dword [esp + eax*2 - 0xbf28], edi
jmp 0x176fdad
ror word [esp + eax - 0x5f95], 0x68
dec eax
mov ebx, dword [esp + eax - 0x5f90]
inc ecx
movzx ecx, si
dec ebp
arpl di, di
inc ecx
dec esi
xor cl, 0x17
jle 0xf4c07c

Function at 0x16115ee
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
xor edi, 0x2a343425
inc ecx
push esp
pop eax
inc ecx
and ebx, 0x703387b3
inc ecx
ror edi, 3
dec esp
xadd esi, ebp
inc ecx
dec ebx
dec edx
lea edx, [ecx + 0x12a3608b]
inc ecx
neg edi
push ebx
call fcn.0161356a
dec edx
or ecx, 0xdba04093
mov dword [esp + eax], ecx
neg edx
ror edx, 1
call fcn.00f213dc
inc ecx
mov edi, 0xef93942a
dec ebx
lea esi, [edi + edi*2 + 0xbaa6e03]
dec ebp
mov ebx, dword [edx]
dec ecx
mov ecx, dword [ebx]
inc cx
rol edi, 0xa4
inc esp
mov esp, esi
dec edx
lea edi, [0xc12b2f94]
dec ecx
mov dword [edx], ecx
inc esp
movzx ebp, si
dec eax
lea ecx, [esi + esi*8 + 0x700dfe04]
dec edi
lea eax, [ebp + eax - 0x2a85]
dec eax
or ecx, 0xf8bd611
inc edi
mov edi, dword [eax + ebp*8 - 0x15408]
inc esp
xor edi, ebx
inc ecx
movzx ebp, bp
inc esp
mov ebx, edi
inc ecx
sub ah, 0x1d
inc edi
lea edi, [ebp + edi - 0x3281d21f]
jns 0xf3d912
Function at 0x1613d34
Capabilities:
Encrypt data using speck

Disassembly:
rep stosd dword es:[edi], eax
jmp 0x1808fb7
inc esp
movsx esi, byte [esp + ecx - 0x11]
dec ecx
lea eax, [edi + edi*2 - 0x244421e3]
xor esi, 0x7d8f4691
push ecx
dec esp
add dword [esp + ecx - 0xf], esi
mov byte [esp + ecx - 0x11], cl
inc ecx
lea esi, [edi + esi + 0x39efdd8d]
dec esi
lea esp, [ecx + edi*8 - 0x13f75b43]
dec ecx
sal esp, cl
sal di, 2
bswap esi
dec eax
mov dword [esp + ecx - 9], ebx
call fcn.00f13a6a
push ebx
push esi
push edi
bt esi, 0xbc
xor edi, 0xa73dfc9c
mov edi, 1
inc esi
mov esi, edi
cmc
stc
jmp 0x1756e6b
mov dword [ebp - 0x44], esi
btr si, si
add si, si
mov esi, edi
jmp 0x1747f1c
mov eax, dword [edx + ebp - 0x6ba5dc91]
push edx
mov edx, dword [ebp + edx - 0x6ba5dc8d]
call fcn.00f36a4a
dec eax
lea edx, [edx*4 + 0x4aa1b23a]
push ecx
xor esi, 0xacbae837
inc esp
mov edi, edx
inc edx
lea esi, [esi + edi*2 - 0xf9d0e7c]
jmp 0xf1d5e4
mov dword [ebp - 0x28], edi
jmp 0x175bdf4
shl esi, cl
mov cx, 0xb2b3
mov ecx, dword [ebp + 0xc]
test esi, 0xae1807a8
clc
mov dword [ebp - 0x18], ebx
test sp, cx
mov byte [ebp - 1], bl
clc
test esi, 0x501afe16
sub esi, edi
test ah, 0xc
clc
mov dword [ebp - 0x48], esi
cmp bx, bp
mov esi, dword [eax]
clc
test ebp, 0x8391c38a
mov dword [ecx], ebx
sal ecx, 0x38
bsf cx, si
bt ecx, ebp
mov ecx, dword [ebp + 0x14]
jmp 0x181d5e8
shl esi, cl
ror cl, cl
and ecx, edx
mov ecx, dword [eax + 4]
stc
cmp bl, 0xba
sub ebx, ebx
clc
cmp si, cx
mov dword [ebp - 0x20], edx
clc
cmp di, cx
sub esi, edi
jmp 0xfe378d
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
je 0x1808fc6
mov ecx, eax
cbw
adc al, 0
mov eax, 0x400
shrd edi, esp, 0xbf
rcr di, 0xa
mov edi, edx
movsx edx, sp
movzx edx, ax
bsf ax, dx
mov eax, edx
test esp, 0x4093c111
jmp 0x17679ff
shl edx, 0x10
stc
or eax, edx
cmc
shr ecx, 1
jmp 0xf0e4d4
adc ecx, ecx
rep stosw word es:[edi], ax
and cx, bp
btr ax, 0x27
rcr ah, cl
mov ecx, dword [ebp + 8]
setb ah
btr eax, esi
dec eax
lea eax, [ecx - 1]
mov dword [ebp - 0x40], eax
stc
cmp sp, 0xf819
xor esi, esi
clc
test di, bp
or eax, 0xffffffff
clc
cmp cl, 0x3a
sub edi, edi
mov dword [ecx], ebx
bt ecx, esp
cmp esp, ebp
mov ecx, dword [eax + 4]
lea ecx, [ecx + esi]
not ax
mov eax, 0x300
stc
shl eax, cl
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], ebx
cmc
mov dword [ebp - 0x10], edi
clc
stc
cmp bx, bp
add eax, 0x736
jmp 0x1724d4b
Function at 0x1727ad5
Capabilities:
Encode data using xor

