joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c070
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100351a6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x240], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push esi
lea ecx, [ebp - 0x248]
call fcn.1001d520
mov eax, dword [edi]
sub eax, 0x10
push eax
mov dword [ebp - 4], ebx
call fcn.100083c0
add esp, 4
lea edi, [eax + 0x10]
lea eax, [ebp - 0x23c]
push eax
mov ebx, 0x22c
push esi
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1001c127
mov byte [ebp - 4], al
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001c10e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
call fcn.1001d540
xor eax, eax
jmp 0x1001c1b1
lea ecx, [ebp - 0x23c]
push ecx
push esi
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1001c179
mov edi, edi
lea edx, [ebp - 0x218]
push edi
push edx
call fcn.1002212d
add esp, 8
test eax, eax
je 0x1001c16d
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001c140
jmp 0x1001c179
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x240], ecx
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001c199
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
call fcn.1001d540
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100202b1
mov esp, ebp
pop ebp
ret
Function at 0x1001c1f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035208
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x240], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push esi
lea ecx, [ebp - 0x24c]
call fcn.1001d520
mov eax, dword [0x10046a68]
mov edx, dword [eax + 0xc]
mov ecx, 0x10046a68
mov dword [ebp - 4], 1
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x244], edi
lea eax, [ebp - 0x23c]
push eax
push esi
mov byte [ebp - 4], 2
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1001c2be
push 0x1003e0f0
mov ecx, ebx
call fcn.10007be0
lea eax, [edi - 0x10]
mov dword [ebp - 0x240], 1
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001c371
mov ecx, dword [eax]
push eax
jmp 0x1001c36a
lea ecx, [ebp - 0x23c]
push ecx
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1001c339
lea esp, [esp]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x234]
je 0x1001c308
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001c2e0
jmp 0x1001c339
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001c311
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x244]
call fcn.100082b0
mov edi, dword [ebp - 0x244]
lea esi, [edi - 0x10]
push esi
call fcn.100083c0
add eax, 0x10
mov dword [ebx], eax
add esp, 4
mov dword [ebp - 0x240], 1
mov byte [ebp - 4], 1
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x1001c371
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 0
call fcn.1001d540
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100202b1
mov esp, ebp
pop ebp
ret

Function at 0x1001c3a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
mov edx, dword [ebp + 0x10]
add ecx, ecx
push ecx
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push 1
push edx
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ebp
ret
Function at 0x1001c3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
push 0x208
push ecx
lea edx, [ebp - 0x20e]
push edx
mov dword [ebp - 0x218], eax
mov word [ebp - 0x210], cx
call fcn.10021fb0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x214]
push edx
push ebx
push edi
push esi
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 0x214], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001c453
mov ecx, dword [ebp - 0x218]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.100082b0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100202b1
mov esp, ebp
pop ebp
ret

Function at 0x1001c770
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035248
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x80], ecx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push 0x1003cb58
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10004dc0
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001c7f2
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.1001fa10
add esp, 8
cmp dword [ebp - 0x20], 0
mov byte [ebp - 4], 1
jne 0x1001c812
cmp dword [ebp - 0x1c], 0x10
jb 0x1001c7f2
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.100202a6
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100202b1
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x79]
call fcn.1001f7a0
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x78]
mov bl, 2
push edx
lea ecx, [ebp - 0x79]
mov byte [ebp - 4], bl
call fcn.1001f920
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.10005350
mov byte [ebp - 4], bl
mov ebx, 0x10
cmp dword [ebp - 0x64], ebx
jb 0x1001c85c
mov eax, dword [ebp - 0x78]
push eax
call fcn.100202a6
add esp, 4
mov esi, dword [ebp - 0x80]
lea ecx, [ebp - 0x5a]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov ecx, esi
call fcn.1001c610
test eax, eax
je 0x1001c895
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x56], eax
jne 0x1001c895
test eax, eax
je 0x1001c895
push edi
lea eax, [ebp - 0x4f]
push eax
mov ecx, esi
call fcn.1001c6a0
test eax, eax
je 0x1001c895
mov esi, 1
jmp 0x1001c897
xor esi, esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.1001f770
cmp dword [ebp - 0x1c], ebx
jb 0x1001c8b4
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.100202a6
add esp, 4
mov eax, esi
jmp 0x1001c7f4
Function at 0x1001c8d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035898
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov esi, dword [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001c931
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x1003cb58
mov ecx, esi
mov byte [esi], bl
call fcn.10004dc0
jmp 0x1001c994
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.1001c770
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
test eax, eax
je 0x1001c975
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call fcn.10005350
cmp dword [ebp - 0x18], 0x10
jb 0x1001c994
mov edx, dword [ebp - 0x2c]
push edx
jmp 0x1001c98c
push ebx
push 0x1003cb58
mov ecx, esi
call fcn.10004dc0
cmp dword [ebp - 0x18], 0x10
jb 0x1001c994
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100202a6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100202b1
mov esp, ebp
pop ebp
ret 8

