joyce8/EMBER2024-capa huggingface dataset:
Function at 0xedd026
Capabilities:
Encode data using xor

Disassembly:
dec eax
lea esp, [esp + 0x10]
je 0xedd091
inc ecx
mov esi, 0x9b9efc3e
inc ecx
movsx ecx, si
dec eax
lea ecx, [0xffff223e]
inc ecx
mov esi, 0x420eca8b
inc ebp
sub dh, dh
inc esi
movzx esi, byte [edi + esi - 0x420eca00]
push 0xbbaf4f1c
inc esp
xor esi, edx
inc ecx
and esi, 0xff
inc esi
mov esi, dword [ecx + esi*4]
shr edx, 8
dec dword [esp]
inc ecx
xor edx, esi
dec eax
inc edi
xor edx, 0x82abf038
dec eax
shr dword [esp], 5
dec ecx
dec esp
push 0xaa302f80
dec eax
lea esp, [esp + 0x10]
jne 0xedd042
not edx
mov eax, 0xca23d119
dec eax
lea esi, [eax + 0x6da9d22e]
inc esp
movzx eax, al
inc ebx
mov dword [eax + edi - 0x19], edx
dec esp
lea esp, [eax + eax*4 - 0x364d7a56]
movsx edi, al
dec edi
lea ebp, [ebp + eax*2 - 0x36]
shr ax, 0x22
mov edx, eax
inc ebx
mov ebx, dword [ebp + eax*2 - 0x32]
inc bp
cmovp eax, esp
inc ecx
xor ebx, ecx
inc ecx
nop
or esi, edi
lea ebx, [ebx + eax + 0x2380b01]
sar al, 0xc1
inc edi
movsx ecx, si
xor ebx, 0x60b95b2a
inc cx
sub esp, 0xd0f63c18
sar esi, cl
bswap ebx
inc sp
xchg ecx, eax
rol edx, cl
dec eax
lea ebp, [edx + esi*2 - 0x8fb3ced]
dec ebx
dec esp
lea esi, [edi*2 - 0x74f36d72]
inc cx
ror esp, 0x6d
inc ecx
push ecx
inc esp
mov edx, eax
dec ecx
lea esi, [edx + 0x1937e79a]
xor dword [esp + eax - 0xf3], ebx
inc esp
mov ecx, edx
inc ecx
pop ecx
dec ecx
lea eax, [eax + edi*2 + 0x10bcee22]
inc ebp
xor dl, dl
rol al, 6
dec eax
arpl bx, bx
inc eax
xor dl, dh
dec esp
adc ebx, ebx
inc ecx
neg eax
inc ecx
xadd esi, ecx
inc cx
inc esp
dec ebp
add edx, ebx
inc ecx
jmp edx

Function at 0xede074
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
not dword [esp + ebx - 0xa5a6]
dec ecx
lea edi, [edi + ebx - 0xa5a6]
dec eax
mov dword [esp + ebx - 0xa5ae], esi
jge 0xeeea01
dec ebx
lea ecx, [esi + esi*2 - 0x60751745]
inc bp
mov edi, dword [edi + ebx - 0x83]
inc sp
and esi, dword [esp + ebx - 0x71]
pop ebx
inc ecx
pop esp
inc ecx
pop esi
jge fcn.00f0add5
dec edx
mov dword [ebx + edi - 0xa5ae], edi
add word [esp + ebx - 0xa5a1], 0xf633
not bl
call fcn.00ef9fae
inc ecx
mov esi, 0xd83a843d
dec ecx
mov edi, dword [edi]
movzx cx, byte [edi]
dec ecx
add edi, 6
inc ecx
movzx ebp, dh
dec eax
lea edx, [ebp + ebp*8 - 0x24e44ffa]
inc eax
not ch
inc cx
mov dword [edi + ebp*2 - 0x184], ecx
movzx eax, bp
call fcn.00fd56a1
inc ecx
inc eax
pop ebx
dec esp
lea edx, [ebx*2 - 0x6fe486f6]
push eax
inc ecx
rol eax, 2
dec esp
lea esi, [eax + ebx + 0x4e046622]
inc ecx
xor eax, 0xc88bb10c
push ebx
rol word [esp + eax*2 - 0x4721a0b8], 0x2c
inc ebp
lea eax, [eax + eax - 0x699f93ee]
inc ecx
ror eax, 1
movsx edi, word [esp + eax*2 - 0x4721a0b7]
inc ecx
not edx
dec esp
mov dword [esp + edi*4 - 0x1f98], ecx
neg edi
inc esp
xor dword [esp + eax*2 - 0x4721a0b0], eax
dec esp
mov ecx, dword [esp + eax*2 - 0x4721a0b0]
inc esp
mov esp, dword [esp + eax*2 - 0x4721a0b8]
call fcn.00c1a0fd
Function at 0xee1adc
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + eax - 0x7f8bfb9f], ecx
inc edx
xor dword [esp + eax - 0x7f8bfb9f], edi
inc ecx
pop ecx
inc ebp
mov edx, esp
and ax, 0xe498
dec eax
arpl di, di
inc ecx
setl dl
dec esp
adc ebx, edi
dec ebx
mov edx, dword [edi + eax - 0x7f8bfb9f]
dec ebx
mov edi, dword [edx + edi - 0x6faca5f9]
inc cx
dec esi
push eax
dec edi
lea edi, [edi + edx - 0x6faca5f1]
call fcn.014ad679

