joyce8/EMBER2024-capa huggingface dataset:
Function at 0x805f20
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x852fba
inc ecx
ror esp, 1
inc edi
lea esp, [ecx - 0x3285986b]
inc ecx
bswap esp
inc ecx
movsx eax, cl
dec eax
neg ebp
inc cx
xor eax, ecx
inc ecx
dec esp
inc ecx
xor esp, 0xcf2bbb11
jmp 0xcd8dd3
mov dword [esp], 0x5392fcbb
and dword [esp], 0xda0fc584
adc cx, dx
movsx edx, ax
shr eax, 6
call fcn.00befab7
call fcn.007797e4
inc ecx
mov ecx, 0xcf1b6a87
dec ecx
sub ebx, 4
inc ecx
mov ebp, ecx
inc ebp
mov esp, dword [ebx]
inc ebp
xor esp, ebp
jmp 0x7edf8b
inc ecx
pop ebp
dec ebp
arpl sp, sp
dec ebp
add esi, esp
inc ecx
movzx edx, cx
movzx ecx, dl
dec edi
lea ebx, [ebx + edx - 2]
mov ebx, eax
dec eax
lea edi, [ebp*2 + 0x651cdf2d]
inc edi
movzx esp, word [ebx + edx*2]
ror bl, 0xa5
jae 0xc775dd
sub esi, 4
mov edx, 0xb1ad29a3
shl dl, 0x67
mov edx, dword [esi]
jb 0xb3c914
mov ecx, 0xaf1a4b83
movzx edx, byte [esi - 1]
mov eax, 0x9e8197ab
dec al
js 0x7aca00
push ecx
call fcn.00b30e1a
mov ecx, 0x7799ef23
rol edx, 1
mov dword [esp + eax - 0x66351d80], ecx
sub edx, 0x858b828d
push eax
call fcn.00bd0a5b
lea ecx, [edx + edx*8 - 0x12506aca]
sar ecx, cl
lea ebp, [ebp + edx - 0x449f0115]
not cl
shl ecx, cl
push edx
xor eax, ebx
bswap eax
push ecx
not eax
neg dword [esp + edx - 0x449f010f]
sub ecx, 0x7225015
xor eax, 0xbc0b1729
sal dword [esp + edx - 0x449f010d], cl
call fcn.00cd0846
mov eax, 0x601b60b4
sub eax, eax
xor edx, ebx
call fcn.00b3b532
inc esp
xor dword [esp], esp
inc esp
movsx edx, al
jmp 0x7a52f2
inc bp
xor esp, ebp
inc cx
sal ecx, 0xe4
dec eax
not ecx
ja 0xcbc775
inc cx
sbb esp, 0x874939ab
leave
inc cx
not esp
inc cx
xor esp, 0xff480e91
ret 0xff66
inc ecx
sar cl, 0xa3
inc ecx
push ebp
jbe 0xbb80b3

Function at 0x815007
Capabilities:
Encrypt data using speck

Disassembly:
not ecx
neg cl
rol edx, 2
call fcn.00c8bc7a

Function at 0x816f3b
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp], edx
call fcn.00c61ae1

Function at 0x820f5f
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + edx - 0x5e9fdd21], edx
call fcn.00c931ee
syscall
push ebp
pushfd
dec eax
mov ebp, 0x65952ab9
mov ebp, 0xe8329a54
dec edi
cmp bh, ch
invalid

Function at 0x832837
Capabilities:
Encrypt data using speck

Disassembly:
not cl
jb 0x84339c
not al
mov word [esp + edx - 0x5dba6236], dx
and edx, 0xe602eb95
or cl, al
mov word [edx + edi - 0x440261fe], cx
movzx edx, byte [ebp + edx - 0x44026201]
rol dword [esp + 6], 0x8d
xor dl, bl
rol dl, 1
neg dl
add dl, 0x8d
mov ecx, 0xe705ac00
push ecx
ror dl, 1
xor bl, dl
lea eax, [ecx + ecx + 0x810ed99]
sub eax, ecx
movzx dx, dl
call fcn.00bc6155
Function at 0x83283f
Capabilities:
Encrypt data using speck

