joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29122
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
je 0x37a89
pushfd
pushfd
mov byte [esp + 4], 0x36
jmp 0x26d34

Function at 0x2988b
Capabilities:
Encrypt data using speck

Disassembly:
push 0x892141ca
lea esp, [esp + 8]
jbe 0x373ab
pushal
jmp 0x274dd

Function at 0x2a34b
Capabilities:
Encrypt data using speck

Disassembly:
pushal
mov esi, edx
push ebp
pushfd
call fcn.00027628

Function at 0x2a3d4
Capabilities:
Encrypt data using speck

Disassembly:
mov byte [esp + 4], al
mov byte [esp], bh
cmp byte [0x224b2], 0
pushal
push eax
pushfd
push 0x3bdd2a76
lea esp, [esp + 0x34]
je 0x3049c
clc
cmc
jmp 0x46245
cmp dword [0x224d8], 0
pushal
lea esp, [esp + 0x20]
jbe 0x3caea
pushfd
mov word [esp], bp
lea esp, [esp + 4]
je 0x29a00
inc al
adc ah, ch
mov eax, dword [0x226bc]
cmc
test eax, eax
call fcn.00026401
push ebp
pushfd
mov byte [esp + 4], 0xc8
mov byte [esp + 4], 0x20
lea esp, [esp + 8]
jmp loc.0001654a

Function at 0x2b5a6
Capabilities:
Encrypt data using speck

Disassembly:
pushal
call fcn.0003d772
dec dl
inc dl
pushfd
inc dl
mov dl, byte [ecx]
call fcn.00038856
push dword [esp]
pushal
lea esp, [esp + 0x2c]
je 0x3c22d
cdq
mov ecx, dword [ebp - 0xc]
xchg dh, ah
xchg ah, dh
jmp 0x39cc7
mov byte [esp], ch
mov word [esp], 0x41fc
mov dword [esp], eax
pushfd
jmp 0x26ea3
push 0xc187254f
mov edx, dword [ebp - 8]
pop eax
lea eax, [ebp - 0x10]
push 0xa3ab08e3
jmp 0x2f7b1

Function at 0x2b76c
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0x2c], edx
push 0x44256782
lea esp, [esp + 0x30]
call sub.ntoskrnl.exe_memcpy
adc dl, 0xcd
dec edx
clc
cmc
add esp, 0x18
pushal
mov eax, dword [0x22448]
movzx dx, bl
not cl
mov eax, dword [eax + esi*8 + 8]
movsx dx, bl
pop edx
jmp 0x41276
pushfd
mov cl, byte [eax]
pushal
inc eax
cmc
jmp loc.00011704
lea edx, [eax + 1]
setno cl
nop
not cl
mov cl, byte [esp]
jmp 0x3f3eb

Function at 0x2b7a6
Capabilities:
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0xc7
lea esp, [esp + 8]
je 0x2c32d
cmp dx, 0x1c24
test esi, esi
pushfd
push dword [esp]
lea esp, [esp + 8]
je 0x2c32d
adc dh, 0x25
xadd dx, cx
pushfd
rol ah, cl
mov edx, 0xf
bsr eax, ebx
mov eax, edi
bsf bx, bx
shld ecx, esp, 9
mov ecx, esi
clc
bswap bx
lea esp, [esp + 4]
btr bx, di
mov ebx, dword [ecx]
call fcn.0003bc7e
lea esp, [esp + 4]
jne 0x2f1f2
push eax
adc si, 0xae06
mov edi, dword [0x223f8]
or si, bx
mov esi, dword [0x223f4]
clc
mov byte [esp], 0xfa
test dh, bl
bt eax, ecx
test edi, edi
pushfd
jmp 0x295c7

Function at 0x2b9fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0x37a89
pushal
mov dword [esp + 0x1c], esi
jmp 0x49b5c
jmp loc.00015c56

Function at 0x2bfba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
cmp ecx, 4
push dword [esp]
pushfd
pushal
lea esp, [esp + 0x30]
jae 0x2f247
pushal
mov byte [esp + 4], ch
pushfd
push esi
lea esp, [esp + 0x28]
jmp fcn.00049b29

