joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa05e63
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0xdf68a2
movzx ebx, word [eax + esi + 4]
jmp 0xda971a
sbb esi, 0xfffffffb
xor ecx, ebx
mov edx, 0xd4845a84
not ecx
lea eax, [edx + edx - 0x16e60453]
inc dx
sub ecx, 0x7232d09b
and dx, ax
inc eax
neg ecx
idiv eax
inc ecx
and edx, edx
ror word [esp + eax - 0x65530108], 0x45
not ecx
ror eax, 0x84
mul dword [esp]
rol ecx, 1
not edx
cbw
cbw
xor ebx, ecx
jmp 0xdc7538
jmp 0xc8f235
call fcn.00dca127
pop edx
rol word [esp + eax - 0x71cffffe], 0xaa
xor ecx, ebx
add al, byte [esp + eax - 0x71cffffe]
pop edx
sbb ecx, 0xb524d4a0
not dl
btr edx, 0x14
sub al, dh
xor ecx, 0xe01d3117
call fcn.00966aa3
mov esp, ebp
pop ebp
ret
xor edx, 0x5b301b24
bts eax, 0xad
bt eax, 0x9e
sar cl, 0xc7
sbb edx, 0x9ab82583
sub ax, 0xe080
mov dword [esp + eax - 0x4030], 0x240c5530
cwde
rol edx, 1
xor edx, 0xa21bf411
rol al, 0xe5
not edx
dec edx
push eax
btc eax, 0x93
rol edx, 1
rol ecx, 0xa2
xor edx, 0x3a4789c
call fcn.00dc0802
mov eax, 0x9d01f03a
mov esi, 0x8a915f2c
mov ecx, dword [edi]
add edi, 4
btr esi, eax
xchg ecx, edi
shr al, 0xc5
mov esi, ecx
lea edx, [eax + eax*8 + 0x25154e90]
sar ax, 0x69
lea ecx, [eax - 0x537d11dc]
js 0x933c14
adc esi, 4
push 0xe6aa75b1
neg dword [esp + 6]
div ecx
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, 0xd1487b6
mov dword [esp + ecx - 0xd1487b6], ebp
ret 8
je 0xdbc061
inc eax
cmp edi, 0x69aaab2f
cmp eax, ebx
jmp 0xdb849e
cmp edi, ebx
jmp 0xe1bc5c
mov ebx, dword [ebp - 4]
sub edi, 0x220f0906
lea edi, [eax + esi]
cmp si, sp
cmc
test eax, edx
lea edi, [edi + ebx]
sal ebx, 0xba
clc
xor ebx, 0xc280d299
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], edi
cmc
jmp 0xdf2993
jne 0xa120ac
movzx edi, byte [eax + esi + 8]
jmp 0xdd4322
not eax
neg dx
Function at 0xa0b031
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
not ecx
jg 0xde17a6
mov eax, 0xf80e07d0
push es
pop ebp
inc dword [ebx]
je 0xa0afe0
push es
pop ebp
jmp dword [ecx - 0x23]
xadd ax, dx
not edx
sar dl, 0x46
lea ecx, [ecx + edx - 0x1b522aea]
btr ax, dx
bt ax, ax
sal dl, 0xa4
rol ecx, 3
or eax, 0x7d0d6480
sar dx, 0xca
sbb ecx, 0x91262812
inc dl
not dx
dec edx
rol ecx, 3
sub ecx, 0x9ba9e293
xor ebx, ecx
push eax
or byte [esp + eax - 0x7d0d64ae], dl
shl dx, 0x6e
shr edx, 0x9f
add ecx, edx
neg dword [esp + edx*4]
bswap ecx
mov dword [esp + edx - 1], 0x64b6879b
sub word [esp + edx*2 + 1], ax
add eax, dword [esp + edx*8 - 4]
xor ecx, 0x5b301b24
sub ecx, 0x9ab82584
sal eax, 0x59
rol ecx, 1
xchg dword [esp + edx], eax
xor ecx, 0xa21bf411
dec ax
not ecx
sub ecx, edx
rol ecx, 1
xor ecx, 0x3a4789c
add al, byte [esp + edx*8 - 1]
ror ecx, 2
xor ebx, ecx
bts eax, edx
mul dword [esp + eax - 0x7a3ab683]
add edi, ecx
cdq
sar dl, 0x24
xchg dword [esp + 4], eax
movzx eax, byte [esi - 5]
sal dl, 0xe1
bswap edx
inc dl
sbb esi, 4
neg word [esp + 2]
sbb dl, 0x8c
xor al, bl
ror byte [esp + 7], 1
adc word [esp + 6], dx
not al
mov ecx, dword [esp + 4]
ja 0xa12b11
rol ecx, cl
xor al, 0xa3
pop ecx
push edx
and ecx, 0x4c2133a6
ror al, 1
ror ecx, 0xfc
sub byte [esp + 3], cl
dec al
xor bl, al
lea eax, [esp + eax + 8]
xor dword [esp + 4], 0x5f0a5736
xor ecx, 0x78202f04
or ecx, edx
mov edx, dword [eax]
call fcn.009f820a
neg dx
rol ecx, 3
sar ax, 0x48
or dl, 0x8e
lea ecx, [ecx + edx - 0x4e63f7e9]
xor ax, 0xac93
neg al
sal eax, 0xf5
xor ecx, 0x2faf9a00
lea ecx, [edx + ecx + 0x1a13f39]
xor ebx, ecx
call fcn.00d62748