Disassembly:
adc edi, edx
pop ecx
pop eax
jmp fcn.00f2d244
inc ecx
setl byte [esp + edx - 0x767549b5]
mov byte ss:[ecx + edx - 0x767549ba], al
movsx eax, word [esp + edx - 0x767549b9]
dec ax
mov dword [esp + eax*8 - 0x3d200], edi
ret 4
not dword [esp + 3]
bswap eax
inc eax
neg eax
inc eax
not ecx
not ecx
call fcn.00f10fd8
movzx ecx, al
movzx edx, byte [ecx + esi - 0x62]
xor dl, bl
and word [esp + ecx*8 - 0x307], ax
sub cl, ah
neg dl
rol dl, 1
not byte [esp + ecx*8 - 0x27e]
dec ax
not dl
jno 0xf40c98
xlatb
jl 0xf299c3
xchg dword [ebx], esp
invalid
add edi, edx
xchg ecx, eax
or cl, 0x88
jmp edi
add dl, 0x23
add cx, 0x7e3a
ror dl, 1
or cx, 0xfb81
xor bl, dl
mov word [ebp + ecx*4 - 0x3fe2a], dx
movzx edx, cx
lea ebp, [ebp + ecx*4 - 0x3fe2a]
dec ax
mov edx, dword [esi + edx*4 - 0x3fe31]
add ecx, dword [esp + ecx - 0xff8b]
ror ecx, cl
sub esi, 5
mov dword [esp], 0xbf91b08f
mov dword [esp], 0x2c2bbb03
sar dword [esp], cl
xor edx, ebx
sub edx, 0x2b2ab684
shr word [esp + 1], 0x28
bswap edx
sar ecx, 0x85
not byte [esp + 2]
and word [esp + 1], cx
rol edx, 1
sar dword [esp], cl
jns 0xfd0e98
neg eax
jg 0xf3b8b1
and dl, dl
lea ecx, [edx + edx + 0x1f327fb0]
xor eax, ebx
jmp 0xfb32a2
and cx, cx
lea eax, [eax + edx - 0x4a7fd5d4]
neg eax
dec eax
xor eax, 0x1e2af209
jmp 0x1813c42
neg edx
mov dword [esp], 0xd9149982
rol dword [esp], 0xc5
and ecx, ecx
not edx
pop ecx
dec cx
dec edx
xor ebx, edx
jmp 0xfa9d5f
mov dword [esp], 0xc21eb60b
dec eax
jmp 0xf299e9
xor ebx, eax
shr ecx, 0x23
add edx, 0xb80e5226
add esi, eax
and cx, cx
jg 0x1825a97
jbe 0x161148b
push ebx
or bx, 0x75a2
mov bl, 0xa4
lea ebx, [ecx + eax]
sbb ah, 0x31
btr ax, bp
push edi
ror al, cl
test al, 0x8a
mov ax, 0x8f3e
movzx edx, word [edx + edi - 0x5e29932d]
lea edi, [edi + ecx*2 - 0x1ada4072]
xor dx, bx
sub ecx, ecx
ja 0xf250b5
push ecx
adc dx, 0xaea4
sar byte [esp + ecx], 0xc7
rol dx, 1
mov eax, ecx
call fcn.00ee873d
Function at 0x172e56c
Capabilities:
Encode data using xor

