joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf485bd
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
movzx eax, bh
bswap ebp
call fcn.00ef561d

Function at 0xf48cb8
Capabilities:
Encrypt data using speck

Disassembly:
mov ebp, edx
inc esi
mov esp, dword [edx + eax - 0x4c182bb8]
inc esp
movsx edi, ch
mov edi, 0xa839c736
dec esi
mov dword [esp + ebp*2 - 0x5770], ebp
inc esp
xor esp, ebx
dec ecx
lea ecx, [edi + edx*2 - 0xc74cedd]
dec eax
dec dword [esp + edx - 0x4c182bb8]
inc ecx
neg esp
inc ecx
ror esp, 1
dec eax
shl edi, 0x69
inc ebp
lea esp, [esp + edx*2 - 0x56f272d9]
inc eax
or bh, ch
inc ecx
xor esp, 0x928ad835
dec edx
mov dword [esp + ebp*2 - 0x5770], ebx
dec esi
lea esi, [edi*4 - 0x49e598fb]
sar di, cl
inc esp
xor dword [esp + edx - 0x4c182bb8], esp
inc ecx
bswap edi
inc ebp
and edi, ebp
or bp, dx
pop ebx
dec ebp
arpl sp, sp
dec di
inc ecx
mov ebx, 0x153b7ebf
je 0x178225c
dec ebp
adc ecx, esp
inc ebp
mov esp, dword [edx + edx - 0x4c182bb8]
dec eax
lea eax, [ecx*4 - 0x1d797876]
inc eax
sal bh, 0x27
dec ebp
lea edx, [edx + edx - 0x4c182bb4]
jbe 0x1729452

Function at 0xf49c52
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + ecx - 0xc], ecx
xor ebx, eax
call fcn.00fb2cb3

Function at 0xf4a887
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [ebp + eax - 0x54377f37]
rol eax, 0x37
shl ecx, cl
bswap eax
mov eax, dword [ecx + ebp - 0x31fffffc]

Function at 0xf53394
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov dword [esp], eax
shr cx, 0x2d
bswap edx
shl eax, 0x19
rol edx, 1
dec dword [esp + eax - 0x2000000]
rol cl, cl
neg edx
not edx
dec edx
xor ebx, edx
jmp 0xfab671

Function at 0xf5586e
Capabilities:
Encrypt data using speck

Disassembly:
inc dword [esp + 4]
shl cl, 6
xor eax, ebx
xor eax, 0x7728ae03
call fcn.018342a5
call fcn.01812a3c

Function at 0xf5690b
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
push esi
dec eax
mov dword [esp + edi - 0xb5fd], ebx
xor dword [esp + ebp + 0x7d7f0021], esi
movsx eax, cx
rol ecx, cl
dec eax
mov dword [esp + edi - 0xb615], eax
dec eax
mov ebx, dword [esp + edi - 0xb5fd]
dec eax
adc dword [esp + edi - 0xb619], 0x983e74ba
dec eax
ror edx, 0x65
inc cx
shr ebx, 0xab
dec eax
arpl si, si
dec ecx
rol edi, 0x4d
dec eax
shl ecx, 9
ja 0xf6c13f
Function at 0xf5695c
Capabilities:
Authenticate hmac

Disassembly:
sub dx, 0x69b9
xor dx, 0x272e
lea ecx, [eax*2 - 0x7765ede2]
neg eax
add eax, eax
inc dx
sal ax, 0x48
xor bx, dx
lea ecx, [eax + ecx*8 + 0xf8da627]
or al, 0x3d
lea ebp, [ebp + eax*2 - 0x2ea2507c]
mov word [ebp + eax - 0x1751283d], dx
sar eax, 0x5c
neg al
lea edi, [edi + eax*2 - 0x202]
js 0xf47756
mov eax, 0xb9af1e99
sal eax, 0xba
lea esi, [eax + esi - 0x64000004]
movsx edx, al
mov ecx, dword [edx + esi]
xor ecx, ebx
dec ecx
ror dl, 0xe7
rol eax, 0x57
rol ecx, 3
bswap ecx
dec ecx
xchg edx, eax
shr dx, 0x4c
xor ebx, ecx
sar dl, 0x86
push eax
adc edi, ecx
or dword [esp + eax], eax
adc edx, eax
add ax, word [ebp + eax]
mov cl, byte [ebp + edx - 0x31fffe]
lea edx, [edx - 0x9fe96f1]
add ebp, 2
shr ax, cl
rol edx, 0x89
call fcn.00f3cad9
mov eax, dword [edi + eax - 0xff]
setno cl
shl cx, cl
push ecx
xor eax, ebx
jmp fcn.015ed64c
xor dx, bx
add dx, 0xaea4
mov dword [esp + eax - 0x74575cec], eax
or eax, eax
lea eax, [eax + eax + 0x798b8aa9]
rol dx, 1
neg ax
pop eax
js 0xfa3629
add ebp, 4
or ecx, eax
not ecx
call fcn.00fbe9d2
push edi
dec eax
lahf
or al, 0x69
movsd dword es:[edi], dword [esi]
aaa
pop edi
invalid
add dx, 0x43f
rol dx, 1
jmp 0x15d2c26
jmp 0xf11e48