Disassembly:
shl byte [esp + eax - 0x24208f2f], 0xe1
lea ecx, [esp + ecx + 8]
mov byte [ecx + eax - 0x24208f35], dl
neg eax
pop eax
pop edx
jmp edi
mov dx, word [esi + edx - 0x7fffff81]
lea ecx, [ecx + ecx*2 - 0x765a76d7]
movzx ecx, byte [ebp + 5]
mov eax, 0x9614352d
sub ax, 0x9800
mov dword [esp], 0x6a2b6d2e
add ebp, 6
xor cl, bl
add al, ah
adc eax, eax
rol cl, 1
add cl, 0xbc
rol cl, 1
xor ax, ax
inc word [esp + eax*2 - 0x5851fffa]
jbe 0xc2ad05
mov eax, dword [esi]
jmp 0xb91533
xor eax, ebx
ror edx, 0xd8
not eax
jb 0xc17c55
mov edx, 0x3816d70e
mov edx, dword [ebp + edx*2 - 0x702dae1c]
add ebp, 4
mov eax, 0x881e927
lea ecx, [eax + eax*2 + 0x31e573e]
shl cx, 3
xor edx, ebx
neg edx
shl ecx, 0x67
call fcn.008400b1
mov eax, 0xd4a89831
mov word ss:[edx], cx
movzx edx, al
shl dl, 6
mov eax, dword [edi + edx*8 - 0x200]
jne 0xc9a60c
mov edx, dword [esi + 4]
jmp 0xbd52f1
add esi, 8
mov ecx, 0xf78ca183
inc cl
mov dword fs:[eax], edx
js 0xc9edd0
and cl, cl
xor eax, 0x418710ac
push edx
rol dx, 0xc8
shl dx, 0xe6
ror eax, 2
lea eax, [eax + ecx + 0x5e830281]
and ecx, edx
call fcn.0085bb46
inc cl
dec eax
xor cl, 0xbf
and eax, 0x65308f35
ja 0xca8c21
movzx ecx, dx
lea edi, [edx + edi - 0x3c]
add cx, dx
sal dl, 0x24
xor eax, ebx
inc edx
call fcn.00b782f5
inc cx
xor eax, 0xf641c39e
fimul dword [ecx + ecx*4 - 0x54]
dec esp
push 0x7f
invalid
mov eax, dword [ebp + ecx*8]
jae 0xb45c8f
movsx edx, cl
rol cl, 0xc5
sbb ebp, 4
lea eax, [edx + ecx*8 + 0x7289c0ab]
sub ecx, ecx
jge 0xc9adb8
and word [esp + eax*2 - 0x48411e69], 0x89b2
sbb cl, 0x27
xor bl, cl
jmp 0x73ff8e

