joyce8/EMBER2024-capa huggingface dataset:
Function at 0x626c7d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec ebp
lea edx, [edx + ecx*4 - 4]
call fcn.00736fc1

Function at 0x626e20
Capabilities:
Encode data using xor

Disassembly:
inc ecx
neg bh
inc ecx
movzx ebx, ah
inc esp
mov eax, eax
inc ecx
movsx edx, al
inc ecx
inc bh
add word [esp + eax + 0x33603459], 0x24a8
call fcn.00622c39
sub edx, 0xb9321a0a
neg edx
sal al, 0x81
jbe 0x6346e9
sub esi, 4
call fcn.006def1e
sub esi, 4
mov ecx, 0x5d02c72e
movzx edx, cl
mov eax, edx
mov ecx, dword [esi + ecx - 0x5d02c72e]
xor ecx, ebx
sub al, 0x23
rol ecx, 3
xor ecx, 0x3923cf3d
sar eax, 0x1d
ja 0x7191a7
sal edx, 0xcb
not ecx
shl dx, 0x87
rol dx, 0x67
rol ecx, 3
sal eax, 0x48
xor ebx, ecx
add ebp, ecx
lea esi, [edx + esi - 0x10001]
movzx ecx, byte [esi + edx*4 - 0x40000]
call fcn.005faaa0
call fcn.006132f6
inc ecx
xor eax, 0x5595feab
dec eax
mov dword [esp + eax*2 - 0x190a525c], 0xd9bc1833
inc edi
lea eax, [eax + esi*4 + 0x835e4aa]
xor eax, esi
dec esp
mov dword [esp + ecx + 0x3fe51dec], ecx
inc ecx
mov edi, 0xe9838c98
inc esp
xor dword [esp + eax - 0xc85292a], eax
dec esp
mov ecx, dword [esp + eax - 0xc85292a]
dec eax
mov dword [esp + eax - 0xc85292a], ecx
dec ebp
arpl ax, ax
not word [esp + eax - 0xc85292b]
dec ecx
add edi, eax
mov ebp, ecx
dec ebp
lea edx, [edx + eax*4 - 0x3214a4c9]
inc ebp
movzx edi, byte [edx + eax - 0xc852932]
inc eax
xadd al, dh
dec eax
xor eax, dword [esp + eax*4 - 0x3214a530]
inc ebp
xor bh, cl
jmp 0x55ba1d
ror edx, 1
not edx
call fcn.0061eb02
movzx eax, byte [esi + edx*2 - 7]
push edx
lea esi, [esi + edx - 6]
xor al, bl
shr edx, cl
rol dword [esp + edx], cl
rol byte [esp + edx*4], cl
inc al
sub dword [esp + edx], 0x579e08a4
push edx
bswap ecx
ror al, 1
pop ecx
or ecx, ecx
dec al
neg al
xor bl, al
call fcn.00556e46

Function at 0x6281f2
Capabilities:
Encrypt data using speck

Disassembly:
add ebp, eax
or dword [esp + ecx*4 - 0x1fca0b4c], edx
xchg word [esp + ecx - 0x7f282d2], dx
sub dword [esp + ecx*2 - 0xfe505a6], 0x97b355ae
pop eax
jns fcn.00566baa
mov dword [esp], ecx
mov eax, dword [esi]
mov edx, ecx
xor eax, ebx
xadd cl, dl
and cx, dx
neg eax
push edx
pop ecx
inc eax
xchg ecx, edx
mov dword [esp], ecx
sub ecx, dword [esp]
not eax
not dword [esp + ecx]
sal word [esp + ecx*2 + 1], 0x4c
lea eax, [ecx + eax - 0x3db7032c]
sal dword [esp + ecx], 0xa2
neg eax
mov dword [esp + ecx], 0xbd011785
bswap edx
or ecx, edx
xor ebx, eax
sar ecx, 0xe3
jne 0x5e99a7
inc esp
xor cl, cl
dec eax
lea ecx, [esp + ecx + 0x38]
inc ecx
sub edx, eax
dec esp
add dword [esp + edx - 0x44ebe1], esp
inc esp
add ebp, edx
inc eax
mov byte [ecx + edx*2 - 0x89d800], dh
dec eax
mov dword [esp + edx - 0x44ec00], edi
ret 0x30
Function at 0x62886b
Capabilities:
Encrypt data using speck

