joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc51a76
Capabilities:
Encrypt data using speck

Disassembly:
or ebp, ebp
mov ebp, esi
movzx ebx, dx
shr dl, 0xe3
shr edx, 0x90
mov ebx, eax
jns 0xd49eb8
mov ebx, 0x5b90a96
push ebx
dec edx
mov ecx, dword [ebx + edx - 0x5b90a96]
inc ebp
mov eax, dword [edx + ebx*2 - 0xb721524]
mov esi, dword [esp + ebx*2 - 0xb721529]
call fcn.0075f5f4
jb 0xc0b25e
mov dword [esp + edx - 0x2c74ac12], ebp
movzx ebp, dl
push edi
inc dx
push ebx
jnp 0x7545ce
call fcn.0077ae6e
shr dl, cl
lea ecx, [eax + eax*2 + 0x35337880]
mov word [ebp + ecx*2 - 0x68a2bf0c], dx
lea ecx, [eax + ecx + 0x4aa25eb9]
jmp esi
push ebx
call fcn.008d4e7a
xor cl, byte [ecx + esi - 0x2ea8fffe]
mov edx, dword [esp]
imul edx, dword [esp + edx - 0xa9f1210]
bswap edx
lea esi, [esi + edx - 0x4126af]
jb 0xd1e7c2
mov eax, 0x27a80e19
movzx eax, byte [ebp + eax*2 - 0x4f501c32]
mov edx, 0x963a5409
add ebp, 1
push edx
xor al, bl
pop edx
bt edx, edx
or edx, edx
not al
rol al, 1
add al, 0x89
bts edx, edx
bts dx, dx
add edx, edx
xor al, 0x36
inc edx
add al, 1
dec dx
push edx
sar byte [esp + edx*2 - 0x58e95822], 0xa3
rol al, 1
xor bl, al
jmp 0x7e239a
dec esp
mov dword [esp + eax*2 - 0x4ad9ff7c], esi
dec eax
arpl dx, dx
jmp 0xc26a52
mov eax, 0x1180522c
shl edx, 2
mov eax, ebp
call fcn.008a818e
adc edx, 0x37ada210
or al, cl
not al
movsx ecx, dl
mov word [edx + esi - 0x37eec8c2], ax
movsx eax, byte [esp + edx*2 - 0x6fdd9184]
mov dword [esp + eax - 0x10], edi
ret
mov edx, ebx
jp 0xc97a43

Function at 0xc541c7
Capabilities:
Authenticate hmac

Disassembly:
xor eax, 0x8130d3a5
push 0x1c07e89c
ror byte [esp + 5], 0x61
bswap eax
ror eax, 1
inc byte [esp + 7]
bswap eax
xor ebx, eax
jmp 0xd6b1b2
ror edx, cl
add al, ah
adc ecx, eax
cwde
xor ebx, edx
inc eax
rol eax, cl
setb cl
add ebp, edx
btc eax, ecx
imul cl
mov edx, 0xad2f872b
mov eax, dword [esi]
lea edx, [edx + ecx - 0x6cf320dc]
mov edx, dword ss:[eax]
mov dword [esi], edx
movzx eax, cx
jmp ebp
push 0xa8b6c92
mov dword [esp + 8], eax
jne 0x8ec2e2
mov edx, 0xc7324dbb
movzx eax, dx
mov edx, dword [eax + edi - 0x4dbb]
lea edi, [edi + eax*2 - 0x9b72]
mov ecx, 0xcfba34b5
bt ecx, ecx
xor edx, ebx
rol cl, 0x22
xor eax, ecx
xor edx, 0x1db972b3
dec ecx
add ecx, eax
bswap edx
bt ecx, ecx
rol ecx, cl
lea edx, [ecx + edx - 0x48156706]
setae al
xadd ax, cx
xor edx, 0x2798c18a
not eax
jmp 0x82f4f5
sar word [esp + 6], 0x6e
ror byte [esp + 1], 0x22
dec ebx
jmp 0xc17134
call fcn.00847044
sbb dword [ebx - 0x33], ebx
push edi
sbb al, 0x85
pop ecx
invalid
mov eax, dword [ebp + ebx*4]
push 0x3030009f
jnp 0x86c255
sub edi, 4
mov edx, dword [edi]
mov eax, 0xa0bef20
call fcn.007b1755
mov eax, 0x1b13d4ae
add ax, ax
mov eax, dword [esi + eax - 0x1b13a95c]
adc esi, 3
push 0x2d8e0818
xor eax, ebx
shl word [esp], 8
inc eax
shl dword [esp], 0xc6
jp 0x762a24
call fcn.00c52968
add ebp, eax
lea esp, [esp + 8]
jmp 0xd3d781
Function at 0xc58959
Capabilities:
Encrypt data using speck