Disassembly:
rol edx, 1
sar cl, 0xa2
call fcn.015f2923
xor eax, ebx
lea edx, [edx - 0xada5acc]
sal dl, 0x21
sbb eax, 0xd034468d
shr dx, cl
sal dl, 0xc3
rol cx, 0x4f
rol eax, cl
xor eax, 0xa4b07db7
sub cx, cx
inc eax
push edx
xadd dword [esp], edx
bswap edx
rol eax, 1
sar byte [esp + 3], 6
neg cx
xor ebx, eax
add edi, eax
movzx dx, byte [ebp]
jmp 0x1762bd6
mov edx, dword [esp]
add edx, 0xac366733
xor eax, ebx
sar word [esp], 0x47
xor edx, edx
jbe 0x1821a7d
mov cx, word [ebp + 2]
not dx
mov eax, 0x53f2d8a
not ax
not cx
and dx, cx
dec eax
inc al
mov word [ebp + eax*8 - 0x29fe93a6], dx
mov dword [esp + eax*2 - 0xa7fa4ea], 0x461730b9
test byte [esi + edx + 0x5b], al
xor ch, 0xb9
xor byte [edi], dl
inc esi
rol word [esp + eax - 0x53fd273], 0xe9
mov eax, dword [esi + eax*8 - 0x29fe93ac]
jnp 0x15f87e5
xchg esp, eax
jl 0x172e58d
or bl, bl
xchg dword [ebp*2 - 0x7c009ca1], ebx
sbb esi, dword [ecx - 0x20605cdf]
pop ebx
mov cl, 0x21
mov dword [0xb14babc7], eax
and dword [ebx - 0x4e800c49], esp
and dword [ebx - 0x7345e47d], esp
add al, 0xa0
invalid
dec eax
movzx ecx, dl
ror eax, 2
or dx, word [esp + edx + 1]
bswap eax
xor eax, 0x50ae68a1
shr edx, 0x6f
xor ebx, eax
add edi, eax
add dword [esp + edx - 1], ecx
push ecx
or cl, byte [esi + edx - 6]
lea esi, [edx + esi - 6]
lea edx, [edx + edx*8 - 0x4a455a65]
call int.00f88467
xor ebx, eax
shr cl, 0x21
rol dx, cl
seta cl
adc edi, eax
not edx
mov eax, ecx
mov ecx, dword [ebp + edx - 0x2bfc75d3]
sal al, 1
movzx edx, byte [esi + edx*2 - 0x57f8ebab]
call fcn.01824884
xor edx, ebx
mov ecx, 0xce811307
sub edx, 0xda310a86
ror ecx, 0x44
jb fcn.015e25c6
jae 0x15f0035
mov dword [edi + 0x78], eax
xor ebx, esi
sub esi, edx
loop 0x1821b25
dec eax
pop esp
push cs
out 0x31, eax
inc ebp
je 0x1821b48
xor ah, bh
xor dword [ebp + 0x30], eax
insb byte es:[edi], dx
and ah, bh
xor dword [ebp + 0x50], eax
je 0x1821b43
out 0x31, eax
inc ebp
dec eax
push 0xed5b1360
pop ebx
scasb al, byte es:[edi]
hlt
invalid
xor byte [0x3e060eb5], bl
jne 0x1821b49
jne 0x1821b49
sal dword cs:[edx - 0xb830246], 1
idiv bl
invalid

Function at 0x173256d
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0xfab656

Function at 0x1734798
Capabilities:
Encrypt data using speck

Disassembly:
xor dword [esp + edx*2 - 0x512bef48], eax
dec eax
mov ebx, dword [esp + edx - 0x2895f798]
inc esp
mov esi, dword [esp + edx*2 - 0x512bef4d]
dec ecx
shl esi, 0x73
jnp 0xf793c8
inc ecx
mov dword [edx + edx - 0x2895f7bc], eax
dec ebp
lea edx, [edx + edx*2 - 0x512bef6c]
call fcn.01829d66