Disassembly:
sub cx, si
inc edx
mov esi, dword [edx + ebp - 0x16a00000]
inc ecx
movsx eax, bp
movzx ebx, cx
inc edi
movzx eax, byte [edx + ebp*2 - 0x2d400005]
dec edx
add dword [esp + ebp - 0x169fffee], 0x148dc29e
inc ebp
xor al, cl
inc edx
sub byte [esp + ebp*2 - 0x2d3fffee], 0x30
inc ecx
inc al
inc ecx
xor al, 0xaf
inc ecx
ror al, 1
sub bx, 0xed29
inc esp
sub edi, ebp
dec eax
sub eax, ecx
inc ecx
dec al
dec esi
mov dword [esp + ebp - 0x169ffff8], esp
call fcn.00601ba7
Function at 0x62b9c2
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + ebp*2 - 0x1838], ecx
inc esi
xor dword [esp + ebp*2 - 0x1838], eax
dec esi
mov ecx, dword [esp + ebp - 0xc18]
call fcn.006e93e1
dec edx
mov dword [esp + ebp*2 - 0x1840], eax
inc ecx
ror eax, 1
jmp 0x5e7794

Function at 0x62bd9f
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
sub edx, 4
dec eax
mov dword [esp], 0x81230031
shr byte [esp], 0x42
inc ecx
mov eax, dword [edx]
dec eax
or dword [esp], 0xa90dd6ab
jno 0x700dea
inc ecx
xor eax, ecx
call fcn.006fbb90

Function at 0x631f4a
Capabilities:
Encrypt data using speck

Disassembly:
mov cx, word [edi]
push eax
movzx edx, al
xor al, dh
mov ax, word [edi + edx - 0x25]
call fcn.00747e56

Function at 0x631f5d
Capabilities:
Encrypt data using speck

Disassembly:
rol ecx, 1
mov eax, dword [esp + 8]
lea ecx, [ecx + eax*2 - 0xf92d750]
mov dword [esp + eax - 0x7111c404], eax
ror ecx, 2
lea edx, [eax + eax*4 + 0x7ea4908b]
ror edx, 5
ror dx, 0xa8
neg ecx
sub eax, dword [esp + eax - 0x7111c3fc]
sub edx, eax
ror ecx, 1
not dx
push eax
xor ebx, ecx
rol edx, 0xd8
mov dword [esp + eax*8 + 4], eax
call fcn.006fa42b

Function at 0x6321af
Capabilities:
Encrypt data using speck

Disassembly:
neg edx
dec edx
xor ebx, edx
push eax
or eax, 0x78055c3c
call fcn.00567269

Function at 0x633441
Capabilities:
Encode data using xor

Disassembly:
into
dec ecx
not ebp
inc esp
mov esp, ebx
lea esi, [ebx + esi - 0x72a1bdb8]
inc cx
rol edi, cl
call fcn.0064c64c
ror eax, 2
call fcn.006bf8e9
add edi, dword [ebp + ebx*2 + 0x2e]
sub ebp, esp
jp 0x6334a8
jnp 0x63342a
dec ebx
stosd dword es:[edi], eax
push ss
or al, 0xae
salc
fist word [ebx - 0x2951f3da]
xchg edi, eax
neg dword [edx]
or al, 0xae
salc
invalid
scasb al, byte es:[edi]
salc
retf 0x27ea
Function at 0x63691e
Capabilities:
Encode data using xor