Disassembly:
push edx
add ebp, ecx
mov ecx, dword [edx + edi - 0x4a9173bd]
rol edx, 0xa
idiv word [esp + edx - 0x45cef529]
mul edx
mov edx, dword [edx + ecx - 0x14f0c948]
movsx ecx, byte [esp + eax - 0x3210ab4e]
push eax
call fcn.0072dcc7
push 0x722d6f80
mov eax, dword [esp]
mov ecx, dword [edi + eax - 0x722d6f80]
lea edi, [edi + eax - 0x722d6f7c]
xor ecx, ebx
lea edx, [eax + eax + 0x1f105c35]
xor ecx, 0x9d223990
not eax
xchg dword [esp + edx*2 - 0x6d6766a], edx
not ecx
push edx
btr edx, 0x28
lea ecx, [eax + ecx + 0x4634028a]
ror ax, 0xef
mul al
rol ecx, 3
xor ecx, 0x4fa5903f
sal edx, 0x70
rol word [esp + edx - 0x6e7ffffd], 0xf
rol ecx, 1
shr al, 0x67
add edx, 0xc405a132
xor ebx, ecx
push edx
xchg dx, ax
add ebp, ecx
push eax
mul ax
xadd dl, ah
mov edx, dword [esi + edx*2 - 0x650acad8]
ror byte [esp + 8], 7
mov cl, byte [esi + 4]
sub eax, 0x81028021
rol ax, 0x41
rol eax, 0xfc
lea esi, [esi + eax - 0x70ccffee]
push eax
jb 0xc471e7
pop eax
mov byte es:[eax + edx - 0x70ccfff4], cl
shl dword [esp + eax - 0x70ccfff4], 0xac
neg eax
movzx edx, ax
mov dword [esp + edx - 0xc], ebp
ret 0xc

Function at 0xc62962
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
mov dword [esp + ecx - 0xb09c], ecx
inc dword [esp + ecx - 0xb098]
lea edx, [ecx + edx + 0x630f1772]
shl eax, cl
rol edx, 1
xor edx, 0xf5013930
bswap edx
ror byte [esp + eax + 6], 0x41
sar ecx, 0xce
ror edx, 3
rol ecx, cl
xor ebx, edx
dec word [esp + eax*2 + 2]
call fcn.00d119e1
adc ebp, dword [eax - 0x4e]
mov edi, 0x605c15c3
add edi, dword [edx + edx]
jne fcn.00c62962
inc bl
in eax, dx
sub cl, ch
ret

Function at 0xc6604d
Capabilities:
Encrypt data using speck

Disassembly:
mov ecx, 0xd38f0835
dec cx
mov edx, dword [esi]
add esi, 4
mov eax, ecx
add eax, ecx
add ecx, ecx
xor edx, ebx
dec edx
not edx
idiv al
inc edx
dec eax
shr al, 0xa2
bswap edx
and cl, ah
xor ebx, edx
sar al, 0xa2
adc ebp, edx
movsx edx, cl
inc ecx
mul ecx
mov di, word [edi + edx - 0x6d184c2e]
sal ecx, 0x41
jbe 0x8b0524
inc ecx
mov eax, 0xd82a94a1
dec esi
lea esp, [eax*4 - 0x5be0fa41]
dec ecx
lea ebx, [eax + 0x23099934]
inc ebp
movzx edi, byte [ebp]
movzx eax, bl
inc ecx
movsx esi, ax
dec esi
lea ebp, [eax + ebp - 0xd4]
inc esp
xor bh, ch
dec eax
cdq
movzx ecx, si
inc ecx
inc bh
inc ebp
movsx ecx, sp
inc ebp
mov esi, ecx
dec ecx
neg esi
inc ecx
not bh
not ebx
call fcn.008fada3
sub ebx, eax
lea eax, [edx + eax*8 + 0x4a07ee2b]
jnp fcn.008b5740
movsb byte es:[edi], byte [esi]
xor dh, cl
enter 0xffffffffffff9422, 0xfffffffffffffffb
in eax, dx
wait
push ds
test dword [eax + 0x3434eb52], 0x5f6eb4c7
jmp 0x544272db
and ebx, 0xff
mov dword [esp], 0xd36bfbe
call fcn.008f186e
jmp 0x763f76

