joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbf8c32
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
xor ebx, ecx
pop eax
shl dx, 0xe2
jne 0xc019f4
lea ecx, [eax + ecx - 0x511c883a]
sal al, 0x21
and ax, 0xf125
not dx
not ecx
lea edx, [eax*4 - 0x37465a62]
rol al, 0xa7
add eax, edx
xor ebx, ecx
and dl, dh
shr edx, 0xb4
jne 0xc50cd7
adc edi, ecx
mov edx, dword [esi - 4]
call fcn.007bfbcf
not dl
xor dl, 0x26
neg dl
inc dl
mov byte [esp + 6], 0xac
xor bl, dl
lea edx, [esp + edx + 8]
sal word [esp + 6], 0xa6
pop ecx
mov dword [edx], eax
pop edx
jmp esi
add edi, ecx
lea ecx, [eax*2 - 0x143105e]
xchg cl, dl
rol eax, 0xe
jmp edi

Function at 0xc00141
Capabilities:
Encode data using xor

Disassembly:
push eax
xor byte [esp + 5], 0x25
adc esi, ecx
movzx eax, byte [ebp]
sal edx, 0xa3
adc ebp, 1
xor al, bl
shl edx, 0x65
shl edx, 0x21
inc al
pop edx
rol edx, 0x37
sar dx, 0x67
rol al, 1
pop edx
xadd dl, dh
call fcn.00be0680
inc edx
xor dword [esp + eax - 0xfec0], edi
dec esi
mov ebp, dword [esp + eax - 0xfec0]
call fcn.0071ac0f
neg cl
add cl, 0xaa
xor al, 0x3d
mov dword [esp + edx + 4], 0xfd3929b1
or dl, al
ror cl, 1
pop edx
inc cl
xor bl, cl
pop edx
lea ecx, [esp + ecx + 4]
movzx dx, byte [ecx + eax - 0x9007]
lea ecx, [eax + eax*2 - 0x11eff262]
lea ebp, [ebp + eax*2 - 0x12010]
mov word [ebp + eax*8 - 0x48038], dx
call fcn.00c16262
xor ecx, ebx
neg byte [esp]
jge 0xc4255d
inc ecx
rol byte [esp + 1], 0xa7
and dword [esp], 0x2b19103b
not ecx
ror ecx, 3
mov dword [esp + 4], 0xf6a3110c
mov eax, dword [esp + 3]
bswap ecx
not word [esp + 3]
pop edx
sar eax, 0x66
xor ebx, ecx
jmp 0x70a2a4

Function at 0xc06b5e
Capabilities:
Encrypt data using speck

Disassembly:
mov esi, dword [esp + edi - 0x6696cc9f]
mov edx, dword [esp + eax - 0x6696cc9b]
mov dword [esp + edi - 0x6696cca3], eax
mov ecx, dword [esp + edi - 0x6696cc97]
mov eax, dword [esp + edi - 0x6696cc93]
call fcn.00ba1917

Function at 0xc0e18d
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [ecx + edi - 0x2db1d]
push eax
not dl
setl al
neg dword [esp + 3]
not cl
sbb byte [esp + 5], ah
or dl, cl
mov word [edi + 2], dx
lea edx, [edi + 2]
call fcn.00c723fb
dec edx
xor ebx, edx
xor eax, 0x86950b39
adc esi, edx
mov dword [esp + ecx*2 - 0x5b63e], eax
or eax, dword [esp + ecx*2 - 0x5b63e]
js 0xc3bfc7
movzx dx, byte [ecx + edi - 0x2db1f]
or dword [esp + ecx*2 - 0x5b63e], 0xaa1dc302
jle 0xb70af5
not eax
call fcn.00c2573f
mov edx, dword [esi + eax - 0x38897628]
xor cl, al
xor edx, ebx
not eax
bswap edx
add ecx, eax
call fcn.007167b7
add esi, edx
neg ax
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
adc dword [esp + 4], 0x12b12bab
mul ecx
mov dword [ebp], edx
mov dword [ebp + 4], eax
mov ecx, 0x50b4ff2f
jmp 0xba5a04

Function at 0xc17d9c
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
ror ecx, 1
xor ebx, ecx
add edi, ecx
shr eax, 0x85
call fcn.00c6159d

Function at 0xc1a298
Capabilities:
Encrypt data using speck

Disassembly:
add cl, dh
inc al
xor al, 0xa4
inc al
xor al, 0xb2
push ecx
not al
mov dword [esp + ecx - 0x38000025], 0x7626ffb3
jmp 0xcecfa8
Function at 0xc1c818
Capabilities:
Encrypt data using speck