Function at 0x2c73f
Capabilities:
Encrypt data using speck

Disassembly:
pushal
lea esp, [esp + 0x28]
je 0x2fc3d
pushfd
test eax, eax
push 0x5c4f3813
call fcn.00046052
Function at 0x2c8c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
pushfd
lea esp, [esp + 0x20]
jne 0x39e0a
btc edi, esi
sub eax, edx
jmp 0x3c913

Function at 0x2cc06
Capabilities:
Encrypt data using speck

Disassembly:
mov byte [esp], cl
mov dword [esp + 0x30], str.PsSetCreateProcessNotifyRoutine
pushfd
pushfd
lea esp, [esp + 0x38]
call fcn.00016b80
sar cl, 6
mov ecx, dword [ebp - 4]
jmp 0x47e1f
call fcn.0002f6be

Function at 0x2d60a
Capabilities:
Encrypt data using speck

Disassembly:
push 0x991ce0c4
cmp eax, esi
push 0x1f3aa39c
lea esp, [esp + 0x10]
je 0x39035
pushal
pushfd
pushfd
push ebp
mov dword [esp + 0x28], esi
call fcn.000498b9

Function at 0x2d750
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
call fcn.00043e1c
mov dword [ebp - 0x18], eax
pushfd
jmp 0x296a1

Function at 0x2d990
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp + 0x20], edi
jmp 0x33f10
push dword [esp + 8]
mov dword [esp + 0x20], ebx
pushfd
mov word [esp + 4], cx
push eax
mov byte [esp], dl
mov dword [esp + 0x24], esi
pushfd
call fcn.00031efd

Function at 0x2e41d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0xc]
jne 0x253f7
clc
sub eax, edx
call fcn.0003de5e

Function at 0x2f22d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx ax, cl
dec bl
das
mov eax, esi
bts ebx, 2
bts bx, dx
bsr bx, si
sub edx, esi
add esp, 8

Function at 0x2f24c
Capabilities:
Encrypt data using speck

Disassembly:
bt ebx, 0x17
test eax, eax
pushfd
lea esp, [esp + 4]
je 0x3ca73
push eax
mov dword [esp], 0
push edx
call fcn.00042e40
add esp, 0x14
jg 0x28ea1
cmc
pushfd
test eax, eax
mov byte [esp], bh
call fcn.00035380

Function at 0x2f28f
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x3c885
lea esp, [esp + 0x24]
je 0x29a00
sal ax, cl
btr ax, si
mov eax, dword [ebp - 8]
test ebp, esp
pushal
stc
push 0x3035ca4f
xor esi, esi
call fcn.00031008

Function at 0x2f2ae
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 4], 2
push edx
mov dword [esp + 4], 0x22418
push ecx
mov dword [esp + 4], 0x59d0d93a
pushal
pushfd
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]

Function at 0x2fbbb
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 8], 1
push 0x5b180b3c
push ebp
mov dword [esp + 0xc], 1
bt sp, 6
pushal
mov dword [esp + 0x28], 0x22700
cmc
clc
cmc
test ecx, ecx
jmp 0x3d3f9
add eax, 0xc
call fcn.0003aecb
cmp eax, 0x94b14268
test dh, al
cmp al, al
mov dword [esp], 0
stc
push esi
pushfd
push esp
mov dword [esp + 8], 0
mov byte [esp + 4], ch
pushfd
test cl, ah
jmp 0x2934b
push ecx
push 0x2bd50550
mov dword [esp], 0x124c3ea8
mov byte [esp], 0xff
pushal
lea esp, [esp + 0x24]
jmp fcn.0003f4ba
jmp 0x39936
push 0xe5eb1db5
mov byte [esp], dh
lea esp, [esp + 0x2c]
je 0x29946
jmp 0x3d11a