Function at 0x8400b1
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
inc ecx
dec edx
mov dword [esp + eax - 0x881e927], ecx
mov dword [esp + eax*2 - 0x1103d24e], ecx
dec dword [esp + ecx - 0x524acc01]
not edx
neg dword [esp + ecx - 0x524acc01]
inc eax
xor ebx, edx
sal ax, cl
add esi, edx
not byte [esp + eax*2 - 0x1103a49e]
shl word [esp + eax*2 - 0x1103a4a0], cl
shr eax, 0xac
mov eax, edi
lea edi, [edi + ecx - 0x524acc03]
mov word [ecx + edi - 0x524acc01], ax
mov edx, ecx
pop eax
inc al
jno fcn.00beeec5
Function at 0x84cc35
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea esi, [ecx + esi - 0x3214]
dec eax
rol dword [esp + ecx - 0x3204], 0xb6
inc esp
movzx ecx, cx
dec esp
mov dword [esi + ecx*2 - 0x6418], esp
dec ebp
lea ebx, [ebx + ecx - 0x3210]
inc ecx
mov ebp, dword [ebx + ecx*4 - 0xc830]
dec esp
cmovb eax, dword [esp + ecx - 0x3204]
inc ecx
xor eax, 0x2f266d3b
inc ecx
xor ebp, ebp
dec edx
lea ebx, [ecx + eax*8 - 0x78e9f167]
rol ebp, 3
not ebp
inc ecx
movsx eax, ax
lea ebp, [ecx + ebp - 0x7aa0b410]
add edi, eax
inc ecx
xadd cl, cl
xor ebp, 0xb412d383
push eax
inc ebp
not ebp
dec ecx
shl edx, 0x2a
dec edx
mov dword [esp + eax - 0x2f25d116], 0x4f03203d
inc esp
add ecx, dword [esp + edi - 0x6ba80316]
dec esp
mov dword [esp + edi - 0x6ba8031a], ebp
inc ecx
mov edx, ecx
inc edx
xor dword [esp + eax*2 - 0x5e4ba22c], ebp
dec esp
mov ebp, dword [esp + edi - 0x6ba8031a]
rol edx, 0x61
dec eax
arpl bp, bp
dec di
add eax, dword [esp + edi - 0x6ba80329]
dec esp
add esi, ebp
inc edx
mov ebp, dword [esp + eax - 0x2f25d11c]
call fcn.007201a8
xchg dword [esi + 0x5721c4d3], esp
pop ds
cmp eax, 0x7e1c4f6
pop es
inc ecx
test ah, 0xe1
jno 0x84cd7d
jns 0x84ccfc
invalid
not al
invalid
mov ecx, ebx
inc byte [eax + 0x48]
sbb ch, cl
mov dh, 0x6d
pop ebx
js 0x84cd02
jb 0x84cd63
mov eax, 0x92493de8
movsb byte es:[edi], byte [esi]
add byte [edi - 0x5361eb83], bh
pushal
cmp al, 0xba
aaa
sahf
and byte [edi + 0x4f], dh
adc byte [edi + 0x61], ah
aad 0xf9
frstor dword [edi + esi*2]
loope 0x84cdcf
cdq
mov eax, dword [0xe17750bd]
sub al, 0x8d
test eax, 0x75d6f1c1
lds eax, [eax - 0x15]
add esp, esp
jne 0x84cd76
inc eax
jmp 0x84cdb5
fadd st(0), st(0)
push edx
jmp 0x84cd9b
mul byte [edi + 0x64ff79a9]
lcall 0x811e, 0xd8eb7f79
jns 0x84cdd0
jmp dword [edx + ebx*4 + 0x79]
lcall 0x811e, 0xd8eb7f79
jns 0x84ce54
jmp 0x84cdaf
fmul qword [eax + 0x6d044e9]
sub al, 0x28
xor esp, dword [edi + 0x61]
out dx, al
out 0xca, al
dec ebx
ja 0x84cdcc
sub al, 0xb6
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
jg 0x84ce68
ja 0x84cdd3
loope 0x84ce1f
sub al, 0xb2
inc cl
int1
salc
mov dl, 0xfe
sal ecx, 0xd6
mov ecx, 0x3ca1a0d4
jl 0x84ce50
invalid
add ah, ah
jl 0x84ce60
call dword [edx - 0x4680c081]
jnp 0x84ce81
add dword [ecx + 0x4d], 0x6d0477c
mov ecx, 0x6164a2e5
dec ebx
jnp 0x84cdf0
je 0x84ce1d
sub al, 0x8b
jae 0x84ce87
mov edx, 0x7f2ce174
dec edi
ret 0xd6f1
cli
invalid
nop
popfd
mov edi, 0xbf0fc18b
ror dword [ebx - 0x49f099e9], 1
add al, byte [ebx]
leave
mov dh, 2
add ecx, ecx
adc cx, 0xf319
dec cx
dec cx
lea edi, [edi + ecx - 0x7f3b1391]
call fcn.00c00c2e
shl dword [esp + ecx*8 - 0x1e00003a], 0x41
loope 0x84ceca