Function at 0xf5d0a5
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + ecx*4 - 9]
xor eax, ebx
neg ecx
inc eax
rol cl, 2
pop ecx
neg eax
dec eax
rol eax, 1
xor ebx, eax
call fcn.00f3422e
or edx, dword [ecx - 0x34]
xchg ecx, eax
mov dword [0x5c53dfa3], eax
mov ebp, 0x77b7d7a2
pop esp
mov ebp, 0x6b9faba2
pop esp
mov ebp, 0x53afefa2
pop esp
mov ebp, 0x4fb797a2
pop esp
mov ebp, 0xcea28ba2
in eax, 0x35
mov edx, 0x43cf236b
sal byte [ecx], 1
in eax, dx
clc
sahf
adc dword [ebx], esi
jle 0xf5d0ab
xchg ebx, eax
aam 0x5f
dec edx
retf

Function at 0xf64acb
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + ebp + 0x40ba0a35], eax
inc cx
rol edi, 0xab
dec eax
arpl di, di
inc cx
add esp, 0x31258f81
xchg dword [eax], ecx
xor byte [ebx + edx - 0x31], cl
call fcn.00f5d237
and al, 0xb
mov ch, 0x5f
inc ebp
or bh, byte gs:[ecx]
and al, 0x48
bound eax, qword [ecx - 0x70]
add byte [esp + ecx*8 - 0x5e], dl
inc ecx
nop
add al, ah
invalid
adc edi, eax
call fcn.00ef4bba
lea eax, [edi + eax - 0x324da292]
xor eax, 0x99b22d1d
rol eax, 2
inc sp
xadd dword [esp + ecx + 0x34d81095], esp
or cl, cl
dec eax
mov dword [esp + ecx + 0x34d81092], ebx
jno 0xf114b8
mov esi, 0x80e5491
dec esp
lea ebp, [esi + esi - 0x50d6b34f]
inc ebp
movsx esi, ch
dec esi
lea eax, [esi + eax - 0x80e5495]
inc eax
movzx eax, dh
inc ecx
mov esp, 0x9f859e2c
inc ecx
mov edi, dword [eax + esi - 0x80e5491]
jmp 0x17706b1
mov ecx, esi
xor edi, ebx
inc esp
movsx ebx, dh
lea edi, [edi + esi - 0x3a8ffc2f]
xor edi, 0x2a343425
dec edx
lea esi, [ebx*8 - 0x52e2c24c]
ror edi, 3
inc ecx
sar ah, 0x46
inc ecx
mov edi, 0x521e8417
neg edi
dec eax
lea esi, [eax + esi*2 - 0x79e503c2]
inc ecx
push esp
dec edx
mov dword [esp + ebp + 0x40ba0a2d], ebx
sal cl, 0x44
mov edx, esi
xor dword [esp + eax - 0x91], edi
inc ecx
push ebx
dec edx
mov ebx, dword [esp + ebp + 0x40ba0a35]
jmp 0xf16b2e
Function at 0xf76e4c
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00f17114
jmp 0xfc8d5f
xor ebx, ecx
add esi, ecx
movsx ecx, dl
add dx, word [edx + ebp]
call fcn.00f841c9
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
call fcn.017596f7
mov eax, 0x138e2c95
movzx dx, byte [ebp + eax*2 - 0x271c592a]
movzx ecx, al
rol ecx, 0x95
and eax, eax
mov al, byte [ebp + ecx - 0x129ffffe]
lea ebp, [ecx + ebp - 0x129ffffe]
setge cl
call fcn.00eeb43f
sysenter
push esi
mov dword [esp], 0x81a6d88c
call fcn.0160a088
ror edx, 0x41
ror edx, 0xc
dec ecx
jmp 0xf7819c