Function at 0xa126fc
Capabilities:
Encrypt data using speck

Disassembly:
bts cx, ax
mov dword [esp], 0xc1c2e89
sbb edx, 0x913a7535
inc dword [esp]
xor ebx, edx
shr al, 0xc1
sbb eax, eax
adc esi, edx
mov edx, dword [eax + edi]
jmp 0xdac6ef

Function at 0xa16da7
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + ecx - 0x2d600000], 0x8b88e37
inc edx
or dword [esp + ecx - 0x2d600000], 0x53288038
jae 0xd64a62
ror edx, 2
rol word [esp + ecx - 0x2d5fffff], 0x45
cbw
bswap edx
pop ecx
add ax, ax
xor ebx, edx
dec cx
add esi, edx
cbw
ror ax, 7
not cx
mov edx, dword [edi + eax - 0x10792dff]
mov cx, word [ecx + edi - 0x5b1128bd]
lea eax, [eax*2 - 0x675e6173]

Function at 0xa18181
Capabilities:
Encrypt data using speck

Disassembly:
sar edx, 0x57
lea edi, [edi + edx - 8]
or dl, byte [ebp + edx + 5]
sub ebp, 0xfffffffa
xor dl, bl
mov ecx, 0x76811ead
add dl, 0x89
mov dword [esp + ecx - 0x76811ead], ecx
rol dword [esp + ecx - 0x76811ead], 0xdf
neg ecx
rol dl, 1
neg dl
xor dl, 0x39
neg cl
rol dl, 1
sar dword [esp], cl
dec dl
call fcn.00a29cd4
Function at 0xa196b0
Capabilities:
Encrypt data using speck

Disassembly:
lea edi, [edi + ecx*8 - 0x5fc]
shr edx, 0x11
sub ecx, ecx
lea edx, [ecx*4 + 0x1223c488]
or cl, byte [ebp + edx - 0x1223c484]
shr dx, 0xcb
rol edx, 0x3b
sbb ebp, 0xfffffffb
sar dword [esp + 4], 0x72
mov dword [esp], edx
xor cl, bl
xor cl, 0xb2
bts edx, edx
adc word [esp + 4], dx
push edx
rol cl, 1
sub edx, 0xdab4dd3d
sbb cl, 0x1e
sal dl, 0xe1
lea edx, [edx + 0x98c8ab4]
neg dl
neg cl
dec cl
rol dx, 0x41
shr edx, 1
pop edx
neg cl
push edx
add cl, dl
sub dx, dx
neg word [esp + 4]
and dl, dh
xor bl, cl
btr edx, edx
push edx
jb 0xd6e731
lea ecx, [esp + ecx + 0x10]
mov byte [ecx], al
lea eax, [edx + edx*2 - 0x375955e]
mov dword [esp + eax*2 - 0x7c7ad544], esi
ret 0xc
sets dl
ror eax, 2
bswap eax
pop ecx
sar edx, cl
xor eax, 0x463f3e31
bswap eax
bswap ecx
lea eax, [ecx + eax - 0x58ace62d]
add dl, 9
ror eax, cl
add dx, cx
adc dx, 0x2ea4
xor ebx, eax
dec dx
lea edi, [edi + edx - 0x3128]
lea edx, [ecx + 0x3bae4d21]
setg dl
mov dword [ecx + edi - 0x36fb0082], eax
setns dl
jg fcn.00dd66d7
neg eax
dec eax
neg cx
ror eax, 1
xor ebx, eax
and dword [esp], 0xa081200d
adc word [esp + 2], 0x612a
adc ebp, eax
pop edx
mov eax, dword [esi + edx - 0x6129fffc]
xadd ecx, edx
call fcn.00c77679