Function at 0xc683be
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
call eax
mov edi, 0x79a54e3a
movsx ecx, di
mov ebp, dword [ebp + ecx*2 - 0x9c78]
call fcn.00838c4c
Function at 0xc684a1
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
movzx cx, byte [ecx + esi - 0x3402264d]
sub edx, edx
mov eax, edx
or dl, byte [esi + eax*4 + 2]
cwde
lea esi, [esi + eax + 2]
sar al, 0x46
not cl
not dl
shl ax, 0x65
or cl, dl
mov word [esi + eax*4], cx
lea ecx, [eax*2 - 0x19dec64f]
inc cx
sar cl, 0x82
or eax, ebp
jmp eax
ror eax, 3
inc eax
bswap eax
dec eax
not cl
xor ebx, eax
ror dx, 0xc4
adc ebp, eax
jmp 0x713200
not dl
shr ecx, cl
or cx, cx
or al, dl
sub cl, 0x36
mov word [esi + ecx*4 - 0x328], ax
movsx eax, cx
je 0x76789d
imul ecx
lea edi, [edi + ecx*2 - 0x198]
jo 0xc09571
idiv ecx
call fcn.007d861d
add edi, ecx
lea esp, [esp + 0x10]
call fcn.00738e3c
inc ebp
movzx esi, al
inc ecx
movsx edi, cl
inc ecx
mov ecx, dword [ebp + edx - 0x9b]
bt di, 0x25
push edi
dec esi
lea ebp, [edx + ebp - 0x97]
inc ecx
push esp
add byte [esp + edx - 0x97], dl
add word [esp + edx*2 - 0x134], di
xor ecx, ebp
inc edx
lea ecx, [ecx + eax - 0x77eb83e7]
not ecx
mov ebx, edx
dec eax
sar dword [esp + edx*4 - 0x264], 0xe8
bswap ecx
dec eax
rol dword [esp + edx - 0x97], 0x1f
ror ecx, 3
neg dl
call fcn.0071c22c
movsx edx, cx
mov dl, byte [esi + ecx - 0x603ca011]
sub cl, cl
dec cx
lea esi, [esi + ecx - 0x603c9ffd]
xor al, cl
and cl, ch
jno 0xc4f51a
neg al
rol al, 1
sal edx, 0xba
shl dword [esp + edx - 0x28000000], cl
xor al, 0x27
xor bl, al
lea eax, [esp + eax + 4]
movzx cx, byte [ecx + eax - 0x2da60f71]
xchg byte [esp + edx*2 - 0x4fffffff], dh
movsx eax, dx
rol byte [esp + edx - 0x27fffffe], 0xe1
lea esi, [esi + edx*2 - 0x50000002]
sar dl, 0x26
inc word [esp + edx*2 - 0x4fffffff]
mov word [esi + edx - 0x28000000], cx
adc dx, ax
mov ecx, dword [edi + edx*2 - 0x50000000]
xor dx, 0xd92e
pop eax
rol dx, 0x6a
lea edi, [edi + edx*2 - 0x500176c4]
adc eax, edx
setge al
xor ecx, ebx
ror ecx, 3
sub ecx, 0xb4bcd739
cwde
rol dl, 0xa7
call fcn.00884c8b
mov ecx, 0x34025913
rol cx, 0x61
lea edi, [edi + ecx - 0x3402b22a]
jo 0xd75ec6
sal ecx, cl
xor cl, byte [ebp + edx - 0x3783]
add dx, 0x139a
setb dl
lea ebp, [ebp + edx*2 - 0x95fe]
btr dx, dx
not al
imul edx, edx
not cl
dec dx
or edx, edx
bswap edx
and al, cl
mov word [ebp], ax
jmp esi
xchg ch, cl
movsx eax, cl
mov eax, dword [ecx + edi - 0x340226b2]
lea edx, [ecx*2 + 0x25a7f5a8]
shr edx, 0x31
xor eax, ebx
xor edx, edx
bt ecx, edx
neg edx
not eax
bt dx, 0xbf
jae 0x7f0d5c

Function at 0xc7ca01
Capabilities:
Encrypt data using speck

Disassembly:
inc esi
xor dword [esp + ecx - 0x8aca67], eax
dec eax
lea ebp, [esi*2 - 0x5ee38be4]
dec esp
lea edi, [ecx + ecx*4 + 0x359aae94]
not cx
pop ebp
shl esi, 0x9d
ror bl, 0x85
dec ebp
arpl ax, ax
dec ebp
add ebx, eax
dec ecx
add esi, ebx
jmp esi
inc ecx
bswap eax
pop ecx
inc ecx
movzx ebx, ah
inc edx
mov ecx, dword [esp + ecx*4 - 0x22b299c]
inc ecx
xor eax, 0x32802ba0
inc edx
movzx esi, byte [esp + ecx*2 - 0x11594ca]
inc ecx
rol eax, 1
dec edx
mov dword [esp + ecx*8 - 0x4565338], ebp
dec esp
xor esp, ecx
jg 0x800835
inc cx
neg ecx
jle 0xc7a1ec