Disassembly:
add dword [esp + ecx - 0x7141e98c], 0xf43bdcb8
mov eax, dword [ebp + ecx - 0x7141e989]
call fcn.00bec0ca
sub ebp, 4
mov ecx, 0xaa8d74a7
movzx edx, cl
mov ecx, dword [ebp + edx*2 - 0x14e]
push edx
xor ecx, ebx
lea eax, [edx*8 + 0x2f82a92e]
ror ecx, 1
dec ecx
not ecx
or ax, 0x8aaf
bswap eax
jl 0xb8b316
xor ecx, ebx
inc ecx
jmp 0x866b51
ror ecx, 1
and edx, dword [esp + edx - 0xa7]
call fcn.00c2c1d5
mov dword [esp + edx - 0x475f8b39], 0xb7bde120
and edx, dword [esp + edx - 0x475f8b39]
inc eax
neg cx
xor ebx, eax
not ecx
add esi, eax
push ecx
sub dx, cx
mov edx, dword [ecx + ebp - 0x7141e98d]
jbe 0x8788a0

Function at 0xc1d69e
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0x35915e89
xor cl, ch
jl 0xb5ca7f
inc word [esp + ecx - 0x5a6c60ba]
xor bx, ax
call fcn.00c316c2
inc edx
jmp 0x8087fc
xor ebx, edx
call fcn.007fcf3a
xor dl, 0x36
sub dl, 0x88
push eax
dec ax
sub al, 0x28
not dl
not eax
xor bl, dl
lea edx, [esp + edx + 0x14]
mov byte [edx + eax*2 - 0x1d65e], cl
lea ebp, [eax + ebp - 0xeb33]
call fcn.00bf9efd
mov dword [esp], 0x9a7e93c
ror dx, 1
movsx eax, cl
inc dx
mov dword [esp + eax*2 - 0x98], ecx
not dx
push eax
inc eax
ror cl, 0x43
sub dx, 0x917
jmp 0xc7dde6
xadd byte [esp + eax*2 - 0x9c], cl
xor bx, dx
and al, byte [esp + eax*8 - 0x26f]
mov word [ebp + eax - 0x4a], dx
sete cl
shl dword [esp + eax*4 - 0x11e], 0x23
or cl, 0xb
mov edx, dword [esi + eax - 0x4e]
xor edx, ebx
sal ax, cl
not ecx
dec ax
inc edx
and word [esp + ecx*2 - 0x16fe2], ax
seta cl
ror edx, 3
jmp 0xb1bee6

Function at 0xc2a310
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
not cl
call fcn.00c7ac61
mov edx, 0x9b9bfe1e
mov eax, dword [ebp]
movzx ecx, dl
push edx
lea ebp, [ebp + ecx - 0x1a]
inc ecx
neg cl
xor eax, ebx
neg eax
push edx
xor eax, 0xc0032934
lea ecx, [edx + ecx - 0xe72bc4d]
shl dword [esp + 4], cl
inc eax
push edx
sar byte [esp + 6], 0xc4
neg eax
not eax
jmp 0xc8aa0f
xor ebx, eax
add esi, eax
xadd word [esp + 9], cx
jp 0xcc12a3
mov edx, dword [edi]
movzx eax, byte [esp + 3]
pop ecx
mov ax, word [edx + eax*2 - 0x136]
lea edx, [ecx + ecx*4 - 0x6ae13bf1]
adc edi, 2
xor edx, edx
shr dword [esp + edx*4 + 1], cl
mov word [edx + edi], ax
sar byte [esp + edx*8 + 1], 0x84
sal byte [esp + edx*2 + 5], 0x87
call fcn.00beeebf
inc ebp
xor edi, ebp
inc esp
mov edx, ebx
dec eax
shr dword [esp + edi - 0xf6a5], cl
inc ecx
bswap edi
rol eax, cl
dec eax
xadd edi, ecx
inc esp
movzx esp, word [esp + ecx - 0xf6a9]
inc ebp
lea edi, [edi + ebx + 0x5a2c8b7b]
mov word [esp + ecx - 0xf6a6], 0x969d
inc ecx
ror edi, 3
dec eax
mov dword [esp + ecx*4 - 0x3dae4], 0xbb86f13f
add dword [esp + ecx*2 - 0x1ed66], 0x68bc0be
inc ecx
inc edi
dec esp
mov dword [esp + ecx*2 - 0x1ed5e], ebp
pop ebx
dec eax
add ebx, 0x1b8952
jmp ebx

