joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc9bf6f
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
adc ebp, eax
ror dx, 0x83
btr dx, cx
add edx, edx
jmp ebp
pop eax
jmp esi
and al, dl
shr ecx, cl
pop edx
add edx, 0x207af
jmp edx
rol eax, 1
mov dword [esp + edx - 0x72c3dbae], edx
shr dword [esp + edx - 0x72c3dbae], cl
shl cl, cl
lea eax, [edx + eax - 0x611f6da5]
neg eax
shr word [esp + edx - 0x72c3dbac], 0x45
shr dl, 6
sbb eax, 0xe52a3a01
add word [esp + edx - 0x72c3db01], cx
mov byte [esp + edx - 0x72c3db01], dh
call fcn.00d43650
mov edx, 0xad2bb4ad
shr edx, 0x18
mov ecx, dword [edx + esi - 0xad]
movsx eax, dl
btc eax, eax
and dx, dx
mov dl, byte ss:[ecx + edx*8 - 0x568]
jo 0xa0652a
adc esi, 2
lea ecx, [eax*4 - 0x55c6c760]
mov word [esi], dx
mov edx, 0xa02a442a
sal dl, 0xc3
lea eax, [ecx*2 + 0x5b334d2d]
mov eax, dword [edi]
jns 0xd7449e
xor eax, 0x8d960b14
sal edx, 0x5e
dec ecx
dec eax
inc cl
rol eax, 1
xor ebx, eax
neg edx
btc dx, dx
jae 0x9221e4
mov edx, dword [esi]
mov ecx, 0x7b2eab96
mov eax, ecx
neg cl
mov cx, word ss:[ecx + edx - 0x7b2eab6a]
cdq
rol edx, 0x2c
adc dx, cx
ror eax, 0xce
mov ecx, eax
rol cx, 0x8a
mov cx, word [esi + 4]
bt eax, eax
add al, 0x2e
js 0xd81961
shr dx, 8
shr edx, cl
lea edi, [edx + edi - 0x9fe]
shr edx, 0x5c
jnp 0x9283c8
xor eax, ebx
xor eax, 0xb435ef17
inc dl
dec edx
inc eax
jmp 0xd66765
and dx, cx
not dx
call fcn.0098d849

Function at 0xc9dbae
Capabilities:
Encrypt data using speck

Disassembly:
inc ax
bswap edx
inc cx
cdq
xor cx, dx
xor bx, cx
xadd byte [esp + 6], ah
mov word [edi + 6], cx
btc edx, 0xa8
jb 0xdc163f
mov ecx, dword [ebp + 2]
xor ecx, ebx
ror dx, 0x66
neg ecx
or dx, ax
adc ecx, 0x3d2d851b
lea edx, [edx + eax*4 + 0x229b11a5]
cdq
dec eax
bswap ecx
cwde
and edx, edx
inc eax
neg ecx
cwde
sal dl, 7
xor ebx, ecx
btr ax, dx
cbw
adc esi, ecx
movzx edx, word [eax + ebp - 0xffd6]
sub al, al
lea ebp, [ebp + eax*8 - 0x7f7f8]
mov ecx, 0x1984c1d
btc eax, eax
xor dx, bx
ror dword [esp + eax*2 - 0x1fdfe], 0x5a
neg dx
inc dx
xadd ecx, eax
pop eax
adc eax, 0x3732d3
jmp eax
Function at 0xca5d0b
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0xb522020e
call fcn.00a17e74