Function at 0xc7ca0b
Capabilities:
Encrypt data using speck

Disassembly:
push 0xf6162c02
mov ebx, dword [ebx*4 + 0xc8930c]
inc byte [esp + 0xd]
jno 0x82af27
Function at 0xc81af8
Capabilities:
Encode data using xor

Disassembly:
not dl
add cl, 0x80
rol ecx, cl
pop ecx
and al, dl
call fcn.00781768
Function at 0xc8dfc0
Capabilities:
Encrypt data using speck

Disassembly:
push 0x6c1594a0
call fcn.007985a9
inc esi
mov esi, dword [ecx + ebp - 0x142e781f]
dec ebp
lea ebp, [ebp + ecx*2 - 0x285cf03a]
inc ecx
mov eax, eax
mov ebx, ecx
bts eax, eax
inc esp
xor esi, ebp
inc ecx
neg esi
inc esp
mov esp, ecx
inc edi
lea esi, [esi + eax + 0x3cba7ac]
inc ebp
movsx ecx, ax
inc ecx
ror esi, 1
dec ecx
neg ecx
inc ecx
setb ah
dec esi
lea edi, [eax*4 + 0x2c271cb9]
inc ecx
not esi
call fcn.007ccd59
shr cx, 0x2d
lea edx, [edx + ecx*2 + 0x749ddcb1]
ja 0xbe74d0
inc eax
neg edx
neg eax
xor eax, 0xb416e110
not cl
bswap edx
add eax, 0x9e1b9636
setbe cl
and eax, eax
neg edx
xor ecx, eax
xor ebx, edx
xor ax, 0xaeb7
or eax, 0x41af9797
imul ax, ax
add edi, edx
movzx edx, al
mov si, word [esi + ecx*2 - 0xadf3302]
btc eax, eax
or dx, dx
jge fcn.008157bf

Function at 0xc909cc
Capabilities:
Authenticate hmac

Disassembly:
jg 0xcb0672
neg byte [esp + 0xc]
call fcn.00c1b3d4

Function at 0xc909db
Capabilities:
Authenticate hmac

Disassembly:
rol eax, 2
bswap eax
lea eax, [ecx + eax + 0x66c83729]
mov dword [esp + ecx - 0x15df6f01], ecx
not cl
dec cx
xor ebx, eax
call fcn.00d2b681

Function at 0xcabca9
Capabilities:
Encrypt data using speck

Disassembly:
xor cl, bl
shl eax, 0x36
neg cl
cwde
mov dword [esp + eax*8], eax
inc cl
dec ax
xchg dword [esp + eax*8 - 0x7fff8], eax
not cl
not eax
sub cl, 0x99
pop eax
sar eax, 0xd8
xor cl, 0x94
inc ax
sal eax, 0x9a
sbb eax, eax
ror cl, 1
rol al, 0x86
rol eax, 0x6f
xadd al, ah
not cl
adc al, al
xor bl, cl
jmp 0xcbd238
bt eax, 8
adc ecx, esp
inc al
mov word [ecx + eax*2 - 2], dx
add eax, eax
lea ecx, [eax + eax - 0x1ed3a0e3]
mov ecx, dword [eax + edi - 2]
call fcn.00c63468

Function at 0xcbf0a0
Capabilities:
Encrypt data using speck

Disassembly:
xor cl, 3
xor eax, 0x67840f8b
rol eax, 1
mov dword [esp], edx
inc eax
xor ebx, eax
inc dx
or dword [esp], edx
jne 0x8cd2ce