Function at 0xa1e804
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck

Disassembly:
inc ecx
pop edx
imul ax, ax
imul eax
ror ecx, 1
shr ax, 0xcd
add dl, 0x81
bswap ecx
sub ax, ax
ror dx, 0x6d
jb 0xe0a468
mov edx, 0xeb8deb7
lea esi, [esi + edx - 0xeb8debb]
rol dx, 0xe8
mov edx, dword [esi + edx*2 - 0x1d716fbc]
mov ecx, 0xb80ffd98
not ecx
xor edx, ebx
inc cl
jno 0xd5fd0f
mov eax, dword [ebp]
mov edx, 0x8080b29e
and dx, dx
adc ebp, 4
dec dx
xor eax, ebx
rol eax, 1
lea ecx, [edx + edx*2 + 0x599c9c9c]
dec ecx
btr ecx, edx
dec eax
sar cl, 0xa4
bts ecx, edx
xor eax, 0xe91d7a15
dec ebp
arpl ax, ax
dec al
dec bp
dec ecx
add ebx, eax
inc ebp
movzx edi, cx
inc cx
rol ecx, 0x68
inc ecx
inc ecx
jmp ebx
xor ecx, 0x9439109e
adc edx, 0x26b2b4a1
not edx
movzx eax, cl
inc edx
sal al, 0x43
bswap edx
call fcn.00a05e63
cwde
shr si, cl
inc ecx
not eax
inc ecx
imul ecx
inc ebp
lea eax, [eax + esi - 0x260c5423]
inc ecx
neg eax
inc cx
imul edx, ecx
inc esi
lea eax, [ebp + eax + 0x247c5680]
add di, ax
inc ecx
push ebx
add esi, eax
dec eax
or edx, esi
dec esp
lea esi, [edx + ebp*4 - 0x7956f646]
inc esp
xor dword [esp + edi - 0x2a38], eax
sar edx, cl
jns 0xe03536
inc sp
btr eax, ecx
inc ecx
pop ebx
dec eax
ror eax, cl
sub ecx, edx
jno 0xc94084
call fcn.0098af77
not eax
dec ecx
adc cx, word [esp + ecx - 0x3d992559]
rol eax, 2
ror word [esp + edx - 0x73a9a3bd], 0xef
add dl, 0x19
lea eax, [eax + edx*2 - 0x2140e929]
ror eax, 2
call fcn.00958fb9
ror ecx, 1
rol edx, 0x4f
neg dx
xor ebx, ecx
add ebp, ecx
mov ecx, edx
sal eax, cl
movzx edx, byte [edi + eax + 4]
lea edi, [eax + edi + 5]
neg al
cwde
xor dl, bl
btr ax, ax
jb 0xd757e7
ror dl, 1
sar cx, 0xd
and cl, ch
sbb eax, 0xb531588e
xor dl, cl
add ecx, 0x85178335
adc ecx, ecx
dec ecx
adc dl, 0
btc cx, cx
not dl
dec dl
ror cl, cl
shr cx, cl
xor dl, 0xd
sal cx, 0x46
call fcn.00cc5122
Function at 0xa287e4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xchg dword [esp + eax - 0xd860102], edx
cdq
mov eax, dword [esi + eax*2 - 0x1b0c020c]
or edx, dword [esi + edx + 0xc]
inc dword [esp + 3]
js 0xd66e2b
jno 0xd6a6db
add ecx, edx
rol dl, 6
inc eax
ror ecx, 1
mov dword [esp + eax*2 - 0x6d96c042], edx
and dword [esp + eax*2 - 0x6d96c03f], 0x188e2637
adc edx, dword [esp + eax*2 - 0x6d96c038]
xor ebx, ecx
sub eax, edx
add eax, dword [esp + eax - 0x37060139]
add ebp, ecx
jmp 0x9205f3
xor ecx, ecx
sar word [esp + 1], 0x44
setp byte [esp + 3]
test edx, edx
lea esp, [esp + 0x10]
je 0xd69128
push esi

Function at 0xa2dae5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg ebp
inc ecx
ror esp, 0x7e
dec eax
mov dword [esp + edx*2 - 0x68], eax
inc ecx
mov edi, 0xaf88b336
rol ebp, 3
call fcn.00cb1487