Function at 0x2fe26
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x40], eax
jmp 0x29229
Function at 0x307f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
call fcn.00044572
lea esp, [esp + 0x28]
je 0x4205d
sal dx, cl
mov edx, dword [esi]
shl di, cl
bts di, bx
pushfd
xor di, bp
and edx, 0xfffffff8
lea edi, [ecx + 0x105103ce]
mov edi, dword [edx + 4]
pushfd
call fcn.0003216d
mov edi, 0x523da20d
pushfd
jmp 0x3984f
lea edi, [eax + 1]
mov dword [esp + 4], 0xb9fce3a4
mov dword [esp + 4], edi
pushfd
mov dword [esp + 4], 0
pushfd
mov byte [esp], al
pushfd
mov dword [esp + 8], 0x453f9
pushfd
lea esp, [esp + 0xc]
jnp 0x27463
push dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
push 0xa8be409a
push 0x484de7b4
push dword [esp + 8]
ret 0xc

Function at 0x30886
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
mov byte [esp], bl
pushfd
pushfd
lea esp, [esp + 0xc]
call fcn.0001e930
call fcn.0003f9ea
lea esp, [esp + 8]
jl 0x411c2
cmc
sbb dx, cx
bswap edx
shrd dx, cx, 0xe
add ecx, dword [0x223a4]
mov dh, 0xe
mov dword [ebp - 4], ecx
pushfd
lea edx, [ebx + 0x2de52252]
seta dl
mov dword [0x223cc], ecx
not dl
movzx dx, bl
sete dh
lea ecx, [ebp - 4]
not edx
pop edx
pushal
jmp 0x47d5f
mov dword [esp + 0x2c], 0x2207c
mov word [esp], bx
pushfd
lea esp, [esp + 0x30]
jge 0x2e027
pushfd
lea esp, [esp + 4]
call fcn.0001e930
cwde
lea eax, [ebp - 8]
jmp 0x4be4d
mov dword [esp + 0x1c], ecx
mov dx, word [esp + 8]
lea edx, [ecx + 0x4b63fe42]
lea edx, [ebp - 0x10]
push dword [esp]
mov dword [esp + 0x1c], edx
pushal
pushfd
mov dword [esp + 0x3c], str.IoQueueWorkItem
push ebp
pushfd
lea esp, [esp + 0x44]
call fcn.00016b80
shld cx, si, 0xc
pushfd
pushal
shr cx, 3
mov ecx, dword [ebp - 4]
stc
call fcn.00041d45
mov dword [esp + 0x20], edx
push 0x2a314ada
push edx
call fcn.00032ec9
call fcn.0004b65c
pushal
lea esp, [esp + 0x24]
call fcn.000111a0
bsf eax, ebx
inc ax
and eax, edx
mov eax, dword [0x224b8]
pushfd
call fcn.00028ec0

Function at 0x308f9
Capabilities:
Encrypt data using speck

Disassembly:
pushal
add eax, 0xc
jmp 0x44325
call fcn.00025b3f

Function at 0x31632
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xb7fb08e4
ror cl, 7
mov cx, word [edi + 2]
pushfd
clc
pushfd
cmp ch, 0x10
add edi, 2
test dh, dh
pushal
jmp 0x2e0f2
test cx, cx
jmp 0x36ae0
lea esp, [esp + 0x38]
jne 0x2c873
movzx cx, al
mov ecx, eax
jmp 0x42ed6
pushfd
call fcn.00046fa7
pushal
push 0xe9e98180
shr ecx, 2
mov byte [esp], ch
rep movsd dword es:[edi], dword [esi]
dec ch
shld cx, sp, 1
sub cx, si
mov ecx, eax
test dl, 0xd5
clc
pushal
mov dword [esp + 0x40], 0x400
call fcn.00045349

Function at 0x32fbb
Capabilities:
Encrypt data using speck

Disassembly:
pop ecx
lea ecx, [ebp - 0x60]
push 0x2b77073a
push dword [esp + 4]
mov byte [esp + 0x1c], dl
mov dword [esp + 0x24], ecx
pushal
call fcn.0004bbb9