Function at 0xcc446d
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x4021e88e
bswap eax
cbw
mov eax, dword [ebp + ebx*4]
call fcn.00d6b2c3
dec esp
lea edi, [ecx*4 - 0x1bc6b0e5]
inc ecx
neg eax
inc ecx
movsx esi, cx
inc ecx
ror eax, 1
inc ecx
bswap eax
push ebp
not edx
movzx edi, dx
inc esi
xor dword [esp + ecx - 0x759b2a00], eax
inc ecx
btc ecx, edi
pop ebp
dec edx
lea ebx, [ecx*4 - 0x5e72a249]
inc ecx
movzx eax, cl
dec ebp
arpl ax, ax
inc esp
and ecx, eax
dec eax
sar edi, cl
dec ebp
add ebx, eax
inc di
mov edx, dword [edx + ecx]
dec ecx
ror ecx, 0x33
dec esp
lea eax, [eax*2 - 0x59f44770]
sub di, cx
jne fcn.00c25987
cdq
xor ecx, 0xde036437
imul ax
shr byte [esp + eax - 0x1543b], 0xc6
adc ecx, 0x8d0847a3
call fcn.0083d91d
lea esp, [esp + 8]
jne 0x7b4cf3
mov eax, dword [ebp]
push 0xe02db4ab
call fcn.00c83424
inc ecx
mov esp, 0x759b2a06
inc edi
mov eax, dword [esp + ebp - 0x759b2a06]
dec ecx
inc esp
dec edi
lea ebp, [ebp - 0x759b2a03]
inc ecx
mov edx, esp
inc ebp
movzx ecx, ah
inc esp
xor eax, ebp
inc ebp
xor ecx, esp
inc ecx
rol eax, 2
inc ecx
inc eax
movzx ecx, dx
jmp 0xcbb5f2
Function at 0xcc76c8
Capabilities:
Encrypt data using speck

Disassembly:
shr ecx, 8
rol word [esp + 5], 0xea
push 0x27bb1c2d
xor ecx, ebx
sal byte [esp + 0xb], 0xe6
inc edx
shr word [esp + 0x10], 0x86
call fcn.00781f93
mov ecx, 0x633d04a5
lea edx, [ecx + ecx*2 + 0x440a8c04]
mov eax, dword [ebp + ecx - 0x633d04a5]
add ecx, 0xed27fcbd
and cl, dl
mov ecx, dword [ebp + edx - 0x6dc199ef]
jnp 0x8934d4
mov edx, 0x3ab3d204
mov ecx, dword [esi + edx*2 - 0x7567a408]
ror dx, 0xea
inc edx
lea esi, [esi + edx*2 - 0x75670266]
jne 0x83a408
call fcn.007b6fd7
syscall
inc ecx
push edx
dec eax
mov dword [esp], 0x879f9e58
call fcn.0081e363
call fcn.00d48211
or eax, 0xd6208ea3
pop eax
ret
xor ecx, ebx
btr edx, edx
ror ecx, 1
mov eax, 0x1586b218
sub ecx, 0x77245222
sub edx, eax
ror ecx, 1
shr eax, 0xfb
cwde
neg ecx
dec dx
neg al
btr dx, ax
xor ebx, ecx
sub dl, 0xb4
add ebp, ecx
mov ecx, 0x1325ff06
cbw
mov cx, word [edx + edi - 0x250c8f68]
not eax
not eax
lea edi, [edi + edx*2 - 0x4a191ece]
movzx eax, byte [edx + esi - 0x250c8f68]
shl dl, 0x26
lea esi, [esi + edx - 0x250c8eff]
xadd dl, dh
xor al, bl
ror edx, 0xf0
btr edx, edx
inc al
neg al
sub dx, dx
call fcn.0083e723
shr dl, 0x63
jnp 0x7ae0ef
push ebx
mov ebx, edx
ja 0x80a761
push cs
push 0xd2a276
ljmp 0x33
and ebx, 0xff
push 0x23bc4719
mov ebx, dword [ebx*4 + 0x8945d0]
push 0xf42f44bf
jmp 0x70f633

Function at 0xcc8a32
Capabilities:
Encode data using xor

Disassembly:
dec ebx
push 0x7e964189
lea esp, [esp + 4]
jne 0xbdd95c
mov eax, 0x137aa1c
mov eax, dword [ebp + eax*2 - 0x26f5438]
push 0xd4966eae
call fcn.00d1f6fa
xchg ecx, ebp
pop ebp
call fcn.008f2358
mov dword [esp], eax
jae 0x864c64
mov dword [edi], eax
push 0xd2bc5535
not dword [esp + 4]
mov edx, dword [esi]
mov eax, dword [esp + 4]
lea esi, [esi + eax*2 - 0x59864898]
xor edx, ebx
xor edx, 0x71bdb100
div al
bswap edx
ror dword [esp + eax - 0x2cc30c73], 0x94
jae 0xc1ba5b
mov eax, 0xfb0d1c9f
btc ax, ax
mov eax, dword [ebp + ebx*4]
call fcn.00cc8a32
pop edi
je 0xbdd9eb
wait
lahf
xchg esi, eax
mov ebp, 0xa2772c6b
dec edx
mov esi, 0x9b8426a
mov esp, 0x9dd4c98c
pushal
xchg ebx, eax
sub esp, dword [edi]
sahf
hlt
dec dword [esp + eax*2 - 0x598618ed]
ror edx, 1
bswap edx
sal eax, 0x76
movsx ecx, byte [esp + eax - 0x1dbffffc]
lea edx, [edx + eax*4 - 0x1b6f3c69]
setbe cl
shr ecx, 0x4f
neg al
neg edx
sub edx, 0x9d2f6617
add ecx, ecx
mov dword [esp + eax*2 - 0x3b7ffff8], eax
xadd cx, ax
xor ebx, edx
add ebp, edx
xor word [esp + eax - 0x1dc0fffb], cx
mov dword [esp + eax*4 - 0x7703fff8], ebp
ret 8
mov dword [esp], 0x8595af33
jae 0x893498