Function at 0x8563e4
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
cmc
test edx, edx
jmp 0x79cf56
push ebp
and dx, 0x2aa
rcl edx, cl
mov ebp, esp
neg dl
mov edx, dword [ebp + 8]
lea esp, [esp - 0x114]
jmp 0x7d4f5e
Function at 0x860e1d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp]
mov dword [esp], ecx
lea eax, [ecx + 0x7da552b9]
or word [esp + eax - 0x66acef3d], 0xef80
mov ecx, dword ss:[edx + eax - 0x66acef3e]
and al, al
jnp 0xcac7e2
loopne 0x860ebf
mov eax, 0xefa104e
mov dh, 0x3b
mov ebx, 0x7a76ec8c
add bh, byte [ebx + 0x46ec9487]
jbe 0x860e94
pop dword [edi + 0x3e02ec94]
inc esi
mov ah, byte [ebp - 0x62b8e4fb]
mov byte [ecx], dl
xchg dword [ecx + ebx*8], edi
jmp dword [edi + 0x10]
mov ah, 0x10
rcl ebx, cl
iretd
invalid
mov dword [eax + ebp - 0x66acef3e], ecx
xadd dword [esp + eax - 0x66acef3e], eax
movsx ecx, word [esp]
sub esi, 4
mov eax, dword [esi]
xor eax, ebx
movsx edx, cl
not cl
rol eax, 3
xchg word [esp + 2], cx
add dx, 0xff8e
call fcn.0076dfdb
xor eax, dword [ebp + eax*2]
xor eax, ebx
dec byte [esp + 4]
jno 0xd02736
mov cl, byte [eax + edi - 0x2e975a8e]
lea edi, [edi + eax - 0x2e975a8e]
bswap eax
sar al, 0xe4
add eax, eax
or dl, cl
not dl
mov word [edi + eax - 0x20b52e04], dx
movzx ecx, al
push eax
mov edx, dword [ebp + eax*2 - 0x416a5c08]
add ebp, ecx
and eax, 0x26122f3e
xor edx, ebx
add cx, cx
rol edx, 1
rol al, 0xc7
neg edx
xchg dword [esp + eax - 0x20102e02], eax
shr ecx, 0x1e
ror edx, 1
shl ax, 0x42
dec edx
shr word [esp + eax*2 - 0x416b7020], 1
shl ecx, 0x91
ror edx, 3
xchg cx, ax
sub edx, 0xa4312e21
sub ecx, eax
bswap edx
sub ax, cx
sar dword [esp + eax*2 - 0x416a8fe0], 0x5d
xor ebx, edx
pop eax
not eax
add esi, edx
xadd ax, cx
shl ecx, 0x24
jmp esi
ror eax, 2
mov ecx, dword [esp + 8]
xor eax, 0x5d2a3ab8
sub eax, 0xeb062494
lea edx, [ecx + ecx*8 + 0xe222199]
sub ecx, dword [esp + edx - 0xe22194f]
not eax
add cl, byte [esp + ecx - 0xe9e9]
sal byte [esp + ecx*8 - 0x74f85], 0x66
neg eax
call fcn.007a3dda
dec esp
mov ebp, dword [esp + eax - 0x542b8425]
dec ebp
arpl dx, dx
inc ebp
movzx ecx, di
pop ebp
mov edx, 0x13882819
dec ebp
adc esi, edx
inc ecx
pop edi
sar bx, 0xa8
dec esp
mov dword [esp + edi - 0x50bf000b], esi
ret

Function at 0x866abd
Capabilities:
Encrypt data using speck

Disassembly:
add eax, edx
mov dword [ebp - 4], eax
mov dword [esp], 0x65a20e2b
test ebx, ebx
lea esp, [esp + 4]
je 0xc25c12
mov eax, dword [ebp + ebx*4]
push 0x1f037588
mov dword [esp], eax
call fcn.00c25c00
or ecx, 0x67093f10
mov ax, word [ecx + ebp - 0x670dbf34]
mov edx, 0x2691103b
adc cl, ch
sbb cx, dx
lea ebp, [edx + ebp - 0x26911037]
dec cx
lea edx, [esp + edx - 0x2691103b]
call fcn.00c8542d
mov eax, 0x26a1d093
mov eax, dword [eax + ebp - 0x26a1d093]
push 0xd8211c8b
lea esp, [esp + 4]
call eax
mov ebx, 0x499a5e02
movzx edi, bx
movzx edx, bl
mov ebp, dword [ebx + ebp - 0x499a5e06]
movzx ecx, dx
mov dword [ebp + edi - 0x5e02], eax
call fcn.00bd1350
Function at 0x866b15
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + edx - 0xce], edx
sar cx, 0xe8
dec edx
lea esi, [esi + edx - 0xda]
dec esi
mov dword [esp + edx - 0xde], esi
ret 0x10
add edi, ecx
lea ecx, [edx + edx*4 + 0x23250ea3]
mov esi, dword [esi + edx*2 - 0x25366bd8]
add dl, dh
mov eax, ecx
xadd ecx, eax
jbe fcn.007f2bf4
mov eax, 0x180ce6a5
call fcn.0075f81e
sub esi, 4
mov edx, 0x2c85870d
call fcn.00c1a1cc
inc edx
mov eax, dword [esp + edx - 0xd2]
dec edx
mov dword [esp + edx - 0xde], ebp
dec esi
mov dword [esp + edx - 0xce], ebp
inc esi
xor dword [esp + edx*8 - 0x6e0], eax
rol cl, 4
dec esi
mov ebp, dword [esp + edx - 0xce]
dec ecx
shr ecx, cl
inc ebp
mov dword [edx + esi - 0xda], eax
jns 0x759798
xadd dl, dh
neg ecx
or dl, dh
lea ecx, [edx + ecx + 0xc0af557]
not ecx
xor ebx, ecx
lea edx, [edx + edx*4 + 0x309e399b]
jmp 0x75dba8