Function at 0xee65a6
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, 0x4716da31
mov ecx, dword [esi + ecx - 0x4716da31]
mov eax, dword [esi + 4]
mov dword [esp], 0x409d1318
mul ecx
mov dword [esi], edx
mov edx, dword [esp]
mov dword [esi + edx - 0x409d1314], eax
lea ebp, [edx + ebp - 0x409d131c]
mov ecx, dword [ebp + edx - 0x409d1318]
movsx eax, dl
xor ax, word [esp + eax - 0x17]
xor ecx, ebx
pop edx
and eax, edx
jge 0xfa83f4

Function at 0xef22ca
Capabilities:
Encode data using xor

Disassembly:
inc eax
sub ecx, 0xee05353d
inc ax
mov dword [esp + eax*2 - 0x7f727880], 0xb3bf1eab
lea eax, [eax*2 - 0x57c769cc]
neg ecx
call fcn.00c40236
push eax
test al, 0x91
loope 0xef22ae
add al, 0x45
xor al, 0x96
cmp byte [eax + 0x49e8d9f7], ch
invalid
inc eax
pop es
stc
lock and byte [ecx + 0x4a], al
sbb ecx, dword [ebp + 0x1572320]
inc ebx
lea esp, [eax]
and ecx, dword [esi + 0x7f]
daa
lea esp, [eax]
and eax, dword [ebx + 0x65]
aas
lea esp, [eax]
and edi, dword [eax]
push esp
aam 0x2f
xor al, byte [eax]
add ah, byte ss:[edx]
dec ebp
loop 0xef2300
pop es
add bh, byte [0xaf9ebc18]
lahf
into
cli
inc ebp
sbb al, 0xca
cmp dl, byte [ecx]
sub al, 0xcf
sar dword [eax + 0x60], 1
jbe 0xef22e0
setno byte [edi + 0x33012fdf]
inc ecx
sub byte [ebx + 0x61], dl
push ebx
arpl word [ecx + 0x28], ax
push ebx
inc esp
push bx
inc ecx
sub byte [ebx + 0x22], dl
test eax, 0x5328411f
test al, 0x66
lea esp, [ecx]

Function at 0xef479b
Capabilities:
Encrypt data using speck

Disassembly:
pop ebx
dec edx
mov dword [esp - 0x72a1d7be], edi
inc cx
xor eax, ecx
inc ebp
sub eax, eax
adc ax, 0xf286
pop edi
inc ecx
push eax
ror ax, 1
inc eax
rol bh, 0x21
adc ax, 0x7525
dec esi
mov dword [esp + eax + 8], esi
inc ecx
pop eax
ror ax, 1
call fcn.00eb4db6