Function at 0xcd6345
Capabilities:
Encrypt data using speck

Disassembly:
mov ebx, 0xb600113d
mov ebx, dword [esp + 0x24]
call fcn.0077756b

Function at 0xce9055
Capabilities:
Encode data using xor

Disassembly:
rol eax, cl
mov dword [esp + eax - 0x53d6dcff], ecx
add ebp, edx
mul ecx
jno 0x719867
mov dword [esp + edx - 0x53c210c7], ebp
ret 4
Function at 0xce9ea4
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
xor bh, 0x1e
inc ecx
inc ecx
inc ecx
not bh
imul edi, esi
inc ecx
setno ah
inc ecx
xor ch, bh
inc ecx
push esp
dec ecx
sal ecx, 0x51
dec esi
lea edi, [esp + edi + 8]
dec ecx
inc esi
dec eax
lea ebx, [edx*2 - 0x2b652cd8]
inc ecx
movzx eax, si
dec edx
mov ecx, dword [edx + edi - 0xb8]
dec eax
mul dword [esp + edx - 0xb8]
dec ebp
lea edx, [edx + esi - 0xc0]
inc ebp
movsx edi, sp
inc esp
or byte [esp + edx*2], cl
dec ecx
mov dword [edx + edx*8], ecx
seto byte [esp + edx]
pop esi
inc ecx
push esi
inc ecx
or edx, dword [ebp + edx]
inc ecx
xor dh, bh
dec eax
cwde
shr dword [esp + ebx + 0x2b652b6b], 0xf7
dec edi
lea ebp, [esp + ebp - 0x631ac5fc]
inc ecx
setbe ah
shr dword [esp + esi - 0x631ac5fe], 0xfd
xor edx, ebp
neg edx
inc cx
add esi, 0x8cc1c305
pop esp
rcl byte [esi - 0x36], cl
push esi
inc edx
inc edx
add bh, byte [esp - 0x631ac5fa]
dec ecx
sbb eax, esp
xor edx, 0xf09c61b7
inc ecx
xchg esi, ebx
bswap edx
dec esi
lea esp, [edi*8 + 0x2a8d4e8e]
dec ecx
lea eax, [esp + esi - 0xe499afc]
jmp 0xc5ffcf
pop ebp
dec eax
arpl dx, dx
dec esp
adc ebx, edx
jmp fcn.00c25987
dec eax
mov dword [esp + esi - 0x631ac600], ebp
sar esi, 0xac
inc ebp
bts esp, esi
xor dword [esp + esi - 0x631ac], edx
inc ebp
movzx eax, cx
inc eax
shr bh, 1
jae 0xbed7ca
call fcn.00c57a86
inc ecx
mov esp, 0x631ac6b8
inc edi
movzx edi, byte [ebp - 0x631ac6b8]
dec edi
lea ebp, [ebp - 0x631ac6b7]
inc ebp
movsx ecx, ah
inc ecx
movzx edx, cl
mov esi, edx
inc esp
xor bh, ch
inc ecx
neg bh
dec eax
lea edi, [edx*4 + 0x5304a1a6]
dec esp
lea esi, [edi + 0x2fbc8893]
inc ecx
rol bh, 1
jmp 0x7113d5

Function at 0xcee81d
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + edi*4], edi
dec esi
mov ecx, dword [esp + ecx - 0x72fec243]
dec esp
mov esp, dword [esp + edi*4 + 0x10]
xchg dword [esp + edi*8 + 1], edi
call fcn.00738f47