Function at 0xf781ac
Capabilities:
Encrypt data using speck

Disassembly:
ror ecx, 1
xor ebx, ecx
jmp 0xfe13f4
mov dword [esp + edx*2], 0xc524393c
rol ecx, 3
add eax, 0x8f950527
xor dl, dl
lea ecx, [ecx + eax*2 - 0x7b0c0422]
push edx
pop edx
jp 0xf14304
add edx, edx
mov edx, dword [esi + edx*2 - 0x2b4]
xor edx, ebx
neg cx
and cx, 0xbf0e
movzx eax, cl
lea edx, [ecx + edx - 0x35fafec4]
not cl
jbe 0xf13a40
push eax
ror edx, 2
shr cx, 0xe1
or al, byte [esp + eax - 2]
call fcn.00f7e4a3
shrd dx, ax, cl
jmp 0x15e1864
shl dx, 0x41
call fcn.00f57e05
add edi, eax
xor word [esp + edx + 5], dx
lea eax, [edx + edx + 0x5c07e030]
rol cl, 0x81
adc dword [esp + edx], edi
ret 4
mov ecx, 0x718c1730
mov word [ebp + ecx - 0x718c1730], dx
lea ecx, [ecx + ecx*8 - 0x57ae271]
sub esi, 4
lea eax, [ecx + ecx + 0x1fa87c25]
xadd cl, al
mov edx, dword [esi + eax - 0x108c583f]
xor edx, ebx
sub cx, 0xe0bd
sal ecx, cl
inc edx
sub eax, 0xc295ebb0
sar ecx, 0xde
rol al, 0x64
neg edx
lea eax, [ecx*8 + 0x720831b2]
or cl, 0x3a
inc eax
dec edx
sub eax, ecx
sar eax, cl
ror edx, 1
sar ecx, 0x31
xor ebx, edx
add edi, edx
sar cl, 6
add ecx, edi
jmp ecx

Function at 0xf795bf
Capabilities:
Encrypt data using speck

Disassembly:
shl dx, 0x61
cmovne eax, edx
mov edx, dword [ecx]
mov dword [ebp - 2], edx
inc eax
mov dword [esp], 0xd0b3c28b
sub ebp, 2
sal dword [esp + 0x10], 0x7f
sar dword [esp + 0x10], 0x29
pop eax
pop edx
pop eax
pop eax
pop eax
jbe fcn.00fb91bb
mov eax, 0xb0986f36
mov eax, dword [ebp]
mov edx, 0xf73bdd0b
movzx ecx, dx
mov dx, word [ecx + ebp - 0xdd07]
ror ecx, 0xf3
sal cl, 5
sal ecx, 0xb6
lea ebp, [ebp + ecx + 6]
sub cl, cl
xor ecx, 0x1829a508
mov word ss:[eax + ecx - 0x1829a508], dx
lea edi, [edi + ecx - 0x1829a50c]
mov ecx, dword [ecx + edi - 0x1829a508]
xor ecx, ebx
mov eax, 0xcbb67912
movzx edx, ax
neg edx
inc ecx
sar eax, 0xfd
ror eax, 0xda
lea edx, [edx + eax*4 + 0x271e4cbd]
mov ebp, 0xf7271e4c
ror dword [ecx + 0x2a], 1
rol byte [ecx - 0x6092e40f], cl
jbe 0xf796bd
sar eax, 0xcc
add al, dh
jle 0xf8acdd
bswap ecx
sal dx, 0x2b
or edx, eax
xor ebx, ecx
jmp 0x1834fc5
or cl, 0x94
dec eax
sar dl, 0xa7
je 0x1604511
jmp esi
adc edx, ecx
xor eax, 0x3e37c33e
shl dl, 0x44
inc eax
jmp fcn.00f6db00
add esi, ecx
sal al, 0xc4
jns 0x15dc643
xor eax, ebx
ror edx, 0x14
bswap eax
xor eax, 0x9fa5a227
jmp 0xfdbf45
Function at 0xf798c2
Capabilities:
Encrypt data using speck

