joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f6965
Capabilities:
Encrypt data using speck

Disassembly:
push eax
or ecx, esi
dec esp
mov ecx, dword [esp + ebx*2 - 0x108]
dec ebp
arpl sp, sp
dec eax
mov dword [esp + ebx - 0x80], ebx
xchg byte [esp + ebx*2 - 0x109], bl
jbe 0x71beba
dec ecx
adc edi, esp
inc esi
mov eax, dword [ebx + ebx]
inc ecx
mov cl, byte [ebx + ebx*2 + 4]
push ebx
dec ebp
lea ebx, [ebx + ebx*8 + 2]
inc ecx
shr eax, cl
dec eax
lea edx, [eax*2 - 0x65e84ecc]
inc esi
mov dword [ebx + ebx], eax
dec eax
xor dword [esp + ebx*2], edi
ret 0x10
push esi
inc ecx
inc esp
inc dword [esp + ebx*4 - 0x21c]
dec esp
mov dword [esp + ebx*4 - 0x220], ecx
movzx ebp, bl
inc ecx
movsx eax, bh
inc esp
xor dword [esp + ebx*4 - 0x220], esp
jmp 0x55b65f
shr ebx, 0x36
inc dx
rol dword [esp + eax - 0xf5a1], 0xec
inc ecx
ror ebp, 3
call fcn.0060675a
adc cx, cx
not al
adc ecx, ecx
adc ecx, 0xb184c109
and dl, al
dec cx
ror cx, 0x8c
mov word [edi + 2], dx
movsx eax, cx
mov eax, dword [edi + eax - 0x34da]
movsx edx, cx
add dl, dl
mov cl, byte [edi + edx*4 - 0xd2da]
xor edx, edx
sub edx, edx
shr eax, cl
xor dx, 0x1391
mov dword [edi + edx - 0x138d], eax
movsx ecx, dl
push edx
mov ecx, dword [edx + edi - 0x138d]
call fcn.0072e359
jmp 0x7454f5
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov eax, 0x850bd18e
add edi, 8
mov dword ss:[edx], ecx
shl ax, 0xe1
sub esi, 4
lea ecx, [eax*4 + 0x113e0622]
sub eax, ecx
mov ecx, dword [esi + ecx - 0x256c9292]
xor ecx, ebx
xchg ah, al
dec eax
shr al, 0xc7
xor ecx, 0x3ca82f8a
call fcn.0072ac12
mov ecx, 0xc086cd88
movzx ebx, cl
mov esi, ecx
dec ebp
lea edx, [edx + ebx*2 - 0x114]
inc ebp
mov esp, dword [edx + ebx*4 - 0x220]
inc ebp
xor esp, ecx
dec eax
or ecx, ecx
dec esp
lea edi, [ebx + ebx*8 + 0x61a6fc26]
inc ecx
ror esp, 3
inc ecx
neg esp
inc ecx
xor esp, 0x2c823c01
jmp 0x61e97c

Function at 0x6f6d55
Capabilities:
Encode data using xor

Disassembly:
not dl
or esi, dword [esp + edx - 0x2415f7d6]
inc eax
dec ch

Function at 0x6f93fb
Capabilities:
Encrypt data using speck

Disassembly:
xor dword [esp + ebx - 0x60d5e60a], ebp
dec eax
mov dword [esp + ebx - 0x60d5e612], 0x5f095988
sar bx, 0xcb
dec esp
mov ecx, dword [esp + edx - 0x4a4f]
dec esp
mov dword [esp + ebx - 0x60d5fff4], ebp
dec eax
arpl bp, bp
call fcn.005ef35b
jmp 0x72416c
call fcn.006f0fe0

Function at 0x6fce9a
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
movzx ecx, ax
dec eax
mov dword [esp + ebx - 0x1cb9559f], ecx
inc ecx
sub dh, 0xab
inc ecx
not dh
inc ecx
rol dh, 1
inc cx
inc eax
inc ebp
xor cl, dh
call fcn.006138ba