Function at 0xcefc61
Capabilities:
Encode data using xor

Disassembly:
call fcn.00d1a202
adc esi, 4
jmp 0x898a5c

Function at 0xd02ba7
Capabilities:
Encode data using xor

Disassembly:
ror eax, 1
mov dword [esp], 0x912be90e
shl word [esp + 5], 0x69
shr word [esp + 3], 0x89
sbb eax, 0xe02a2389
and byte [esp + 6], 0xe
jb 0x8ef30b
xor eax, 0x36815fb0
neg eax
shr word [esp + 8], 0x6f
not dword [esp + 2]
setp byte [esp + 6]
bswap eax
jae 0xd64d5d
sub edi, 4
jmp 0x876204
jne 0xc3dfb6
mov ecx, dword [esi + edx*8]
add dx, word [esi + edx + 4]
shr al, 0xa1
pop eax
adc esi, 6
mov eax, 0x1f3778ba
mov word [ecx + eax*4 - 0x7cdde2e8], dx
movzx ecx, ax
not ecx
jmp edi

Function at 0xd08007
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], eax
not ax
xor ebx, edx
xor byte [esp + 5], ah
shl dword [esp + 4], cl
sal byte [esp + 5], 0x44
adc ebp, edx
mov word [esp + 2], ax
sar word [esp + 4], cl
dec byte [esp + 3]
pop eax
pop ecx
jmp ebp
lea edx, [edx + eax - 0x6e7f46f9]
inc eax
adc al, 0x24
not edx
lea edx, [eax + edx - 0x2c6c6b19]
jns 0xcf60bd
push edi
inc edx
sub bl, byte [ebx + 0x7cb1bf6d]
inc esp
push 0x36
invalid
Function at 0xd117ae
Capabilities:
Authenticate hmac

Disassembly:
not dword [esp + 4]
lea esp, [esp + 8]
jne 0xd117bd
mov eax, dword [ebp]
call eax
mov esi, 0x8d158720
push esi
mov ebp, dword [ebp - 4]
sar byte [esp + 1], 0xa6
movzx ebx, si
mov dword [ebp + ebx*2 - 0x10e40], eax
movzx edx, word [esp + ebx - 0x8720]
xadd word [esp + ebx*4 - 0x21c7f], dx
mov esi, ebp
mov ebx, dword [esp + edx*8 - 0xafec]
mov edi, dword [esp + edx - 0x15f6]
movzx ebp, dx
mov ebp, dword [esp + edx - 0x15f2]
dec edx
mov ecx, dword [edx + ebp - 0x15fd]
shr edx, 0x51
push edx
mov eax, 0xc1320714
lea ebp, [ebp + edx + 4]
bt edx, eax
idiv dword [esp + edx + 2]
sal word [esp + edx*2 - 0x18e40e27], 0xce
xor ecx, ebx
rol ecx, 1
xor eax, eax
jbe 0xce8f9b
call fcn.00858c19
lea esp, [esp + 8]
je 0x74a67f
mov eax, 0x7c9c0830
mov eax, dword [ebp + ebx*4]
push 0x8030d211
mov dword [esp], eax
push 0xde2d723d
dec ebx
push 0x349b0929
jmp 0x74a671

Function at 0xd1228c
Capabilities:
Encrypt data using speck

Disassembly:
xor edi, eax
and edi, 0xff
sub word [esp + 4], 0xf103
mov edi, dword [edi*4 + 0xbdfa2c]
call fcn.0080cab5

Function at 0xd12827
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + edx - 0xfe]
lea eax, [edx*8 - 0x43e433d2]
cdq
cdq
mov word [esi], cx
shl ax, 0xc9
rol al, 4
pop edx
sbb edi, 4
mov eax, dword [edi]
mov edx, 0x648531b3
movzx ecx, dl
xor eax, ebx
shl dword [esp + ecx*2 - 0x166], cl
imul ecx, dword [esp + edx - 0x648531b3]
rol eax, 2
neg eax
imul ecx, edx
imul dx, dx
bswap eax
seto byte [esp + edx - 0x64850327]
dec eax
push edx
xor ebx, eax
add ebp, eax
neg dword [esp + edx - 0x64850325]
lea eax, [ecx + edx*8 + 0x111813bc]
pop ecx
pop ecx
jbe fcn.00d0b40c
pop esi
mov esi, 0xed916757
lcall 0x6469, 0x60173bb0
mov fs, edi
lahf
or ch, bl
pushfd
pushal
imul esp, dword [esi + ecx*4 - 0x19], 0x9ceb0a9f
call 0x3e508996
push 0xffffffffffffffe9
pop ebx
xor byte [ebp + 0x76], ch
pushal
aam 0xf1
xlatb
test edi, 0xd3acfa30
mov ebx, 0x8df563a6
outsw dx, word [esi]
sal ebx, 1
fadd dword [eax - 0x4e]
mov dword [0x98df3e50], eax
jl 0xd128a1
inc ecx
invalid