Function at 0x868713
Capabilities:
Encode data using base64

Disassembly:
inc ebx
add eax, dword [ecx - 0x1bffdf39]
dec ecx
dec edx
inc cx
sar edx, 0xa5
inc edx
mov dword [esi + ecx - 0x1bffdf3d], eax
inc esi
or byte [esp + edx + 0x66daff34], bh
jg fcn.00834216
dec ecx
or eax, 0x52fc80e
dec edx
lea esi, [esi + edx + 0x66daff21]
inc ecx
pop esp
pop ecx
pop edx
pop ebx
pop ecx
jg fcn.007a084f

Function at 0x86b970
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub dl, 0x94
neg cl
not dl
sbb dword [esp + eax - 0x7d8679e1], ecx
sal word [esp + eax - 0x7d8679e4], 0x65
ror cx, 0xc4
adc dl, 0xb7
sal word [esp + eax - 0x7d8679e3], 0xa3
xor dl, 0xa7
shl al, 0xa3
xor bl, dl
shr ax, 0xc7
lea edx, [esp + edx + 8]
mov eax, dword [eax + edx - 0x7d8600f2]
mov dword [esi - 4], eax
sub byte [esp + 4], 5
mov ecx, dword [ebp + 5]
neg dword [esp]
mov edx, dword [esp]
sub ebp, 0xfffffff7
xor ecx, ebx
movsx eax, dl
add ax, word [esp + 6]
sal eax, 0x85
rol ecx, 1
neg ecx
bswap ecx
jmp 0xc17e16
adc edi, edx
not cx
movzx edx, byte [ebp + eax - 0x7d8679e0]
bswap ecx
mov dword [esp + eax - 0x7d8679e4], 0x959865a9
xor dl, bl
ror dl, 1
push eax
jmp 0x770423

Function at 0x879dc3
Capabilities:
Encrypt data using speck

Disassembly:
movzx ecx, dx
lea ebp, [ebp + ecx*4 - 0x23e10]
push ecx
shr dword [esp + ecx*4 - 0x23e14], 0x93
xor eax, ebx
shr dl, 0xc1
sub eax, 0x9ba45b9b
sal ecx, 0xe1
call fcn.00c97740
Function at 0x87e8b4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
dec esi
mov dword [esp + ecx*4 - 0x37f88], edi
dec esp
adc esi, edi
xchg ebx, eax
call fcn.00b10729
nop
or esp, dword [edi - 0x4c6e4b4d]
or esi, dword [ebx + 0x1b]
pop ecx
xor eax, 0xd30bf603
cmp dl, byte [edx + ecx - 0x32]
sti
adc edi, edi
push 0x54
mov bh, bl
adc edi, edi
push ss
jecxz 0x87e8cc
imul esp, dword [eax - 0x369713e6], 0xfffffffd
in eax, 0xf3
inc esp
scasb al, byte es:[edi]
push esi
push es
inc ecx
mov edx, ebx
stosb byte es:[edi], al
add ch, byte [esi + 0x41]
cmp edi, edi
lodsb al, byte [esi]
sar byte [ebx - 0x24cbed8c], 1
and al, 0xff
xchg edx, eax
cmp al, 0xed
je 0x87e90b
invalid
mov ebx, 0x12858d8
mov ch, 0x89
pushfd
mov edx, 0xd92c38
jp 0x87e96f
hlt
ljmp 0xea9b:0x3c18ebb0
clc
das
cld
bound ecx, qword [edi + edi*8 + 0x13]
jnp 0x87e957
out 0xf9, eax
add byte [ebx - 0x39], cl
aaa
daa
xchg edi, eax
add byte [ebx - 0x59], al
pop edi
daa
xchg edi, eax
add byte [ebx], ch
pop ss
dec edi
daa
xchg edi, eax
add bl, bh
das
pop es
daa
xchg edi, eax
add byte [ebx + 0x72e53698], dh
loope 0x87e9b0
mov word [ebx - 0xcf3a314], es
ret
push 0xeb32c3cf
adc al, 4
ffreep st(3)
xor ch, bl
cmp al, 0xed
mov bh, 0x44
ja 0x87e9c0
dec esi
into
retf 0xdb2b