Function at 0xca5d18
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, dword [esi + ecx - 0x6cbe5f80]
xor ecx, ebx
add ecx, 0x6611740c
mov edx, 0xdf25aa2a
lea eax, [edx + edx - 0x147ea86b]
xchg dh, al
xor ecx, 0xe227822f
not ax
inc ecx
bswap ecx
neg eax
dec ecx
and edx, edx
neg ax
xor ebx, ecx
idiv ax
and eax, eax
cbw
mov dword [edi + eax - 0x5633ffab], ecx
xor eax, edx
sbb edi, 0xfffffffc
movzx ecx, dl
mov eax, dword [esi + ecx*2 - 0x70]
push ecx
lea esi, [esi + ecx - 0x32]
imul dx, dx
pop ecx
shr edx, 0x70
xor eax, ebx
dec dl
jno 0xa2bf75
push 0xe295e621
inc dword [esp]
sbb edi, 7
push 0xc5839713
push 0x8d9fa522
mov dword [edi + 0xc], eax
jmp 0xdbfc32
call fcn.009330a4
mov ecx, 0xd39d8d21
lea eax, [ecx - 0x30d260e7]
rol cl, 0xe1
movzx eax, byte [esi]
xor al, bl
neg al
lea edx, [ecx*4 + 0x6033098d]
dec al
xor edx, edx
not dl
ror al, 1
ror edx, 0x19
sub edx, ecx
sal ecx, 0xea
inc al
btc dx, dx
rol edx, 0xb1
bt ecx, ecx
xor al, 0x8e
rol dl, 0xc2
xor bl, al
mov word [edi + edx - 0x647c5819], ax
rol cx, 3
movzx edx, byte [esi + edx - 0x647c5816]
movzx eax, cl
not eax
xor dl, bl
neg dl
add eax, ecx
sbb dl, cl
rol eax, 0x6d
neg ax
ror dl, 1
dec al
shr ax, 0x62
and cx, ax
inc dl
shl ax, 0xc
sar ecx, 0xa1
xor dl, 0x8e
neg ecx
not eax
neg cl
xor bl, dl
jmp 0xded8ae
lea eax, [edx + eax - 0x9815c1]
xor ebx, eax
ror ecx, 0x10
add edi, eax
mov dword [esp + edx - 0x4f3f20c2], 0x728855bf
add dword [esp + edx - 0x4f3f20bf], edx
mov eax, ebp
lea ebp, [ebp + edx - 0x4f3f20c4]
mov word [edx + ebp - 0x4f3f20c2], ax
pop ecx
pop edx
jb fcn.009213ba
mov edx, 0x3db9352b
mov eax, dword [edx + edi - 0x3db9352b]
mov edx, dword [edi + edx*2 - 0x7b726a52]
mov ecx, 0x6cbe5f80
mov dword [eax + ecx - 0x6cbe5f80], edx
jmp 0x987952
movsx edx, al
mov ebx, dword [esp + edx*2 - 0x7c]
cwde
sar word [esp + eax - 0x841], 2
mov ecx, 0xb30e7e07
pop edx
pop ecx
pop ecx
pop eax
jae fcn.009419ad
ror edx, 1
or eax, eax
dec edx
push ecx
xchg word [esp + ecx - 0x77e2], ax
and cx, cx
xor edx, 0x55b33e8a
xor ebx, edx
sar ecx, cl
add esi, edx
movzx ecx, byte [ebp + ecx - 0x1df4]
shr ax, 0xa6
movzx edx, ax
sub edx, 0x53a7ca39
xor cl, bl
cwd
rol dl, 0x82
adc cl, 0x1e
not cl
mov dword [esp], edx
dec cl
shr al, 0x87
rol cl, 1
xor cl, 0x16
sar dx, 0x2a
not cl
je 0xdf2e79
mov dword [edi + 8], ebx
and dword [esp + 8], 0x570784be
mov eax, dword [esp + 8]
adc eax, eax
mov dword [edi + 4], ecx
mov dword [esp + 8], eax
xor dword [esp + 8], eax
mov dword [edi], edx
movzx ebx, ax
jle 0xdb8299
xor bl, cl
pop edx
add ecx, esp
dec edx
mov ax, word [ecx]
mov word [edi - 2], ax
call fcn.00955fba
Function at 0xca6a62
Capabilities:
Encode data using base64