Disassembly:
not al
sub ecx, 0x8822a628
sal cx, 0xc
not dl
xor ecx, ecx
shl ecx, 0xc4
and al, dl
sub ecx, ecx
rol cx, 0xc
movzx edx, cl
mov word [edi + ecx*2], ax
call fcn.005e7785
mov ebx, 0xda83c2a0
and bx, 0xad3b
push ebx
movzx ebx, byte [eax]
push 0x4513dd06
xor ebx, edx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x627840]
shr edx, 8
xor edx, ebx
shl dword [esp], 0x7e
sbb byte [esp + 7], 0x3f
call 0x72510a
shr eax, 0x4c
mov dx, word ss:[ecx + eax - 0xde27e]
rol eax, 0xc5
lea edi, [edi + eax*4 - 0x6f13efe]
sar eax, 0x34
mov word [edi + eax - 0x1b], dx
mov edx, eax
call fcn.00635595
inc cx
not esi
call fcn.0073d738
mov ebp, esi
inc ecx
rol ebp, 2
inc ecx
inc ebp
pop esi
inc ecx
xor ebp, 0x8f3e47b9
inc edx
shl dword [esp + esi - 0x447010ea], 0x52
dec edx
mov dword [esp + esi - 0x447010fd], 0x410ade25
inc dx
rol dword [esp + esi - 0x447010f5], 0xa
dec esp
mov dword [esp + eax - 0x5a68], ecx
dec ecx
xchg esi, ebp
shl ax, 0xc3
inc esp
xor dword [esp + eax*2 - 0x1a8d8], ebp
dec esp
mov ecx, dword [esp + eax*4 - 0x351d8]
movzx ebx, ax
inc dx
xadd dword [esp + esi - 0x654c97bf], ebx
dec ebp
arpl bp, bp
ja 0x7250c5
bswap ecx
lea edi, [edi + ecx - 0x8e47523]
jne 0x616172
test eax, esp
idiv ebp
jmp dword [esi + 0x41]
inc cx
xor eax, 0x4166460c
add eax, 0x45661c8f
xor ecx, eax
dec edx
add dword [esp + edi - 0x9a1b], 0x1c05b883
mov eax, ebp
inc di
mov dword [ebx + edi - 0x9a23], eax
inc edi
mov esi, dword [edx + edi - 0x9a29]
movsx ecx, ax
dec eax
sbb edx, edx
inc ebp
xor esi, ecx
dec eax
neg eax
dec eax
lea esi, [ebp*4 - 0x65da9ef]
call fcn.00722e21
sbb dword [ebx - 0x394dd69f], 0xd6b80cae
mov ecx, 0x9278746a
salc
push ebp
adc eax, 0xd6927878
leave
mov eax, dword [0xd692785c]
cmc
stc
dec esp
js 0x63698d
salc
xchg ecx, eax
fstp st(4)
inc ebx
jbe 0x636a43
loopne 0x636a5a
xchg ebp, eax
arpl word [edi], di
jne 0x636a4a
push dword [ebx]
and edx, esi
salc
dec eax
bswap esp
rcr byte [0x622673a], cl
jle 0x636a0c
and al, byte [0xfffff47e]
fcom qword [ebx]
push ebp
inc edx
pop ss
cmp al, 0xda
popfd
lahf
sub byte [esp], cl
out 0xdc, al
push es
xlatb
sub byte [ecx], ch
ret
dec eax
bound eax, qword [esi + 0x59]
movsb byte es:[edi], byte [esi]
mov edi, edi
adc al, 9
movsb byte es:[edi], byte [esi]
mov edi, edi
imul dx, word es:[eax], 0x1a
jb 0x636a13
invalid
dec ecx
adc edi, ebp
inc edx
or byte [esp + esi - 0x654c97ab], 0xb8
inc bp
movzx ebp, byte [ebx + eax - 0xd482]
inc edx
mov al, byte [eax + ebx - 0xd480]
rol word [esp + ebp - 0x447010f9], 1
call fcn.00649f96
inc ecx
mov eax, 0x94a6e4b1
dec ecx
mov eax, dword [ebx]
inc ecx
movsx ebp, al
inc ecx
mov cl, byte [ebx + 8]
inc esp
movzx edi, ch
call fcn.00610ad6
inc eax
ror dword [esp + 8], 0x82
mov dword [esp], 0x2bb5a109
xor edx, 0x868f5702
push 0xa69f2819
dec ecx
push 0x482f532c
lea esp, [esp + 0x14]
jne 0x6331c5
mov eax, 0xcae9e2f
dec al
movsx ecx, ax
pop ebx
call fcn.0055c9f8
push 0x98087d27
mov eax, dword [esp]
call fcn.00631f4a
Function at 0x63a807
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc ebp
xor eax, ecx
inc ecx
bswap eax
inc ecx
sub eax, 0xb0a5ce19
call fcn.006de64f
jb 0x73f7df
movzx edx, si
dec ebp
lea edx, [edx + edx - 0xb828]
inc ecx
mov edi, 0xff99cd3f
dec eax
lea ebx, [edx + edx*8 + 0x2a136911]
sal esi, 0x46
inc ebp
mov eax, dword [edx + edx*4 - 0x2e090]
dec edx
lea ebp, [ebx + edi*2 + 0x361cbf96]
jp 0x624aec
sub esi, 4
mov ecx, 0x572db10b
call fcn.006d9d1b