Function at 0x3347b
Capabilities:
Encrypt data using speck

Disassembly:
test eax, eax
pushfd
lea esp, [esp + 8]
jl 0x274f2
rcl dx, 7
add ecx, dword [0x223a4]
push edx
jmp 0x46320
Function at 0x33560
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push 0xd38f3fd1
mov dword [ebp - 0x18], eax
push dword [esp + 4]
mov byte [esp + 8], 0x41
push 0xf1c45879
lea esp, [esp + 0x10]
je 0x2cfbb
movzx edi, al
mov di, 0x1760
lea edi, [eax + 1]
pushfd
jmp 0x3ea65
lea esp, [esp + 0x3c]
jne 0x258cf
cmc
sub eax, edx
pushfd
mov byte [esp], bl
jmp 0x2719b

Function at 0x33614
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [ebp - 4], ecx
movsx ax, dl
not ax
movzx ax, bl
mov dword [0x22404], ecx
movzx cx, al
push 0xd9f897f0
lea eax, [ebp - 4]
not cl
pushal
not cl
mov dword [esp + 0x24], eax
jmp loc.00015d69

Function at 0x33762
Capabilities:
Encrypt data using speck

Disassembly:
pushal
jmp 0x346da
lea esp, [esp + 0x30]
jne 0x2cbe4
sar ch, 7
mov ecx, eax
inc si
pushfd
shr ecx, 2
pop esi
push 0xbcb64289
mov word [esp], bp
mov esi, edx
push dword [esp]
push 0x92326631
rep movsd dword es:[edi], dword [esi]
jmp 0x3cff1

Function at 0x33870
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x4c]
jne 0x27d47
clc
bt ecx, edi
pushfd
bt bx, 7
sub eax, edx
pushal
call fcn.00041ad1

Function at 0x33a41
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x37c68
jmp 0x3b9c4
cmp al, ch
test al, al
jmp 0x29e5c
push esi
jmp 0x47141

Function at 0x34246
Capabilities:
Encrypt data using speck

Disassembly:
push 0x6477979a
lea esp, [esp + 0x4c]
jl 0x274f2
setle dl
rol dh, cl
dec dh
add ecx, dword [0x223a4]
setbe dl
bswap dx
mov dword [ebp - 4], ecx
bswap ax
jmp 0x3b1c5

Function at 0x35369
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0003bc0e
dec cl
mov cl, byte [eax]
jmp 0x2c11a

Function at 0x35380
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x3de3b
lea esp, [esp + 8]
je 0x3ca73
jmp 0x4ad00
push edi
mov byte [esp], al
mov dword [esp], 0
call fcn.0003241e
cmp ecx, eax
push 0x7cc8c1c8
mov byte [esp], 0x9f
call fcn.00034444

Function at 0x35630
Capabilities:
Encrypt data using speck

Disassembly:
je 0x477c7
cwde
aaa
call fcn.000366a0
mov word [esp], dx
mov byte [esp + 4], 0xf4
push ecx
lea esp, [esp + 0xc]
je 0x477c7
cmc
test dh, 0x4b
cmp eax, dword [0x2241c]
jmp 0x2ea7f

Function at 0x35f27
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
lea esp, [esp + 0x10]
jl 0x2fc3d
rol al, cl
btr ax, bx
add ecx, dword [0x223a4]
push 0xe30f1213
mov dword [ebp - 4], ecx
mov al, cl
jmp loc.0001644b