Disassembly:
rol edx, 1
dec edx
add cl, byte [esp]
xor cx, ax
not al
ror edx, 2
not dword [esp]
not dword [esp]
add cx, cx
lea edx, [edx + ecx - 0xdbaf138]
bt eax, 0xb8
cmovae ecx, eax
push eax
xor ebx, edx
neg eax
shr byte [esp + eax - 0x74718964], 0x64
and dword [esp + eax - 0x74718962], eax
adc esi, edx
mov eax, edi
mov dword [esp + 4], 0x2eb5439c
movzx edx, cl
lea edi, [edi + edx*2 - 0xe4]
btc ecx, ecx
shl edx, 0xfe
mov dword [edi + edx], eax
rol cl, 2
mov eax, dword [esp + edx]
pop ecx
pop eax
jns fcn.00dd66d7
mov dword [esp], 0xb80dc136
jmp 0xd9fee6
xchg esp, eax
sal ecx, 0x8e
sbb edx, 0x81303898
sar dword [esp], 0x15
jne 0xa313cd
or dword [esi - 0x3b159b11], ecx
adc al, 0x8e
xchg byte [esp + esi*2 - 0x25d1973b], dl
sal byte [ebp + eax*8 + 0x68], 1
push esi
push edx
fdiv dword [ebp + eax*8 + 0x68]
js 0xd98475
ljmp 0x7494:0x868e14c4
pop eax
stosd dword es:[edi], eax
loope 0xd984a3
pop ds
retf
mov ebx, dword [ebx*4 + 0x96ff10]
shr ecx, 8
xor word [esp + 6], 0x700d
xor ecx, ebx
shr byte [esp + 1], 0x86
mov word [esp + 4], 0x3427
dec dword [esp]
inc edx
xor ecx, 0x38a50312
sar dword [esp + 4], 0x46
je 0xd9848b
dec eax
lea esp, [esp + 8]
jne 0xd6cd8f
mov eax, 0x47995635
add eax, 0xb104a0ab
pop ebx
Function at 0xcaff17
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
or eax, 0xf993408
dec dl
ror dl, 1
cwde
shl word [esp + eax - 0x3407], 0x42
and byte [esp + eax - 0x3407], 2
inc dl
xor dl, 0x8e
inc eax
bswap eax
xor bl, dl
sar al, 0xc1
xor eax, ecx
movzx dx, dl
sub cx, word [esp + eax - 0x5139f745]
mov al, byte [edi + eax - 0x5139f744]
not dl
and cl, byte [esp + ecx - 0x580dd343]
and ecx, ecx
sbb cl, byte [esp + ecx - 0x580dd341]
not al
adc dword [esp + ecx - 0x580dd342], ecx
sar ecx, cl
adc dword [esp + ecx*2 - 0x2c06e9a0], ecx
or dl, al
shr ecx, 0xd3
not dword [esp + ecx*4 - 0xb00]
imul ecx, dword [esp + ecx*2 - 0x580]
mov word [ecx + edi - 0x6d7713fe], dx
btc ecx, ecx
movzx edx, cx
jae 0xa1e5a4
mov dword [esp + edx*2], edx
not cl
ror dx, 0x45
jns 0xd77477
sub esi, 4
mov edx, 0x3fae1d12
lea ecx, [edx + edx + 0x9b0783f]
mov eax, dword [edx + esi - 0x3fae1d12]
btr ecx, 0x89
rol edx, 0x6f
lea edx, [edx + ecx*8 + 0x7e2637b9]
xor eax, ebx
inc eax
btr edx, 0x3a
xchg ecx, edx
ror eax, 1
bswap eax
dec eax
jmp 0xd79139
not al
neg edx
or cl, al
sal dword [esp + edx], 0xba
ror edx, 0xa
lea eax, [edx*2 + 0x49a13f09]
mov word [edi + edx*2 + 2], cx
movzx ecx, word [esp + edx]
add cl, 0
add ecx, dword [esi + edx]
xor ecx, ebx
cdq
ror ecx, 2
bts eax, edx
adc dword [esp + edx*4], edx
not dword [esp + edx]
neg ecx
not edx
mov dword [esp + eax - 0x49a13f09], 0x95b7c704
ror ecx, 1
xchg dx, ax
cdq
neg ecx
sar word [esp + edx], 0xec
btr ax, 0x3b
xor ebx, ecx
add ebp, ecx
neg word [esp + edx*8 + 2]
div word [esp + eax - 0x49a1f7fe]
movzx edx, byte [esi + edx*2 - 0x3400]
lea ecx, [eax*8 + 0xb05f72f]
btr ax, ax
sar ax, 0x23
lea esi, [esi + eax - 0x49a0fffb]
dec ecx
add byte [esp + eax - 0x49a0fffd], ah
xor dl, bl
neg dl
shr byte [esp + eax - 0x49a0ffff], cl
jns 0xc9a44b
mov dh, 4
invalid
push ss
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
jb 0xd774b3
insb byte es:[edi], dx
fimul word [0xec806571]
mov edx, 0x80650915
in al, dx
push edx
std
sbb dword [ebp - 0x80], esp
in al, dx
mov dl, 0x2d
cmp dword [ebp - 0x80], esp
in al, dx
mov edx, 0x8065f9dd
in al, dx
mov esi, 0x80654965
in al, dx
cmpsb byte [esi], byte es:[edi]
cmc
push ecx
sub ah, 0x46
xor esi, esp
pop edi
adc ebp, dword [ebx - 0x19791654]
stosb byte es:[edi], al
invalid