Function at 0xa2f30c
Capabilities:
Encrypt data using speck

Disassembly:
adc edi, 6
mov word ss:[edx], cx
jmp esi
mov eax, ecx
mov eax, dword ss:[edx + ecx*4 - 0x214]
bt cx, 0x25
push ecx
lea edx, [ecx + ecx*8 - 0x79dad1f6]
mov dword [esi + ecx*4 - 0x210], eax
jae 0xdcbf4c
js 0xd64a9c
mov dword [edi + edx - 0x5e280732], eax
not dl
jmp esi
bt ecx, eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp], 0xf1adc986
mov edx, 0xc7acf808
add eax, ecx
sar edx, 0x76
pop edx
movzx ecx, dl
mov edx, eax
dec cl
jbe 0x9f91b2
das
retf
jae 0x93dd22
call fcn.00c89168
dec eax
xchg dword [eax + 0x385420b3], esp
mov word [edi - 1], gs
dec esp
sub byte [edi + ecx*4 - 0x38], cl
outsd dx, dword [esi]
dec dword [edi + edi*8 + 0x68]
mov dword [0x187901e0], eax
or dword [edi], ebx
cmp dword [ebp - 0x5c85aa6d], edi
pushfd
in al, dx
iretd

Function at 0xa2f63d
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov eax, 0x902b9f1a
dec ecx
mov ecx, dword [ebp]
pop ebp
inc ecx
mov esi, dword [ebp + 8]
inc ecx
mov edi, eax
and eax, 0x8b415d00
je 0xa2f672
or byte [ecx - 0x75], al
clc
dec ecx
add ebp, 0xc
mov dword ss:[ecx], esi
inc eax
movsx edx, bh
dec esi
lea edx, [edx + edx - 0x1e]
mov ecx, 0x2f05bea8
inc esp
movzx ecx, cl
test al, 0xbe
add eax, 0xb60f442f
leave
inc ebp
mov esi, eax
inc ecx
mov eax, dword [edx + edx - 0x1a]
inc esp
movsx esp, dl
inc ecx
rol cl, 0x63
inc ecx
xor eax, ebx
inc sp
btc edx, eax
call fcn.00c88c9a
mov eax, 0x7da6487c
insb byte es:[edi], dx
in al, dx
pop ebx
ja 0xa2f646
pushal
in al, dx
dec esp
mov dword [0xec60b157], eax
cld
jae 0xa2f6ef
mov cl, 0x60
in al, dx
pop esp
mov ebx, 0xec60b127
fdivr dword [ebx + 0x3f]
mov cl, 0x60
in al, dx
call 0x615405f7
in al, dx
mov byte [ebx], dl
out dx, eax
mov cl, 0x60
in al, dx
pushal
jg 0xa2f6f0
mov edi, 0xa502c113
jge 0xa2f666
stosb byte es:[edi], al
invalid
xchg ebx, eax
stosb byte es:[edi], al
imul byte [edx]
invalid
Function at 0xa320ba
Capabilities:
Encrypt data using speck

Disassembly:
shr edx, 0xa1
lea ecx, [edx + edx*2 - 0x4e1de51]
dec al
neg al
xadd dx, cx
mov dword [esp + edx - 0x472721b7], ecx
inc al
dec ecx
call fcn.00e19b22
mov eax, 0x24a748bc
bts ax, ax
cbw
lea edx, [esp + eax - 0x24a7ffb0]
movsx ecx, al
inc ecx
movzx cx, byte [edx + eax*2 - 0x494fff78]
mov word [ebp + eax*2 - 0x494fff7a], cx
mov edx, dword [esi + eax*2 - 0x494fff7c]
movsx ecx, al
xor edx, ebx
cwde
not edx
xchg ecx, eax
dec eax
rol edx, 2
inc al
lea edx, [edx + eax - 0x32fcbbb4]
ror edx, 2
xor ebx, edx
xor cx, ax
adc edi, edx
cdq
sub dl, al
neg ecx
movzx ecx, byte [ecx + esi - 0x10005]
cwd
xor ax, ax
adc dx, ax
adc esi, 0xfffffffb
inc dx
jle 0xd94482
dec ecx
ror esp, 1
inc edx
shr byte [esp + eax - 0x3e6322ec], cl
dec ecx
xor esp, 0x2617ef07
inc esi
movsx esi, byte [esp + eax - 0x3e6322f5]
or ecx, edi
inc ecx
push eax
dec ecx
bswap esp
dec ecx
xor esp, 0x3a813805
dec edx
xadd dword [esp + eax - 0x3e6322ee], edx
mov esi, 0xd9b2e200
dec ebp
xor ebx, esp
cwde
dec edi
lea ebp, [ebp + eax - 0x3e632300]
cdq
inc ecx
idiv eax
inc eax
sub bh, 0xb1
dec edi
mov dword [eax + ebp - 0x3e6322f8], esp
jnp 0xd55c8e
pop ecx
pop esi
inc ecx
pop esp
jno fcn.00c9d101
sub esi, 4
mov eax, 0xb702c80c
mov edx, 0xe093edbe
mov ecx, 0x3a35718c
mov ecx, dword [esi + ecx - 0x3a35718c]
neg eax
shr edx, 0xa9
not dl
xor ecx, ebx
inc dl
sub ecx, 0xe595f52d
ror dx, 0xa1
btr edx, edx
rol ecx, 1
xchg dl, al
div dl
ror edx, 0xcd
bswap ecx
sal edx, 0x88
push edx
neg dword [esp + eax - 0x48fd3d3a]
neg ecx
sub eax, dword [esp + eax - 0x48fd3d3a]
inc edx
not ecx
shr dword [esp], 7
xor ebx, ecx
pop edx
or edx, 0xd9a41190
dec edx
adc edi, ecx
lea ecx, [edx*4 - 0x5f4500f1]
inc dx
rdtsc
or cx, cx
sal cl, cl
lea ebp, [ebp + ecx*4 - 0x1eeb9c68]
xor ecx, ecx
inc cx
mov dword [ecx + ebp + 3], eax
movzx eax, cl
mov dword [ebp + ecx*2 - 2], edx
shl cl, cl
je fcn.0097b869
mov edx, ecx
jae fcn.009213ba