Function at 0x1747ec4
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [esi - 4]
mov dword [esp], 0x5db94aa1
call fcn.00f46598
push 0xb293c628
push 0x1984d2b4
mov dword [esp + 4], ebx
lea esp, [esp + 4]
Function at 0x174e85d
Capabilities:
Encode data using xor

Disassembly:
dec esp
lea ebx, [edi - 0x14fb3874]
dec eax
mov dword [esp + edi - 0x5f8ef408], edi
inc ebx
mov esi, dword [eax + ebx - 0x4a93bb94]
jmp 0x1825bab
xor esi, ebx
inc ecx
movzx eax, bx
shl eax, 0xb
inc ebp
mov edi, ebx
bswap esi
mov ebp, edi
inc esp
movzx esp, bp
dec esp
sbb dword [esp + edi - 0x5f8ef408], edi
xor esi, 0xdb9eac96
shr di, 0x6d
dec esi
not dword [esp + edi - 0x5f8e0005]
rol esi, 1
dec eax
shr dword [esp + edi - 0x5f8e0007], 0x3a
dec esi
dec edi
lea ebp, [esp + ebx*8 - 0x3ae4cbcc]
dec edx
or dword [esp + ebx - 0x4a93bb94], ebx
inc eax
movzx ebx, ch
dec ecx
lea edx, [ebp + edi*2 + 0x49a88d35]
xor dword [esp + edi - 0x5f8e0007], esi
pop ebx
dec ecx
bswap edi
dec eax
arpl si, si
dec edx
dec esp
add ecx, esi
call fcn.00f81d8a
inc ebp
push cs
js 0x1825bc7
fmul dword [edi - 0x7e974d53]
invalid