Function at 0x6fd11a
Capabilities:
Encrypt data using speck

Disassembly:
mov esi, dword [esp + esi - 0x21ed878d]
jl fcn.007121d1
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call fcn.006484d5
Function at 0x6fe373
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
shr dword [esp + edx + 0x6b38], cl
inc ecx
not bh
shr ax, 7
inc ecx
sub bh, 0xab
inc ecx
not bh
or bl, byte [esp + edx + 0x6b3e]
inc ecx
rol bh, 1
inc ecx
pop ebp
inc ebp
xor cl, bh
dec esi
lea edi, [esp + edi + 0x18]
dec eax
shr ebx, cl
dec eax
or dword [esp + edx*2 + 0xd666], 0x71020f0d
inc esp
xadd ebx, eax
inc edx
mov ecx, dword [edx + edi + 0x6b2b]
dec eax
and esi, 0x281b89a6
inc ecx
mov dword [ebx + esi*2 - 6], ecx
dec ebp
lea ebx, [ebx + esi - 6]
jo 0x600a95
jb 0x64e9b4
pop esi
inc ecx
pop ebp
inc ecx
pop eax
je fcn.005e92fc
pop edi
mov dh, 0xa5
outsd dx, dword [esi]
sub dword [edi - 0x15], ecx
mov gs, word [ecx + 0x7b272944]
scasb al, byte es:[edi]
test eax, 0xb732944
out 0xa9, al
inc esp
sub dword [edi], eax
arpl si, ax
test eax, 0xbff2944
scasb al, byte es:[edi]
test eax, 0x5a072944
imul ecx, dword [esi + eax*4 - 0x61], 0xfd16762b
out 0xbc, al
in al, 0x38
in eax, 0xd6
and byte [eax], al
sub esi, eax
insb byte es:[edi], dx
mov al, byte [0x65fccd6]
mov eax, 0x231d96b5
les ebx, [0x5c4fd6bd]
and ebx, dword [eax - 0x34309f92]
test eax, 0xc07a378b
cmp al, 0xa
js 0x6fe490
sub al, byte [edi + 0x6c7a52ff]
imul ebp, dword [edx], 0x760eff87
in eax, 0x1c
sbb cl, byte [ecx - 0x3038f374]
mov dword [esp + ecx - 0x8083039], ecx
lea esi, [ecx + esi - 0x808303d]
jmp 0x71b144
pop es
jg 0x6fe4b5
inc ebp
aaa
dec eax
add dword [edi + ecx - 0x38], ecx