Function at 0xa36fa5
Capabilities:
Encrypt data using speck

Disassembly:
rol eax, cl
sal ecx, 0x8b
setns cl
xor eax, 0x7b2acdaa
rol ecx, cl
sal byte [esp + ecx - 0x201002], cl
bts edx, ecx
sbb eax, 0x9c048213
xor ebx, eax
shl dword [esp + ecx*8 - 0x1008010], cl
rol ecx, cl
adc esi, eax
movsx eax, dx
mov dword [esp + ecx*8 - 0x4020040], esi
ret
not ecx
dec eax
neg eax
bt edx, edx
mov dword [esp + ecx - 0x44000201], ecx
jae 0x984b0f
Function at 0xa39b27
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x10]
je 0xa39b65
mov eax, 0x53038d22
inc eax
mov eax, dword [ebp + ebx*4]
push 0xf4286a05
push 0xaa8e5c10
mov dword [esp + 4], eax
shr word [esp + 1], 0x42
ror byte [esp + 3], 0x67
jp 0xe18467
dec ebx
lea esp, [esp + 4]
jne 0xa39b31
call fcn.00e0f0d1
call fcn.00936225
rol dword [esp + eax - 0x6b19fc6a], 0xa1
shl ax, cl
dec edx
not edx
sar eax, cl
xor edx, 0xe88a6a0b
add dword [esp + eax - 0xd633c67], ecx
dec eax
sbb edx, 0x97ae679f
xor edx, 0x9d2d5486
cbw
jmp 0xd4d2ed
lea ecx, [edx + ecx - 0x334ec197]
push eax
xor ecx, eax
xor ecx, 0xfe9c2d81
push eax
shr dl, 0x81
xor ebx, ecx
xchg dword [esp + 1], edx
sar dl, 0xe5
add ebp, ecx
sub dword [esp + eax - 0x6b19fc70], eax
ror edx, 1
jmp 0xd5a3c1
btc edx, 0xa6
add dx, dx
xor ecx, 0x78855386
cwde
jmp 0xd78d94

Function at 0xa3b6ff
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg al
shr dl, 0xa2
jbe 0xc99718
mov dword [esp + edx*2 - 0x7a670000], 0xd82389a7
inc word [esp + edx*2 - 0x7a66fffa]
lea esi, [edx + esi - 0x3d338005]
setg dl
pop edx
dec dx
xor al, bl
mov dword [esp], edx
shr edx, 0x2b
rol al, 1
pop edx
jmp 0x9260c0
xor edx, edx
sbb al, 0x21
add edx, edx
neg al
inc al
bts dx, 0x90
jae 0x969cc7
mov edx, dword [ebp]
mov eax, 0xb2310a99
lea ecx, [eax*4 + 0xaaae84]
xchg ah, cl
mov eax, dword [ebp + 4]
not cl
add ebp, 4
shr ecx, 0x89
rol ecx, cl
not edx
sal ecx, 0x9c
bt cx, cx
add cx, cx
not eax
sbb ecx, 0x6537949c
bt ecx, ecx
dec cl
or edx, eax
mov dword [ebp], edx
movsx eax, cl
shr eax, cl
or al, 0x8d
lea esi, [eax + esi - 0x91]
bswap ecx
mov edx, eax
btr cx, cx
mov eax, dword [esi + ecx - 0x636bc8fa]
btc ecx, edx
shr ecx, 0x39
xor eax, ebx
btr edx, 0x85
sbb eax, 0x873fa507
bswap eax
sub dl, dh
not edx
add ecx, 0xf5964d33
dec eax
xadd dl, dh
xor eax, 0x35afe532
add dx, cx
dec eax
btc cx, cx
rol ecx, 0x12
bswap eax
rol cx, 0xe7
xor ebx, eax
and edx, edx
setp cl
add cl, 0x84
adc edi, eax
jmp edi