Function at 0x35fae
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [eax + esi*8 + 8]
push dword [esp + 0x18]
lea edx, [ecx + 0x6f0bfa69]
pop edx
pop edx
lea edx, [eax + 1]
jmp 0x43d1a
Function at 0x35fc6
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.0002d1e6
mov byte [esp], bh
pushfd
lea esp, [esp + 8]
jne 0x35ffc
bswap cx
mov cl, 0xce
movsx cx, dl
push edx
sub eax, edx
bsr cx, sp
sete cl
add edi, 0xfffffffe
rcr cl, 1
rcr ch, 3
mov cx, word [edi + 2]
pushfd
add edi, 2
jmp 0x317d1
test ch, ch
mov word [edx + eax], cx
test dl, dh
bt ax, 1
test cl, 0xf8
pushal
add eax, 2
push 0xd197364d
test cx, cx
mov word [esp + 8], dx
lea esp, [esp + 0x28]
jne 0x3dc85
aad 0xe0
lea eax, [ebx + 0x10]
xchg cl, dh
mov dl, dh
mov edx, eax
sub ch, cl
rcr ch, cl
mov cl, dh
mov cx, word [eax]
bt bp, cx
cmc
bt dx, bp
add eax, 2
push esp
sub esp, 0xfffffffc
jb 0x468f6
cmp dh, dl
cmc
test cx, cx
pushal
push ecx
pushal
lea esp, [esp + 0x44]
jne 0x35ffc
movzx cx, al
sub eax, edx
pushfd
jmp 0x3f40f
add edi, 0xfffffffe
sub esp, 0xfffffffc
shrd cx, si, 1
bsr cx, dx
mov cx, word [edi + 2]
stc
bt ecx, esi
push edx
add edi, 2
clc
clc
test cx, cx
call fcn.000400ab
push 0x2e63c704
test cx, cx
jmp 0x334fb

Function at 0x36173
Capabilities:
Encrypt data using speck

Disassembly:
mov word [esp], 0xf2d3
jmp 0x3e3dd
cmc
cmc
cmp eax, dword [ebp - 0x14]
pushal
pushfd
pushfd
call fcn.00049bd1
pushfd
mov dword [esp + 0x40], 0
call fcn.000162bf
lea esp, [esp + 4]
je 0x424bd
jmp 0x44cc9
jmp 0x36bd8

Function at 0x36331
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x4743c
mov dword [esp], edx
pushal
mov dword [esp + 0x1c], str.IoQueueWorkItem
jmp 0x33895

Function at 0x3638b
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x20]
jl 0x274f2
setp dl
btc dx, ax
add ecx, dword [0x223a4]
pushal
bswap dx
mov dword [ebp - 4], ecx
bswap dx
mov dword [0x223d4], ecx
call fcn.0003272b
mov word [esp + 4], 0x25d0
pushfd
mov dword [esp + 0x2c], ecx
pushfd
mov dword [esp + 0x2c], str.IoFreeWorkItem
push dword [esp + 0x10]
lea esp, [esp + 0x30]
call fcn.00016b80
and cx, di
shr ch, 3
sal cl, cl
mov ecx, dword [ebp - 4]
pushfd
mov word [esp], 0xf15a
cmc
test al, 0xb9
test ecx, ecx
pushfd
lea esp, [esp + 8]
je 0x274f2
pushal
jmp 0x4a9ae
clc
test eax, eax
mov byte [esp], 0x5c
jmp 0x34e68

Function at 0x3666a
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], ebx
push esp
lea esp, [esp + 0x28]
call sub.ntoskrnl.exe_memcpy
cmp ch, 0xce
stc
add esp, 0x18
pushal
mov word [esp], 0xa7ec
pushfd
pushfd
lea esp, [esp + 0x28]
jmp 0x2cfbb

Function at 0x367b0
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x2c]
je fcn.00049b29
aaa
mov edx, edi
shl bx, cl
movzx cx, cl
mov ecx, 8
sbb bh, 0xa3
mov eax, esi
shld ebx, edx, 0x10
movsx ebx, cl
shr ebx, 0x1b
bswap bx
sub edx, esi
shrd bx, di, 0xb
bswap bx
mov ebx, dword [edx + eax]
push 0xf7fde46b
push 0x646a3bc0
mov word [esp], 0x24af
cmp bx, 0x1c27
cmp ebx, dword [eax]
push 0x63e0749f
call fcn.00033e3b
Function at 0x36814
Capabilities:
Encrypt data using speck

Disassembly:
clc
jmp 0x43d15
call fcn.0003c6cf
inc cl
nop
dec cl
mov byte [esp + 8], 0xdb
mov byte [esp], 0xd3
mov cl, byte [eax]
mov byte [esp + 4], al
inc eax
bt bp, di
stc
test bl, 0x87
test cl, cl
pushfd
lea esp, [esp + 0x28]
jne 0x3db97
pushal
push 0x7b91da75
sub eax, edx
push 0x7908e508
mov dword [ebp + 8], eax
mov word [esp + 8], 0x1c6c
pushfd
lea esp, [esp + 0x2c]
je fcn.00041f6f
call fcn.000307f6