Function at 0xb0125c
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [esp + ecx + 0x10]
xor ax, 0x339e
mov dword [ecx + eax*2 - 0xf2b2f96], edx
mov edx, dword [edi + eax*8 - 0x3cacbe57]
bswap eax
movsx ecx, ax
xor edx, ebx
push eax
sub eax, eax
inc edx
bswap edx
dec edx
sar word [esp + eax + 1], 0xc7
mov dword [esp + eax*4 + 8], eax
call fcn.00c062de
dec esp
add esi, ebp
call fcn.00b2638c
ja 0xb012e5
xor al, 4
xlatb
xchg esp, eax
sbb eax, 0x68647e9b
stosd dword es:[edi], eax
xchg esp, eax
sbb eax, 0x50543e9b
jns 0xb01299
sbb ebx, dword [ebx + 0x53355b7f]
mov edi, 0xff9b7973
adc eax, 0xe1ee6dde
sbb ecx, edi
dec esp
out 0x3b, al
pop edx
retf
in al, dx
fsub qword [esp + edi*8 + 0x1a59c934]
enter 0xffffffffffffb126, 0x40
test dword [esi + 0x5a], ebx
adc byte [esi + 0x5075d032], al
sub ebx, dword [ecx]
fdivr st(6)
mov word [edx - 0x3696e4be], fs
out dx, al
lodsb al, byte [esi]
sbb ecx, dword [edx + ebp - 0x7cce30]
inc edx
mov eax, dword [0x2b3045bd]
sub edx, dword [esp + ebp*4 + 0x9b00a8f]
and dl, dl
cli
movsb byte es:[edi], byte [esi]
mov esp, 0x236fb6b0
invalid

Function at 0xb06ee2
Capabilities:
Encrypt data using speck

Disassembly:
dec ebx
lea esp, [esp + 4]
jne 0x76842b

Function at 0xb079f6
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
add al, 0x2e
lea ecx, [ecx*4 - 0x6b475b5d]
call fcn.00b42dfc
mov cl, byte [esi + ecx*4 - 0x1b810]
inc esp
movsx eax, ax
jmp 0xca2fa0
Function at 0xb1220e
Capabilities:
Encode data using base64

Disassembly:
and ebx, edx
inc ecx
dec esi
mov dword [esp + edx - 0x6b3bfff8], ebp
dec edx
lea edx, [ecx*8 + 0x65368d07]
call fcn.00bc97dd
inc ebx
mov dword [esp + ecx*2 - 0x5e], ebp
inc bp
xor edx, edx
inc ecx
neg cl
inc ebx
mov ecx, dword [ebx + edx - 0x6b3c0004]
movsx eax, dx
inc ecx
xor ecx, ebp
not ecx
dec edx
mov dword [esp + edx - 0x6b3c0000], edx
inc ecx
movsx ebp, dl
neg ecx
inc si
xor dword [esp + edx - 0x6b3bfffe], ecx
dec edx
ror dword [esp + edx - 0x6b3c0000], 0x41
inc ecx
not cl
inc edx
lea ecx, [ecx + edx*2 - 0x1edfaece]
inc ecx
push ecx
inc esp
movsx eax, bp
dec eax
lea ebx, [eax*8 + 0xc85d0ab]
bswap ecx
js 0x870c9f
ljmp 0x8c31:0x4666d9f7
jp 0xb122c4
stc
xchg esp, eax
or eax, 0x45eb733
call 0x5f6855ae
fdiv st(0), st(0)
cmp edi, esp
divps xmm2, xmmword [ecx]
cmc
popfd
mov dh, 0x3f
mov byte [0xed311e5d], al
pop esp
mov eax, dword [0x80ea01c9]
mov al, 0x4b
or byte [ebp - 0x51d2188d], cl
out 0x2d, eax
scasb al, byte es:[edi]
pop esp
cmp eax, 0xea1df567
lahf
xchg ecx, eax
jae 0xb12235
mov bh, 0x3d
pop ebx
push 0xfffffffffffffff5
mov byte [0xe8cbacd1], al
push ecx
add esp, dword [ecx]
cmp eax, 0xa2f56a5b
shr dword [ebx + ecx*8 + 0x210351e8], 1
inc edx
add al, 0x8c
push 0x446015b
mov word [eax + 0x33], gs
xor eax, 0x688c046a
outsd dx, dword [esi]
aaa
jns 0xb12294
and dword [edx - 0x5c87011d], ecx
jecxz 0xb122c4
js 0xb1226b
jne 0xb122a2
push edi
stc
xchg esp, eax
scasd eax, dword es:[edi]
xor esi, dword [edi - 0x68b191a2]
xor esi, dword [edi - 0x4c89d9a2]
xor esi, dword [edi - 0x340905a2]
xor esi, dword [edi - 0x2a525a2]
cmp al, 0x36
pop esi
pop es
sub esi, dword [eax - 0x79]
mov edx, 0x8ab165e
sub al, 0xe6
jmp 0x571f4cd9