Function at 0x6fe459
Capabilities:
Check http status code

Disassembly:
sub cl, cl
lea eax, [esp + eax + 8]
mov dword [eax + ecx*2], edx
mov edx, dword [edi + ecx*2 + 4]
add cl, cl
lea edi, [edi + ecx*8 + 8]
setns cl
jg 0x634035
js 0x620f4e
mov cl, byte [ecx + esi - 6]
mov eax, 0x2696992c
lea esi, [eax + esi - 0x26969931]
sar eax, 2
seta al
xor cl, bl
jmp 0x726e59
add ebp, ecx
movzx ecx, al
add edx, dword [edx + edi]
jmp 0x61355a
not ecx
sub ecx, 0xaebf71b2
pop eax
movzx eax, dl
not ecx
lea ecx, [ecx + edx + 0x998f38e]
not ecx
ror al, 0x86
xor ebx, ecx
jmp 0x6cbdcb
or al, al
sbb cl, al
shl eax, 0xd3
push eax
shr al, 0xe6
not cl
jne 0x554692
adc byte [esp + eax - 0x30080000], al
dec cl
add dword [esp + eax*2 - 0x60100000], 0xba9a5cb0
rol cl, 1
dec word [esp + eax*2 - 0x60100000]
xor bl, cl
inc byte [esp + eax - 0x30080000]
rol ax, 0x41
lea ecx, [esp + ecx + 4]
shl word [esp + eax*2 - 0x600ffffe], 0xa7
mov dword [ecx + eax*2 - 0x60100000], edx
movzx edx, ax
lea ecx, [eax*2 - 0x37fa15f0]
jb 0x74924b
sbb eax, 0x29026b84
sub eax, 0x2967c8d6
sub dword [0x2967cca9], edx
sub dword [ecx + 0x55], eax
shl byte [edi + 0x29], 0x29
adc dword [ecx - 4], edx
sub dword [bx + di], ebp
xor eax, 0x2967d06d
sub dword [ecx], eax
cmp edx, dword [ecx]
pop edi
rcl byte [edi - 0x7f], cl
movsd dword es:[edi], dword [esi]
cmp al, 0xc8
out dx, eax
wait
fdivr qword [eax - 0x7a293ed5]
clc
and bl, byte [edx + 0x351db5dc]
test byte [ebx], dh
cwde
stc
add al, 0xd7
popfd
test eax, 0xd6d7004c
insd dword es:[edi], dx
dec esi
pop es
mov ebx, 0x74c29b85
and dl, byte [edx + 0x64]
xor ebp, esi
fdivr qword [ebx + 0x3c06b0a6]
xchg edi, eax
dec ebp
imul edx, edi, 0x45
lodsd eax, dword ds:[esi]
leave
cmp al, 0x13
ret
Function at 0x6fea65
Capabilities:
Encrypt data using chaskey
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + edi - 0x4cb30900], ecx
pop edx
dec edi
lea ebx, [edi + ebx - 0x4cb30914]
inc eax
sal ch, 0xc5
inc esp
movzx esi, ch
call fcn.005ea9b1
dec esp
lea esp, [ebx + ecx - 0x4f7b9dc1]
dec eax
shr ebp, 0xeb
dec ecx
dec esi
dec ecx
neg esi
inc ecx
sal bh, 0x41
add bl, cl
movzx edx, bl
dec ecx
ror esi, 1
dec ebp
xor ecx, esi
sub cl, ch
js 0x6362ac
dec edi
mov dword [ebx + edi - 0x4cb30914], esi
jbe 0x64c3d2
Function at 0x700df2
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
movzx ebx, dh
inc esp
xor dword [esp + eax - 0x25a4], ebp
dec ecx
ror edi, cl
dec esp
lea esi, [eax + edx + 0x3c1a55a8]
inc esp
mov eax, eax
inc ecx
pop ecx
dec esp
add esi, edx
inc ebp
cmovns esi, esp
dec ebp
arpl bp, bp
call fcn.0055adf2
inc ecx
mov esp, 0xcd180582
inc ecx
movzx ecx, sp
dec ebp
lea edx, [edx + ecx*8 - 0x2c14]
dec esp
lea esi, [ecx + 0x3e349020]
inc edx
mov ebp, dword [ecx + edx - 0x582]
movzx ebx, cl
jmp 0x64b7ef
mov ecx, dword [esi]
xor ecx, ebx
mov edx, 0x49052ab4
movsx eax, dl
xor edx, 0x9c8f8033
dec ecx
shr al, 0x61
jne 0x6f65b7
call fcn.00616062
pop ecx
je fcn.00566baa
lea esi, [esi + ecx - 6]
add ecx, 0xc697372c
setg cl
and al, cl
mov ecx, dword [esi + eax*2]
mov edx, eax
xor ecx, ebx
bswap ecx
sal eax, 0x7b
xor al, ah
inc ecx
bswap ecx
inc eax
add ecx, eax
sal ax, 0x25
lea eax, [eax + edx*8 - 0xd4ffefe]
inc eax
xor ebx, ecx
call fcn.007114c6
sub esi, 4