Disassembly:
adc ecx, 0xd43a148a
xor al, bl
ror dl, 0xc2
pop ecx
dec al
not al
push edx
sub dword [esp + edx*2 - 0x10b8e], 0xba0a0a25
dec al
not al
movsx ecx, word [esp + edx - 0x85c7]
dec al
shr cl, 0x21
xchg byte [esp + edx - 0x85c5], dl
rol al, 1
add ecx, dword [esp + edx - 0x85f6]
adc edx, dword [esp + edx*4 - 0x217d8]
xor bl, al
shr ecx, cl
pop ecx
sbb edx, edx
add eax, esp
push ecx
xchg dword [esp + ecx - 0x45c77ba2], ecx
mov edx, dword [eax + ecx - 0x45c77ba2]
movzx eax, cx
mov dword [ecx + ebp - 0x45c77ba8], edx
mov edx, eax
inc dword [esp + eax - 0x7ba2]
lea ebp, [eax + ebp - 0x7ba8]
mov ecx, dword [esi + eax*2 - 0xf74a]
ror ax, 0xa6
shl dword [esp + eax - 0x89ee], 0xd2
lea esi, [esi + eax*4 - 0x227be]
sal eax, 0xc3
ror byte [esp + eax*2 - 0x89edd], 0xa5
xor ecx, ebx
sal edx, 0x8a
rol ecx, 3
sar dx, 0xeb
inc dx
dec ecx
not ecx
bswap ecx
xor ebx, ecx
ror word [esp + eax - 0x44f6f], 0xa8
adc edi, ecx
xor word [esp + eax*8 - 0x227b7e], 0x7f94
or dword [esp + edx*2 - 0x3ddffe4], 0x2c10dd0d
pop ecx
jnp fcn.00fb91bb
inc esp
mov ebx, ecx
inc esp
movzx ebp, cl
inc ecx
mov ecx, dword [eax + edi - 0x51800000]
jmp 0x177e28a
call fcn.015fd909
mov dword [esp], 0xdaa53314
ror edx, 2
call fcn.00f08df3
test si, 0xdb1d

Function at 0xf7c879
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
neg ch
jmp 0x15db057
inc esp
xor ch, bl
inc ecx
not ch
mov eax, edi
mov edx, eax
dec eax
mov dword [esp + edi - 0x2b], ecx
inc ecx
ror ch, 1
jmp 0xf302a0
inc ecx
add ch, 0x1a
dec ecx
lea esi, [ebx + 0x522828a4]
inc ecx
xor bl, ch
ror eax, cl
mov dword [esp + edi*2 - 0x52], esi
call fcn.01823966

Function at 0xf85f3d
Capabilities:
Authenticate hmac

Disassembly:
mov word [ebp + edx*2], ax
call fcn.00fd40d0
inc ecx
mov esi, dword [edx + ebp*2 - 0x59ec]
inc ecx
mov ecx, dword [edx + ebp - 0x2cf0]
not esi
inc cx
sal ebp, 0xc6
dec esp
xor ebx, edx
push eax
not ecx
call fcn.00f48c74
inc ecx
inc dx
not eax
rol dl, 0x83
xor ebx, ecx
add edi, ecx
lea ecx, [eax*4 + 0x7736d290]
mov dword [esp + ecx*2 - 0x48421998], 0xc90515ae
mov cl, byte [ecx + ebp - 0x24210ccc]
sar eax, 0x5c
mov dword [esp + 4], 0x739927a5
shl word [esp + 6], 0x44
movzx ax, byte [ebp + 2]
ja 0x172c115
sar edx, 0x66
xchg dword [esp + 4], edx
lea ebp, [ebp + edx - 0x399027a3]
pop ebp
fsubr dword [edi - 0x3a]
add dword [esp + edx*2 - 0x73204f46], edx
xor dx, dx
neg edx
imul cl
sub edx, edx
jge 0xf7bdfa
mov ah, dh
shr byte [ecx + 0x771779b5], cl
mov bl, 0x61
pop ecx
aas
ja 0xf85fb8
xchg edi, eax
popal
pop ecx
aas
push ebx
imul eax, dword [ecx - 0x55], 0xfffffff4
push ebx
stosd dword es:[edi], eax
hlt
jecxz 0xf85fbd
pop ebp
adc byte [ecx + 0x25], ch
jne 0xf85fbb
cwde
mov ebp, 0xa4923456
aad 0x5f
mov eax, 0x560153d1
pop ss
jae 0xf85f89
test al, 0x67
push esp
stc
inc edx
mov eax, dword [0xbc6923c6]
popfd
push eax
int3
Function at 0xf8af69
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + ebp - 0x580c4505], ebx
inc eax
sub dh, 0x2e
inc eax
neg dh
inc eax
dec dh
dec edx
lea edi, [ebx*4 + 0x6a96aa83]
dec eax
lea edx, [ebp + 0x17817f39]
dec edx
inc dword [esp + ebp - 0x580c4505]
inc eax
neg dh
dec esi
sub dword [esp + ebp - 0x580c4505], esi
inc ecx
xadd ebx, ebp
inc eax
add dh, 4
mov eax, 0x77214b9e
inc edx
ror dword [esp + ebp - 0x580c4502], 0xcf
mov ecx, 0xdd84ac1a
inc eax
neg dh
jmp 0x182be58