Function at 0xcb293d
Capabilities:
Encrypt data using speck

Disassembly:
lea eax, [ecx + eax + 0x35f98c1b]
bswap eax
adc dl, byte [esp + edx - 0x3ffffce8]
js 0xdc54c9
bswap edx
ror eax, 2
xchg dl, cl
mov dword [esp + edx], ecx
sub word [esp + edx*2 + 2], dx
neg eax
btr edx, ecx
sar edx, 0xdb
dec eax
pop ecx
dec edx
ror edx, 0x31
neg eax
shl cl, 0x82
bt edx, 0x92
jae 0x9416c7
xor ebx, eax
add ebp, eax
inc ecx
movzx eax, cl
mov edx, dword [ecx + esi + 1]
bts eax, 0xaa
lea esi, [esi + ecx*4 + 2]
mov cl, byte [edi + ecx*2 + 2]
sar al, 0x41
bt ax, 0x89
lea edi, [edi + eax - 0x3fb]
add ax, ax
lea eax, [eax + eax*8 + 0x7aaa4306]
lea eax, [eax + eax*8 - 0x19d04b5b]
xor cl, bl
xchg ah, al
bswap eax
sub al, al
adc cl, 0x35
rol cl, 1
sal ax, 0xc1
xor cl, 0xb7
rol cl, 1
xor bl, cl
shl al, 1
adc ecx, esp
mov dword [ecx], edx
jmp ebp
Function at 0xcb2e69
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc esp
movzx esp, dl
inc ecx
xor cl, bl
dec eax
mov dword [esp + edi*4 - 0x224], esi
add cl, 0xbe
idiv byte [esp + edi*4 - 0x224]
imul dword [esp + edi - 0x87]
rol cl, 1
dec eax
ror dword [esp + edi - 0x89], 0xc7
inc ecx
sbb cl, dh
neg cl
inc esp
btr eax, esp
sbb dword [esp + edi - 0x88], esi
dec eax
cwde
inc esp
xor bl, cl
dec eax
lea ecx, [esp + ecx + 8]
dec eax
mov ebp, dword [ecx + edi - 0x89]
inc cx
neg esi
dec eax
btc esi, edx
dec ebp
lea ebp, [ebp + edi*2 - 0x11a]
dec ecx
mov dword [ebp + edi - 0x89], ebp
adc edx, 0x65346b32
pop eax
jns fcn.00c9d101
inc ecx
xor esi, ebx
ror esi, 2
inc esi
inc eax
shr bh, 0x43
not esi
dec ecx
shr eax, cl
dec esp
bt ecx, esp
mov eax, edi
lea esi, [edi + esi - 0x5e9046f0]
bt cx, 0x24
inc ecx
btc ecx, 0xba
inc ecx
push ebx
inc ebp
mov ebx, esi
inc ecx
sal cl, 0xe3
call fcn.00c8566b

Function at 0xcb54be
Capabilities:
Encode data using xor

Disassembly:
dec esp
mov dword [esp + ecx - 0x18bc7bad], ebx
inc ebp
or eax, esp
inc cx
bts ecx, 0x84
xor dword [esp + ecx*2 - 0x3178f75a], esi
ror ebp, 0xb7
imul ebp, ecx
inc cx
adc ecx, 0x5b412218
sbb byte [edx], ah
inc ecx
pop ebx
shl dl, 5
inc ecx
neg ah
dec eax
arpl si, si
add dl, 0x9b
dec eax
shr ecx, 0xa2
inc esp
xadd edi, esp
dec eax
adc ebx, esi
dec ebx
lea ebp, [ecx + eax - 0x246e13fe]
cdq
dec ebp
lea edx, [edx + ecx*8 - 2]
dec eax
imul ebp
adc dx, 0x3b11
inc ebp
movzx eax, word [edx + ecx*8]
inc bp
xor eax, ebx
inc ebp
movsx edi, cx
inc cx
neg eax
inc eax
mul bh
inc esp
sbb bh, ch
dec ecx
bswap edi
inc cx
ror eax, 1
movzx esi, cx
call fcn.00a2646b
mov al, byte [0xa362b58]
cmp al, 0x1c
jge 0xcb54e0
inc dword [ebx + 0x68]
sbb dword [ecx - 0x45], edi
inc dword [ebx + 0x68]
mov eax, dword [0x43ffc7bd]
push 0x203be867
in eax, 0xf5
mov gs, esi
inc edi
inc eax
out 0x8a, al
mov ebp, 0xdb5b39f7
mov ah, 0x55
cmp edi, dword [ecx + 0x4780220c]
add al, 0x95
sbb byte [edx], ah
add byte [edi + 0x41], 0xb1
adc byte [edx], ah
add byte [edi + 0xc], 0x6a
outsb dx, byte [esi]
test al, 0x18
xor ch, dl
jp 0xcb5554
pop ebx
test eax, 0x94459fb2
cwde
push 0x9459b3d7
cwde
push 0x94393357
cwde
push 0x4be50099
mov esp, 0x10b929e5
inc ebp
hlt