Function at 0xef818d
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [ebp + edx - 0xbb]
dec ecx
jns 0xfa83f4
xor edx, ebx
pop eax
add eax, 0x5d5014
jmp eax
sbb ecx, 0xee05353d
call fcn.00eb1f7d
Function at 0xef8629
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax + edx - 0x6a0b61]
pop ebx
dec esi
mov dword [esp + eax*2 + 0x18], ecx
dec edx
lea ebx, [eax*4 - 0x607bc764]
dec esi
lea ecx, [ebx + eax - 0x4fd61bf3]
bswap edx
xor dword [esp + edx*2 - 0x151c2], eax
pop edx
sar ebx, 0x90
dec edx
mov dword [esp + eax], 0xcaa3dda4
dec esi
mov ecx, dword [esp + eax + 0x10]
dec eax
arpl ax, ax
inc esi
xchg byte [esp + eax*2 + 4], al
inc cx
sar eax, 0x23
dec esp
add ebx, eax
sub bx, 0x5888
inc cx
sar eax, 0x69
dec ebx
mov ebx, dword [edi + eax*8]
call fcn.00ee2338
add al, 0x1e
fabs
push esi
cmp ecx, dword [edx + eax - 0x4d]
sub ecx, ecx
sub eax, 0x2bb34219
leave
and edx, dword [esi + ebx - 0x4d]
sub ecx, ecx
pop eax
add eax, dword [edx - 0x4d]
sub ecx, ecx
xor ch, byte [edx + edi*2]
mov bl, 0x2b
leave
js 0xef8683
xor ch, dl
outsd dx, dword [esi]
pop eax
insd dword es:[edi], dx
mov ch, 0x71
inc ebp
out dx, al
mov ebx, 0xc827aff0
adc bh, bl
adc eax, 0x662c630
invalid

Function at 0xef99bb
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
push esp
inc eax
ror dh, 1
inc cx
sal esp, 2
inc eax
inc dh
dec esi
mov dword [esp + eax + 0x14d2fa0e], esp
dec edx
mov dword [esp + eax*4 + 0x534be7e0], 0x6180269f
inc esi
add dword [esp + eax*2 + 0x29a5f3ef], eax
inc ecx
xor dh, al
dec eax
not edx
pop edi
inc edx
neg byte [esp + eax*4 + 0x534be7d8]
inc esp
xor cl, dh
dec eax
lea esi, [esp + esi + 0x20]
xadd di, dx
jno 0xec53a3
Function at 0xf0cbfe
Capabilities:
Encode data using xor