Function at 0x63c34f
Capabilities:
Encrypt data using speck

Disassembly:
not edx
bswap edx
xor ax, word [esp + 4]
and dword [esp + 4], ecx
xor ebx, edx
call fcn.006013c0

Function at 0x63d240
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
not al
dec ecx
sal esp, 0x69
dec edx
mov dword [esp + ebp*2 - 0x1fff2], esi
je 0x6d742a
bswap eax
dec esi
mov esp, dword [eax + ebx - 0x16127dc]
dec ebp
or edi, esp
jmp 0x6f08d9

Function at 0x63fbfd
Capabilities:
Encrypt data using speck

Disassembly:
lea edi, [edi + edx*8 - 0x6d3fffce]
add dl, 0x36
mov dword [esp + edx - 0xda7ff2c], 0x9588de8e
lea esi, [esi + edx*8 - 0x6d3ff981]
movzx ecx, byte [edx + esi - 0xda7ff30]
adc byte [esp + edx - 0xda7ff2a], dh
xor cl, bl
mov dword [esp + edx*8 - 0x6d3ff980], edx
xor cl, 0x92
sar edx, 0x45
sub cl, 0x1c

Function at 0x644b35
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
lea esp, [edx + edx*4 - 0x73fc4ddc]
inc di
mov eax, dword [edx + edi - 0xcd13]
call fcn.006febef

Function at 0x647158
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
or esi, eax
dec edi
lea edx, [edx - 0x7f0800a5]
inc ecx
xor ch, cl
call fcn.0063cb13
xor ecx, 0xebb60c25
jmp 0x6fe655
xor ebx, ecx
xadd dl, al
sar dl, 0x86
add ebp, ecx
jmp 0x712d64
sub ax, word [esp + edx + 0x51213d01]
or dl, byte [edx + edi + 0x51213d00]
lea ecx, [eax + eax - 0x1548137c]
movzx ax, byte [edi + ecx - 0x262282c8]
not ecx
neg cl
add edi, 2
neg ecx
setl cl
imul dl
and word [esp + ecx - 0x262281fe], 0xea35
mov word [edi + ecx - 0x26228200], ax
call fcn.006e3423
mov ecx, 0x8083039
call fcn.006fe446

Function at 0x647394
Capabilities:
Encrypt data using speck

Disassembly:
dec cl
bswap edx
pop eax
not cl
xor bl, cl
and edx, edx
neg edx
jae 0x64daeb

Function at 0x6484d5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push eax
mov eax, 0x4cbd5fb2
push edx
jmp 0x6df033
jmp 0x61186c
push esi
pushfd
lea eax, [eax + eax*2 + 0x67b8cb39]
rol eax, 0x5b
push esi
inc eax
lea esi, [eax*2 - 0x1e78fa51]
push ebp
adc esi, eax
call fcn.00622e3a
inc esp
and esi, ebx
call fcn.006f8e5e
Function at 0x64cad6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc bp
mov dword [ebx + eax - 0x4f881190], eax
dec esi
lea ebx, [edx + ebx - 0xc17f]
inc ecx
sub edx, ebp
pop eax
dec eax
mov dword [esp + eax - 0x4f76ef67], edi
ret
jno 0x72fb6d
sbb cl, 0x80
xor ebx, edx
call fcn.0070b909
movzx edx, byte [esi + edx - 0x58d0deaa]
xor dl, bl
xadd cl, ch
call fcn.0055af6f
xor eax, 0x351bff9a
adc eax, 0xff9a3506
and esp, dword [ebp - 6]
add dword [edx], ebx
inc bp
xor eax, ecx
inc sp
xor esi, eax
movzx ecx, bp
inc cx
not eax
inc ecx
pop esp
inc cx
adc eax, 0x4166daba
ror eax, 1
inc cx
xor eax, 0x8948460c
xchg esp, eax
sub al, 0xa1
out dx, al
ja 0x72fb46
neg word [esp + ebp - 0x4f881166]
inc cx
add eax, 0x41661c8f
xchg esi, edx
ror word [esp + ebp - 0x4f881161], 0xe1
dec eax
add dword [esp + eax - 0x4f881190], ebx
inc bp
xor ecx, eax
jmp 0x568ec2