Function at 0xc2ab67
Capabilities:
Encrypt data using speck

Disassembly:
not ecx
xor ebx, eax
add edi, eax
call fcn.00759569
Function at 0xc2bb74
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ecx, ebx
inc dword [esp]
call fcn.00c926f3
pop ecx
mov dword [eax], edx
mov edx, dword [esi + 4]
rol byte [esp + 3], 0x24
mov eax, dword [esp]
lea esi, [esi + eax*8 - 0x7f0]
adc eax, dword [esp + eax - 0xff]
xadd al, ah
lea ecx, [esp + eax*8 - 0x7f794]
setbe byte [esp + eax*8 - 0x7f7f8]
ror eax, 0x81
mov dword [ecx], edx
dec dword [esp]
mov ecx, dword [ebp + 1]
xadd dword [esp], eax
sal byte [esp + 2], 0x85
sbb ebp, 0xfffffffb
shr al, 0xc7
jbe 0xbf0396
mov edx, dword [ebp + 4]
mov eax, 0x108fca89
lea ebp, [ebp + eax*2 - 0x211f950a]
shr ax, 0x81
shl al, 0xa2
mov dword [ecx + eax - 0x108f6510], edx
movsx edx, ax
or dx, dx
or edx, edx
lea esi, [esi + eax*2 - 0x211eca24]
mov eax, dword [esi + edx*2 - 0xca20]
setg dl
mov ecx, edx
sal ecx, 4
xor eax, ebx
push edx
call fcn.0080109e
xor edx, ebx
mov eax, ecx
add ax, ax
neg edx
shr cx, 0xc1
neg eax
dec edx
call fcn.00cf037e

Function at 0xc359da
Capabilities:
Encrypt data using speck

Disassembly:
mov si, word [esi + ecx*2 - 0x29189e02]
xor dword [esp + ecx - 0x148c4efd], edx
pop ecx
pop ecx
jp fcn.0074a1b4

Function at 0xc3f980
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [ecx + ecx - 0x6e4f3e44]
or cx, cx
mov dword [esi + 4], edx
sbb esi, 0xfffffffc
movzx edx, byte [esp]
inc dword [esp + edx - 0xbd]
call fcn.00843bc6
ror ax, 0x29
not edx
shr cl, 4
ror edx, 1
ror eax, 0x24
rol cl, 1
xor ebx, edx
call fcn.00bdedb8
xor ebx, eax
inc ecx
add edi, eax
lea eax, [edx*4 + 0x7d947f0b]
xor cl, ah
xor ax, 0xfcb6
adc edx, dword [esi + edx*4]
push eax
sal cl, 3
mov eax, dword [eax + esi - 0x7d9483b9]
not edx
not eax
adc byte [esp + 3], ch
jne 0xc656ef
or edx, eax
jmp 0xba808a

Function at 0xc45e39
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0xb88331
xor ebx, edx
jmp 0x79f200
push eax
add edi, edx
push ecx
mov eax, dword [ebp + ecx - 0x5d45f08f]
not byte [esp + ecx - 0x5d45f083]
sar cx, 0x81
dec word [esp + ecx - 0x5d45f839]
lea ebp, [ebp + ecx - 0x5d45f843]
xor eax, ebx
lea ecx, [ecx + ecx*4 - 0x347d9d75]
movsx edx, cx
call fcn.00bd829d
mov edx, 0x783f373c
movzx ecx, dx
mov eax, dword [edx + edi - 0x783f373c]
xadd ecx, edx
shl ecx, 0xfa
mov ecx, dword [edi + edx - 0x3738]
bswap edx
not eax
jne 0xb5caf5
inc bp
movzx edx, dl
inc cx
shr eax, 0x46
inc ecx
adc bl, al
mov cl, byte [esi + eax - 0xa200]
inc esp
xor byte [esp + eax*4 - 0x28800], al
inc ecx
shr dl, cl
inc sp
mov dword [eax + esi - 0xa200], edx
jmp 0xce985d
push ecx
lea edx, [ecx + edx - 0x5d08fd58]
lea eax, [ecx*2 + 0x8341711]
mov dword [esp + ecx - 0x5d45f08b], ecx
xor edx, 0x509d9405
sub word [esp + ecx - 0x5d45f08e], cx
shl eax, cl
js 0xb32e54
dec esi
lea edx, [ebx + eax*8 + 0x65275328]
not word [esp + eax - 0xa1f5]
mov bx, word [eax + esi - 0xa200]
or al, 0x12
jns 0xbc9727
sysenter
call fcn.0076978d
jmp 0xc76077

Function at 0xc47ed0
Capabilities:
Encrypt data using speck

Disassembly:
not cx
not edx
xor ax, ax
add dword [esp + ecx - 0x5821ab9], 0x35b2ee22
dec word [esp + ecx - 0x5821ac9]
inc edx
call fcn.00b315e6
neg eax
xadd edx, ecx
call fcn.00cf58b0
Function at 0xc49a5f
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00bdb23e
mov eax, 0xbe376e06
movzx ecx, ax
mov edi, dword [esi + ecx*8 - 0x3702c]
jmp 0xb07a04
dec eax
jmp 0x86797b