Disassembly:
add al, 0x4c
add eax, eax
rol edx, 1
xchg word [esp + ecx + 2], cx
sar byte [esp + ecx + 2], 0xa4
xor ebx, edx
push ecx
add edi, edx
add al, al
jl 0xf0cbec
add ah, byte [ebx + esi - 0x5fcae26]
or eax, dword [esi + ecx*4]
neg ecx
movzx edx, word [esp + ecx*2 + 1]
dec dword [esp + ecx + 4]
adc dl, byte [esi + ecx*4 + 4]
call fcn.00c49d39
call fcn.00f9a0ac
mov eax, dword [0xbf712dbc]
xlatb
test al, 0xe0
inc edi
mov ebx, 0xc484c520
inc edi
mov ebx, 0x94d19920
inc edi
mov ebx, 0xa4ea9620
inc edi
mov ebx, 0xd490d420
inc edi
mov ebx, 0x9aecc820
and edi, edi
mov cl, 0xc7
inc ecx
loope 0xf0cbdc
push cs
inc edx
popal
inc esp
sub byte [esi + 0x7f10130a], al
aam 0x7a
imul ecx, dword [edi], 0xffffffa8
pop es
jle 0xf0cbd2
fild word [eax + 0xa]
cmp ebp, dword [esi - 0x2224acc9]
imul ebp, dword [esi - 0xae2acc9], 0x4f
scasb al, byte es:[edi]
aaa
push ebx
sbb eax, 0x37ae13a0
push ebx
movsb byte es:[edi], byte [esi]
mov dword [edx + 0x54878921], edx
stosb byte es:[edi], al
sbb eax, 0x3e8bd8df
pushal
or ch, 0x9c
fistp qword [esi]
pushal
and byte [ebp + 0x603ed78f], 0x82
mov byte [0x603ea3e7], al
sub bh, 0xe3
mov bl, 0x3e
pushal
sub bl, 0
loope 0xf0ccde
and al, 0x13
mov esp, 0x7d0e3a38
cmp edi, dword [edx - 0x2e00a81a]
jge 0xf0ccc9
mov edx, 0xd1ff57e6
mov cl, 0xad
jbe 0xf0cc34
sbb edx, ebp
jae 0xf0cd11
fistp qword [esi - 0x70]
fbstp tbyte [edi + 0x37aea715]
push ebx
mov ebp, 0x37aeaf9a
push ebx
pop edx
int3
and eax, 0x8fd2e68a
and eax, 0xd0e6a08a
stosb byte es:[edi], al
sub bl, byte [ebx + 0x645af624]
mov edi, 0xab7567d4
and al, 0xf6
pop edx
mov edi, 0xab7567d4
jne 0xf0cc8c
and byte ss:[ecx], ch
adc ebx, edx
adc byte [ebx - 0x49c6de3f], ah
out 0xe0, eax
mov edx, 0x8ab67d8e
in eax, dx
jo 0xf0ccd8
mov dh, 0x53
add dword [ebp + edx*2], ebx
daa
push ebp
pop ebx
and edi, ebx
mov edx, 0x5a6fe389
std
push es
mov dl, 0x38
pop ebx
dec esp
mov cl, 0xad
invalid
mov al, 0x81
out dx, al
inc ebx
aaa
aam 0xc8
xor dl, byte [edi + 0x5a]
invalid
Function at 0xf110fe
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
movsx esi, ax
rol ebp, 2
inc ecx
movzx edi, si
xor ebp, 0xc88bb10c
inc esp
movzx esp, cl
inc ebp
xchg ah, dh
sub ax, 0xbb98
lea ebp, [ebp + edx - 0x460f26c1]
ror ebp, 1
inc ecx
push ecx
xor dword [esp + edx*4 - 0x18cbc], ebp
dec esp
lea ecx, [edi + edi*8 - 0x60e8646a]
inc ecx
pop ecx
dec eax
arpl bp, bp
dec esp
add ebx, ebp
inc ecx
xadd esi, esi
jno fcn.00f0add5
push eax
ror byte [esp + eax*2 - 0x33ffffff], 0x63
dec ecx
sar al, 0xe2
ror ecx, 3
bswap edx
lea ecx, [ecx + edx*2 + 0x78f105a9]
not dword [esp + eax*2 - 0x33fffffc]
shl dx, 0xa
sub dl, dh
bswap ecx
xor ebx, ecx
neg dl
rol byte [esp + eax*2 - 0x33fffffc], 0x67
add edi, ecx
mov eax, dword [esi + eax*2 - 0x34000000]
mov ecx, dword [esp + edx - 0x29d12824]
sal cx, 0x6e
mov edx, dword [edx + esi - 0x29d12824]
setae byte [esp]
adc esi, 8
call fcn.00ec5fbe
mov edx, 0xe3b3733c
rol dx, 0x69
mov cl, byte [esi + 4]
adc esi, 2
sal eax, cl
call fcn.00eb9049
rol ebx, 1
rol dl, 0x62
inc ecx
push ecx
shr dl, cl
xor dword [esp + edx - 0x6869ea00], ebx
neg dx
inc ecx
pop ecx
inc ecx
ror al, 0xa7
inc ecx
xor cl, ah
dec esi
lea edx, [edx + eax*2 - 0x31cd7875]
dec eax
arpl bx, bx
add cl, 0x85
dec esp
adc ebx, ebx
inc ecx
push eax
inc ecx
pop eax
jmp fcn.00f0add5
mov dword [esp + ecx*2 - 0x1800002], edx
movzx ecx, byte [ebp + ecx*8 - 0x6000008]
dec dl
xor cl, bl
sub cl, 0x88
call fcn.00c45bf5
dec esp
mov ebx, dword [esp + ebx - 0x343a4bf1]
inc eax
movzx edx, ch
dec eax
mov ebx, dword [esp + ebx - 0x343a4be9]
dec eax
mov ecx, dword [esp + edx*2 + 0x20]
dec esp
mov dword [esp + edx*8 + 0x18], edx
dec esp
mov esi, dword [esp + edx*2 + 0x28]
dec edx
mov dword [esp - 0x71bcc8f4], 0x7d383b18
dec eax
neg edi
dec esp
mov ecx, dword [esp + edx + 0x30]
dec esp
mov ebp, dword [esp + edx*4 + 0x38]
jns 0xf34643
dec esp
mov esp, dword [esp + edx*2 + 0x40]
dec eax
mov esi, dword [esp + edx*8 + 0x48]
inc eax
dec ch
inc esp
movsx edi, dx
dec eax
mov eax, dword [esp + edx*4 + 0x50]
dec esp
mov edx, dword [esp + edx*2 + 0x58]
pop edi
sar word [esp + edx*2 + 0x11], 0xc6
dec eax
mov edi, dword [esp + edx + 0x58]
dec eax
mov dword [esp + edx*2 + 0x28], edx
dec eax
mov edx, dword [esp + edx*2 + 0x60]
push dword [esp + 0x68]
popfd
call fcn.00eada15
mov edx, 0x38e91ae
ror dx, 0xec
lea ebp, [ebp + edx*2 - 0x71c35d6]
call fcn.00fdd0bf
cmp ax, 0xeea4
test si, 0x7886
rol ebp, 3
inc ebp
jmp 0xc66770