Function at 0x369c0
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [0x223d4], ecx
not al
push dword [esp + 0x18]
movsx eax, al
lea edx, [ebp - 4]
cwde
movzx ax, dl
call fcn.00027324
setns cl
mov ecx, dword [0x2242c]
pushfd
pushal
lea edx, [ebx*4 + 0x5ad1f5dd]
not dx
mov edx, dword [0x22428]
pushal
mov dword [esp + 0x40], ecx
jmp loc.000164a0
pushal
pushfd
lea esp, [esp + 0x28]
jl 0x274f2
btr dx, bp
bsf ax, ax
pushal
bsf edx, eax
add ecx, dword [0x223a4]
lea eax, [ecx*4 + 0x4f0f555c]
mov dword [ebp - 4], ecx
jmp 0x25b63

Function at 0x36a2e
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + 0x2c], 0x4bd55
push ecx
mov byte [esp], 0xba
call fcn.00014054

Function at 0x36f5c
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x1ccb8
cmp bp, bp
cmp dword [0x223e8], 0
push 0x1bd2a90f
jmp 0x3d4b7
mov word [esp], 0xe0ff
jmp 0x33b6b

Function at 0x3786a
Capabilities:
Encrypt data using speck

Disassembly:
test ecx, ecx
pushfd
pushal
call fcn.00044636

Function at 0x37950
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x33ca1
cmp dword [eax], 0
mov byte [esp + 4], 0xab
pushal
jmp 0x2954f

Function at 0x379e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], edi
push dword [esp + 8]
pushfd
pushal
lea esp, [esp + 0x34]
call sub.ntoskrnl.exe_memcpy
lahf
shrd edx, esp, 0x12
rdtsc
add esp, 0x18
mov dword [esp + 0xc], edx
push 0xe9f8085f
mov dword [esp + 0xc], ecx
pushfd
jmp 0x30714

Function at 0x37e48
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [ebp - 0x14], eax
call fcn.000275be
jmp 0x42d6e
je 0x4be5c
push 0xd7352a77
pushfd
mov eax, dword [eax]
test dh, 0x92
mov byte [esp], 0x21
mov dword [esp + 4], eax
mov byte [esp], bl
xor esi, esi
push 0x4fb53168
push 0xcc3fddde
mov dword [esp + 8], 0x2774d
pushfd
pushfd
push 0x3e8a320e
push dword [esp]
mov dword [esp + 0x14], edi
mov byte [esp + 4], 0x6a
push dword [esp + 0x14]
ret 0x18

Function at 0x37ec3
Capabilities:
Encrypt data using speck

Disassembly:
push ebx
mov dword [esp], edi
mov word [esp], 0x55e5
push dword [esp]
mov dword [esp + 4], esi
mov dword [esp], 0xd4680291
push ebp
pushfd
pushfd
mov dword [esp + 0xc], eax
push dword [esp]
pushal
call fcn.000343fa
lea esp, [esp + 0xc]
je 0x467a9
jg 0x350ca
pushal
mov byte [esp + 4], cl
mov dword [esp + 0x1c], esi
call fcn.00042391
lea esp, [esp + 0x20]
call fcn.0001f180
pushfd
cmp eax, dword [ebp - 0x10]
pushal
pushfd
pushfd
call fcn.0004b1f4

Function at 0x3812d
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
mov dword [esp + 0x2c], 0x414e0
mov byte [esp], 0x4c
mov byte [esp], 0x8e
push edi
call fcn.0004018d
Function at 0x387e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0003f55c
push 0x73a2f6f6
inc cl
mov cl, byte [eax]
mov byte [esp], dl
jmp 0x37300
pushfd
inc eax
clc
stc
test cl, cl
jmp 0x3f7f4
mov byte [esp + 4], bh
jmp 0x36eb4
lea esp, [esp + 0x34]
jne 0x253f7
call fcn.000159b3
pushal
mov dword [esp + 0x1c], eax
call fcn.0003eefb
movzx dx, bl
mov edx, eax
push 0x57fbd68f
pushfd
pushal
lea esp, [esp + 0x28]
jmp fcn.0003460a