Function at 0x64caf8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
xor ebx, ecx
inc dx
not dword [esp + esi*2 - 0xa62a78]
movsx esi, ax
and bp, si
bswap ebx
inc bp
inc ebx
dec edx
mov dword [esp + esi - 0x531533], ebp
inc ecx
mov esp, 0x71028bbb
bswap ebx
neg ebx
inc ecx
pop ebp
inc edx
xor al, byte [esp + esi - 0x531541]
push eax
dec esi
mov dword [esp + esi*2 - 0xa62a76], ecx
call fcn.005eaf93

Function at 0x64cb3b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
je 0x6e384e
movzx edx, byte [ecx]
clc
shl esi, 8
jmp 0x6e10f2
inc ecx
jmp 0x7049d9
rep stosd dword es:[edi], eax
jmp 0x6500c0
dec ecx
not esi
neg dword [esp + 0xa]
dec eax
mov dword [esp], 0x3297f82a
call fcn.006bf00a
mov dword [ebp - 0x28], edi
jmp 0x6d7d70
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp + 8]
lea eax, [ecx - 1]
jmp 0x6bc80a
mov dword [ebp - 0x40], eax
cmc
sub esi, esi
stc
cmp bp, 0xd011
or eax, 0xffffffff
sub edi, edi
cmp ecx, dword [ebp - 0x40]
jmp 0x5f3f1c
mov dword [ebp - 0x24], edi
jmp 0x6febb4
inc edi
or esi, edx
jmp 0x6466ba
mov dword [ebp - 0x2c], edi
je 0x6500c5
mov ecx, eax
or di, 0xb43a
bt edi, 0x3d
mov eax, 0x400
mov edi, edx
movzx edx, ax
movzx ax, dh
bt ax, si
setb ah
mov eax, edx
shl edx, 0x10
cmc
test dx, si
or eax, edx
shr ecx, 1
jmp 0x646e07
cmp edi, 5
jmp 0x712db5
jl 0x6bc81b
mov dword [ebp - 8], ecx
test eax, esi
btc edi, esi
shrd di, di, 0xa3
lea esp, [esp]
cmovnp edx, edx

Function at 0x64e2df
Capabilities:
Encrypt data using speck

Disassembly:
sal bx, 0x6e
inc ebp
movzx eax, cx
dec esi
mov ecx, dword [esp + ebp*8 + 8]
dec eax
arpl ax, ax
dec edx
mov dword [esp + edi - 0x62febdbf], 0x4b940e91
inc bx
dec eax
adc edi, eax
dec ebx
lea edx, [eax - 0x55c0154c]
inc cx
dec eax
inc edx
sal byte [esp + edi - 0x62febdb8], 1
dec ebx
mov esi, dword [ebx + ebp*2]
dec esi
mov dword [esp + ebp*2 + 8], esp
dec ebx
mov ebx, dword [ebx + edi - 0x62febdb7]
xadd ebp, ecx
dec edi
lea ebx, [ebx + ebp + 0x10]
inc edx
rol byte [esp + edi - 0x62febdb0], 0x27
inc esi
movzx esi, word [esp + ebp*2 + 0xa]
inc ebp
xchg al, dh
dec ecx
mov dword [edi + esi - 0x62febdbf], ebx
inc ecx
xchg eax, ebp
call fcn.006ee1b3
Function at 0x64e361
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + ebp*2 - 0x5e], ebx
inc ecx
movsx eax, ch
dec esp
mov esp, dword [esp + edx - 0x27]
and al, 0x17
dec esp
mov esi, dword [esp + edx - 0x1f]
call fcn.00606f36