Function at 0xb15747
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + ecx*2], 0xe61a5894
dec esp
add esi, ebp
dec edi
lea edx, [ecx + eax - 0x22d2c36b]
inc ecx
neg edi
inc esi
movzx esp, byte [ecx + ebx - 5]
jnp 0xb61faa
inc dword [esp + ecx + 3]
dec ebp
lea ebx, [ebx + ecx - 5]
dec eax
sar ecx, 0xa3
inc ebp
xor ah, ch
inc edx
dec edx
lea edi, [eax*4 + 0x56067cab]
dec eax
mov dword [esp + ecx + 0x10], 0x888d4985
inc ecx
add ah, 0xf
inc ecx
ror ah, 1
call fcn.00bc0426
inc edx
mov byte [edi - 8], bl
inc esp
xor ah, ch
dec eax
sal eax, cl
inc ecx
push esp
dec edi
lea ebx, [ebx - 0xc]
inc ebx
mov edx, dword [edi + ebx - 0x4631b531]
dec esi
sbb ecx, dword [esp - 4]
cld
inc edx
ror dword [esp], cl
setns cl
inc ecx
xor edx, ebp
call fcn.00877835
cdq
loope 0xb61fc8
jo 0xb61fde
ror ecx, 0xdb
mov edx, 0xc3cfe148
leave
fstp xword [edx - 0x3c301eb8]
retf
Function at 0xb1be61
Capabilities:
Encrypt data using speck

Disassembly:
add al, 0x9e
xor bl, al
sar word [esp + ecx - 0x863fffb], cl
mov dword [esp + ecx*8 - 0x43200008], ecx
lea ebp, [ecx + ebp - 0x8640003]
push edx
mov word [ebp + ecx - 0x8640001], ax
and dword [esp + ecx*2 - 0x10c80002], edx
pop ecx
pop ecx
pop edx
pop ecx
pop ecx
pop edx
jno fcn.00c6975d
xor ebx, ecx
call fcn.00c84483
not edx
neg byte [esp + eax*2 - 0x1758f9ee]
neg cl
xor cx, cx
xor ebx, edx
mov dword [eax + esi - 0xbac7d02], edx
lea esi, [eax + esi - 0xbac7d02]
xor cx, 0x85bd
cmovge cx, ax
jp 0xc9dac8
sub ebp, 4
mov edx, 0x22250f9c
bswap edx
or dl, dl
mov ecx, dword [ebp]
movzx eax, dx
call fcn.0076d50f
pop edx
pop edx
pop eax
pop edx
pop eax
jne fcn.00c335ef

Function at 0xb24bda
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0xbe8928]
push 0xefa7d093
shr eax, 8
xor eax, esi
inc ecx
push 0xac19fd2c
xor eax, 0xd6880f16
dec edx
lea esp, [esp + 8]
jne 0x7bd2f6
mov ecx, 0xbc330c28
jmp 0x7bd2f3

Function at 0xb25735
Capabilities:
Encode data using xor

Disassembly:
shl edx, 0xbc
sbb ecx, ecx
xor eax, ebx
call fcn.00bf46b8

Function at 0xb268d2
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [eax*4 + 0x21fe49d]
pop eax
mov eax, dword [edi + 4]
call fcn.00c152b2
mov ecx, 0x1906150f
mov edx, dword [ebp + ecx*2 - 0x320c2a1e]
mov eax, ecx
or al, al
rol cl, 0xe3
lea ebp, [ebp + ecx*2 - 0x320c2aec]
or cx, 0xf730
xor edx, ebx
or cl, ch
add ax, ax
bswap edx
neg ecx
xadd eax, ecx
sub ecx, ecx
lea edx, [edx + eax - 0x235a4d14]
not edx
rol edx, 3
not al
dec eax
ror ecx, 0x7e
xor ebx, edx
sal ecx, 0x5a
adc edi, edx
sar ecx, 0xd0
dec ecx
mov edx, dword [esi]
sal eax, cl
sbb eax, 0x2bbf52b4
shr ax, 0xaa
mov cl, byte [eax + esi - 0x54400027]
inc ax
lea esi, [esi + eax - 0x5440002a]
and al, 0x23
not eax
shr edx, cl
call fcn.00781d74

Function at 0xb29430
Capabilities:
Encrypt data using speck

Disassembly:
movzx edx, byte [ebp]
mov ecx, 0x3b33678f
lea ebp, [ecx + ebp - 0x3b33678e]
xor dl, bl
pop eax
rol dl, 1
xor dl, 0xa6
jmp 0xc8aa03
rol dl, 1
neg ecx
add dl, 0x85
call fcn.00cd3acb
Function at 0xb2db40
Capabilities:
Encrypt data using speck