Function at 0x38c76
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0002b9fb
lahf
lea eax, [ebp - 0x10]
mov word [esp + 0xc], si
mov dword [esp + 0x24], eax
push ebx
jmp 0x38c71
call fcn.0003dab7
clc
cmc
mov dword [ebp - 8], esi
add al, ah
neg ah
mov eax, dword [ebp - 0xc]
pushal
cmp eax, esi
pushfd
lea esp, [esp + 0x24]
jbe 0x270d0
je 0x37a89
call fcn.0001ba19

Function at 0x38dbf
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x2a4cb
mov di, 0xf978
mov di, 0x5f8f
lea edi, [ebx + 1]
push esi
pushal
pushal
mov dword [esp + 0x40], edi
mov word [esp], dx
push 0xf099b13c
mov dword [esp + 0x40], 0
mov dword [esp + 4], 0xe06780e0
pushfd
mov dword [esp + 0x40], 0x4939a
mov byte [esp], ah
call fcn.00032dd9
inc eax
cmc
test bl, 0x57
bt si, bx
test cl, cl
pushfd
lea esp, [esp + 0x10]
jne 0x1592c
sal bl, cl
rcr bh, 5
sub eax, edx
movzx bx, bl
mov ebx, eax
push ecx
jmp 0x2dd09

Function at 0x38e2f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x20]
jne 0x1ccb8
call fcn.000334b4
cmp ch, ch
push dword [esp]
test al, al
push esp
lea esp, [esp + 0xc]
jno 0x38144
pushfd
lea esp, [esp + 4]
jne 0x1ccb8
cmp bh, 0x3e
pushal
cmp bl, bh
stc
mov byte [0x224b0], al
das
bt ax, si
mov eax, dword [0x224b4]
push dword [esp]
cmp dword [eax + 0x18], 0
call fcn.00043dc5

Function at 0x393ae
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
push dword [esp]
test cl, cl
push eax
mov byte [esp + 4], 0x32
pushfd
pushfd
lea esp, [esp + 0x44]
jmp 0x38d96

Function at 0x39788
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x14]
je 0x29a00
aas
adc ax, ax
daa
mov eax, dword [ebp - 0xc]
cmc
test eax, eax
push esp
call fcn.0003df3b

Function at 0x3a125
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
call 0x3a12b
mov dword [esp + 0x2c], eax
push ecx
pushfd
push dword [esp]
mov dword [esp + 0x34], ecx
jmp 0x35a98

Function at 0x3a5cd
Capabilities:
Encrypt data using speck

Disassembly:
setae ah
lea eax, [ecx + 0x631b9c73]
mov dword [ebp - 4], ecx
not ah
call fcn.0004773a

Function at 0x3b17e
Capabilities:
Encrypt data using speck

Disassembly:
rep movsd dword es:[edi], dword [esi]
sub ecx, 0xc206a7a4
test di, si
mov ecx, eax
pushfd
cmc
test bl, al
mov byte [esp + 4], dl
mov dword [esp + 0xc], 0x400
mov word [esp + 4], 0xaa64
stc
cmc
jmp 0x47d3e