Function at 0x64e39a
Capabilities:
Encrypt data using speck

Disassembly:
inc ebp
xor eax, ebp
dec esp
adc dword [esp + ebx - 0xf1c], ecx
xor dword [esp + ebp*2 - 0x50], edx
dec eax
mov dword [esp + ebx*2 - 0x1e48], 0x3db15e37
dec esp
mov ecx, dword [esp + ebx*2 - 0x1e40]
sar bx, 0x4c
inc ecx
dec ebp
dec eax
arpl dx, dx
neg word [esp + ebx*2]
jno 0x7278e6
inc esp
movsx esp, dl
inc ecx
ror ebp, 3
movzx ecx, si
inc ecx
inc ebp
inc ecx
push ecx
inc esp
xor dword [esp + esi*4 - 0x6908da2c], ebp
inc eax
sal dh, 0x41
rol ax, cl
inc esp
movsx edi, cl
inc ecx
pop ecx
dec ebp
arpl bp, bp
jnp 0x74061e
mov ebx, 0xed12ba1a
inc ecx
mov esi, 0x74a924a9
dec ebx
mov edx, dword [esi + ebx - 0x74a924a9]
inc ecx
movsx ebp, dh
inc bp
mov edi, dword [esi + edx - 0x74a924a9]
inc cx
sar esi, 0x89
inc ecx
movzx ecx, si
inc esp
movzx esp, ch
dec edi
lea ebx, [ebx + esi - 0x74a9000c]
inc bp
mov dword [ebx + ecx - 0x12], edi
and ecx, 0x728130b1
dec edi
lea edx, [esi + edx - 0x74a90016]
inc sp
xor esp, ebp
movsx edx, bp
inc ebx
mov edx, dword [edx + esi - 0x74a90012]
inc esp
mov eax, ecx
inc ecx
xor edx, ecx
jmp 0x6cf40b
sar bx, 0xcf
neg edx
inc ecx
not dh
not edx
bswap edx
inc edx
inc ecx
push ecx
xor dword [esp + ecx*2 - 0x20], edx
inc eax
movzx eax, ch
dec eax
or eax, ecx
inc ecx
pop ecx
jge 0x7495fc
dec esi
lea edi, [eax + ebp*4 - 0x1dd4b47b]
inc ecx
push edi
inc ebx
movzx ebx, byte [ebp + edx - 1]
inc ecx
xor bl, cl
inc edx
shr dword [esp + ebp*2 + 6], 0x81
dec esp
lea eax, [eax*4 + 0x579fa703]
pop edx
dec bl
jmp 0x701786
dec eax
add edi, edx
dec eax
mov dword [esp + ebx + 8], 0xe2515bd
dec ecx
sal eax, 0xe7
dec eax
mov dword [esp + ebx*2], edi
ret 8
inc ecx
seta bh
ja 0x5ebc3d
mov eax, 0xb5bab384
push eax
inc esp
movsx ebp, byte [esp + 4]
inc bx
mov esi, dword [ebx + ebp*4]
jmp 0x72502a
Function at 0x654b58
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + eax - 0xd2fa], 0x5c0d5b0c
pop edx
ja 0x565eff
ror edx, 3
inc ecx
mov ebp, 0x3693fb8a
inc edx
lea edx, [edx + ebp*2 + 0x6373b116]
neg edx
inc esp
mov edi, ebp
mov dword [esp + ebp - 0xaab0], ebp
not edx
rol bp, 0x21
dec esp
mov dword [esp + ebp*2 - 0xaada], ecx
inc edx
xor dword [esp + 8], edx
dec esp
mov ecx, dword [esp + ebp*8 - 0x2ab80]
call fcn.0070e794
lea esi, [esi + ebp*2 - 0x2d20661a]
dec esp
mov dword [esp + ebp*2], ecx
call fcn.0062e73d
dec ecx
add esi, 0xde10d59a
jne 0x6ee853
movzx eax, cx
mov esi, edx
jle 0x620f85
arpl word [edi], di
loope 0x654af1
sbb eax, 0x6a428656
or dword [edx], 0xe6aad8b9
outsb dx, byte [esi]
dec ecx
or bh, byte [ecx + 0x56a6fed8]
dec ecx
or bh, byte [ecx + 0x429212d8]
inc ecx
or bh, byte [ecx + 0x7e6612d8]
jns 0x654b94
mov ecx, 0xbcae6ed8
and ecx, ecx
dec ebx
and al, 0xb2
sub ecx, dword [ecx - 0xe]
and eax, 0xea5841e7
mov dl, 0x2b
dec ecx
and eax, 0xea5841e7
xchg ebx, eax
lodsb al, byte [esi]
push edi
inc ebp
inc esp
movzx edi, bx
inc ecx
mov dword [ebx + edx*2], ebp
dec ebx
lea ebp, [eax + eax + 0x149fdabd]
dec eax
xor edx, edi
jmp edx