Function at 0xf12532
Capabilities:
Encrypt data using speck

Disassembly:
mov al, byte [esi + eax*4 - 6]
call fcn.00ecf05c
add eax, eax
not dl
shl eax, 0x68
not cl
push eax
dec ax
or dl, cl
movzx ecx, al
mov dword [esp + eax*4 - 0x3fff8], ecx
sar ecx, 0x77
mov word [esi + eax - 0xffff], dx
lea ebp, [ebp + eax - 0x10003]
add ecx, dword [eax + ebp - 0xffff]
xor ecx, ebx
ror ecx, 1
jmp 0xf953f5
bswap ecx
lea edx, [eax*8 - 0x5f6aa95c]
sal dx, 0xe1
lea ecx, [ecx + eax*2 + 0x31b095b6]
or ax, 0xfa3c
adc dword [esp + eax*8 - 0x7fff8], 0x1c15202b
jbe 0xed87bc
bswap ecx
and byte [esp + eax*2 - 0x1fff7], ah
not ecx
sar ax, 0xc6
xor ebx, ecx
add edi, ecx
lea ecx, [edx + edx*4 - 0x6e519fe0]
dec edx
mov dword [esp + eax*8 - 0x7fff8], edi
ret 4
Function at 0xf1319e
Capabilities:
Encrypt data using speck

Disassembly:
not eax
xor eax, 0xac91223c
push edx
mov dword [esp + edx + 4], edx
ror eax, 2
shl edx, 0x3f
inc eax
pop edx
call fcn.00c2a620
cmp eax, 0x2b0c2489

Function at 0xf1332f
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
movsx ebx, dx
inc ebp
lea esp, [esp + ecx*2 - 0x390fe44a]
dec ecx
adc ebx, edx
dec esp
mov dword [esp + ecx*2 - 0x940], ecx
inc sp
adc edx, eax
call fcn.00ea5082

Function at 0xf14a04
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
shl dword [esp + 0x11], 0x63
dec ebp
adc ebx, edx
dec ecx
mov edi, dword [edi + 8]
and byte [esp + 0xc], 0x90
dec ecx
mov edx, dword [edi + 0x10]
call fcn.00ee553c

Function at 0xf17a80
Capabilities:
Encrypt data using speck

Disassembly:
inc esp
movzx esp, byte [edi]
inc esp
xor esp, edx
inc ecx
and esp, 0xff
call fcn.00ec29ad

Function at 0xf1b839
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp + ecx - 0x464bb85c], ecx
xor edx, ebx
mov eax, ecx
sal dword [esp + ecx - 0x464bb85c], 0x8a
push ecx
bswap edx
dec edx
jmp 0xf2b40c

Function at 0xf1c9d8
Capabilities:
Execute syscall

Disassembly:
call fcn.00ef161e
sysenter
pushfd
push ebp
mov dword [esp + 4], 0xf8443aeb
lea esp, [esp + 4]
call fcn.00f0d114