Function at 0x1001c9c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035278
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001ca32
xor eax, eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push esi
mov ecx, edi
call fcn.1001c770
cmp dword [ebp - 0x18], 0x10
mov esi, eax
jb 0x1001ca2e
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.100202a6
add esp, 4
mov eax, esi
jmp 0x1001ca34
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100202b1
mov esp, ebp
pop ebp
ret 4
Function at 0x1001cb00
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push esi
push eax
mov dword [ebp - 4], 0
call fcn.1001aa40
add esp, 8
test al, al
je 0x1001cb64
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov dword [esi + 0x5c], ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 4]
and al, 4
sub al, 4
movzx eax, al
push 0
neg eax
push 0
sbb eax, eax
push 0
and eax, 4
push eax
push 0x10039740
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0x54], eax
test eax, eax
jne 0x1001cb6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x68], eax
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.1001ca60
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1001d3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.10022500
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov edi, 0x2000
push edi
mov dword [ebp - 0x2014], ebx
mov dword [ebp - 0x2018], eax
mov dword [ebp - 0x2010], ecx
mov dword [ebp - 0x200c], 0
call fcn.10020a82
mov ecx, dword [ebx]
add esp, 4
lea edx, [ebp - 0x200c]
push edx
mov esi, eax
mov eax, dword [ebp - 0x2010]
push esi
push 0
push 0
push eax
push ecx
mov dword [ebp - 0x200c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, 0xea
jne 0x1001d4b4
lea ebx, [ebx]
add edi, 0x1000
push edi
push esi
call fcn.1002271f
mov ecx, dword [ebp - 0x2014]
add esp, 8
lea edx, [ebp - 0x200c]
push edx
mov edx, dword [ecx]
mov esi, eax
mov eax, dword [ebp - 0x2010]
push esi
push 0
push 0
push eax
push edx
mov dword [ebp - 0x200c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, 0xea
je 0x1001d470
xor eax, eax
push 0x2000
push eax
lea ecx, [ebp - 0x2006]
push ecx
mov word [ebp - 0x2008], ax
call fcn.10021fb0
add esp, 0xc
test ebx, ebx
jne 0x1001d4ed
mov edx, dword [ebp - 0x200c]
push edx
lea eax, [ebp - 0x2008]
push esi
push eax
call fcn.100215a0
add esp, 0xc
push esi
call fcn.10020903
mov esi, dword [ebp - 0x2018]
add esp, 4
lea ecx, [ebp - 0x2008]
push ecx
mov ecx, esi
call fcn.10007be0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100202b1
mov esp, ebp
pop ebp
ret 8

Function at 0x1001f9c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001fa0a
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push esi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x100202b1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046ca0]
jne 0x100202bb
repz ret
jmp fcn.100244fa

