joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000333c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add rax, 0x20
jmp 0x140003356
cmp r8w, r9w
je 0x1400033b0
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003350
add rdx, 2
cmp r8w, r9w
je 0x140003360
jmp 0x140003350
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400033e3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400033e0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
sub rsp, rdi
mov r15, rsp
mov byte [r15], r11b
movzx r14d, byte [r14]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
adc dword [rax], ecx
cmp dword [rcx + r11*8], r10d
jae 0x1400033e0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
xor r9b, dl
not r9b
and r9b, r8b
xor r9b, dl
movzx edx, r9b
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400034c2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400034c0
add r9, rax
inc r9
mov r10d, 0xab43
add byte [rax], al
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
sub esp, edi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400034e0
cmp r10d, 0x7080d354
jne 0x1400034c0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
Function at 0x14000353a
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140003576
cmp r9w, r10w
je 0x1400035d0
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
mov ecx, edx
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [r8 + rsi]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140003570
add r8, 2
cmp r9w, r10w
je 0x140003580
jmp 0x140003570
mov rcx, qword [rcx + 0x20]
movsxd rdx, dword [rcx + 0x3c]
lea r8, [rdx + rcx]
movzx r9d, word [rdx + rcx + 0x14]
add r8, r9
add r8, 0x18
add rdx, rcx
invalid
invalid
ret 0x88
invalid

Function at 0x140003572
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx ecx, byte [rbp - 0x30]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140003576
cmp r9w, r10w
je 0x1400035d0
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
mov ecx, edx
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [r8 + rsi]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140003570
add r8, 2
cmp r9w, r10w
je 0x140003580
jmp 0x140003570
mov rcx, qword [rcx + 0x20]
movsxd rdx, dword [rcx + 0x3c]
lea r8, [rdx + rcx]
movzx r9d, word [rdx + rcx + 0x14]
add r8, r9
add r8, 0x18
add rdx, rcx
invalid
invalid
ret 0x88
invalid
Function at 0x1400035c5
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
nop word cs:[rax + rax]
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140003600
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
sub rsp, rdi
mov r12, rsp
mov byte [r12], bl
movzx r15d, byte [r15]
not r15b
or r14b, bl
not bl
or bl, r15b
and bl, r14b
movzx ebx, bl
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140003600
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
sub rsp, rdi
mov r11, rsp
mov byte [r11], r8b
movzx r10d, byte [r10]
not r10b
or r9b, r8b
not r8b
or r8b, r10b
and r8b, r9b
movzx r8d, r8b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x1400036f3
inc r8d
movzx r8d, r8w
mov r10d, dword [r9 + r8*4]
add dword [rcx + 0xf], 0x840a1cb6
invalid
je 0x1400036f0
add r10, rcx
inc r10
mov r11d, 0xab43
movsx ebx, bl
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov dword [r15], ebx
mov r14d, dword [r14]
not r14d
or r11d, ebx
not ebx
or ebx, r14d
and ebx, r11d
imul r11d, ebx, 0x127aa3
movzx ebx, byte [r10]
inc r10
test bl, bl
jne 0x140003710
cmp r11d, 0xf417b87a
jne 0x1400036f0
dec r13d
mov r9d, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
add rdx, rcx
movzx edx, word [rdx + r8*2]
add r9, rcx
mov r10d, dword [r9 + rdx*4]
add r10, rcx
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, qword [rbp - 0x38]
mov r8d, r13d
xor r9d, r9d
call r10
call rdx
Function at 0x140003642
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
nop word cs:[rax + rax]
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140003600
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
sub rsp, rdi
mov r12, rsp
mov byte [r12], bl
movzx r15d, byte [r15]
not r15b
or r14b, bl
not bl
or bl, r15b
and bl, r14b
movzx ebx, bl
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140003600
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
sub rsp, rdi
mov r11, rsp
mov byte [r11], r8b
movzx r10d, byte [r10]
not r10b
or r9b, r8b
not r8b
or r8b, r10b
and r8b, r9b
movzx r8d, r8b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x1400036f3
inc r8d
movzx r8d, r8w
mov r10d, dword [r9 + r8*4]
add dword [rcx + 0xf], 0x840a1cb6
invalid
je 0x1400036f0
add r10, rcx
inc r10