Function at 0xf202ce
Capabilities:
Encode data using xor

Disassembly:
add al, 0xaa
xor bl, al
dec word [esp + edx - 0x4e0e9100]
pop ecx
movzx ecx, byte [ebp + edx - 0x4e0e910b]
lea edx, [edx*4 + 0x442254a2]
neg byte [esp + edx - 0x7c5c98c4]
js 0xfce908
cmp edx, dword [ebx + 0x60]
test dword [eax], edi
mov edi, dword [ebx]
push ebx
sub eax, 0x3b8b44f8
push ebx
rep lodsb al, byte [esi]
sahf
and dword [edx], esi
retf
xor cl, bl
bswap edx
dec cl
ror dl, 0xc5
neg cl
shr edx, 0xb0
call fcn.00fb9333
call fcn.00efc253
stosd dword es:[edi], eax
push cs
dec esp
cmp eax, 0x873b293e
outsd dx, dword [esi]
and byte [edx - 0x2ad8a0ef], ah
mov dl, 0xca
inc ebx
dec ebx
and al, 0xfa
inc esp
cmp al, 0x9e
stosd dword es:[edi], eax
dec ebp
movsd dword es:[edi], dword [esi]
or byte [ebx - 0x79662db6], bl
cmc
inc edx
movzx esi, dl
xor eax, 0xacfbe7b5
and edx, edi
cld
fild dword [eax + 0x16459842]
jb 0xfce8f6
xor ch, byte [ebx + 0x133aab96]
xchg ecx, eax
fmul st(7), st(0)
push ds
cdq
push ecx
pop ecx
sahf
jecxz 0xfce9e9
xchg edi, eax
mov edi, 0xc8904f75
salc
invalid
pop edi
stc
test byte [ebp + 0x1ef3fe6f], bh
cli
lcall 0x321a, 0x9dca886d
wait
xchg esp, eax
and dword [ebx + ebp*4 - 0x49ca0b6d], 0x2c
mov dword fs:[0x19132b86], eax
xlatb
and cl, byte [edx - 0x2da1871]
sub al, 0x72
inc ecx
arpl word [edx + 0x144642], di
adc ecx, dword [edi - 0x73]
xchg esi, eax
and ecx, dword [eax - 6]
cmp ecx, dword [edi - 0xe]
cmp ch, byte [ebp + 0x174df57f]
cld
aam 0x81
push ds
sti
mov dword [0x3d9f8b22], eax
mov ah, 0xbb
cwde
dec edx
push cs
ljmp 0xa496

Function at 0xf3153a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
and dl, al
mov eax, 0x5125bb01
call fcn.00fa888e

Function at 0xf3a939
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
lea edx, [ebp*2 - 0x5140cb49]
dec ebp
adc ebx, eax
dec edx
mov dword [esp - 0x40b9a8fe], esi
dec eax
shr ebp, 4
pop edx
ja fcn.00f0add5
Function at 0xf42bdf
Capabilities:
Check for vm using instruction vpcext
Execute anti-debugging instructions

Disassembly:
dec esp
and dword [esp + 8], eax
inc ecx
mov edx, dword [esi]
dec ecx
adc edi, 4
dec esp
mov dword [esp], eax
shr word [esp + 3], 0x61
inc ecx
mov dword [edi], edx
rol dword [esp + 0xc], 0x6d
dec ecx
sbb ebp, 4
inc ebp
mov eax, dword [ebp]
jmp 0xf18339

Function at 0xf43d2e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
js 0xea2ef1
jns 0xfcfd19
inc dx
sal dword [esp + eax*2 - 0x6054], cl
inc ecx
movzx eax, dx
neg esi
inc cx
inc edx
dec esi
mov dword [esp + eax - 0x302d], ecx
jne 0xfa02a6
sbb ax, 0x3b13
inc ecx
dec al
dec esp
mov dword [esp + ebp - 0x3e94], ecx
inc eax
xor dword [esp + ebp*8 - 0x1f548], ecx
mov word [esp + ebp*2 - 0x7d4c], bx
inc ebp
movzx ecx, al
inc cx
sar esi, 0x2f
dec esp
mov ecx, dword [esp + ebp - 0x3e94]
dec eax
arpl cx, cx
dec ecx
shl esp, 0xfd
inc ecx
pop eax
ja 0xc3e2b9
dec esp
adc ebx, ecx
neg byte [esp + ebp*8 - 0x1f55c]
inc ecx
pop esp
pop edx
inc ecx
pop esp
jno fcn.00f0add5
inc edx
xor dword [esp + esi*2 - 0x69050e78], esi
dec ecx
xadd eax, ecx
call fcn.00ed04c2
dec eax
arpl si, si
dec ecx
shr esi, 0x9b
inc ecx
mov esp, 0xf7b7f98f
dec esp
adc ebx, esi
inc ecx
mov esi, eax
inc ebx
mov ebx, dword [edx + edi - 0x6d896f]
movsx edx, al
inc edx
mov cl, byte [edi + edi - 0x6d896f29]
xor edx, edi
dec edi
lea edi, [edi + edx*2 - 0xdb12dc]
inc cx
rol esi, 0x6e
dec ecx
xor edi, esp
shr ebx, cl
inc eax
movzx ebp, dh
dec eax
sar edi, 0xb7
setne al
inc ecx
mov dword [edi + edi*4], ebx
dec eax
sub edx, esi
inc ecx
dec esi
inc eax
movsx ebx, bh