Function at 0xfab66a
Capabilities:
Encode data using add xor sub operations

Disassembly:
rol eax, 1
call fcn.00eeec8b
shl ax, 0x42
ror dword [esp + eax - 0x2000000], 0x81
adc edi, edx
movzx edx, word [esp + eax - 0x2000000]
xor edx, ecx
add cx, cx
lea esi, [esi + eax*2 - 0x4000001]
or ecx, eax
rol dx, 0xa8
inc dx
movzx edx, byte [esi + eax*8 - 0x10000000]
push eax
xor dl, bl
inc byte [esp + eax - 0x1fffffc]
seto cl
shr dword [esp + eax - 0x2000000], 0x1b
neg dl
mov dword [esp + eax*8 - 0xffffffe], eax
rol dl, 1
not dl
shr cx, 0x2f
sub ax, cx
call fcn.01766740
or eax, 0x603c9d2e
push esp
jl 0xfab67f
sub al, bl
pop ebp
jg 0xfab73f
retf 0xfff9
add al, 0xff
int3

Function at 0xfb45f1
Capabilities:
Encode data using xor

Disassembly:
add byte [edx - 0x7f], bl
ret 0xc6e2
mov edx, 0xa8b5ad22
mov ecx, dword [esi + ecx*4 - 0x54936cfc]
xor ecx, ebx
call fcn.00fbae73
pop ebx
loop 0xfb45f6
je 0xfb4631
xchg ecx, eax
cld
fdiv dword [ebx]
jmp 0xfb45e2
inc ebx
lahf
fsubrp st(3)
push ebp
cmpsd dword [esi], dword es:[edi]
imul edx, dword [0x1bf084f0], 0x1b8f047e
retf

Function at 0xfb8696
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
mov esi, dword [edx]
inc ecx
mov cl, byte [edx + 4]
dec eax
mov dword [esp], edx
jmp 0x15d2b85
inc esp
movzx esp, word [esp]
dec edi
lea edx, [edx - 0x140e]
shr esi, cl
inc ebp
movzx ebx, ah
inc edx
ror dword [esp - 0x502], 0xe4
inc dx
cmovb edx, dword [esp - 0x504]
inc ebx
mov dword [edx - 0xa08], esi
inc ecx
mov ebp, ebx
dec ebp
sbb eax, ebx
inc edi
mov esp, dword [eax - 0x504]
dec esp
lea esi, [edx*2 + 0x7c9a1e23]
dec ebp
lea ebp, [esi + 0x621eb93]
inc esp
xor esp, ebx
inc ecx
sub esp, 0xb9b4a68b
inc ecx
mov edi, 0x2da09d15
inc cx
ror ebx, 0x84
inc ecx
ror esp, 1
call fcn.017378ea

Function at 0xfb9d4f
Capabilities:
Encrypt data using speck

Disassembly:
lea ecx, [ecx + eax - 0x147325c0]
neg ecx
push edx
push eax
dec ecx
inc eax
xchg dword [esp + 8], eax
add eax, 0xffff5714
jmp eax
xor ebx, ecx
add esi, ecx
ror dl, 0x22
fchs
dec edx
jmp esi
xadd eax, ecx
mov edx, dword [esi + eax*4 - 0x1c85a7c4]
jnp 0x15f7228
neg ecx
rol ax, 0x64
sar ax, 0xb
jne 0xf06c86
xor ecx, ebx
sal al, 3
not ecx
ror ecx, 1
sar edx, 0x5a
jbe 0xeff40a
mov ecx, 0x442b139f
fild qword [ebp + ecx - 0x442b139f]
jmp 0xfb9f71
lea eax, [ecx + ecx + 0x3aa02f14]
lea esi, [esi + ecx - 0x442b13a3]
jmp 0xf9eb26
ror edx, 1
neg edx
inc al
xor ebx, edx
call fcn.015f2a0f
jmp fcn.00f3d8ed
sbb al, 0x20
xor edx, ebx
xadd eax, ecx
rol edx, 1
sal ax, 0xe2
xor ax, 0xcb8b
not edx
js 0xfbba7f