Function at 0x656eae
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg edx
add cx, ax
xor ebx, edx
and eax, eax
dec cx
neg ecx
add ebp, edx
lea edx, [ecx + ecx*4 + 0x5c1cd615]
sal ecx, 0x49
jne 0x64cae6
inc esi
or ebp, dword [esp + edi*8 + 3]
inc eax
dec ch
inc esp
xor cl, ch
mov eax, 0x5e925831
dec edx
lea esi, [ebx + eax - 0x7ef75a4e]
inc esi
xor dword [esp + edi*2 + 4], eax
dec eax
lea ebp, [esp + ebp + 8]
inc esp
xadd edx, eax
inc ecx
inc ch
dec esi
xor esi, dword [ebp + edi]
dec edi
lea ebx, [ebx + edi*2 - 8]
dec ebx
lea ebp, [ebp + edi*8 - 0x50d362ed]
dec edi
mov dword [edi + ebx], esi
ror eax, 0xce
dec edi
lea edx, [edx + edi*2 - 4]
inc ecx
rol bh, 0xc4
inc ebx
or ebx, dword [edx + edi*2]
inc ecx
add ebp, eax
inc ecx
xor ebx, ecx
rol ebx, 1
inc dx
sar dword [esp + edi*4 + 4], 0x8c
dec esp
and ebp, ebp
lea ebx, [ebx + esi*4 - 0x37b4ac7d]
dec esp
lea eax, [esi + esi*2 - 0x2dddf84e]
dec edx
ror dword [esp + edi], 0xab
bswap ebx
neg ebx
push ebp
push ebp
inc dx
xchg dword [esp + edi*2 + 0x11], esi
dec esi
mov dword [esp + ebp - 0x7c2ecbf1], ecx
inc ecx
push edi
inc esi
movzx esi, word [esp + ebp - 0x7c2ecbf2]
inc edx
xor dword [esp + ebp - 0x7c2ecbe9], ebx
dec ecx
ror eax, 0xa9
xor dl, 0x95
dec esi
mov ecx, dword [esp + edi*2 + 0x18]
inc edx
sal dword [esp + edi + 4], 0x88
inc ecx
shr ebp, 0xfb
dec eax
arpl bx, bx
inc sp
sbb esi, esi
dec edx
mov dword [esp + ebp*2 - 6], esi
dec eax
add edi, ebx
pop esi
pop eax
pop eax
pop esi
jmp fcn.005e92fc
or bl, 0xb7
push dword [esp + 0x28]
popfd
call fcn.00728ede
mov ecx, 0x65bd8596
not ecx
inc edx
lea eax, [ecx*8 + 0x330a9c9a]
add eax, ecx
not edx
inc eax
inc edx
and eax, eax
and al, ch
jae 0x5e91f8
Function at 0x656f7a
Capabilities:
Encode data using xor

Disassembly:
dec eax
adc edi, ebx
dec edx
mov dword [esp + ebp - 0x169ffff0], 0xeb935034
dec ebx
mov edx, dword [ebx + ebp*4 - 0x5a800000]
inc edx
movsx ebp, byte [esp + ebp - 0x169fffed]
call fcn.0062886b
add byte [edx], ah
xchg dword [edx - 0xaf133c3], esp
mov esi, 0x3a29fa2
adc eax, 0x6679cfe9
leave
push ss
xor byte [ebx - 0x3a], cl
aad 0xf
adc dword [ecx - 0x77aa9c7a], ebx
test dword [ebx], ebp
jne 0x656f80
sub al, 0x10
add byte [eax - 0x17], ah
xor al, 0x50
xchg ebx, eax
jmp 0x656fd5
xchg byte [ebx + 0x55], ah
mov byte [ebp + 0x6cbd752b], al
insb byte es:[edi], dx
sbb esi, esi
bound eax, qword [esi]
cmp bh, byte [ecx]
push es
mov dword [0x6f822063], eax
jge 0x656fbb
xor al, 0x78
mov dl, 0xf6
lcall 0x24f4, 0x85539dc6
pop ss
daa
and edx, dword [edx + 0x6b]
xchg edx, eax
mov bl, 0xd7
insd dword es:[edi], dx
and al, 0x3a
invalid
neg byte [edx - 0x7aac623a]
hlt