Function at 0xf9a60f
Capabilities:
Encrypt data using speck

Disassembly:
and word [esp + edx*2 - 0x144], 0x1418
dec esp
mov dword [esp + edx*2 - 0x14a], edx
call fcn.00c4d4ab
dec edx
mov dword [esp + edi - 0xff], 0xcabe0f14
dec eax
lea edi, [edx*8 + 0x10b62892]
dec esi
lea edi, [esp + edi - 0x157]
add dl, 0xa6
jno 0xeba86e
xor dword [esp + 0x38], ebx
dec esp
mov ecx, dword [esp + 0x38]
dec esp
mov eax, dword [esp + 8]
dec ecx
add eax, 0xffc53faf
inc ecx
jmp eax

Function at 0xf9df42
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, ebx
sar dword [esp], 0xa6
add edx, 0xb0a72497
mov ecx, 0x272e2a3c
ror edx, 1
mov eax, ecx
or cl, 0x9d
dec word [esp + eax - 0x272e2a3c]
dec edx
bswap ecx
xchg dword [esp + eax - 0x272e2a3c], ecx
ror ax, 0x84
bswap edx
xor ebx, edx
add edi, edx
rdtsc
push ecx
sub esi, 8
pop ecx
dec cx
not ecx
mov dword [esi + ecx*2 - 0x331dffe], eax
call fcn.00f33ff6
inc ecx
mov edi, dword [edi + eax*2 - 0x72114156]
call fcn.00f916ea
mov edx, 0x99358834
sub ebp, 4
push edx
sal word [esp + 1], 0x47
mov edx, dword [ebp]
jp 0xea3a39
dec ebp
adc ebx, esp
dec eax
rol dword [esp + eax*2 - 0x72114150], 0x81
dec edx
mov ebp, dword [eax + edi - 0x3908a0af]
dec eax
mov dword [esp + eax*2 - 0x7211415e], 0xf2176f23
jb 0xed48fd
Function at 0xfa02b7
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec dx
sal dl, 0xe4
xor ebp, 0x60b95b2a
and bl, bl
bswap ebp
or bl, bh
dec ebp
not edx
inc ecx
push ecx
push ebx
ror edx, 0x51
xor dword [esp + ebx - 0xa9a5], ebp
ror dword [esp + ebx*8 - 0x54d67], 0x14
dec esp
mov ecx, dword [esp + ebx - 0xa9a5]
dec eax
arpl bp, bp
xadd byte [esp + ebx*2 - 0x15355], bh
shl dword [esp + ebx - 0xaa], 0x97
or dl, 0xa4
dec esp
adc ebx, ebp
push edx
and dl, 0xad
sbb dx, word [esp + ebx - 0xa2]
dec edx
mov edx, dword [ebx + edi - 0xad]
dec eax
mov dword [esp + ebx - 0x9d], ebx
setl bl
dec ecx
mov ebx, dword [edi + ebx*8]
dec ecx
adc edi, 0xc
xor edi, edi
dec eax
rol dword [esp + 4], 0xd9
dec eax
test ebx, ebx
push 0x47b36c17
push 0xd32b5ba3
dec eax
lea esp, [esp + 0x28]
je 0xedbb65
inc ecx
push edi
inc ecx
mov edi, 0x5c1f1094
dec eax
lea ecx, [0xbf64b]
inc ecx
mov edi, 0x3d12df29
inc esi
movzx edi, byte [edx + edi*2 - 0x7a25be52]
inc esp
xor edi, edi
inc ecx
and edi, 0xff
call fcn.00f13d7e
not edi
mov ecx, 0x2605510e
inc esp
mov edx, ecx
inc ebx
mov dword [edi + edx*2 - 0x4c0aa21c], edi
call fcn.00ec77d6
stc
in al, 0x29
invalid
call fcn.00f1c8be
mov ebx, 0xe9a8f1b1
bswap ebp
add si, di
xor bl, 0x9d
sar ebx, 0x27
not ebp
not edi
dec eax
shr ecx, 0xaa
ror ebp, 1
not ebp
dec ecx
neg edx
dec eax
sal ebx, 0xfe
dec esp
mov dword [esp + edi*8 - 0x3ffc790], ecx
inc ecx
inc dl
inc ecx
movzx eax, ax
xor dword [esp + edi*2 - 0xfff1e4], ebp
rol bl, 0x65
dec ecx
neg esi
inc ecx
pop ecx
call fcn.00fe16e4
mov edx, 0x8c06a925
dec ecx
sub ebp, 4
movzx ebx, dx
mov ebp, ebx
inc ecx
mov ebp, dword [ebp + ebx*2 - 0x1524a]
inc ecx
xor ebp, ecx
lea ebp, [ebx + ebp + 0x23761f5]
jmp 0xed6e38
Function at 0xfa248f
Capabilities:
Encode data using xor