jmp 0x60519f
inc ecx
sar bh, 5
inc edx
xor dword [esp + esi*4 - 0x3b0], eax
inc ecx
movsx edx, di
inc ecx
pop ecx
not esi
inc ecx
push eax
call fcn.006bee3b
push 0xc1b0ce9c
dec eax
lea esp, [esp + 8]
ret
call fcn.006352a2
not dx
ror ecx, 3
bswap ecx
xchg dx, ax
shr dl, 0x67
rol ecx, 3
xor ebx, ecx
ror ax, 0x47
setb dl
add ebp, ecx
call fcn.00566680
push ebp
push 0xf1ae430b
pushfd
mov ebp, dword [esp + 4]
mov ebp, dword [esp + ebp + 0xe51bcfd]
mov dword [esp + 8], 0xe555bdeb
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.006484d5
dec esi
mov ecx, dword [esp + edi*2 - 0x1e]
dec eax
or edx, 0x65a23f2c
dec edx
mov dword [esp + edi - 0x1b], 0xc9292c95
dec ebp
arpl bp, bp
inc ecx
push edi
jo 0x724179
inc ecx
mov ecx, edi
dec ecx
adc edi, ebp
inc di
mov esp, dword [ebx + edi*8 - 0xd8]
dec eax
inc dword [esp + eax - 0x490b7083]
inc bx
mov edx, dword [edi + ebx - 0x19]
inc ecx
mov cl, byte [ebx + ecx*8 - 0xd4]
inc ecx
mov ebp, 0xcb06ca15
dec edx
not dword [esp + edi - 0xc]
sar eax, 0x5d
dec edi
lea ebx, [ebx + edi - 0x17]
inc edx
or byte [esp + edi - 0x14], 0x18
inc ecx
sar ebp, 0x8c
inc cx
shrd esp, edx, cl
call fcn.0064757f
inc bp
mov dword [ebx + edx*4 + 0x58004144], esp
inc esp
xchg byte [esp + edx + 0x16001054], dh
dec edi
lea esp, [esi + eax - 0x7f2b4fb]
pop ebp
ja fcn.005e92fc
inc ecx
rol ebp, 2
inc ecx
push ecx
jmp 0x566035
sar edx, cl
dec eax
arpl si, si
dec edx
mov dword [esp - 0x40127dd6], 0xdf10b382
inc ebp
sub ebp, esp
inc ecx
neg esp
dec eax
add edi, esi
inc edx
add bl, byte [esp + edi - 0x1c]
dec eax
shl ebx, 0xfa
inc edi
mov esi, dword [ebx + edi*4 - 0x9c]
inc ecx
sal ah, 0x84
ja 0x60df75
inc ebx
mov cl, byte [edi + ebx - 0x23]
je 0x6329b5
dec ebp
xadd edi, esp
dec edi
lea ebx, [ebx - 0x25]
jbe 0x71bea0
dec ecx
sal esp, 0x67
inc ecx
shl esi, cl
dec esp
mov dword [esp + ebp*4 - 0x205e7908], esp
inc ebp
mov dword [ebx + ebp - 0x8179e44], esi
inc ecx
shr edi, 0x4d
dec edx
mov dword [esp + edi*8 - 0x37fdb0], edi
ret 8
Function at 0x7017d0
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
inc eax
jmp 0x61d1e3
not word [esp]
and word [esp + 3], ax
inc ecx
xor eax, 0x791a60a1
inc cx
sal esp, 0x44
inc esp
movsx edi, ch
jns 0x6eb0db
movzx eax, cx
movzx edx, word [esi + ecx*2 - 0x3d54]
xor dx, bx
xor dx, 0x8c97
sub ax, ax
dec dx
bswap eax
rol dx, 1
ror ecx, 0x49
call fcn.0070fb21
inc ecx
inc eax
dec esi
mov dword [esp + edi], ecx
dec edx
lea ebx, [edi*2 + 0x421129a6]
inc esi
xor dword [esp + edi], eax
push eax
movzx edx, ax
inc cx
sal esp, 0x26
dec esi
mov ecx, dword [esp + edi*2 + 8]
call fcn.00634165
inc ecx
bswap edi
inc ecx
ror edi, 1
inc ecx
and eax, eax
dec esi
mov dword [esp + eax + 0x18], ecx
adc eax, eax
inc esi
xor dword [esp + eax + 0x18], edi
inc eax
inc dh
dec esi
mov ecx, dword [esp + eax + 0x18]
dec ebp
arpl di, di
call fcn.0072363d
neg dl
mov dword [esp + eax - 0x790916d2], 0xe307c42e
xor ebx, ecx
call fcn.006ddaf6
dec ebp
arpl si, si
call fcn.0055acb3
inc ecx
mov esp, 0xb5be7008
inc ebp
mov eax, dword [edx - 4]
inc ecx
push esp
dec ecx
lea ebp, [esp - 0x5dcb97f9]
sub byte [esp + ebp - 0x57f2d80c], 0x1f
inc ebp
xor eax, ecx
dec eax
ror ebp, 0xb4
inc ecx
ror eax, 1
dec ebx
lea eax, [esp + 0x57b8fb3d]
jmp 0x5e9b21