Function at 0x10021b27
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10021b4e
call fcn.10024368
mov dword [eax], esi
call fcn.10024355
push 0x16
pop esi
mov dword [eax], esi
call fcn.10024a92
mov eax, esi
jmp 0x10021ba3
test dword [ebp + 0xc], 0xfffffff9
jne 0x10021b34
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10021b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1002437b
pop ecx
call fcn.10024355
mov eax, dword [eax]
jmp 0x10021ba3
test al, 0x10
jne 0x10021ba1
test al, 1
je 0x10021ba1
test byte [ebp + 0xc], 2
je 0x10021ba1
call fcn.10024368
mov dword [eax], 5
call fcn.10024355
mov dword [eax], 0xd
jmp 0x10021b72
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10031639
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10046ca0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10026634
and dword [ebp - 0x14], 0
cmp dword [0x10049de0], 0
mov dword [ebp - 0x18], eax
jne 0x100316ec
push 0x1003cb10
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10031794
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003cb04
push ebx
call edi
test eax, eax
je 0x10031794
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x1003caf4
push ebx
mov dword [0x10049de0], eax
call edi
push eax
call esi
push 0x1003cae0
push ebx
mov dword [0x10049de4], eax
call edi
push eax
call esi
push 0x1003cac4
push ebx
mov dword [0x10049de8], eax
call edi
push eax
call esi
mov dword [0x10049df0], eax
test eax, eax
je 0x100316ec
push 0x1003caac
push ebx
call edi
push eax
call esi
mov dword [0x10049dec], eax
mov eax, dword [0x10049dec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10031745
cmp dword [0x10049df0], ecx
je 0x10031745
push eax
call esi
push dword [0x10049df0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10031745
test ebx, ebx
je 0x10031745
call edi
test eax, eax
je 0x1003173c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1003173c
test byte [ebp - 8], 1
jne 0x10031745
or dword [ebp + 0x10], 0x200000
jmp 0x10031778
mov eax, dword [0x10049de4]
cmp eax, dword [ebp - 0x18]
je 0x10031778
push eax
call esi
test eax, eax
je 0x10031778
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10031778
mov eax, dword [0x10049de8]
cmp eax, dword [ebp - 0x18]
je 0x10031778
push eax
call esi
test eax, eax
je 0x10031778
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10049de0]
call esi
test eax, eax
je 0x10031794
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10031796
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100202b1
leave
ret
Function at 0x7142ad
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
mov edx, 0x47874eb8
push edx
mov eax, 0x3581cc88
bswap ecx
sub ecx, 0xd033d6b4
ror ecx, 1
sub word [esp + edx - 0x47874eb7], dx
xchg dx, ax
xor ecx, 0xee881096
not eax
xor ebx, ecx
pop edx
add esi, ecx
inc edx
movzx ecx, byte [edi + edx - 0x473896b9]
mov dword [esp + edx - 0x473896b9], eax
lea edi, [edi + edx - 0x473896b8]
not dword [esp + edx - 0x473896b9]
lea eax, [eax + eax - 0x2e4088c2]
xor cl, bl
push eax
call fcn.00c6ffa3

Function at 0x71fcf2
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [eax + ecx - 0x4a888456]
ror cx, 0xe
neg eax
inc cx
mov dword [esp], 0x64ab269f
inc dword [esp + 2]
dec eax
sar byte [esp + 5], cl
not cx
adc cx, 0xc214
neg eax
dec word [esp + 6]
bswap eax
call fcn.00c760d5
movzx edx, cl
dec eax
mov dword [esp + ecx - 0x3bb169be], edx
not eax
call fcn.00c08356

Function at 0x72423c
Capabilities:
Encrypt data using speck

Disassembly:
not edx
xor bl, cl
lea ecx, [esp + ecx + 0x14]
mov dword [esp + edx - 0x121], eax
ror al, 0x42
mov eax, dword [ecx + edx*2 - 0x242]
jae 0xc3cd38