Function at 0xd175bf
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
rol esi, 1
dec eax
mov dword [esp + ebx - 0x55], 0xda2a28b4
inc esp
movzx edi, word [esp + ebx*2 - 0xa7]
inc ebp
sub cl, cl
inc ecx
inc esi
xor dword [esp + ebx*2 - 0xa8], 0x80ab69b6
dec eax
mov dword [esp + ebx*2 - 0xaa], ebp
inc esp
xor dword [esp + ebx*2 - 0xaa], esi
rol edx, 0x16
jae 0x7856bc
bts eax, 0x3b
xor edx, ebx
add eax, eax
movzx ecx, ax
call fcn.00796e4b
mov edx, 0x8416a8bf
and dl, 0x8b
mov eax, edx
sbb edi, 4
bt edx, 0xe
btr eax, 8
mov edx, dword [edi]
movsx ecx, al
xor edx, ebx
not edx
neg edx
rol eax, 0xf7
not ecx
lea edx, [edx + eax + 0x7dd7d32]
bt ax, ax
not edx
lea edx, [edx + eax + 0x2571f769]
sal cx, 0xac
rol ecx, 0x45
xor al, 0xb1
xor edx, 0xea24cbb8
dec edx
sal ecx, 0x35
ror edx, 3
rol ecx, 0x5a
dec cl
xor ebx, edx
add esi, edx
lea edi, [edi + ecx*2 - 0x1ff]
and ecx, ecx
movzx edx, byte [edi + eax - 0x45c20be5]
xor dl, bl
neg dl
add dl, cl
sub cx, 0x13a8
bts ecx, ecx
xor dl, 0x39
call fcn.00d5778d
mov ecx, 0xa63e1588
sub edi, 1
sar cx, 0xa8
jnp 0x78f3cf
Function at 0xd1c120
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp], edx
mov edx, 0xd11d879d
movzx eax, dl
bswap edx
lea edi, [eax + edi - 0xa1]
xor dword [esp + eax*2 - 0x12e], 0xb98aea16
dec word [esp + eax - 0x93]
mov ecx, dword [eax + edi - 0x9d]
btr dx, 0x85
div dl
xor ecx, ebx
mov dword [esp + eax - 0x9d00], 0x8c9d2d09
dec ecx
lea eax, [eax*8 + 0x3bb18e94]
ror ecx, 2
mul word [esp + eax*2 - 0x776ced1c]
inc ecx
cbw
shl eax, 0x2c
call fcn.0080e209
invalid

Function at 0xd1f1a7
Capabilities:
Encrypt data using speck

Disassembly:
sub edi, 2
ror ecx, cl
call fcn.00d2160e
sal dx, 0x46
and ecx, eax
push edx
and dx, 0x7db7
not ecx
mov dword [edx + esi - 0x34567d80], ecx
push edx
sal byte [esp + edx*2 - 0x68acfaf9], 0x24
jae 0xc7dcb8
mov ecx, dword [edx + edi - 0x34567d80]
lea edi, [edi + edx*2 - 0x68acfafc]
push edx
xor ecx, ebx
btr dx, dx
jae 0x79153c
mov dword [esp], 0x597dc8e0
call fcn.0074b44f

Function at 0xd26e00
Capabilities:
Encode data using xor

Disassembly:
call 0x67b86d5a
mov ecx, dword [esi + eax - 0xbc0]
mov cx, word [esi + eax - 0xbc0]
dec dword [edi]
mov bh, 0xd0
movzx edx, ax
rol word [esp + eax - 0xbb7], 0x43
neg ax
lea esi, [esi + eax*2 - 0x1e87e]
cdq
add eax, dword [esp + eax*4 - 0x3d0f8]
lea edi, [edi + edx*4 - 1]
or byte [esp + edx + 8], 4
sub eax, 0x1db1bc0d
movzx eax, byte [edi + edx*2]
inc edx
xor al, bl
add al, dl
ror al, 1
or dl, byte [esp + edx*2 + 7]
bts edx, edx
call fcn.0087f8a6
jbe 0xd26e07
insb byte es:[edi], dx
fimul dword [0x34d70e52]
out 0x9b, al
mov byte [esi - 0x7f], ch
aas
int 0x51
mov bh, 0x4c
ja 0xd26dfc
cdq
invalid