Function at 0x703d2c
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [eax + esi - 0x265a]
mov dword [esp + edx - 0x593884de], edx
call fcn.0055d26a
Function at 0x70568b
Capabilities:
Encrypt data using speck

Disassembly:
sar bx, 2
inc ebx
mov cl, byte [eax + ebx - 0x7a]
call fcn.0073139d

Function at 0x708e39
Capabilities:
Encrypt data using speck

Disassembly:
jne 0x730543
dec esp
mov ecx, dword [esp + ecx + 0x2d]
dec eax
arpl dx, dx
inc sp
sub ebp, dword [esp + ecx + 0x1c]
dec eax
adc edi, edx
movzx ebx, byte [esp + ecx + 0x15]
inc eax
sub dh, 0x88
inc esi
mov eax, dword [ecx + ebx - 7]
inc ecx
mov ch, byte [edx + esi - 0x89]
dec eax
not dword [esp + esi - 0x7d]
pop edx
inc ecx
xor ch, cl
dec eax
ror dword [esp + ecx*4 - 0x13], cl
bswap ecx
inc eax
inc ch
inc eax
xor ch, 0xaf
neg ax
dec eax
mov ebx, dword [esp + 8]
dec eax
add ebx, 0xfffa051e
jmp ebx
inc ecx
mov edx, dword [edx]
inc ecx
xor edx, ecx
inc ecx
mov edi, 0xc5bd438d
sub edx, 0x82008412
inc ebp
xor bh, bh
inc ecx
mov eax, edi
shr al, 0x21
rol edx, 2
dec eax
mov dword [esp + 0x10], eax
inc ecx
push edi
inc ecx
ror bh, 0x41
inc edx
dec eax
ror eax, 0x6f
xor edx, 0x8f3e47b9
dec esp
mov dword [esp + 0x18], ecx
xor dword [esp + 0x18], edx
call fcn.0072ea32
mov ecx, 0x5804271c
sal ecx, 0x3b
mov edx, ecx
mov edx, dword [edi]
ror ecx, 0xe4
movzx eax, cx
mov ecx, dword [ecx + edx - 0xe000000]
movsx edx, ax
mov dword [edi + eax*4], ecx
lea esi, [eax + esi - 4]
js 0x6d0a46
setne dl
mov edx, dword [esi + eax*2]
xor edx, ebx
mov ecx, eax
xor al, 0xc
neg edx
xor eax, ecx
shr ecx, 0x73
shl al, 0x84
not edx
not ecx
adc cl, cl
inc edx
not edx
or ax, 0xde9f
xor ebx, edx
add ebp, edx
call fcn.007297d7

Function at 0x70b223
Capabilities:
Encrypt data using speck

Disassembly:
inc edx
ror edx, 1
dec eax
lea ebx, [esi*4 + 0x7e0e7c30]
dec eax
mov dword [esp + esi - 0x1b8e4895], ebx
dec eax
xadd dword [esp + esi - 0x1b8e4895], esi
xor edx, 0x12bbfaa1
neg si
call fcn.00622553
Function at 0x70bf0f
Capabilities:
Encrypt data using speck