Function at 0xcb9424
Capabilities:
Encrypt data using speck

Disassembly:
imul ecx
pop ecx
mov dword [ebp - 4], edx
mov edx, 0xd821f719
movzx ecx, dl
ror edx, cl
mov dword [ebp + edx - 0x10fb8cec], eax
bt cx, 0xaa
lea ebp, [ebp + edx - 0x10fb8cf0]
lea edx, [edx + 0x308d1924]
inc cl
mov eax, 0x52227c19
mov ecx, dword [esi + edx - 0x4188a615]
lea esi, [edx + esi - 0x4188a615]
rol edx, 0xb3
cdq
xor ecx, ebx
add al, al
imul ax
adc edx, edx
lea ecx, [ecx + edx*4 + 0x1737c71b]
dec dl
xor ecx, 0xd7b3ddb7
lea ecx, [ecx + eax*4 - 0x5600db5d]
call fcn.00e084eb
mov dword [ecx + esi - 0xdf53], edx
xor al, 0x9c
or ax, 0xc4ae
jne fcn.0097a521
Function at 0xcb949e
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x9035d6a2
push 0x52098c12
ror ecx, 3
rol dword [esp + 1], 0x15
not ecx
jb 0xc86aa8
call 0xd5a6d4
sub esi, 4
mov edx, 0x3eb52dbe
sub dl, dl
mov ecx, dword [esi + edx*2 - 0x7d6a5a00]
lea eax, [edx*2 - 0x68edf8d2]
xadd edx, eax
cdq
xor ecx, ebx
not ax
mul dx
lea edx, [eax*2 + 0x7c96deae]
dec ecx
or dx, ax
push eax
xor ecx, 0x37949722
imul ax
bt edx, 0x81
bswap ecx
or byte [esp + eax*2 - 0x7d69ffff], 0xe
mul eax
sbb ecx, eax
and dword [esp + edx*8 - 0x7ae15fc8], eax
xor ebx, ecx
xchg byte [esp + edx - 0xf5c2bf9], al
pop eax
add edi, ecx
inc al
movsx ecx, dl
sar dl, 0xc2
mov dx, word [ebp + edx*4 - 0x3d70aff8]
ror eax, cl
mov cl, byte [ebp + eax*2 - 0xfe]
seta al
shl eax, 0xa4
lea eax, [eax*2 - 0x59e894fb]
adc ebp, 2
sal eax, 0xb9
rol ax, 0x82
xor ax, 0x2b37
shr dx, cl
push eax
sal eax, 0xf9
mov word [eax + ebp - 0x6e000000], dx
inc word [esp + eax - 0x6e000000]
cbw
shl eax, 0x71
mov dword [esp + eax*2], edi
ret
jmp 0xe17f5a
neg ecx
jmp 0xa3b7ad

Function at 0xcc5203
Capabilities:
Encrypt data using speck

Disassembly:
neg dl
mov word [edx + edi - 0x787442b], cx
mov ecx, dword [ebp + edx*2 - 0xf0e8856]
call fcn.00df0eef

Function at 0xd39378
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.00c806dd
inc byte [esp + 4]
and ebx, 0xff
inc dword [esp + 4]
push 0xa9a0ad98
mov ebx, dword [ebx*4 + 0xa0a260]
jne 0xa2a8c0
add byte [eax], al
inc ebp
outsb dx, byte [esi]
je 0xd39403
jb 0xd393e3
jb 0xd3940b
je 0xd3940d
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add cl, dl
ret 0xca0f
cld
clc
rcl dword [ecx], cl
in al, dx
arpl word [eax + ebp], cx
rcl dword [ecx], cl
in al, dx
invalid
rcl dword [ecx], cl
in al, dx
mov dword [0x11d30804], eax
in al, dx
das
dec eax
push eax
into
adc ebp, esi
fnsave dword [edx + 0x1f]
shr byte [edx + 0x7fffffff], 1
cmp al, cl
add dl, dl
cmc
jmp 0xd393c3
push esp
shr byte [edi], 0x55
and dword [ebp + 0x2ee24ad2], eax
loop 0xd3943b
and dword [ecx], 0xe24a9a11
jno 0xd39467
or dword [edx + 0x4a], edx
loop 0xd39449
pop ebp
sub eax, 0xe24ae29d
adc eax, 0x9ea6f53d
sahf
jmp 0xd39469
or al, 0x6c
sub eax, eax
invalid
sub byte [ebx + edx*8 - 0x3fac13ef], 0xdc
rcl dword [ecx], cl
in al, dx
daa
test al, 0xec
rcl dword [ecx], cl
in al, dx
arpl ax, sp
pushfd
rcl dword [ecx], cl
in al, dx
jg 0xd3942c
lodsb al, byte [esi]
rcl dword [ecx], cl
in al, dx
out dx, eax
movsb byte es:[edi], byte [esi]
push eax
into
adc eax, dword [edx]
sbb dword [esi - 0x552fe1], ebp
invalid
out 0xc1, al
add dl, dl
sub dword [edi], esi
and dword [esp + edx*2 + 0x2d192fc0], edx
frstor dword [esi - 0x26d11db6]
pop ecx
lodsd eax, dword [esi]
fimul word [edx - 0x1e]
lea esp, cs:[0xe24af675]
std
popal
xchg ecx, eax
out dx, al
dec edx
loop 0xd394bc
xchg ebp, eax
test dword [ecx - 0x5a], ecx
sahf
sahf
out dx, eax
adc esi, ebp
adc al, 0xec
sbb dword [edx + 0x6c0614d6], ecx
pop ecx
retf 0x145e
insb byte es:[edi], dx
and dword [edx + 0x6c06146e], ebx
invalid
Function at 0xd396cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 0x14]
mov edx, 0x40a43203
lea eax, [edx + edx*4 - 0x3c7dfb7a]
mov eax, dword [edi + eax - 0x6b6fe9d]
sbb edx, edx
lea edi, [edi + edx*2 - 4]
call fcn.00988f1e