Function at 0x6b875e
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, eax
jae 0x601c80
dec ebx
mov edx, dword [ebp + ebx - 0x3de59d]
inc ecx
mov esi, ebp
dec edi
lea ebx, [ebx + ebp - 0x3de59d]
dec ebx
lea ebp, [ebp + ebp*4 + 0x5c10f829]
dec eax
and eax, edx
dec eax
not eax
dec ebx
mov dword [ebp + ebx - 0x3de5a5], eax
inc eax
movzx ecx, dh
dec ecx
xor ebp, ebp
inc esp
movzx esp, dh
dec edi
lea edx, [edx + ebp*2 - 0x7bcb4e]
dec ebp
lea eax, [esp - 0x62ca7942]
inc esp
mov edi, ebp
inc edi
mov edi, dword [edx + ebp*2 - 0x7bcb4a]
inc ebp
xor edi, ecx
sub si, bp
inc ecx
xor edi, 0x44134f88
dec eax
lea eax, [ecx*4 + 0x2336a2bd]
inc ecx
neg edi
dec eax
sub eax, 0xc5acfa91
jns 0x63543f
inc bp
mov dword [esp + esi], edi
jns 0x7014b5
mov eax, 0xee318b87
sub esi, 4
mov eax, dword [esi]
jmp 0x74ca67
dec esp
xchg ecx, eax
inc ecx
dec edi
inc ecx
shr ebp, 0x64
dec eax
shr esi, cl
dec eax
lea edx, [esi - 0x6d5d9fc6]
inc ecx
xor edi, 0x5bb5e49a
inc ecx
push ecx
call fcn.00653414
inc ecx
not ah
dec esp
mov dword [esp + esi*2], ebp
shl bx, 0xec
shl bp, 0x61
inc ecx
dec ah
not dword [esp + esi*8 + 4]
inc ecx
ror ah, 1
inc ebp
xor cl, ah
sal word [esp + esi + 6], 0x25
add bl, byte [esp + eax*2 - 0x63]
dec esi
lea esp, [esp + 8]
jno 0x569d4a
push ecx
dec eax
mov dword [esp + esi*4], edi
ret 8
neg eax
call fcn.00723be3
xor eax, ebx
push 0x9c2768ac
bswap eax
and dword [esp], 0xd4b323a3
rol dword [esp], 0xb0
not eax
js 0x739e62

Function at 0x6ba2b7
Capabilities:
Encode data using xor

Disassembly:
inc ecx
bswap esp
lea ebp, [ebp + edx*8 + 0x72ff5892]
dec esp
mov dword [esp + esi*2 - 0x13946], ecx
dec esp
mov dword [esp + esi - 0x9cab], esp
shr dword [esp + ebx*2 - 0x2e20], 0x3f
xor dword [esp + esi*8 - 0x4e548], ebp
inc cx
sar eax, 0xa1
inc ebp
movsx ecx, ax
dec esp
mov ecx, dword [esp + esi - 0x9c9b]
dec eax
arpl bp, bp
dec eax
adc edi, ebp
call fcn.00622981
movsd dword es:[edi], dword [esi]
sub bh, ah
salc
in al, 0x98
mov ch, 0xd7
mov ch, 0x28
clc
cmp esp, dword [0x90296733]
nop
sub eax, 0xc0296733
call 0x29d2d63d
xchg esp, eax
out dx, al
inc ebp
mov esp, 0x222b375f
invalid
Function at 0x6bc02a
Capabilities:
Encrypt data using speck

Disassembly:
inc cl
dec ax
bswap eax
xor cl, 0xb1
call fcn.00638bfb
sbb al, dl
not ecx
neg ecx
xor ecx, 0xf70a0d00
inc dx
xor ebx, ecx
add ebp, ecx
lea ecx, [eax*8 + 0x4023e29]
xadd edx, ecx
push ecx
lea esi, [esi + edx - 0x6c033318]
setno cl
movzx ecx, byte [eax + esi - 0x2d000087]
rol dx, 0x8b
xor cl, bl
sal byte [esp + edx - 0x6c03b996], 1
pop eax
sbb cl, 0x3c
shl dl, 0xe4
rol cl, 1
jmp 0x61ec3f
inc esp
xor cl, dl
dec eax
lea edx, [esp + edx + 8]
inc ecx
dec ebp
dec ecx
dec eax
dec edx
mov esi, dword [edx + esi*2 - 0x8c]
dec edx
mov dword [esp + esi*2 - 0x8c], ecx
dec ebx
mov dword [ebx + esi - 0x4a], esi
inc cx
inc ebp
dec edi
lea ebx, [ebx + esi - 0x4a]
jns 0x6dd679
rol byte [esp + ebx - 0x190b0dfa], 0xc1
call fcn.007396b5
mov ecx, 0x2592f0b4
movzx eax, cx
lea esi, [ecx + esi - 0x2592f0b8]
mov ecx, dword [esi + ecx*2 - 0x4b25e168]
mov edx, eax
xor ecx, ebx
inc edx
ror ecx, 3
ror eax, 0xca
jae 0x63cd26