Function at 0xc54bf1
Capabilities:
Encrypt data using speck

Disassembly:
mov dl, byte [ecx + esi - 0x699d]
mov al, byte [esi + ecx*2 - 0xd338]
xor cx, 0x920c
lea esi, [esi + ecx - 0xfb8f]
push ecx
adc cl, 0x82
not ecx
or dl, al
movzx eax, cx
neg word [esp + eax*4 - 0x13ae]
not dl
mov word [esi + eax*8 - 0x2760], dx
call fcn.00bf218b
sub eax, eax
not edx
and eax, 0x7997b9b3
and al, al
shr eax, 0xbc
or ecx, edx
mov edx, eax
mov dword [eax + edi], ecx
movzx ecx, dl
call fcn.00b40553
lea eax, [ecx + eax - 0x1d3aff54]
xor ebx, eax
movzx edx, cl
inc dl
add edi, eax
jmp 0x755734
mov edx, esi
lea esi, [esi + eax - 0x5476]
shl word [esp + eax*2 - 0xa8e2], 0xc5
mov dword [eax + esi - 0x5472], edx
mov dword [esp + eax*4 - 0x151c4], eax
pop ecx
pop ecx
jne fcn.007f2bf4
not ecx
mov eax, 0x7b4e01f
jmp 0x843b62
xor eax, ebx
sub eax, 0xe3b6a0a9
neg eax
mov edx, 0x87a3548e
bswap eax
mov dword [esp], edx
sub eax, 0xc618e324
xor eax, 0x52a52735
movsx ecx, byte [esp]
xor ebx, eax
add edi, eax
movzx eax, dx
neg al
jne 0xbf9e11
syscall
call fcn.00b0cb90

Function at 0xc54d5f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [ebp + eax*2 - 4], edx
mov eax, dword [ebp + eax*2 - 4]
add ebp, 6
movzx ecx, byte [esi - 5]
mov edx, 0x2e97e732
lea esi, [esi + edx*2 - 0x5d2fce69]
add edx, 0xb0114399
and edx, 0x21387512
add edx, edx
xor cl, bl
sal dx, 0xf
jae 0x84f4d5
dec eax
inc edx
add cl, 0xad
neg eax
mov dword [esp], 0xafb725a6
inc dl
ror eax, 1
add edx, dword [esp]
xor ebx, eax
ror dx, cl
adc edi, eax
rol cl, 0x67
movzx ecx, byte [ebp - 5]
and dword [esp], edx
jnp 0xc5b136
not edx
xor edx, 0x9797fa16
add byte [esp + ecx - 0x9be2b29], ch
lea eax, [ecx*2 + 0x61d090a]
rol edx, 1
not edx
xor ebx, edx
not cx
add edi, edx
sar ecx, cl
sar eax, cl
mov edx, dword [ebp + ecx*2 - 0x136]
mov cl, byte [ebp + ecx*4 - 0x268]
shr edx, cl
jmp 0xc106a8

Function at 0xc5b122
Capabilities:
Encrypt data using speck

Disassembly:
shr dword [esp + edx*2 - 0x737dfe3c], 0xe
or cl, al
ror dword [esp + edx - 0x39beff1e], 0x7d
not cl
jae 0xc61bd3
mov dword [esp], edx
ror al, 1
add byte [esp + 1], dl
sbb al, 0x94
rol word [esp], cl
call fcn.00c22e52
sbb ebp, 5
lea edx, [edx*8 - 0x767770ea]
mov eax, 0xf30029ac
xor cl, bl
and byte [esp + 2], dl
shr dl, 0xc1
dec cl
neg dword [esp]
or ax, word [esp + 1]
and edx, eax
xor cl, 0x23
sal eax, 0x14
sbb cl, 0x31
ror cl, 1
dec cl
push edx
xor bl, cl
mov dword [esp + 4], eax
shr word [esp + 1], 0xf
sbb dword [esp + 4], eax
lea ecx, [esp + ecx + 8]
rol dword [esp + 4], 0xbc
neg dl
add al, byte [ecx]
mov cx, ax
pop eax
movzx cx, cl
bswap edx
dec edx
neg edx
mov al, byte [esi + edx*2 - 0x737dfe3c]
jb 0xc58706
mov eax, 0x211a9a6
movzx dx, byte [edi + eax*4 - 0x846a698]
movzx ecx, al
ror eax, cl
mov al, byte [ecx + edi - 0xa4]
add dl, al
movzx eax, cx
mov word [edi + ecx*2 - 0x14a], dx
mov eax, dword [ebp + ecx - 0xa6]
and cl, ch
xor eax, ebx
ror eax, 1
call fcn.00b90810
Function at 0xc5d6a7
Capabilities:
Encode data using xor