Disassembly:
not eax
xor ebx, ecx
add esi, ecx
shr dword [esp + edx + 3], 0x7a
jns 0x8140b7
movzx cx, byte [edx + edi - 2]
shr eax, 0x3c
jns 0xc8d5b9
jns 0x7a0575
sal al, 1
bswap ecx
mov dword [esp + eax - 0x998ae8a], edx
xor ecx, 0xed3dfdbd
ror ecx, 2
push edx
mov dword [esp + edx*2 - 0x7b7e2b4c], edx
xor ecx, 0xaa30b832
sub byte [esp + edx*2 - 0x7b7e2b4f], al
lea ecx, [ecx + eax + 0x33f0c6b1]
shr edx, 0xff
jbe 0x715335
xchg ah, dl
cdq
or dword [ebx], 0xe4bef43
sbb byte [edi + ecx*4 - 0xc04e606], ch
mov ah, 0x8f
cli
sbb ebx, edx
iretd
neg dx
add dl, byte [edi + edx]
add al, 0x3b
and word [esp + eax - 0x42], 0x3398
adc ax, ax
not cl
xor dword [esp + eax - 0x8c], eax
sal al, 7
not dl
and cl, dl
xor ax, ax
mov word [eax + edi], cx
call fcn.00b06061
dec ecx
dec eax
sub dword [esp], ecx
shl cl, 1
neg eax
bswap eax
lea ecx, [ecx*8 + 0x5726adb5]
or byte [esp], cl
dec eax
push ecx
rol dword [esp + 4], cl
jae 0x791c19
xor ebx, eax
add esi, eax
mov ecx, dword [ebp + 4]
xor ecx, ebx
add ecx, 0x681cc003
mov eax, dword [esp + 2]
call fcn.00c1d315

Function at 0xb3317b
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00b3c6d3
or word [esp], dx
sar word [esp], 0x2a
add esi, eax
xor dword [esp], edx
mov eax, dword [edi]
pop ecx
jge 0x870728
loopne 0x766459
add byte [edi], dh
invalid
or ecx, eax
lea eax, [edx + edx*4 + 0x4e8be0b5]
not ecx
xor dl, dl
seto dl
mov dword [edi + eax*2 - 0x434133b2], ecx
shl al, 0x41
lea edi, [edi + eax - 0x21a099b2]
jmp esi
mov ecx, dword [ecx + edi - 0x7593ed1c]
or eax, ecx
add dx, dx
mov ecx, edx
not eax
lea ecx, [ecx*2 - 0x31c296de]
xor cl, ch
mov ecx, eax
sbb dl, 0x80
mov eax, dword [edi + 8]
jne 0x80f9cb
add edi, edx
lea esp, [esp + 0xc]
jmp 0x766438

Function at 0xb33186
Capabilities:
Encrypt data using speck

Disassembly:
enter 0xffffffffffff8166, 0xffffffffffffffea
cmp al, 0x7b
shr byte [esp + ecx - 0x6b0], 0xc1
xor bl, al
rol cl, 0xe2
call fcn.0075e2fb
dec cl
rol dl, 1
not ax
call fcn.00c0fde3
mov dword [0x38e5c93], eax
in al, dx
mov ah, 0xbc
daa
in eax, 7
jmp 0xb33163

Function at 0xb3d614
Capabilities:
Encode data using xor

Disassembly:
not edx
lea eax, [ecx*4 - 0x75c605fc]
call fcn.0076f8e1
dec ebx
pushal
push ebp
inc ebx
popal
test byte [esp + edi*4 - 0x511e86c4], bh
xchg esi, eax
invalid

Function at 0xb3eeef
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov dword [esp + eax - 0x71], ecx
add dword [esp + eax - 0x67], ecx
ror al, 4
bswap edx
dec word [esp + eax*2 - 0x25]
lea eax, [ecx + eax*8 - 0x5de365f1]
mov dword [esp + ecx*2 - 0x31fc], 0xda9311bd
rol edx, 3
xor byte [esp + ecx - 0x18f7], 0x8d
xor ebx, edx
add eax, dword [esp + ecx - 0x18f9]
add esi, edx
mov cx, word [edi + eax*2 - 0x2566e33e]
add dword [esp + eax*2 - 0x2566e332], 0x25a6e2a9
lea edi, [edi + eax*2 - 0x2566e33c]
mov edx, 0x4e230b87