Function at 0xa3b75b
Capabilities:
Encrypt data using speck

Disassembly:
shr edx, 0xbb
pop edx
mov eax, dword [esi + ecx*4 - 0x4e16a60c]
xor eax, ebx
call fcn.00cb95e8
test ebp, 0xb120090

Function at 0xc78356
Capabilities:
Execute syscall

Disassembly:
call fcn.0092a6a0
sysenter
push ebx
pushfd
mov ebx, 0xf73fbfb4
neg bx
mov ebx, dword [esp + ebx*2 + 0x11817f6c]
mov dword [esp + 4], 0x39685353
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00955e4f

Function at 0xc785a1
Capabilities:
Encode data using xor

Disassembly:
shr ecx, 8
mov dword [esp], 0xe6151a1f
xor ecx, ebx
inc edx
push 0x30b18499
push 0x8e0cefa0
jmp 0xa3886a
jae 0xa32b65
Function at 0xc79511
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
jp fcn.009213ba
inc eax
dec dh
dec ecx
lea edx, [eax + ecx*4 + 0x30fca06]
inc eax
neg dh
inc ecx
neg ecx
inc eax
dec dh
neg edi
inc cx
neg ecx
inc eax
rol dh, 1
inc ecx
shr ecx, 0xd9
inc esp
xor bl, dh
inc di
jg 0xa10ca6
xor edx, 0xfe9c2d81
jmp 0x979b05
dec eax
add esi, esp
push edi
dec edx
lea ecx, [edi*8 - 0x2e696958]
inc ebp
add ecx, ecx
inc edx
mov dword [esi + ecx], ebp
dec ecx
bswap ecx
dec edx
sbb dword [esp + ecx*2], 0x9808f0ab
inc cx
inc eax
inc ebx
movzx ebp, word [edx + ecx*2 - 3]
inc ecx
inc al
inc dx
sub dword [esp + ecx], 0x2444227
loop 0xa10d42
inc ecx
xor ebp, ebx
neg bp
inc dx
and dword [esp + ecx], edi
inc dx
sar dword [esp + ecx + 4], 0xc4
dec esi
xadd dword [esp + ecx*2], eax
rol bp, 1
not dx
call fcn.00925db5
shl eax, 0x22
push eax
mov dword [esp + eax*2 - 0x42fdb37c], ecx
mov edx, dword [esi + eax*2 - 0x42fdb388]
push ecx
pop ecx
xor edx, ebx
xadd ax, cx
lea edx, [edx + eax*2 - 0x7383d0dc]
dec al
adc eax, eax
dec ecx
xor edx, 0x2b092a1f
sal eax, cl
jp 0xc8d900
pop ecx
bswap edx
lea ecx, [eax*8 + 0xfbe62a7]
pop ecx
neg edx
or ax, ax
seto cl
push eax
dec edx
btr eax, 0xa1
xor ebx, edx
sal cx, 0x4a
adc edi, edx
mov edx, dword [esi - 0xc]
sub dword [esp + eax - 0x80000000], 0x9dae4e0d
cwde
lea esi, [esi + eax*2 - 0xc]
sbb dword [esp + eax*8], eax
or ecx, ecx
imul ecx, ecx
xor edx, ebx
not dword [esp + ecx*8]
cwde
ror edx, 1
and byte [esp + ecx*4 + 2], cl
push ecx
dec edx
neg ax
or eax, 0x9b09002e
shl dword [esp + ecx*2 + 4], 0x78
not edx
sbb cx, 0x9d28
jno 0xcb32d8
mov ebp, 0xeea4de2d
inc esp
mov eax, ebp
inc ecx
mov ebp, dword [ebp]
inc ebp
movsx ecx, ax
inc ebp
mov esp, eax
inc ecx
movsx ecx, sp
inc ecx
movzx esi, byte [edx - 1]
inc ecx
mov edi, 0x53835f3b
inc ecx
mov edi, ecx
inc ecx
xor dh, bl
jmp 0x92f42c
xor edx, 0xe88a6a0b
sub edx, 0x97ae67a0
pop eax
xor edx, 0x9d2d5486
xor cl, al
or cx, ax
jge 0xe05615
xor ebx, edx
sal ax, 0xc
mov dword [ebp + ecx*2 - 0xc5b8], edx
lea ebp, [ebp + ecx*4 - 0x18b68]
jns 0x91ff99