Function at 0x72fb07
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + eax - 0x5975c0cc], 0xce1b83b7
movzx ecx, word [eax + esi - 0x5975c0d2]
lea esi, [edx + esi - 0x2d75c0e9]
sal dword [esp + edx - 0x2d75c0db], 0x48
or eax, 0x492ef5ac
xor cx, bx
lea eax, [eax + eax + 0x5d10c2be]
dec cx
pop eax
ror cx, 1
lea edx, [eax*8 + 0x7bb3142a]
sar al, 1
inc cx
sub ax, ax
shl eax, 0x5e
not cx
call fcn.0076b245

Function at 0x733282
Capabilities:
Encode data using xor

Disassembly:
inc cx
sub ecx, 0xfac016ad
js 0xb9e483
dec edi
inc cx
ror ecx, 1
neg dl
push edi
inc edx
setnp byte [esp - 0x3c]
inc cx
sbb ecx, 0x4166bc92
neg ecx
inc esp
mov edi, edx
dec esp
xchg dword [esp + edx*2 - 0x4a191de0], esp
inc cx
rol ecx, 1
dec byte [esp + edx*2 - 0x4a191de1]
inc cx
dec ecx
inc cx
ror ecx, 1
inc esi
movzx eax, word [esp + edx - 0x5b]
inc ecx
sal edx, 0x6d
inc cx
xor ecx, 0xff48c212
test byte [eax + eax], dl
jno 0x7332d2
fcmovb st(0), st(0)
clc
movsb byte es:[edi], byte [esi]
inc cx
neg ecx
inc cx
add ecx, 0x41664aa0
neg ecx
rol word [esp + edx*2 - 0x4a191dde], 0xc1
pop ebx
inc bp
xor ebp, ecx
dec word [esp + edx*2 - 0x4a191df5]
inc edx
rol byte [esp + edx*2 - 0x173fe9], 0xa4
call fcn.0070c964
invalid
inc ecx
inc edi
inc ecx
xor ecx, 0x7a0d4400
dec esp
lea esp, [ebp + edx*4 + 0x30b18b95]
inc ecx
not ecx
ror byte [esp + 4], 0x83
jae 0xb7fbe4
inc ecx
neg ecx
inc ecx
not ecx
dec dword [esp]
dec esp
mov dword [esp], ebp
inc esp
mov edx, ebx
inc esp
xor dword [esp], ecx
dec esp
lea edi, [ebp*8 + 0x31af6789]
inc ecx
pop ebp
shl bl, 0x65
inc ebp
movzx eax, dx
dec ebp
arpl cx, cx
dec ebp
add esi, ecx
inc cx
sub ebx, edi
mov edi, 0xd4051f0b
shr ax, 0xed
inc ecx
jmp esi

Function at 0x734e18
Capabilities:
Encrypt data using speck

Disassembly:
dec esp
mov dword [esp + edx*2 - 0x1eac8], ecx
inc edx
lea eax, [eax + ecx + 0xc90ca05]
call fcn.00b550d0

Function at 0x734e2d
Capabilities:
Encrypt data using speck

Disassembly:
shld edx, eax, cl
mov dword [edi], edx
call fcn.00b14d57
Function at 0x735b26
Capabilities:
Encrypt data using speck

Disassembly:
xadd dword [esp + edx - 0x6da35287], edx
xor ecx, 0x17ac533c
xor ebx, ecx
dec dl
jp 0xc5807c
call fcn.00b2da97
add edi, ecx
lea eax, [edx*8 + 0x271c5325]
mov dword [esp + eax - 0x4f60fe85], edi
ret 8

Function at 0x735b56
Capabilities:
Encrypt data using speck

Disassembly:
inc ebp
xor dl, ch
inc ecx
rol dl, 1
dec edi
lea eax, [ecx + ecx*2 - 0x773de4c]
inc ecx
xor dl, 0x87
inc cx
inc ecx
inc ecx
push eax
dec ebx
lea edi, [ecx + ecx*4 + 0x7a225c39]
inc ecx
dec dl
add dword [esp + 0x18], edi
jg 0x863ffd
inc ecx
xor dl, 0x8e
inc ebp
xor ch, dl
dec esi
lea edx, [esp + edx + 0x20]
call fcn.00cff428
dec edi
lea ebx, [ebx - 0x6a81bb37]
inc ebx
mov edi, dword [ebx - 0x6a81bb33]
inc ebp
movsx edi, ah
movsx eax, bl
inc ecx
xor edi, ebp
dec ecx
shr edi, cl
inc ecx
mov edx, 0xdd3360bb
call fcn.00cb753c