Function at 0x1757ef3
Capabilities:
Encrypt data using speck

Disassembly:
shr ecx, 0x6e
lea ebp, [ebp + eax*2 - 0x247fa]
push eax
call fcn.00f06f58
call 0xe2720068
shl byte [edi], 0x10
movsd dword es:[edi], dword [esi]
pushfd
fsubr qword [eax + ebp - 0x1ba32434]
cwde
pop esp
int3
jmp 0x15d4d7d
add ebp, 2
sub al, ah
bswap eax
shr cx, 1
call fcn.0175ee7d
xor ebx, edx
mov dword [esp + eax - 0x12400], ecx
xadd word [esp + eax*4 - 0x48ffe], cx
adc edi, edx
or ecx, dword [eax + ebp - 0x123fc]
mov dword [esp + eax*2 - 0x247fc], eax
and al, byte [esp + eax*4 - 0x48ffb]
mov dx, word ss:[eax + ecx - 0x12400]
dec dword [esp + eax*4 - 0x48fff]
movzx ecx, al
mov word [eax + ebp - 0x123fa], dx
jne 0xf9e404
mov edx, dword [ebp]
mov cx, word [ebp + 4]
mov eax, 0xeb3c5534
jmp 0xfb0e8f
Function at 0x175a766
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [eax + edi - 0x2eb0ab28]
lea edx, [eax + eax*4 - 0x17868f1]
xor ecx, ebx
rol ecx, 2
mov dword [esp + eax - 0x2eb0ab24], 0x150bf9bf
inc ecx
neg ecx
inc ax
ror ecx, 1
sub word [esp + eax*2 - 0x5d615649], dx
sub edx, edx
xor ebx, ecx
add esi, ecx
shl dx, 0xe1
mov ax, word [eax + ebp - 0x2eb0ab23]
movsx ecx, dl
push ecx
jge 0x1771794
mov word [ebp + eax*8 - 0x7fff8], dx
movzx edx, ax
xor edx, edx
mov ecx, dword [edi + eax - 0x10005]
not dl
adc eax, 0x26a7ba3e
dec dx
lea edi, [edi + eax*2 - 0x4d517480]
bswap edx
bswap edx
xadd dl, dh
xor ecx, ebx
sub dl, dh
jae 0xf02089
dec ebp
mov ebp, dword [edx]
inc ecx
mov esi, 0xad08448f
dec ecx
mov edx, dword [edx + 8]
dec ebx
lea edi, [esi + esi + 0x6a087fac]
dec ecx
mov dword [ebp], edx
inc ecx
movzx esi, dh
dec ebp
mov ebx, dword [edx + esi*2 - 0x10e]
inc ecx
movzx edx, dh
dec esi
mov esp, dword [esi + edx - 0x77]
dec ebp
add ebx, esp
inc esp
movzx ebp, dh
dec ebp
mov dword [edx + esi*4 - 0x224], ebx
inc esp
mov edi, esi
inc cx
inc esi
inc eax
setp dh
dec esi
lea edx, [esi + edx + 0x17]
sub dx, dx
inc esi
mov esp, dword [esi + eax - 5]
inc eax
xadd dh, bh
dec ebp
lea eax, [eax + esi*2 - 0x19a]
inc ecx
movsx ebp, ch
inc ecx
sal bh, 0x84
inc esp
xor esp, ebx
inc ebp
and ch, dh
inc ecx
sbb esp, 0x8581bb9c
inc ecx
neg esp
inc ecx
movsx eax, di
dec eax
lea ecx, [eax + edx*4 + 0x452f26a2]
inc ebp
lea esp, [esp + esi*2 - 0x7c9f883d]
call fcn.00f10a2e
lea ecx, [eax + ecx + 0x29667370]
ror dl, 0xc5
cmovs eax, edx
not ecx
ror dl, 0x41
ror ecx, 1
inc ecx
xor al, dh
xor ebx, ecx
add esi, ecx
jmp esi
lea edi, [edi + edx*2 - 5]
sbb edx, edx
dec edx
xor cl, bl
push edx
jmp 0x1609d06
shr dl, 4
neg cl
ror cl, 1
not cl
xor cl, 0x9e
xor bl, cl
call fcn.00f48583
call fcn.00f3b89f
mov word [eax], dx
movzx eax, cl
xor al, byte [edi + eax*8 - 2]
movzx edx, cl
xor al, bl
lea ecx, [edx + edx*2 - 0x6ccc49e9]
xor cl, 0x37
ror edx, 0xd0
ror al, 1
or ecx, 0xc531c33d
sub dx, dx
not al
neg dx
ror al, 1
bswap edx
neg edx
inc al
xchg dx, cx
neg cl
dec ecx
xor bl, al
add eax, esp
add dl, 0xb4
jbe 0x173507a
mov dx, word [eax + edx*8 - 0x7bf88]
movzx eax, cx
add cl, ah
jnp 0xee5db8
mov word [ebp + eax*2 - 0x5d615646], dx
jg 0xee4090
lea ebp, [ebp + edx*2 + 4]
xor cl, byte [edi + edx*4 - 5]
sal byte [esp + edx*4 + 5], 0x47
sar dword [esp + edx*2 + 4], 0xb3
jns 0xf14b1e
xor edx, 0xbb244e12
pop ecx
lea edx, [edx + eax - 0x2aee665e]
sub cx, ax
xor edx, 0x5e15d716
inc edx
and eax, 0x81332d2b
pop eax
bswap edx
xor ebx, edx
dec ax
add edi, edx
movzx edx, al
mov dx, word [ebp + eax*4 - 0x15c003fc]
xadd ax, cx
neg eax
not cx
add cl, byte [ebp + 2]
shl eax, 0x99
lea ebp, [ebp + eax - 0x25fffffe]
shr dx, cl
sar ax, 0x8e
sar eax, 0x86
mov word [ebp + eax*2 - 0x1300000], dx
movsx edx, ax
movsx ecx, ax
add edx, edi
jmp edx
Function at 0x175aa38
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
lea eax, [ecx*2 - 0x53615eeb]
add ax, 0x732e
dec edx
mov ebx, dword [esp + ebx - 0x7d1e7d19]
dec esi
mov dword [esp + ebx - 0x7d1e7d29], ebx
dec ebp
arpl sp, sp
dec ecx
dec ebx
dec ebp
add ecx, esp
dec eax
mov dword [esp + eax + 0x5362e61f], 0x7e3bc5a4
ror cl, 0x63
pop edi
pop edi
inc ecx
pop esi
jb fcn.00ee9d27

Function at 0x175c396
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0xf40c8f
mov dword [esp + 4], 0xd4b8449d
add ebp, 4
jmp 0xee67df

Function at 0x175e9eb
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0x93286aa6
not dword [esp + ecx - 0x348154]
lea edx, [edx + ecx*8 + 0x6de24540]
not ecx
call fcn.0172a91d