Disassembly:
adc ebp, edx
mov edx, dword [esp + ecx*2 - 0x6a0dbd90]
and dword [esp + edx - 0x35060000], 0x4ab66c9c
mov dword [esp + ecx*2 - 0x6a0dbd90], ebp
ret
lea edx, [edx + edx - 0x3d5f6ad8]
neg ecx
dec dx
sal dl, 0xa1
xor ebx, ecx
xor ax, 0xf3bb
bswap edx
rol eax, 0x57
add ebp, ecx
sal byte [esp + edx - 0x24a12e2], 0x65
pop edx
pop eax
pop ecx
pop edx
jb fcn.00566baa
mov word [edi + eax*2], cx
jbe 0x70c114
lea ecx, [edx + eax*8 - 0x16415df7]
lea esi, [esi + eax*4 - 4]
setbe dl
neg dl
mov ecx, dword [esi + eax*4]
rol dx, 0x4a
xor ecx, ebx
push eax
xor ax, word [esp + eax*2 + 3]
rol ecx, 1
neg dword [esp + eax - 0xbfff]
push edx
inc ecx
rol eax, 0xae
not ecx
or edx, 0x14b8daad
sub byte [esp + eax - 0x2ffffff4], ah
inc ecx
shr al, 0xe1
jae 0x5e9f94
mov edx, dword [esi]
sub ecx, ecx
xor cx, 0xc81f
and ecx, ecx
xor edx, ebx
bswap edx
inc cl
inc edx
bswap edx
lea ecx, [ecx + ecx + 0x35054e88]
inc edx
push ecx
movsx eax, cx
xor ebx, edx
sub word [esp + ecx - 0x3506dec8], cx
je 0x55abae
xchg esi, eax
xlatb
pop ebx
sub ecx, eax
and ecx, edx
inc eax
adc dh, 0xf2
mov esi, 0xd6a8342b
dec byte [edx]
jg 0x650cf6
test al, 0xd6
retf 0x79a
fadd st(2), st(0)
invalid
pop edx
pop edx
movzx cx, byte [eax + ecx - 0x7b75efa]
mov eax, dword [esp + 4]
movsx edx, ax
lea edi, [eax + edi - 2]
adc dl, 3
jp 0x5ff43c
mov eax, 0x7aabc300
mov dx, word [edi + eax - 0x7aabc300]
lea ecx, [eax*8 - 0x32c99ceb]
mov cl, byte [eax + edi - 0x7aabc2fe]
lea edi, [eax + edi - 0x7aabc2fe]
shl dx, cl
movzx ecx, ax
and cx, cx
mov word [edi + eax - 0x7aabc300], dx
lea esi, [eax + esi - 0x7aabc304]
mov edx, ecx
mov edx, dword [esi + eax - 0x7aabc300]
xor edx, ebx
and cx, ax
xor edx, 0xdd057c81
shr eax, 0x19
jae 0x6bd87c
mov edx, 0x76a386ab
movzx eax, dx
mov edx, dword [edi + eax*2 - 0x10d56]
mov ax, word [edi + eax*2 - 0x10d52]
add edi, 6
mov ecx, 0x5b16d531
add ecx, ecx
add cl, cl
mov word ss:[edx], ax
mov edx, 0xea0d238d
sbb esi, 4
jmp 0x650c7e
Function at 0x70eb51
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x61d202
inc cx
shl edx, cl
setnp dl
add ebp, eax
lea eax, [edx + edx + 0x1ca3d7b5]
mov eax, dword [edi + ecx*8 - 0x33d08]
sub edx, edx
shl ecx, cl
jno 0x73f99e
mov ebp, eax
inc ebp
movzx ebp, byte [edx]
dec eax
lea edx, [eax + ebp*4 + 0x6d10a728]
movzx esi, al
inc ebp
xor ch, cl
inc ecx
rol ch, 1
dec eax
bswap esi
dec eax
lea esi, [ebp + edx + 0x3e3eb289]
inc ecx
add ch, 0x9b
neg esi
movzx ebx, bp
or si, 0x912
inc ecx
xor ch, 0x2d
inc ecx
sub ch, 0x8d
inc ebp
xor cl, ch
push edx
dec esi
lea ebp, [esp + ebp + 8]
inc bp
mov edi, dword [ebp + esi - 0x2487ddf3]
dec ebp
lea ebx, [ebx + ebx - 0x783c]
dec esp
lea eax, [eax + esi*8 + 0x1ea5528b]
xor bp, 0xd211
inc bp
mov dword [ebx + esi*2 - 0x490fbbe6], edi
dec ebp
lea edx, [edx + esi*2 - 0x490fbbea]
inc edx
mov ebp, dword [esi + edx - 0x2487ddf3]
inc ebp
mov esp, eax
inc ecx
xor ebp, ecx
mov dword [esp + esi*2 - 0x490fbbe5], eax
rol ebp, 2
and word [esp + esi - 0x2487ddf3], 0x6f29
dec ecx
neg eax
dec eax
sub dword [esp + esi - 0x2487ddf3], 0x2329008
xor ebp, 0xb2819bb0
shr si, 0x81
call fcn.0062fef5
inc ecx
push ecx
inc ebp
movsx edi, ax
sub eax, ebx
inc ecx
neg edi
inc esi
xor dword [esp], esi
inc ecx
pop ecx
dec ebp
arpl si, si
dec ecx
add edi, esi
dec eax
xchg ecx, eax
dec ebx
mov eax, dword [esp + ebx]
call fcn.0055b9ff
push 0x61082c81
pop edx
movsx eax, dx
lea esi, [eax + esi - 0x2c85]
lea eax, [eax*8 - 0x10d01e59]
mov ecx, dword [edx + esi - 0x61082c81]
lea eax, [edx*8 + 0x740e0504]
inc dl
sal dl, 0x24
xor ecx, ebx
call fcn.007347f6
movzx eax, dl
xor edx, ebp
jmp edx
mov dword [edi + edx], eax
jmp 0x6e8336
movsx edx, ax
lea ecx, [ecx + eax*4 + 0x28a893a]
mov eax, dword [esi + eax*4 - 0x4787e1b8]
sub edx, 0x470c5a36
jge 0x568e74
xor eax, ebx
ror eax, 1
or dx, cx
jp 0x64eb9d
lea eax, [ecx + eax - 0x2afa42ba]
and edx, dword [esp + 6]
xadd dword [esp + edx + 8], edx
and byte [esp + edx - 0x3cdbfff8], dh
not eax
jne 0x64c4e0
lea eax, [eax + edx - 0x17b36c52]
call fcn.005f0594
inc esp
movsx eax, bp
inc ebx
mov cl, byte [eax + ebx - 0x7b14]
call fcn.005676de
mov ecx, dword [ecx + edi - 0xcf3e]
setno dl
sbb edx, edx
lea edi, [edi + edx + 4]
inc dl
shr dx, 0xce
adc eax, ecx
movzx ecx, dl
jmp 0x6eb45f
Function at 0x70f252
Capabilities:
Encode data using xor