Function at 0xfc704d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc cx
mov dl, byte [edx + ebp - 0x7e2b7446]
call fcn.00fcbee0
Function at 0xfc8401
Capabilities:
Encrypt data using speck

Disassembly:
shl ax, 0xc3
not edx
mov dword [esp + ecx - 0x7c85fff8], eax
jnp 0xf71ba2
rol edx, 2
push ecx
inc edx
xadd al, ah
neg cx
rol dword [esp + eax - 0x100028cd], 0x82
xor ebx, edx
rol ecx, 0xcf
inc ecx
add edi, edx
pop edx
pop eax
pop edx
pop edx
pop ecx
jmp fcn.00f2d244

Function at 0xfc8ca9
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [ecx + eax - 0x46f537ed]
lea ecx, [edx*2 + 0x2e21c10e]
sal ecx, 0xc3
rol eax, 2
sub dword [esp + ecx - 0x55391d2c], ecx
inc eax
rol cx, 0x4c
ror edx, 0x43
call fcn.00fad692

Function at 0xfc96de
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x640c83b0], ecx
xor dx, bx
call fcn.0177084b

Function at 0xfca86b
Capabilities:
Encrypt data using speck

Disassembly:
lea edi, [eax + edi - 0x18]
inc dword [esp + eax*2 - 0x28]
mov eax, dword [edi + eax*8 - 0xa0]
movzx edx, word [esp]
jne 0x1752536
mov ecx, dword [ebp + ecx*2 - 0x4260f026]
mov dword [esp + eax - 0x15], eax
lea ebp, [eax + ebp - 0xd]
mov dword ss:[edx + eax - 0x15], ecx
lea ecx, [eax + eax*8 - 0x75eb764c]
dec al
jp 0xf46db2

Function at 0xfd18ec
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ebp, dword [ebp - 4]
mov ebx, 0xb68b75be
inc ebx
mov dword [ebp], eax
jg 0xf4bf1d
movzx eax, bl
lea edi, [eax + eax + 0x4ba6753d]
pop ebx
and eax, eax
pop esi
inc eax
shl eax, 0xc4
call fcn.0182acb4
pop eax
jmp esi
mov dword [esp], 0x969f1493
xor edx, ebx
ror edx, 1
rol word [esp], 0x4f
jb 0x175ae29
jmp 0x180e64f
sal edx, 2
shl eax, 0xcc
mov eax, ebp
mov dword [esp], 0xd69252b2
add eax, edx
inc byte [esp + 1]
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x15f9f97
lea esp, [esp + 4]
je 0x1820e4b
mov eax, dword [ebp + ebx*4]
jmp 0xf50ab3
push eax
call fcn.00f885f7
push 0xcd1b3712
mov eax, dword [esp]
mov eax, dword [ebp]
push 0xaeb16c00
lea esp, [esp + 8]
call eax
jmp 0xf1685f

Function at 0xfd4346
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp - 0xa73d252], 0x64991c00
dec eax
xor esi, ebx
shr dl, 0x81
dec esi
xadd dword [esp - 0xa73d252], esi
inc ecx
setp ah
dec edx
lea esi, [esi + 0x2afd655c]
dec eax
lea ebp, [edi - 0x2264dbd4]
inc dx
sbb dword [esp - 0xa73d1ff], 0xf7484533
salc
dec eax
neg esi
inc edx
xchg byte [esp - 0xa73d1fc], dl
inc cx
dec ebp
pop edi
dec eax
not esi
dec eax
xor ebx, esi
dec ebx
mov dword [esp + edx - 0xa73d206], esi
inc eax
xchg ch, cl
dec ecx
rol ebx, 0x84
dec edi
lea edx, [esi + edx - 0x64991c06]
inc ecx
not bl
inc ecx
sub ch, ch
dec esi
lea ebp, [esi*2 - 0x19dc6bcc]
jne fcn.00ee9d27
sub cx, cx
xor bl, al
ror edx, 0xf3
sal cl, 0x24
adc eax, esp
add dl, cl
movzx dx, byte [eax]
lea eax, [ecx + ecx*2 - 0x427b7d47]
call fcn.00f128c8
Function at 0xfd5459
Capabilities:
Authenticate hmac