Disassembly:
push 0xeeb619a2
mov eax, dword [ebp]
lea esp, [esp + 0xc]
call eax
mov ebx, 0xf719512e
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
lea eax, [ebx*2 - 0x2fd1c4d6]
call fcn.00c1f497
mov ecx, 0xe79267bf
sub esi, 4
movsx eax, cl
call fcn.00c29ddf

Function at 0xc60c38
Capabilities:
Execute syscall

Disassembly:
mov ecx, dword [edi]
mov dword [esp], 0x283f321
mov al, byte [edi + 4]
add edi, 6
mov byte es:[ecx], al
mov ecx, dword [ebp]
add ebp, 4
call fcn.00b18c3a

Function at 0xc60c5c
Capabilities:
Execute syscall

Disassembly:
sub eax, 0xe4256d94
inc dx
call fcn.00bf6f01
lea edx, [edx + eax - 0x7615ee6c]
xchg ecx, eax
setae al
not edx
dec al
neg edx
call fcn.00cb15e2
sysenter
push ebx
push edx
mov dword [esp + 4], 0x7d0f9881
lea esp, [esp + 4]
call fcn.00bfae9a
push 0xff319ba6
add edi, 2
mov ecx, 0x7297bc94
neg cx
add al, dl
shr ecx, 0x69
mov word [edi + ecx*2 - 0x729742], ax
mov dword [esp + ecx - 0x394ba1], esi
ret

Function at 0xc61b86
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, edx
add edi, edx
inc word [esp + eax - 0x78ffff4b]
shr word [esp + eax - 0x78ffff4c], 0xe1
shr ax, 0xa3
mov dx, word [ebp + eax - 0x78ff1fe9]
mov cl, byte [ebp + eax - 0x78ff1fe7]
jbe 0xbf63fa
movsx edx, cl
lea esi, [ecx + esi - 0x32004021]
xor ax, bx
xchg dword [esp + 0x18], edx
add edx, 0xffead366
jmp edx
mov dword [esp + edx - 0x39beff1e], edi
ret
lea ebp, [ebp + eax - 0x78ff1fe7]
shl dx, cl
dec eax
shl ax, 0x89
mov word [eax + ebp - 0x78ffd000], dx
sub byte [esp + eax - 0x78ffcffe], ah
mov dword [esp + eax - 0x78ffd000], edi
ret
bswap edx
inc ecx
mov dword [esp], ecx
ror edx, 2
ror eax, cl
shl byte [esp + eax - 0x78ffff4a], 0x87
not edx
jae 0x76cc9e
call fcn.007c3c3e
bswap edx
lea ecx, [ecx + ecx*2 - 0x2466c6f6]
sub eax, eax
jno 0xca3ad5
and edx, edx
inc ecx
pop edx
sal dl, 0x85
and eax, edx
rol ecx, 3
not edx
add edx, edx
neg ecx
xor ax, dx
xor ebx, ecx
call fcn.0085c031
mov word [esi + edx - 0x39beff1e], cx
neg byte [esp + edx - 0x39beff1c]
add word [esp + edx*2 - 0x737dfe3b], dx
jno 0x7eb341
not edx
ror eax, cl
xchg ecx, eax
sal cl, 0x81
inc edx
xor ebx, edx
add edi, edx
dec cx
jmp edi

Function at 0xc624b4
Capabilities:
Encode data using xor

Disassembly:
not edx
mov dword [esp + eax*4 + 0x67fffd44], 0x7d17e4ab
pop eax
or cl, 0x1b
xor ebx, edx
jmp 0xc370e5

Function at 0xc635eb
Capabilities:
Encode data using xor

Disassembly:
dec edx
ror eax, 3
neg eax
lea ecx, [edx*8 + 0x61360813]
add cx, cx
xor eax, 0x679f8819
not eax
call fcn.00bbf23d

Function at 0xc76e88
Capabilities:
Encrypt data using speck

Disassembly:
neg eax
inc byte [esp + ecx - 0x7593831d]
sub eax, 0x6030adb9
sub cx, word [esp + ecx - 0x7593831c]
pop ecx
ror eax, 1
xor dword [esp], edx
xor ebx, eax
jmp 0x76643d
Function at 0xc831fd
Capabilities:
Encrypt data using speck