Function at 0x176084f
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov edi, dword [esp + 8]
dec eax
add edi, 0xff9d9057
jmp edi
lea esi, [esi + edi - 0xea2acd8]
dec edx
xchg dword [esp + esi*2 - 0x48], eax
ror esi, 3
inc cx
xor ebp, edi
bswap esi
dec esi
neg esi
dec edx
mov dword [esp + esi*4 - 0x90], ebx
inc cx
rol edi, 0x89
inc edx
xor dword [esp + esi*4 - 0x90], esi
dec ebx
lea eax, [ebx + ebx + 0x79b37f14]
pop ebx
sal di, 7
inc eax
setb ch
dec eax
arpl si, si
dec eax
lea ecx, [ebp*4 + 0x7bb55d9a]
dec esp
add ecx, esi
inc eax
sar ch, 0x84
inc ebx
movzx eax, byte [eax + esi*8 - 0x126]
dec edi
lea eax, [eax + esi*2 - 0x4e]
jp 0x15dc6b4
inc ecx
not ah
mov ebp, 0x76399f80
dec ebp
add ebx, edi
or bp, 0xce3c
inc ecx
inc ah
inc ebp
movsx esi, di
inc ecx
movsx eax, bh
inc ecx
not ah
inc ecx
xor bl, ah
dec edx
mov dword [esp + edi - 0x24], ebp
inc esi
sub edi, dword [esp + edi - 0x22]
inc sp
or dword [esp + edx - 0x3caa071e], edi
dec esi
lea esp, [esp + 8]
inc cx
mov edx, dword [esp + edx - 0x3caa0724]
inc dx
xadd dword [esp + esi - 0x22], ebp
inc dx
mov dword [ebp + edx - 0x7639763b], edx
je 0xf996b8
inc esp
movzx esp, bh
inc edx
mov esi, dword [ebp + eax - 0x7639763e]
xor esi, ebx
inc edx
inc dword [esp + esi - 0x22]
jns 0x1758002

Function at 0x176583e
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
pop esp
inc ecx
mov edi, 0x5eb7cbbc
dec edi
lea eax, [eax + edi - 0x5eb7cbbe]
inc edi
movzx edi, word [eax + edi - 0x5eb7cbbc]
inc sp
xor edi, ebx
call fcn.015de7a5
Function at 0x1769304
Capabilities:
Encrypt data using speck

Disassembly:
not al
dec ecx
or esp, 0x761d050a
shr bp, 0xa9
inc al
dec esi
lea ebp, [esi*2 + 0x51333d02]
inc ebp
xchg esp, ebp
not al
movzx edx, bp
xor bl, al
mov ecx, eax
inc esp
movsx ebx, ax
xor di, bx
inc di
call fcn.00ef2826
inc ecx
mov esi, 0x9c0c6d87
dec edx
lea eax, [esi*8 - 0x116c9400]
dec ecx
mov edx, dword [edx]
inc ecx
movsx ebp, si
inc ebp
movzx ebx, dh
inc bp
mov ebp, dword [edx + ebp*4 - 0x1b614]
dec ebp
xchg esi, ebx
inc ecx
movzx esi, bx
call fcn.0176849d
mov word [ebp], dx
mov ecx, 0x7132a2aa
mov dword [esp + ecx - 0x7132a2aa], eax
pop eax
pop eax
jmp fcn.00ef1ac1
add edi, ecx
lea esp, [esp + 0x10]
call fcn.00f7722d
inc ecx
mov esi, 0x8cbfb813
jmp 0x177fc21
inc bp
mov esi, dword [edx]
mov esi, 0x413f8325
mov ebp, 0x65b9f412
mov eax, 0x99993b9b
dec esi
lea edx, [ebp + edx - 0x65b9f410]
ror esi, 0x88
inc eax
setb dh
dec ebp
lea eax, [eax + esi - 0x25413f02]
inc esp
movsx esp, si
inc cx
shr esp, 0x43
xor ax, si
inc ecx
movzx edi, word [eax + esi*2 - 0x4a827e00]
jne 0x15e660a
dec ecx
sub eax, 1
inc ecx
mov esp, 0x8696b51e
inc ebp
movsx ebp, ah
inc ebx
movzx eax, byte [eax + ebp*2 - 0x3c]
inc ecx
movzx edi, sp
xor al, bl
dec ebx
lea ebp, [ebp + ebp*8 - 0x7d7f5c76]
add al, 0x14
inc ecx
movsx esi, ah
inc esp
movzx esi, bh
jmp 0xfbdf8c