Function at 0xd3c39b
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xd7391a0e
ror eax, 1
mov edx, ecx
xadd byte [esp + ecx*2 - 0x14f0fffa], dh
dec eax
not eax
xor ebx, eax
inc byte [esp + ecx*4 - 0x29e1fffe]
add esi, eax
shr byte [esp + ecx - 0xa787ffb], 0xe4
mov dword [esp + ecx*4 - 0x29e20000], esi
ret 4
lea ebp, [ebp + eax - 0x19ff413f]
adc cx, 0x4a0c
adc eax, dword [esp + eax - 0x19ff412c]
jp 0xd9e6e0
mov dword [eax + ebp - 0x197a4416], edx
mov edx, eax
imul eax, ecx
pop eax
pop ecx
pop edx
pop eax
pop ecx
pop edx
jb fcn.009213ba
xor cl, 0x2a
sar al, 0x43
xor cl, al
shr word [esp + eax*8 - 0xfffe7], 0x8b
btr eax, eax
shr ax, 0x8a
rol cl, 1
ror eax, 0x1a
sar edx, 0x96
adc cl, 0x32
inc eax
idiv ax
rol cl, 1
and dword [esp + eax - 0x40ff33], edx
jl 0x954380
neg cl
bswap eax
push edx
inc byte [esp + eax*2 - 0x7ffe7fec]
rol cl, 1
mov dword [esp + eax - 0x3fff3ff8], 0xbbac5581
sub cl, 0x8f
xor eax, dword [esp + eax*2 - 0x7ffe7fec]
ror cl, 1
not byte [esp + eax*4 - 0x6ffd04da]
xor byte [esp + eax*2 - 0x37fe8265], al
xor bl, cl
btc eax, 0x99
lea ecx, [esp + ecx + 0x18]
mov edx, dword [eax + ecx - 0x19ff413b]
lea ecx, [eax + 0x6b02a595]
jb 0xca33b9
call fcn.00cc03ab
shl dword [esp + 4], 0x17
ror eax, 3
sub dword [esp + 4], 0x66878b0f
shl dword [esp + 4], 0x13
inc eax
rol dword [esp + 4], 0xdc
bswap eax
sbb word [esp], 0x5f33
mov ecx, 0x172564b1
rol eax, 3
sub eax, 0xb1928c02
xchg dword [esp + ecx - 0x172564ad], ecx
jmp 0x96d0c6

Function at 0xd3c754
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push 0xeab1f0b0
inc edx
push 0xad3f3187
mov dword [esp + 0x18], 0x6b0bb781
xor eax, 0x57a7e5b2
rol dword [esp + 4], 0x91
dec ecx
push 0x4a01701a
call fcn.00c78d8a
mov ebx, dword [ebx*4 + 0x95ebac]
push 0x4a8435b6
shr eax, 8
xor eax, ebx
jmp 0xc9e7ac

Function at 0xd406ae
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edx
sal edx, 0x4b
mov dword [esp], esi
xor edx, 0xd739ed15
push ebp
push ebx
movzx ebx, dx
movsx ebp, dx
rol edx, 0x22
mov ebp, edi
mov ebx, eax
lea eax, [edx - 0x2eea794a]
add dx, dx
sal eax, 0x49
mov edx, ebx
ror eax, 0xa2
or eax, eax
je 0xcb62b3
shl edx, 2
inc eax
cbw
idiv al
mov eax, ebp
call fcn.00df3306

Function at 0xd4369e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc word [esp + edi*4 - 0x1673d27e]
dec ecx
mov dword [ebp + edi - 0x59cf4a2], edx
dec ecx
bt esp, 0x89
bt cx, 0x31
inc ecx
pop esi
inc ecx
pop esi
jb fcn.00c9d101
Function at 0xd4376f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0xcdaa1d18
lea esp, [esp + 0x24]
jmp 0xd5a044
mov dword [esp], 0xb7b5b937
bswap edx
rol edx, 2
mov dword [esp + 4], 0x592314b4
push 0x80375497
add edx, 0x9d37dd83
mov dword [esp + 0xc], 0x212c7189
shr dword [esp + 7], 0x36
xor ebx, edx
mov dword [esp + 0x17], 0xb602c405
shl dword [esp + 0x15], 0x90
add esi, edx
push 0xf39bcbb3
jmp 0xc9c23e
call fcn.00d9d7c5