Disassembly:
inc ebx
mov edx, dword [eax + ebx - 0x6d0dd06]
mov edi, 0x1ba91eb7
dec ecx
shl edx, cl
inc ecx
xor edx, ebp
dec ecx
sar esp, cl
inc ecx
push esp
bswap edx
dec esp
and edx, edi
xor edx, 0xfb9065b4
dec edx
xchg dword [esp + eax*2 - 0xda1ba0c], ebp
inc ecx
lea edx, [eax + edx + 0x7dede198]
bswap edx
dec esi
mov dword [esp + eax*4 - 0x1b437418], ebp
dec esi
lea ebp, [ecx*8 - 0x7dcc304e]
jmp 0xcb7b30
push edx
not ecx
ror ecx, 2
shl al, 0x81
sar edx, 0x2a
call fcn.00bf73e7
mov eax, 0xc23ebc04
ror al, 0x41
mov eax, dword [ebp]
mov edx, 0xda1ce21a
adc ebp, 4
sar dl, 0xa6
sbb esi, 1
call fcn.00cc54d2
dec edx
mov ebx, dword [esp + ebx*8 - 0x34468]
pop edx
dec esi
xchg dword [esp + ebx - 0x6884], ebx
dec esi
mov edx, dword [esp + ebx*2 - 0xf0]
call fcn.00844043
mov ecx, 0x91ad9184
mov eax, 0x54b1e80a
mov ecx, dword [eax + ebp - 0x54b1e80a]
and eax, 0xd0805b0a
jp 0xce28c0
lea ebp, [ebp + eax - 0x50804806]
movsx edx, al
xor ecx, ebx
inc eax
rol dl, 0xc2
lea eax, [eax + 0x10beb435]
dec ecx
bswap ecx
rol ax, 0x48
jae 0xbf7a59
jne 0x816f44

Function at 0xc87f25
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
jmp 0xcbe4cf
dec cl
not cl
or dx, ax
dec cl
pop edx
mov edx, 0x5025219a
not cl
lea edx, [eax + eax*8 + 0x7e105f39]
xor bl, cl
sub edx, eax
pop eax
add ecx, esp
movzx dx, byte [ecx]
mov word [ebp - 4], dx
mov edx, dword [esi - 7]
neg eax
xor edx, ebx
jmp 0xc3fb90

Function at 0xc8aa1f
Capabilities:
Encrypt data using speck

Disassembly:
sar ecx, 0x50
xadd byte [esp + eax - 0xf3], al
lea edx, [esp + edx + 0x14]
push ecx
mov dword [esp + eax - 0x2b], eax
rol ecx, 0x2f
mov eax, dword [eax + edx - 0x2f]
lea edx, [ecx + ecx - 0x775366d3]
or ecx, 0xf683bc80
mov dword [edi - 8], eax
rol dword [esp + 6], 0x73
ror word [esp + 6], 0x67
add dx, 0x4da5
mov ecx, dword [ebp + 5]
movzx eax, dl
inc dword [esp + eax*2 - 0x199]
lea ebp, [ebp + eax*4 - 0x33f]
xchg dword [esp + eax*4 - 0x347], edx
sal al, 0x65
xor ecx, ebx
push edx
shl edx, 0x56
dec byte [esp + edx + 0x11]
bswap ecx
inc edx
sbb ecx, edx
and dl, 0xf
adc eax, dword [esp + edx + 0xd]
bswap ecx
sar dx, 0x26
js 0x716534
not ecx
xadd eax, edx
sbb dword [esp + edx*2 - 0xf00270], eax
xor ebx, ecx
ror eax, 0x9a
shr eax, 0xcd
add esi, ecx
mov ecx, edx
mov edx, dword [edi + edx - 0x780148]
shl eax, 0x45
sar al, 0xc2
mov eax, dword [edi + eax - 0x1e0014]
adc edx, eax
sal cx, 0xc6
xadd dword [esp + ecx - 0x784fec], ecx
sar dword [esp + 0x10], cl
mov dword [edi - 4], edx
cmovae ecx, dword [esp + 0x12]
mov edx, 0x7fb60015
lea edi, [edi + edx - 0x7fb60019]
movzx eax, dx
shr word [esp + edx - 0x7fb60013], cl
xchg edx, ecx
pop ecx
pop eax
pop edx
pop ecx
pop eax
pop eax
pop edx
jns fcn.00beeec5

Function at 0xc8e81d
Capabilities:
Authenticate hmac

Disassembly:
lea ebp, [ecx + ebp - 4]
movzx edx, cl
sar dword [esp + ecx*2], 0xcf
add eax, dword [esp + ecx]
add edx, dword [ebp + ecx*4]
inc eax
xor eax, 0x7c361113
xor edx, ebx
push eax
call fcn.0076a211
or dx, word [edx + eax - 0xa400000]
add edi, 2
mov dword [esp], ecx
movzx eax, word [esp]
xor ax, cx
mov word [edi + eax], dx
xchg ecx, eax
jae 0xb27c52
Function at 0xc9143b
Capabilities:
Encrypt data using speck