Disassembly:
sar al, 0x47
mov eax, dword [ebp + eax - 0x3e8fd8fc]
call fcn.00eef114
call fcn.017835ba
shr word [esp + edx - 0x6ff3], 0xa6
mov ecx, dword [ebp + edx*2 - 0xdffc]
jb 0xf84f21
lea ebp, [edx + ebp - 0x6ff8]
shl edx, 0x78
shr dword [esp + edx*2 + 0x14], 0xb4
sar dword [esp + edx*4 + 0x11], 0xd
movzx eax, byte [esi + edx*2 - 5]
sbb dword [esp + edx + 0xe], edx
or edx, 0xb31b1b9d
sal dword [esp + 0xa], 0xc2
sub esi, 5
bswap edx
call fcn.00f4df91
sub esi, 4
mov eax, 0xc39fa180
movsx ecx, ax
mov edx, dword [esi]
xor edx, ebx
sub ecx, ecx
setbe cl
not al
rol edx, cl
bswap edx
bswap ecx
call fcn.00f66804
mov ecx, 0x77192c27
mov edx, ecx
add cl, cl
lea esi, [ecx + esi - 0x77192c52]
xchg ecx, edx
jns 0x1772b7b
movzx eax, dl
mov eax, dword [ecx + esi - 0x77192c27]
xor eax, ebx
inc eax
neg eax
dec eax
lea edx, [ecx + ecx*2 - 0x4fc028eb]
sar dl, cl
rol eax, 1
ror edx, cl
sbb dl, 0x24
xor ebx, eax
call fcn.00f75f05
mov ecx, dword [ebp]
mov eax, 0x3e8fd91b
jmp 0xf3a135

Function at 0xfdc8f7
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
not eax
inc ecx
dec esi
dec eax
neg eax
dec edx
mov dword [esp + ebx - 0x3a2a8800], 0x1289e0a8
dec eax
sar ebp, cl
dec eax
not eax
inc eax
setp ch
dec ecx
dec esp
dec eax
xor ebx, eax
inc cx
sar esi, 0xe9
call fcn.00f1a595
add edi, ecx
not eax
mov eax, dword [edx + ebp - 0x20ed14e]
movzx edx, byte [edx + esi - 0x20ed153]
mov ecx, 0xe30a769d
lea ecx, [ecx + 0x6ebffb26]
inc cx
xor dl, bl
inc dl
add ecx, ecx
sub cl, ch
push ecx
neg dl
ror dl, 1
xadd dword [esp], ecx
xor dl, 6
add dword [esp], 0x980ce529
add ecx, ecx
or ecx, dword [esp + ecx - 0x4729c74a]
not dl
xor bl, dl
push ecx
ror cl, 0x21
and byte [esp + 1], cl
lea edx, [esp + edx + 8]
jnp 0x1613d2f
and dl, dh
xor eax, 0xc1b4b50d
sal dl, 0x82
not cx
setae byte [esp + edx*2 + 6]
rol eax, 1
xor ebx, eax
ror word [esp + edx + 3], 0xa
add dl, dl
neg ecx
add esi, eax
mov dword [esp + ecx - 0x75eb8a90], esi
ret 4
call fcn.0160232b

Function at 0xfdca02
Capabilities:
Encrypt data using speck

Disassembly:
movzx ecx, byte [esi + edx*2 - 0xb6]
mov dword [esp + edx - 0x5b], 0xa611de81
xor cl, bl
shr edx, 0x3c
jne 0xee6de8
dec cl
xor cl, 0xb4
add cl, 0x87
not cl
xor bl, cl
mov byte [esp + edx*2 + 2], dl
dec dl
lea ecx, [esp + ecx + 8]
call fcn.01833e8e