Function at 0x74aef4
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [edi + edx*2 - 0x160]
mov ecx, 0x5bbf7984
mov dword [esp + ecx - 0x5bbf7984], ecx
mov cl, byte [edi + ecx - 0x5bbf797c]
add edi, 6
dec word [esp]
shld eax, edx, cl
push 0x582e9107
call fcn.00cd5bef

Function at 0x74af25
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + eax - 0x9c], ebp
dec ebp
arpl cx, cx
mov word [esp + eax*2 - 0x156], 0xcfa0
inc ecx
mov edi, 0xd0951c2a
inc cx
dec esp
dec ebp
add esi, ecx
call fcn.00879df0
dec eax
inc edi
not cl
dec eax
mov dword [esp], edi
dec eax
shl dword [esp], 0x56
neg cl
inc esp
xor ch, cl
inc sp
xchg dword [esp], ecx
inc eax
add byte [esp + 2], bh
jno 0xcb06bd
inc ecx
mov edx, 0xaba51a12
dec eax
mov edx, dword [esi]
inc ebp
movzx esp, byte [ebx - 1]
dec esi
lea edi, [edx*2 + 0x7127abbd]
inc ebp
xor ah, ch
inc ecx
xor ah, 0x83
inc ebp
movzx ecx, di
mov eax, 0x9237ae86
inc ecx
neg ah
inc ecx
inc ecx
inc ecx
sub ah, 0x11
call fcn.00869678
and bx, 0xd48c
inc ecx
push ebp
xor dword [esp + ebp*2 - 0x3e038018], eax
inc ecx
pop ebp
call fcn.008105cd
mov edx, 0xad261eb0
and edx, 0xd719df25
mov eax, 0x1199529b
mov eax, dword [edi + eax*2 - 0x2332a536]
jno 0xbe77c0
inc esp
movzx esp, ax
inc ecx
neg ecx
inc ecx
not ecx
or byte [esp + eax*2 - 0x153], 0x17
push ebx
movsx ebp, byte [esp + eax*8 - 0x557]
dec esi
mov dword [esp - 0x9c], ebp
dec eax
sbb dword [esp + eax - 0xa4], 0xdfa14117
inc esp
xor dword [esp + eax - 0x9c], ecx
dec esp
mov ebp, dword [esp + eax*2 - 0x148]
jmp 0x740ea8
dec eax
lea ecx, [esp + ecx + 8]
inc esp
mov byte [ecx], al
dec esi
lea esp, [ecx*2 - 0x57cf8cef]
dec ebx
lea ebx, [esp + 0x6b372839]
ror di, 0xa
dec ecx
sub ebx, 4
inc ecx
mov eax, dword [ebx]
inc ecx
xor eax, ebp
xor eax, 0x9107122b
inc ecx
pop edi
inc ecx
sar edi, 0xc8
ror eax, 1
dec ebp
or edi, ecx
sal bl, 0x44
inc ecx
sbb bh, bh
neg eax
mov ebp, 0x1f01c00c
lea eax, [eax + ebp - 0x55218f32]
jmp 0x778fb1

Function at 0x750334
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax + edx - 0x70ec6fab]
push ecx
xor eax, 0xa5a7c386
neg eax
sal dword [esp + ecx - 0x70d3], cl
sub eax, 0xf607488e
xor ebx, eax
call fcn.00c0088c
and al, ch
arpl bp, cx
cmp byte [esi + 0x74], dh
cli
pop eax
dec ecx
popal
invalid