Function at 0xd448c7
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + edx - 1], 0x4583042a
add esi, eax
and edx, dword [esp + edx*2 + 0xa]
push edx
call fcn.00d876d9

Function at 0xd450f9
Capabilities:
Encode data using xor

Disassembly:
dec al
shl ecx, 0x5f
rol al, 1
mov dword [esp + ecx*2 + 4], edx
xor al, 0x16
neg byte [esp + ecx*4 + 0xa]
pop edx
not al
rol cx, 0xef
rol dword [esp + ecx*2 + 4], 0xf
or ecx, 0xdc99c73e
xor bl, al
sal byte [esp], 0x81
movzx edx, cx
xadd word [esp + edx - 0xc73d], dx
lea eax, [esp + eax + 8]
btc cx, cx
lea edx, [edx + edx*4 + 0x650329a0]
mov cx, word [edx + eax - 0x650329a0]
ror edx, 0xd8
lea edi, [edi + edx - 0x329a067]
lea eax, [edx - 0xd400fdf]
mov word [edi + edx - 0x329a065], cx
mov eax, dword [ebp + edx*2 - 0x65340ca]
not dx
imul dx, word [esp + edx - 0x3295f99]
lea ebp, [edx + ebp - 0x329dd48]
sar dx, 0x6d
push edx
dec edx
xor eax, ebx
rol eax, 3
movzx ecx, dl
inc word [esp + edx*4 - 0xca7ffed]
bswap eax
add byte [esp + edx*2 - 0x653fff4], cl
ror eax, 1
imul ecx, ecx
dec eax
not edx
sal ecx, 0x8d
xor eax, 0x55b33e8a
shl ecx, 0x48
xor ebx, eax
add esi, eax
bt cx, dx
pop eax
pop ecx
pop eax
jae fcn.00dd66d7

Function at 0xd48cb7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esi, [esi + edx - 0x28992bec]
pop edx
mov eax, dword [edx + esi - 0x2899d418]
bt ecx, edx
lea edx, [ecx + 0x400a6d1c]
xor eax, ebx
inc eax
lea edx, [edx*8 + 0x1db3941b]
lea edx, [edx*8 + 0x51b6be0e]
xor edx, ecx
bswap eax
not eax
ror cl, 4
imul ecx, ecx
sbb eax, 0xae92b982
xor ebx, eax
xor edx, ecx
shr cx, cl
ror dl, 0x24
add edi, eax
sar ecx, 0x41
jmp edi
btc cx, cx
xor ebx, eax
xchg dx, cx
sal dl, 0xe4
add ebp, eax
movsx eax, cx
imul al
xchg cl, al
mov si, word [esi]
dec ecx
adc eax, 0x30e6322
jns 0xdad96b
movzx ecx, dl
mov eax, dword [edi + ecx*2 - 0x1ec]
ror ecx, 0xaf
lea edi, [edi + ecx*2 - 0x3d7fffc]
and cx, 0x2cb7
inc dx
not ecx
xor eax, ebx
shl dl, 0xa3
xor eax, 0x402e425
inc eax
bswap eax
neg eax
jmp 0xa34aeb
shl dword [esp + 4], 0xfa
inc edx
mov dword [esp], 0xbe161591
xor ecx, 0xa625be37
not byte [esp + 4]
sar word [esp], 0x41
rol word [esp], 0xad
dec eax
lea esp, [esp + 8]
jne 0xd68a61
mov esi, 0xbe83b390
jmp 0xdb1194
movzx esi, byte [edx]
xor esi, ecx
jmp 0xc7c729
mov eax, 0x38a96a01
pop esi
mov edx, 0x2899d418
push edx
not ecx
neg dx
jle 0xa35e10
movsx eax, dl
mov dword [ebp + edx - 0x28992be8], ecx
mov ecx, edx
jbe 0x95b204
Function at 0xd49b4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ax, 0xc1
ror edx, 1
xor ebx, edx
shl cl, 0xe1
add ebp, edx
call fcn.00dc3dd1
sub esi, 4
mov eax, 0x359b1c97
neg eax
mov eax, dword [esi]
mov edx, 0x11a4a15
movzx ecx, dl
xor eax, ebx
xadd ecx, edx
lea eax, [edx + eax + 0x26b2b48c]
jns 0xdea8aa
rdtsc
mov edi, 0xd421c29d
dec ecx
sub ebp, 8
call fcn.00e129ac
pop edx
movsx ecx, ax
mov ecx, dword [edx + edi - 9]
lea edi, [edi + edx*4 - 0x20]
shl dx, 0x44
xor ecx, ebx
xor ecx, 0x549f9ebe
push eax
xor word [esp + edx*2 - 0x11f], ax
cbw
dec ecx
btr dx, ax
xor dl, 0x88
rol edx, 0x2d
bswap ecx
rol ecx, 2
shl dword [esp + edx - 0x30000], 0xda
xadd edx, eax
dec ecx
neg word [esp + eax*8 - 0x180000]
add edx, edx
neg dword [esp + eax - 0x30000]
xor ebx, ecx
cdq
add ebp, ecx
movsx ecx, word [esp + eax - 0x30000]
not edx
or dword [esp + eax - 0x30000], ebp
ret