Disassembly:
ror edx, 3
xor edx, 0x6bac17bd
lea ecx, [eax + eax + 0x52855619]
mov dword [esp + ecx - 0x52855649], eax
jmp 0xfa5c5d
inc esp
pop esp
jmp 0xfa5bb3
out dx, eax
jb 0xfa5c2c
or esi, dword [ecx + 0x57095666]
adc esi, dword [ebx + 0x1f5504d4]
sub al, 0xea
fist dword [0x8e25b190]
and ecx, ebp
retf 0xd049
xchg ebp, eax
lahf
mov dword [esi + ebp*2 - 0x22], eax
adc byte [ebx], 0x8a
push cs
xchg dword [eax - 0x19], edi
push cs
mov edi, 0x991050c0
outsb dx, byte [esi]
sub eax, 0xccdedb66
jmp 0xfa5b94
fsubr dword [esp + eax - 0x2ffbda86]
mov al, byte [edi - 0x63b1ab81]
add byte [edi + 0x2aeafeec], ah
stosd dword es:[edi], eax
out 0x8b, eax
xor ebp, dword [edi - 0x62]
imul ebp, dword [eax - 0x2d3c360], 0xc02badf0
inc eax
imul eax, edx, 0x99f8f8fa
rol byte [eax + 0x69], 0xc2
cli
clc
clc
cdq
and ebp, dword [eax + ecx*8 - 0x4ef40769]
push edx
enter 0xfffffffffffff897, 0xb
mov cl, 0x52
xor dword [ecx], edx
out dx, al
lcall 0x3d3e, 0x211bf6df
push ebx
push 0x52
popal
cmp eax, 0x55e74d53
cmp eax, 0x112dfd53
cmp eax, 0x9819a653
and edi, esi
rcl bl, cl
loopne 0xfa5be2
not edx
shl eax, cl
adc byte [esp + eax - 0x3000], 0xb2
xor ebx, edx
and ecx, 0x839cff97
call 0xfbb2bc
daa
xchg esp, eax
add al, 0
sar bh, 1
push dword [edx - 0x1e7e25cd]
xchg edi, eax
call [ebx + eax*4 + 0x15646e8]
add byte [edi], ah
js 0xfa5c0a
in al, dx
sub bh, byte [esi]
mov edi, 0xcbeb8f9
loopne 0xfa5c36
invalid

Function at 0xfa66df
Capabilities:
Encrypt data using speck

Disassembly:
not dl
bswap eax
sal edx, 0xbf
mov dword [esp + edx - 0x80000000], ecx
ror edx, 0xaa
xor ebx, eax
pop edx
add edi, eax
movzx ax, byte [esi]
ror dl, 0x43
sar edx, 0xb1
and ecx, 0xcd29b72b
mov dl, byte [esi + 2]
bswap ecx
dec cx
lea esi, [ecx + esi - 0x2029c4]
sar ecx, 0xa
adc al, dl
dec ecx
add ecx, 0x4a9ec8be
mov cx, ax
call fcn.00c30358

Function at 0xfab166
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0xfa98de
xchg byte [esp + ecx*2 - 0x1800000], dl
ror eax, 1
add dx, 0xec2d
cmovns dx, cx
add eax, 0xe2980427
ror eax, 1
sar edx, 0xdd
js 0xf12188
sete cl
xor ebx, eax
add edi, eax
lea ebp, [ebp + ecx*4 - 0x3000005]
xor dx, 0x6f35
call fcn.00f110fe
shl ax, 0x88
xor eax, dword [esi + eax*4 + 4]
add cl, 0x9c
adc edx, eax
ror ecx, cl
jb 0xefd4da
pop eax
adc eax, 0xffd87087
jmp eax