Disassembly:
dec ecx
or ebp, esi
dec eax
or ebp, 0x96a83e2b
dec eax
not edx
dec eax
bswap ecx
inc ecx
rol ah, 4
dec ebx
mov dword [eax + ebx - 0x8867], edx
dec ecx
ror edi, 0xc8
inc ebx
mov esi, dword [edx + eax - 0x8873]
je 0x6dea9a
dec edi
lea edx, [edx + eax*2 - 0x110da]
dec esi
mov dword [esp + eax*8 - 0x44328], esi
inc ecx
mov edx, edi
inc ecx
xor esi, ecx
inc dx
sal dword [esp + eax - 0x8844], 0x41
dec edx
lea eax, [ecx + 0x7206eb1]
not esi
dec edx
mov dword [esp + eax*2 - 0x110c6], ebp
jns 0x61b8b0
neg esi
inc ecx
movsx ebx, sp
dec ecx
add esp, 0x603cd3bd
bswap esi
dec ecx
or esi, 0x7f199931
xor esi, 0x14ac70a1
dec esi
mov dword [esp + eax - 0x8847], ecx
dec esi
mov dword [esp + eax*4 - 0x2219c], edi
jmp 0x727a0e
inc ecx
xor al, 0x29
inc edx
xor dword [esp + eax*4 - 0x22118], esi
dec esi
mov ecx, dword [esp + eax*2 - 0x1107c]
inc ecx
and ebp, esp
jo 0x6cf429
dec eax
arpl si, si
dec eax
adc edi, esi
sal ax, 0x48
inc cx
sal esi, 1
dec ebx
mov eax, dword [ebx + eax*2 - 0x1109c]
inc esp
movsx ebp, dx
inc ebx
add cl, byte [ebx + eax*4 - 0x22130]
dec eax
shr eax, cl
jmp 0x5fc85d