Disassembly:
not dx
sub al, 0x9f
call fcn.00c0b127
shr edx, cl
mov eax, 0x5a8458af
jmp 0xce0f2d
sal eax, 0x69
mov dword [edi + eax*8 - 0x458af000], edx
and eax, eax
mov eax, dword [ebp + eax - 0x8b15e00]
mov edx, 0xd612ce07
lea ecx, [edx + edx - 0x4fb90f2]
jne 0xbf2cd6

Function at 0xc91d03
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + ecx*8 - 8], esi
ret
add esi, eax
mov dx, word [edi + edx - 0x66606a40]
xor dword [esp + ecx*2 - 0x1c934], 0xf0a8f69a
mov cl, byte [edi + ecx*2 - 0x1c932]
mov eax, 0x98884a22
or eax, eax
adc edi, 2
ror dword [esp], 0x1e
sub ax, 0x3f2c
shr dx, cl
mov ecx, eax
sub ecx, ecx
inc cx
mov word [edi + ecx*4 - 4], dx
shr al, cl
jae 0x81d97a
test cx, sp
bswap eax
pop ecx
movzx ecx, word [esp + edx - 0x66606a40]
neg eax
sal cl, 0xc2
xchg ch, cl
xor ebx, eax
neg dword [esp + edx - 0x66606a40]
jg 0xb26957

Function at 0xc942fa
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor eax, ebx
sub eax, 0x2c320423
mov dword [esp + edx - 0x7f21a101], edx
xor eax, 0x1b2c610f
add ecx, 0xe5146c02
sal byte [esp + edx - 0x7f21a0fe], cl
inc eax
bswap eax
neg edx
ror dword [esp], cl
sar word [esp + 1], 0x4a
xor ebx, eax
shr dword [esp], cl
not cl
adc edi, eax
sar ecx, cl
inc ecx
xor cx, word [esp + 1]
pop edx
jne fcn.0074a1b4
mov al, byte [0x170031b5]
out dx, eax
pushal
shr byte [ebp + 0x5f], 0x4f
xchg dword [eax - 0x40], esp
insd dword es:[edi], dx
invalid
lea ebp, [edx + ebp - 0x7f21a0fd]
jb 0xb4d1ce

Function at 0xca2fae
Capabilities:
Encrypt data using speck

Disassembly:
rol cx, 1
neg cx
pop edx
neg eax
mov edx, eax
xor bx, cx
mov word [eax + esi + 2], cx
movsx ecx, dl
dec cl
lea esi, [esi + eax + 2]
bswap edx
call fcn.00b756f4

Function at 0xcab491
Capabilities:
Encrypt data using speck

Disassembly:
mov cx, word [ebp + 4]
mov edx, 0x9633c621
lea edx, [edx + edx*2 - 0x19408f4d]
add ebp, 6
xadd dl, dh
mov word ss:[eax], cx
mov ecx, edx
and ecx, edx
lea edx, [edx + edx + 0x69b45a9f]
jmp edi
ja 0xbaad20
xor ebx, edx
jmp 0xccdbc1
inc al
and cx, dx
jae 0xbbe253
mov edx, dword [ebp + edx - 0x109fffb]
shr ecx, cl
bswap ecx
call fcn.007bc540
lea esi, [esi + ecx - 0xf000006]
movsx edx, cx
and dx, 0x521e
shl edx, 0xe
xor al, bl
add ecx, ecx
mov dword [esp + ecx - 0x1dfffffc], 0x5d13ca8c
dec al
not al
xadd cx, dx
pop edx
neg al
movzx edx, cl
inc edx
add al, dl
or dx, word [esp + ecx*2 - 0x3bffffff]
pop ecx
rol ecx, 0x96
xor al, 0xa4
jmp 0xc77596
add edi, edx
mov eax, dword [ebp]
jmp 0x877ba9

Function at 0xcb7b01
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
sal esp, 0x27
lea edx, [edx + ebp*4 + 0x6253ed42]
call fcn.00823b42