Function at 0xc7dd11
Capabilities:
Encode data using xor

Disassembly:
xor dl, 0xa7
cwde
or ax, cx
not dl
rol dl, cl
mov dword [esp + eax*8 - 0x1bcd8], ecx
not cx
neg dl
xchg word [esp + eax*2 - 0x6f36], ax
shr eax, 0xe1
sar dword [esp + eax*4 - 0x4400], cl
xor bl, dl
Function at 0xc821ef
Capabilities:
Encrypt data using speck

Disassembly:
or dl, al
bswap ecx
xchg dword [esp + ecx - 0x6d34d157], ecx
and cl, byte [esp + ecx*2 - 0x6fd]
not dl
movzx eax, byte [esp + ecx - 0x37f]
or al, 0x1e
mov word [edi + ecx - 0x380], dx
lea edx, [ecx*8 + 0x1d0050a9]
mov al, byte [ebp + ecx - 0x37b]
lea ecx, [ecx + edx*2 + 0x3f06ed3a]
lea ebp, [ecx + ebp - 0x7907ca06]
pop ecx
xor al, bl
or dword [esp + edx - 0x1d006ca9], ecx
adc al, 0xad
ror al, cl
xor byte [esp + edx*4 - 0x7401b2a1], 0x83
xor al, 0x27
dec dword [esp + edx - 0x1d006ca9]
ror al, cl
dec al
add ecx, dword [esp + edx*2 - 0x3a00d952]
pop edx
xor bl, al
bt dx, dx
add edx, ecx
mov word [edi - 2], ax
push edx
sar ecx, 0x41
sbb edi, 1
movsx eax, byte [esp]
xadd cx, dx
xor ecx, eax
pop eax
jno fcn.00dd66d7
cwde
add ebp, ecx
movsx ecx, ax
xchg ecx, edx
movzx dx, byte [edi + ecx - 0x52]
mov cl, byte [edi + ecx - 0x50]
mov dword [esp], eax
add edi, 2
add dword [esp], 0x30b43c18
jns 0xd56434
neg ecx
jnp 0x9673e9

Function at 0xc8566b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebp
mov ecx, dword [ebp + esi*8 - 0x180]
jmp 0x945534
inc edx
xor dword [esp + ecx - 0x4000040], esi
dec eax
mov dword [esp + edx*2 - 0x124], 0x63493aa
pop ebp
inc ecx
pop ebx
call fcn.00db6843
mov ecx, 0xfc2c53a0
sub esi, 4
lea edx, [ecx*4 + 0x2e9307]
sar cl, 0x65
mov ecx, dword [esi]
js 0xdf710f
inc ecx
mov eax, 0x5a9cfb30
inc ecx
movzx esi, al
jmp 0xa3ce81
xor ecx, ebx
add edx, edx
xor ecx, 0xd4a753bd
movzx eax, dx
dec dx
ror eax, 0xc6
ror ecx, 1
dec ecx
neg edx
shr eax, 0xd
rol ecx, 3
neg al
neg ax
lea ecx, [ecx + eax - 0x3aa5dba8]
bswap edx
neg ecx
call fcn.00df5d92