Function at 0x3b4df
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x4c]
jne 0x26ca5
cmc
bt di, 0xb
clc
push 0xacea8100
sub edx, 4
cmc
bt bp, sp
add eax, 4
bt ecx, 0xc
mov byte [esp], bl
add ecx, 4
stc
cmp edx, 4
push ebx
jmp 0x34686
Function at 0x3bc0e
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 4]
je 0x2cfbb
movzx di, bl
not di
jmp 0x4256f
pushfd
mov byte [esp], 0xef
inc eax
test dh, al
test cl, cl
pushfd
lea esp, [esp + 0x3c]
jne 0x258cf
pushfd
pushal
push 0x8f1fa63
sub eax, edx
pushfd
mov byte [esp], 0xa4
pushfd
mov word [esp + 4], si
mov dword [ebp - 0x18], eax
lea esp, [esp + 0x30]
jbe 0x298c3
pushfd
push edx
lea esp, [esp + 8]
je 0x2cfbb
jmp 0x49aaf
pushal
pushfd
pushfd
mov dword [esp + 0x24], edi
pushal
push dword [esp]
jmp 0x42d18
lea edi, [eax + 1]
jmp 0x3e537
push eax
movsx di, bl
lea edi, [eax + 1]
pushal
pushal
mov dword [esp + 0x40], edi
call fcn.00035d39
bts ax, 2
mov dword [ebp - 8], esi
shld ax, ax, 0xb
dec ax
bt bx, bx
mov eax, dword [ebp - 0xc]
stc
bt edx, esi
push edi
bt di, 0xe
cmp eax, esi
call fcn.00026854

Function at 0x3bc55
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x316d1
lea ebx, [ebp + 0x3dbd930]
mov ebx, dword [edx + eax]
cmp al, 0x14
pushfd
cmp dh, 0xd9
jmp 0x46625
sub ecx, 4
cmp dh, 0xa7
stc
pushfd
add eax, 4
mov byte [esp], ch
cmp ecx, 4
pushfd
lea esp, [esp + 0x10]
jae 0x2f247
pushfd
pushfd
pushfd
push ebx
lea esp, [esp + 0x10]
jmp fcn.00049b29
cmp ebx, dword [eax]
call fcn.0004b4b5

Function at 0x3bf3c
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x2fc3d
clc
call fcn.00046d07
push ecx
lea esp, [esp + 0x2c]
call fcn.00016b80
btc cx, cx
rcr ecx, 0x12
mov ecx, dword [ebp - 4]
clc
test ecx, ecx
push eax
jmp 0x321c6

Function at 0x3bf7c
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x32edf
bswap si
movsx si, al
pushfd
mov esi, dword [eax]
push 0xec6bdac2
jmp 0x3e16e
jmp 0x3bce9

Function at 0x3c64e
Capabilities:
Encrypt data using speck

Disassembly:
test eax, eax
pushfd
mov byte [esp], 5
lea esp, [esp + 0x28]
jl 0x274f2
bswap eax
daa
rol dh, 5
add ecx, dword [0x223a4]
seto al
mov dword [ebp - 4], ecx
call fcn.00031ada
movzx ax, al
pushfd
lea eax, [ecx - 0x5fa8dbea]
pushfd
mov dword [esp + 4], str.Device_afd
jmp 0x2eed5
jmp 0x3a658

Function at 0x3d569
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
je 0x424bd
bsr ax, dx
lea eax, [ebp*2 + 0x1c99832d]
or ah, 0xe5
mov ax, 0xd39d
mov eax, dword [ebp - 8]
stc
pushfd
test eax, eax
mov word [esp], bx
pushal
lea esp, [esp + 0x24]
je 0x424bd
jb 0x466b8
pushfd
lea edx, [ebp - 0xc]
mov word [esp], 0xd59f
pushal
jmp 0x48ec9
test ecx, ecx
pushfd
mov byte [esp], 5
jmp 0x2daa8
xchg dword [edx], ecx
sub esp, 0xfffffffc
sal cl, cl
shr cx, 3
btc cx, bp
lea ecx, [esp + 0x2e52d62f]
mov ecx, dword [ebp - 4]
clc
test bh, 0x61
cmc
jmp 0x3939a
call fcn.00034afd

Function at 0x3d7fc
Capabilities:
Encrypt data using speck

Disassembly:
cmp dword [ebp + 8], edi
pushal
jmp 0x4122b

Function at 0x3dcb6
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0xc]
je 0x29a00
cwde
mov eax, dword [ebp - 0xc]
bt eax, 0x1b
stc
pushfd
test eax, eax
mov dword [esp], eax
pushfd
jmp 0x4a452
lea esp, [esp + 8]
je 0x29a00