Function at 0x176b5ce
Capabilities:
Encrypt data using speck

Disassembly:
neg edx
mov dword [esp], 0xc2227b11
mov ecx, eax
not ecx
lea edx, [edx + eax - 0x37f72f5]
neg edx
shr word [esp + ecx*2 - 0x8df2bfc], 0xc2
xor ebx, edx
add esi, edx
and ecx, ecx
call fcn.00f8c923

Function at 0x177707b
Capabilities:
Encrypt data using speck

Disassembly:
and dword [esp + 4], 0xa21f1909
not edx
inc edx
xor edx, 0xf50086b5
xor ebx, edx
inc byte [esp + 4]
add edi, edx
lea esp, [esp + 8]
call fcn.00ee9549
mov edx, esp

Function at 0x1778a8f
Capabilities:
Encode data using xor

Disassembly:
push ecx
sar word [esp + edx*2 - 0x11cf3], 0x61
dec eax
pop edx
not eax
bswap eax
xor ebx, eax
mov dword [esp + edx - 0x797f1342], 0xaf848f31
and word [esp + edx - 0x797f133b], dx
jge 0xfe1983
Function at 0x177a4be
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x5037072d
movzx esi, di
mov cl, dl
xchg esi, esi
rol eax, cl
lea esi, [ebp + edx - 0x10c]
cmp cx, 0x159b
test edx, ebp
add al, dl
test esi, ebp
xor al, byte [edi + esi]
mov byte [esi], al
jmp 0xf0ae69
je 0x1759824
inc edx
cmp edx, 0x104
jmp 0x175981e
je 0xefbc80
lea ebx, [ebx]
xadd di, si
xor di, cx
btc edi, ebx
jmp 0xf023ab
sar ax, 0x83
add edi, ecx
or eax, eax
mov ecx, dword [esp + eax - 0x7d6b01c8]
movzx edx, word [esi + eax - 0x7d6b01d1]
ror eax, cl
add esi, 0xfffffffa
xor dx, bx
dec cx
neg ax
and eax, 0x2cb3923b
inc dx
not dx
neg ecx
rol cl, 0xa4
not ax
ror dx, 1
neg byte [esp + eax*2 - 0x4965fbf8]
add cl, 0x91
xor dword [esp + eax - 0x24b2fdfd], ecx
dec dx
xchg dword [esp + eax - 0x24b2fdfb], ecx
ror eax, 0x96
xadd byte [esp + 2], ah
xor dx, 0x6814
sar word [esp + 6], cl
rol dx, 1
xadd word [esp + 6], cx
dec cx
push ecx
xor bx, dx
call fcn.00fd18ad
jb 0xf023ab
mov eax, dword fs:[0x30]
rol bx, 0x9e
not ebx
mov eax, dword [eax + 0xc]
setp bh
test cx, di
mov ecx, dword [eax + 0xc]
or bx, 0xbb19
stc
mov eax, dword [eax + 0x10]
bt ebx, ecx
mov dword [ebp - 4], eax
mov ebx, ecx
cmp edi, 0x922d7681
cmp ecx, eax
jmp 0xf5a306
neg ecx
lea eax, [edx + edx + 0x2e801890]
inc ax
mov dword [esp + eax - 0x2956b4ad], eax
rol ecx, 2
lea ecx, [ecx + eax*4 - 0x15a2400f]
xadd edx, eax
xadd al, ah
add edx, 0x18a037a9
ror ecx, 1
or dword [esp + eax - 0x7d6b0e58], 0x909a8e3c
or word [esp + eax - 0x7d6b0e56], dx
inc ecx
xor ebx, ecx
sal byte [esp + eax - 0x7d6b0e58], 0xa1
ja 0xfb9eaf
push ebp
xadd ebp, ebp
cmp ecx, edi
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
jmp 0x177f452
mov edi, eax
test sp, si
bsr eax, ebp
sar ax, cl
lea eax, [ebp - 0x10c]
test si, ax
cmp ecx, esp
xor edx, edx
cmc
sub edi, eax
jmp 0xf6cda7

Function at 0x177e19f
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, ebx
bswap eax
mov dword [esp + edx*2 - 0x5e72], 0xc6ad208d
or eax, 0xf90cc3b1
inc ecx
lea edx, [eax*2 - 0x4cc66c6b]
ror ecx, 3
lea eax, [eax + eax*4 - 0x3782651]
bswap ecx
call fcn.00ef1443