Function at 0xc8bdda
Capabilities:
Encrypt data using speck

Disassembly:
push eax
sar al, 0x85
call fcn.00dc7d8c
inc ax
ror cl, 1
and ax, ax
shl al, 0xe2
call fcn.00e07fe2
dec esi
inc ecx
mov edi, esp
dec esi
lea edi, [eax*2 + 0x36a89904]
bswap esi
sub esi, 0x879c5e08
inc ecx
push esp
inc esi
xadd dword [esp + edi - 0x36a9d85b], edi
neg esi
inc dx
shl dword [esp + edi - 0xb9019c], 0xec
inc edx
movzx eax, byte [esp + eax*4 - 0x27eaf]
je 0x930799
dec esi
mov dword [esp + eax - 0x9fac], ebx
dec edx
lea edx, [0x4d1138ad]
inc edx
xor dword [esp + eax*2 - 0x13f58], esi
inc ecx
pop ebx
dec eax
shl edi, 0xe6
call fcn.0098df76
dec esi
mov ebx, dword [esp + eax*2 - 0x1fffffe]
neg edx
dec ebp
arpl si, si
inc eax
cwd
dec ecx
adc ebx, esi
cwd
inc esp
movzx edi, si
dec edx
mov dword [esp + eax*2 - 0x2000006], ecx
dec edi
mov ecx, dword [eax + ebp - 0xffffff]
dec edx
mov dword [esp + eax - 0xfffffb], 0x612e1904
inc ecx
not esp
dec ebx
mov edi, dword [eax + ebp - 0xfffff7]
inc ebp
movzx esi, ah
dec dl
inc edx
sub ch, byte [esp + eax - 0xfffffc]
dec esp
adc ecx, edi
dec esp
xchg ebp, esi
dec edi
mov dword [eax + ebp - 0xfffff7], ecx
dec edi
lea ebp, [ebp + eax - 0xfffff7]
shl cx, cl
je 0xa33b75
dec edx
mov dword [esp + eax*2 - 0x2000006], ebx
ret 8
Function at 0xc9a4d4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push esi
mov esi, 0
neg bl
setbe dl
mov dword [esp + ebx - 0xff05], esi
and edi, ebx
adc ebp, esi
push ebx
sar di, 0xab
movzx ebx, di
js 0x92c041
cdq
xor ecx, ebx
div ax
rol eax, 0x37
lea ecx, [eax + ecx + 0x474be30b]
not edx
ror ecx, 2
cdq
dec edx
sar eax, 0x87
xor ecx, 0xb96339
or al, dh
shr eax, 0x4e
sal edx, 0xca
ror ecx, 1
xor ax, 0x3b2a
not ecx
ror dx, 0xe4
xor ebx, ecx
inc ax
shl eax, 0xc5
cdq
adc esi, ecx
movzx ecx, ax
rol al, 0xa7
inc edx
mov dx, word [eax + edi - 0x76600]
push eax
sub ecx, eax
lea ecx, [ecx + ecx*4 + 0x1f38e5a4]
mov cx, word [edi + eax*2 - 0xecbfe]
shr al, 5
dec ax
sar ax, 0xc1
lea edi, [eax + edi - 0x732fd]
setbe al
add dx, cx
movsx ecx, ax
mov word [edi + eax*4 - 0x1cc804], dx
add ecx, 0xf20eae26
sub word [esp + eax*4 - 0x1cc803], cx
mov dword [esp + eax - 0x73201], esi
ret
pushfd
movzx edi, dx
dec edx
push ebp
lea ebp, [edi*8 - 0x71e910ec]
mov ebp, dword [esp + edi - 0x94e0]
xor dx, di
sbb edi, edi
inc ebp
rol dl, 0x41
dec dl
jle 0x973d94
not ebp
setg dl
dec edx
not dl
lea ebp, [ebp + edx*2 - 0x18c33656]
dec dx
inc dx
or edi, edi
ror ebp, 3
btc edi, 0x9d
shr edx, 0x47
dec ebp
lea edx, [edi + edx*2 + 0x78983da3]
push edx
sar dword [esp + edi - 0x20000000], 0xe9
mov dword [esp + edi - 0x1fffffe8], eax
pop edi
jbe 0x937c3f
lea edx, [edx*4 - 0x3e46f17c]
mov dword [esp + edx - 0x49e794f8], edi
jmp 0xa39341

Function at 0xc9aea4
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
dec eax
ror esi, 7
inc esp
xor dword [esp + edx*4 + 0x10], eax
dec esi
mov ebx, dword [esp + esi*2 - 0x5ffffff0]
inc dx
inc dword [esp + esi*2 - 0x5ffffff8]
push ecx
inc esp
movzx ecx, si
dec ebp
arpl ax, ax
dec ecx
add ebx, eax
inc cx
shl edi, 0x8b
dec ebx
mov ebp, dword [esi + ebp - 0x30000008]
inc ebx
or dl, byte [esi + edx - 0x30000006]
inc esp
add bh, dh
sar esi, 0xb0
dec eax
mov dword [esp + esi + 8], 0x6f0221b3
inc ecx
xor dl, bl
inc dx
xchg dword [esp + esi*2 - 0x5fffffeb], esi
rol dl, 1
inc cx
bt ecx, edi
xor dl, 0xb9
jmp 0xde18d6