Function at 0xcb7b11
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
pop ebp
call fcn.00b650b1
movsx eax, cx
mov dword [ebp - 6], edx
movsx edx, word [esp + 0xa]
sub ebp, 6
add ecx, 0xb4bd38a9
pop edx
pop eax
pop eax
pop eax
jnp fcn.00c6975d
inc cx
shl ebp, 0x47
inc edx
xor dword [esp + eax*2 - 0xda1ba0c], edx
jmp 0x7b110a
Function at 0xcc1bc3
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea eax, [esp + eax + 0x18]
mov eax, ecx
dec edx
lea ebx, [ecx*8 - 0x74ca4c64]
dec ebx
mov ebp, dword [ecx + eax - 8]
dec eax
shr dword [esp + edx*2 + 0x10], 0x9e
push ecx
dec esp
mov ecx, ebp
je 0x84fc90

Function at 0xcce94c
Capabilities:
Get number of processors

Disassembly:
bswap ecx
sub ecx, 0x2cbc323e
inc edx
lea edx, [edx + edx - 0x74cb96dc]
bswap ecx
setnp al
jl 0xbf469b
xor cl, bl
jmp 0xc5ce7a
xor ebx, ecx
add esi, ecx
movzx ecx, byte [edi + edx*2 - 0x5897ad24]
lea edi, [edx + edi - 0x2c4bd691]
not eax
sub eax, eax
jae 0xbeb4f1
call fcn.00b16e9c
xor ecx, ebx
not ecx
call fcn.007ffa48
and dword [esp + 4], eax
neg dl
mov dword [esp + 8], eax
push eax
mov dword [esp + 4], 0x7da89a20
add dl, 0xbc
not dl
push eax
xor bl, dl
neg eax
mov dword [esp + eax*4 - 0x4f0516ec], edi
call fcn.00c285ac
mov edx, 0xd08bb620
mov ecx, 0x408abea9
mov ecx, dword [edi + ecx - 0x408abea9]
mov eax, edx
add edi, 4
xor ecx, ebx
and dx, dx
not ecx
sub al, dh
sub dl, al
jnp 0x775e4f
dec ebp
xor ebp, edi
inc ecx
mov eax, esp
inc esp
movsx eax, dx
pop ebp
dec eax
add ebp, 0x49b0af
jmp ebp

Function at 0xcd3acb
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.00bda146
mov dword [esp], 0x100fb338
movzx eax, byte [esp]
xor dl, 0x39
xchg word [esp + eax*2 - 0x6e], ax
xor bl, dl
sub eax, ecx
neg byte [esp + eax*2 - 0x7666ef3c]
lea edx, [esp + edx + 4]
sbb ecx, ecx
sal word [esp + eax*2 - 0x7666ef3c], 0x6b
movzx cx, byte [eax + edx - 0x3b33779e]
setae al
and dword [esp + eax - 0x3b337701], eax
lea esi, [eax + esi - 0x3b337703]
shl eax, 0xfd
push eax
mov word [esi + eax*4 - 0x80000000], cx
not eax
movsx edx, ax
xor edx, dword [esp + 4]
mov ecx, dword [ebp]
jle 0xc503bb

Function at 0xcd3b31
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
adc word [esp + ecx + 2], dx
mov word [ebp + ecx*4], ax
mov dword [esp + ecx], edi
ret
mov edx, dword [eax + ebp]
mov ecx, eax
mov dword [esp + eax], 0xbe9677be
xor al, byte ss:[eax + edx]
mov edx, ecx
sar dl, 0x21
neg dword [esp + ecx]
lea ebp, [ebp + ecx + 2]
xchg dx, cx
jbe 0xc49f03
xor ebx, ecx
sal ax, 2
or dl, al
xchg edx, eax
adc esi, ecx
movzx ecx, ax
call fcn.008562bd

Function at 0xcd3b69
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor dl, byte [esp + edx*2 - 0x22fbef42]
xor bx, ax
lea ebp, [ebp + ecx*2 - 0x57fa9c30]
neg dword [esp + ecx*2 - 0x57fa9c27]
mov word [ecx + ebp - 0x2bfd4e17], ax
mov eax, dword [ecx + edi - 0x2bfd4e17]
lea edi, [edi + ecx*2 - 0x57fa9c2a]
ja 0x79cead
xor eax, ebx
pop edx
ror eax, 3
lea edx, [ecx + ecx*2 - 0x7c574a6c]
dec eax
inc dword [esp + ecx - 0x2bfd4e14]
neg dword [esp + edx - 0x7a09fd8]
not eax
dec cl
inc eax
dec dword [esp + ecx*2 - 0x57fa9c2c]
inc ecx
neg eax
bswap eax
or dword [esp + ecx - 0x2bfd4e13], edx
xor ebx, eax
call int.00c438a9
dec ebp
arpl dx, dx
inc edx
mov ebp, dword [esp - 0x11a3b01]
dec ebp
add esi, edx
inc ecx
pop ecx
pop eax
jmp fcn.007a084f