Function at 0xd49e8f
Capabilities:
Encrypt data using speck

Disassembly:
neg eax
btc edx, edx
call fcn.00c784ce

Function at 0xd49e99
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, ebx
sal edx, 2
mov eax, ebp
mov dword [esp], 0x72189214
neg byte [esp + 1]
sal dword [esp], 0xf9
adc eax, edx
rol word [esp], 5
sub dword [esp], 0xd834a183
mov dword [ebp - 4], eax
setle byte [esp + 3]
or dword [esp], 0xc4a96936
test ebx, ebx
lea esp, [esp + 4]
je 0xe218f0
mov eax, 0xc10ebc16
mov eax, dword [ebp + ebx*4]
call fcn.00df7dab
xor al, byte [ebp + eax - 0x3fe]
lea ebp, [ebp + edx - 0x204a13]
sar edx, 0x25
add edx, edx
adc cl, al
mov eax, edx
add edx, edx
neg dl
mov word [ebp + edx*2 - 0x81380], cx
rol eax, 0x7d
bts eax, eax
jmp edi
mov eax, 0xe9184026
not eax
lea eax, [eax - 0x495ec6d6]
mov eax, dword [ebp]
push 0x4e95e7b6
jmp 0xd6767c

Function at 0xd49f55
Capabilities:
Encrypt data using speck

Disassembly:
adc dl, al
movzx dx, byte [ecx + eax - 0x381]
mov dword [esp + eax - 0x381], eax
movzx dx, dl
push eax
sbb dword [esp + eax - 0x37f], eax
lea ecx, [eax + eax*8 - 0x5bd153f6]
mov al, byte [edi + eax - 0x381]
ja 0xc82219
sahf
cmpsd dword [esi], dword es:[edi]
test al, 0xb3
out dx, al
cli
xchg esi, eax
dec edi
test dword [ecx + esi - 0x6a], 0xf74f52e2
dec esp
mov dh, 0x92
invalid
Function at 0xd4d494
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
rol ecx, 3
lea ecx, [edx + ecx + 0x7bc59da0]
inc eax
xchg dl, al
xadd dl, dh
not ecx
rol ecx, 1
btr edx, 0x90
add eax, edx
sbb ecx, 0x36a3cbb1
shr al, 0x26
bts eax, edx
sub eax, 0x20aa8a0b
xor ebx, ecx
add dl, 0x3a
sbb dl, 0x82
bt eax, edx
mov edx, ecx
mov eax, dword [edi + eax - 0x583e3ded]
mov ecx, 0x8e1104bb
or cl, 0x11
adc edx, eax
inc ecx
mov dword [edi + 8], edx
movzx edx, cx
lea edi, [edi + edx*4 - 0x12e8]
movsx eax, dl
add eax, 0x3d37ee23
sal dx, 0x67
jmp ebp
mov dword [esi + 4], eax
mov dword [esi], edx
mov eax, dword [edi]
mov edx, dword [esp + 2]
adc edi, 4
lea edx, [edx*4 + 0x1407950f]
sal dx, cl
xor eax, ebx
shr cl, 0xa3
bswap edx
sar edx, 0xe1
not eax
xchg dh, cl
bswap eax
not eax
shr dl, cl
lea eax, [eax + ecx - 0x4a006add]
xor ebx, eax
inc edx
xchg dword [esp + edx - 0x60153b], ecx
shr word [esp + edx*2 - 0xc02a76], 0x21
add ebp, eax
pop eax
pop eax
jmp fcn.0097a521
add al, dl
jge 0x956fb6
mov eax, 0x789a0c38
rdtsc
push 0xb20e503d
mov dword [esp + 4], 0xde20f8ae
sub esi, 8
or word [esp + 6], 0x712c
mov ecx, dword [esp + 4]
jae 0x95dcb0
movzx eax, dl
xor ecx, ebx
jmp 0xc9ae9c

Function at 0xd5910b
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x10]
je 0x9601b1
push esi