mov r11d, 0xab43
movsx ebx, bl
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov dword [r15], ebx
mov r14d, dword [r14]
not r14d
or r11d, ebx
not ebx
or ebx, r14d
and ebx, r11d
imul r11d, ebx, 0x127aa3
movzx ebx, byte [r10]
inc r10
test bl, bl
jne 0x140003710
cmp r11d, 0xf417b87a
jne 0x1400036f0
dec r13d
mov r9d, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
add rdx, rcx
movzx edx, word [rdx + r8*2]
add r9, rcx
mov r10d, dword [r9 + rdx*4]
add r10, rcx
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, qword [rbp - 0x38]
mov r8d, r13d
xor r9d, r9d
call r10
call rdx
Function at 0x140003662
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
nop word cs:[rax + rax]
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140003600
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
sub rsp, rdi
mov r12, rsp
mov byte [r12], bl
movzx r15d, byte [r15]
not r15b
or r14b, bl
not bl
or bl, r15b
and bl, r14b
movzx ebx, bl
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140003600
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
sub rsp, rdi
mov r11, rsp
mov byte [r11], r8b
movzx r10d, byte [r10]
not r10b
or r9b, r8b
not r8b
or r8b, r10b
and r8b, r9b
movzx r8d, r8b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x1400036f3
inc r8d
movzx r8d, r8w
mov r10d, dword [r9 + r8*4]
add dword [rcx + 0xf], 0x840a1cb6
invalid
je 0x1400036f0
add r10, rcx
inc r10
mov r11d, 0xab43
movsx ebx, bl
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov dword [r15], ebx
mov r14d, dword [r14]
not r14d
or r11d, ebx
not ebx
or ebx, r14d
and ebx, r11d
imul r11d, ebx, 0x127aa3
movzx ebx, byte [r10]
inc r10
test bl, bl
jne 0x140003710
cmp r11d, 0xf417b87a
jne 0x1400036f0
dec r13d
mov r9d, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
add rdx, rcx
movzx edx, word [rdx + r8*2]
add r9, rcx
mov r10d, dword [r9 + rdx*4]
add r10, rcx
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, qword [rbp - 0x38]
mov r8d, r13d
xor r9d, r9d
call r10
call rdx
Function at 0x1400036ba
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
nop word cs:[rax + rax]
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140003600
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
sub rsp, rdi
mov r12, rsp
mov byte [r12], bl
movzx r15d, byte [r15]
not r15b
or r14b, bl
not bl
or bl, r15b
and bl, r14b
movzx ebx, bl
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140003600
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
sub rsp, rdi
mov r11, rsp
mov byte [r11], r8b
movzx r10d, byte [r10]
not r10b
or r9b, r8b
not r8b
or r8b, r10b
and r8b, r9b
movzx r8d, r8b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x1400036f3
inc r8d
movzx r8d, r8w
mov r10d, dword [r9 + r8*4]
add dword [rcx + 0xf], 0x840a1cb6
invalid
je 0x1400036f0
add r10, rcx
inc r10
mov r11d, 0xab43
movsx ebx, bl
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov dword [r15], ebx
mov r14d, dword [r14]
not r14d
or r11d, ebx
not ebx
or ebx, r14d
and ebx, r11d
imul r11d, ebx, 0x127aa3
movzx ebx, byte [r10]
inc r10
test bl, bl
jne 0x140003710
cmp r11d, 0xf417b87a
jne 0x1400036f0
dec r13d
mov r9d, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
add rdx, rcx
movzx edx, word [rdx + r8*2]
add r9, rcx
mov r10d, dword [r9 + rdx*4]
add r10, rcx
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, qword [rbp - 0x38]
mov r8d, r13d
xor r9d, r9d
call r10
call rdx

Function at 0x1400037d0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov qword [rbp - 0x18], rcx
lea rcx, [0x14000a1c6]
mov qword [rbp - 0x10], rcx
lea rcx, [0x14000a30c]
mov qword [rbp - 8], rcx
mov qword [rbp], 0
xor ecx, ecx
nop word cs:[rax + rax]
Function at 0x140003854
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140003890
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003830
add rdx, 2
cmp r8w, r9w
je 0x140003840
jmp 0x140003830
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400038c3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp + 0x18], 0x54
mov byte [rbp + 0x14], 0x54
movzx r10d, byte [rbp + 0x14]
movzx r11d, byte [rbp + 0x18]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400038c0
mov byte [rbp + 0x1f], 0x54
mov byte [rbp + 0x13], 0x54
movzx r11d, byte [rbp + 0x13]
movzx ebx, byte [rbp + 0x1f]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
sub rsp, rdi
mov r13, rsp
mov byte [r13], r11b
mov byte [rbp], bl
movzx r15d, byte [r15]
not r15b
or bl, r11b
not r11b
or r11b, r15b
sti
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400038c0
mov byte [rbp + 0x18], 0x6f
mov byte [rbp + 0x14], 0x6f