Function at 0xfe1226
Capabilities:
Encode data using xor

Disassembly:
dec ebp
adc ecx, ebx
shr word [esp + ecx*4 + 9], 0xa9
inc ecx
pop edi
pop ebp
jns fcn.00ee9d27
fnsave dword [ecx]
invalid
dec esp
mov dword [esp + ebp - 0x4d2e1a01], edi
jns 0xf222aa
Function at 0xfe3f6e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov esi, 0xe32929ae
mov esi, dword [esp + edi - 0x51fa0ae7]
xor esi, 0xb83fad13
lea edx, [ecx + ebx*4 + 0x6538a494]
rol esi, 2
neg ecx
lea esi, [ebp + esi + 0x1c172cb6]
ror esi, 1
dec di
jge 0xf881f1
dec bp
push eax
mov edi, 0
jno 0x176e94c
push edi
mov dword [esp + edi - 0x51fa0b0b], esi
push edi
mov dword [esp + ebp - 0x51fa0b0b], eax
push ecx
pushfd
pop ecx
mov dword [esp + ebp - 0x51fa0b0b], ecx
movsx ecx, di
xor bp, cx
push edx
lea ebx, [ebp*2 - 0x504a7d5b]
jno 0xeee623
ror al, 1
lea edx, [ecx + ecx*4 + 0x4f383bba]
xor al, 0x3d
sal dx, 0x84
not dword [esp + edx - 0x40e2fad0]
xor bl, al
dec dword [esp + edx - 0x40e2fad0]
lea eax, [esp + eax + 8]
jg 0xfc707b
push ebp
mov ebp, 0x414db22
push ebp
lea ebp, [ebp*4 + 0x41a69e83]
mov dword [esp + ebp - 0x51fa0b0b], ecx
push edi
mov edi, ebp
push ebx
lea ecx, [ebp*4 + 0x3488933d]
jmp 0xfbccdc
adc esi, edi
ror ecx, cl
setb cl
call fcn.017768da
mov ecx, 0x942b3882
neg ecx
lea eax, [ecx*8 + 0x4d2ec11c]
mov edx, dword [ebp + ecx - 0x6bd4c77e]
xchg ch, cl
mov eax, dword fs:[edx + ecx - 0x6bd47ec7]
mov edx, 0xe90f9c3c
shl edx, cl
bswap ecx
mov dword [ebp], eax
inc dl
push edx
mov byte [esp + 1], ch
sbb edi, 4
xor dword [esp], edx
mov edx, dword [edi]
ror dword [esp], 0x12
mov eax, 0x9d9e7bb7
call fcn.00fd9112
jp 0x15edd88
fldcw word [eax]
mov eax, dword [0xf6af39ca]
rcr dword [edx + 0x32], 1
fldenv [esi + 9]
xchg esp, eax
adc al, 0xa4
invalid
add byte [ebx], al
ror byte [ecx + 0x3bcc1494], cl
xchg edi, eax
mov ebp, 0x3778035
dec edi
lea ecx, [edx + edx*8 - 0xc71d170]
pop edx
sub eax, 0xea14dea5
bswap edx
shl ecx, cl
bswap eax
sub dx, 0x9d10
mov dword [esp + ebp - 0x51faffff], edi
jae 0x15edcfc

Function at 0xfe599e
Capabilities:
Encrypt data using speck

Disassembly:
add dl, dl
or dl, dh
rol eax, 3
sal ecx, 0x15
rol edx, 0x12
xor ebx, eax
xchg ecx, edx
mov dword [esp], 0xe8be0f93
add esi, eax
pop edx
movsx eax, dx
add cx, word [eax + ebp - 0xf93]
jmp 0x15f00f2
lea ebp, [ebp + eax - 0xf91]
ror edx, 0x96
lea edi, [edi + eax*8 - 0x7c99]
shl dx, 0xad
movzx edx, byte [edi + eax - 0xf93]
neg eax
xor dl, bl
sar eax, 0xe1
shr eax, 0x82
sub dl, 0x23
shl eax, 0xcb
ror dl, 1
bswap eax
neg dl
not eax
rol dl, 1
push eax
xor bl, dl
call fcn.0175aaf9

Function at 0x15d2c08
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword ss:[ecx]
mov dword [ebp], edx
mov eax, dword [ebp]
mov edx, dword [ebp + 4]
mov cl, byte [ebp + 8]
push 0x699d492f
call fcn.00f57064
push esi
dec esp
mov ebx, dword [esp + edx - 0x5c84a998]
dec eax
mov edx, dword [esp + edx - 0x5c84a990]
dec eax
mov dword [esp + ebx - 0x5d97c6f5], esi
call fcn.00f2c077