movzx edx, byte [rbp + 0x14]
movzx r8d, byte [rbp + 0x18]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
Function at 0x140003876
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140003890
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003830
add rdx, 2
cmp r8w, r9w
je 0x140003840
jmp 0x140003830
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400038c3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp + 0x18], 0x54
mov byte [rbp + 0x14], 0x54
movzx r10d, byte [rbp + 0x14]
movzx r11d, byte [rbp + 0x18]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400038c0
mov byte [rbp + 0x1f], 0x54
mov byte [rbp + 0x13], 0x54
movzx r11d, byte [rbp + 0x13]
movzx ebx, byte [rbp + 0x1f]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
sub rsp, rdi
mov r13, rsp
mov byte [r13], r11b
mov byte [rbp], bl
movzx r15d, byte [r15]
not r15b
or bl, r11b
not r11b
or r11b, r15b
sti
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400038c0
mov byte [rbp + 0x18], 0x6f
mov byte [rbp + 0x14], 0x6f
movzx edx, byte [rbp + 0x14]
movzx r8d, byte [rbp + 0x18]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
Function at 0x1400038a8
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140003890
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003830
add rdx, 2
cmp r8w, r9w
je 0x140003840
jmp 0x140003830
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400038c3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp + 0x18], 0x54
mov byte [rbp + 0x14], 0x54
movzx r10d, byte [rbp + 0x14]
movzx r11d, byte [rbp + 0x18]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400038c0
mov byte [rbp + 0x1f], 0x54
mov byte [rbp + 0x13], 0x54
movzx r11d, byte [rbp + 0x13]
movzx ebx, byte [rbp + 0x1f]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
sub rsp, rdi
mov r13, rsp
mov byte [r13], r11b
mov byte [rbp], bl
movzx r15d, byte [r15]
not r15b
or bl, r11b
not r11b
or r11b, r15b
sti
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400038c0
mov byte [rbp + 0x18], 0x6f
mov byte [rbp + 0x14], 0x6f
movzx edx, byte [rbp + 0x14]
movzx r8d, byte [rbp + 0x18]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
Function at 0x140003c1c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x48], rcx
mov byte [rbp + 0x18], 0x69
movzx eax, byte [rbp + 0x18]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
add byte [rax - 0x75], cl
sbb byte [rax - 0x7d], cl
shl byte [rax], 0xeb
invalid
jne 0x140003bf0
cmp r10d, 0xdd833843
jne 0x140003bd0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp + 0x18], 0x69
movzx eax, byte [rbp + 0x18]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140003c76

Function at 0x140003c8c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmp r8w, r9w
je 0x140003cd0
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003c70
add rdx, 2
cmp r8w, r9w
je 0x140003c80
jmp 0x140003c70
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add edx, 0x18
add rcx, rax
invalid
invalid
Function at 0x140003dec
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp + 0x18], 0x54
mov byte [rbp + 0x14], 0x54
movzx r10d, byte [rbp + 0x14]
movzx r11d, byte [rbp + 0x18]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x140003d00
mov byte [rbp + 0x1f], 0x54
mov byte [rbp + 0x13], 0x54
movzx r11d, byte [rbp + 0x13]
movzx ebx, byte [rbp + 0x1f]
sub rsp, rdi
mov r15, rsp
mov byte [r15], bl
mov r15d, r11d
mov edi, ebx
mov edi, ebx
xor r15b, r11b
not r15b
and r15b, bl
xor r15b, r11b
movzx r11d, r15b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x140003d00
mov byte [rbp + 0x18], 0x6f
mov byte [rbp + 0x14], 0x6f
movzx edx, byte [rbp + 0x14]
movzx r8d, byte [rbp + 0x18]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
sub rsp, rdi
mov r10, rsp
mov byte [r10], dl
movzx r9d, byte [r9]
not r9b
or r8b, dl
not dl
or dl, r9b
and dl, r8b
movzx edx, dl
mov ecx, dword [rcx + rdx*8]
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x140003de2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x140003de0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r15, rsp
mov dword [r15], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x140003e00
cmp r10d, 0x7080d354
jne 0x140003de0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
add rdx, rax
sub rsp, 0x20
mov ecx, 0xfffffff5
call rdx
add rsp, 0x20
mov byte [rbp + 0x18], 0x69
movzx ecx, byte [rbp + 0x18]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140003e96
Function at 0x140004134
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
and byte [rax], al
add byte [rsi - 0x7d], ah
clc
add dh, byte [rbp + 0x4f]