Function at 0x712d56
Capabilities:
Encrypt data using speck

Disassembly:
mov al, byte [edi + 4]
add edi, 6
call fcn.006b8e76

Function at 0x7149f4
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
jmp 0x6d0bfb
dec esi
mov dword [esp + eax - 0x2a], eax
inc edx
lea ebp, [ebp + eax*2 - 0x7514a086]
inc ecx
push edi
ror ebp, 1
inc dx
dec dword [esp + eax - 0x31]
dec esi
xchg dword [esp + eax*2 - 0x64], esi
jp 0x626e73
bswap ebp
inc si
xor ebp, dword [esp + ebp - 0x5189a12d]
dec esi
or dword [esp + ebp - 0x5189a122], ebp
call fcn.007143a0
stc
sub edi, eax
jmp 0x6473db
Function at 0x7166d8
Capabilities:
Encrypt data using speck

Disassembly:
pop edx
pop edx
jno fcn.00566baa
fiadd dword [esi + 0x2979a0a9]
pop eax
xor al, 0xd1
nop
jae 0x5f7850
push esp
add al, 0xd9
nop
jae 0x5f7856
and byte [edi + eax - 0x7a], ah
sahf
mov al, byte [0xcfcb9e1f]
xchg dh, cl
inc esi
shr dword [eax - 0x67], 0xdb
mov word [eax + 0x64], gs
pop ebx
ret
or al, 0x5b
dec ecx
mov al, byte [0x3c310547]
mov dh, 0xb7
inc dword [ecx]
pop ds
xor dword [esi + esi*4], edi
mov bh, 0xff
add dword [edi], ebx
aaa
sub al, 0xb6
mov bh, 0xff
sbb eax, 0x1a2c7957
mov esi, 0xecb4fa34
jmp 0x71b137
neg edx
ror edx, 1
neg al
xor cl, cl
push eax
not edx
sbb cl, cl
add ecx, dword [esp + ecx*2 - 0x10100000]
sbb edx, 0xd7b6fe3a
dec cl
xor ebx, edx
dec dword [esp + ecx*4 - 0x4041bcbc]
jle 0x61eb92
add ebp, edx
mov ecx, dword [ecx + edi - 0x10106f2f]
movzx edx, word [esp + eax - 0x8086f30]
sub dx, ax
mov edx, dword [edi + eax - 0x8086f2c]
inc eax
neg word [esp + eax*8 - 0x40437987]
lea edi, [edi + eax*8 - 0x40437984]
ror byte [esp + eax - 0x8086f31], 0xe4
jb 0x73f3d2
xchg ch, al
neg ax
sub edx, 0xb9321a0a
jmp 0x623ec4
pop eax
sbb edx, 0x2a6861f
sal dword [esp + 4], cl
movzx eax, cx
inc al
xor ebx, edx
xor cl, 0x32
dec word [esp + eax*8 - 0x16a]
mov dword [esp + eax - 0x2e], eax
lea edi, [edi + eax*4 - 0xbc]
mov dword [edi + eax*8 - 0x170], edx
jl 0x5f7813
in al, 0x60
das
ret
call fcn.005657fb
inc ecx
rol dh, 1
call fcn.005fd82c
sal word [esp + ecx*2 - 0x10106072], 0xac
mov edx, dword [esi + ecx*8 - 0x404181c8]
pop eax
xor edx, ebx
jmp 0x6d5104
ror dword [esp + eax - 0x8086f31], 0x27
add ecx, edx
mov dword [edi + eax*4 - 0x2021bcc4], ecx
mov dword [esp + eax*4 - 0x2021bcc4], ebp
ret

Function at 0x721864
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
xor ebp, ecx
dec eax
mov dword [esp], 0x31822984
not word [esp + 3]
not ebp
neg word [esp + 3]
pop ebx
bswap ebp
movzx eax, bl
dec eax
mov dword [esp + ebx - 0x32822984], eax
inc esp
mov edi, dword [esp + ebx - 0x32822984]
lea ebp, [ebp + ebx*4 - 0x4c9d18b]
dec esp
cmovle edi, dword [esp + ebx - 0x32822984]
ror ebp, 1
inc esp
movsx esi, bx
dec esp
mov dword [esp + ebx - 0x32822984], ecx
inc ebp
movsx eax, bh
dec ebp
xor eax, esi
xor dword [esp + ebx - 0x32822984], ebp
inc ebp
mov ebp, esi
call fcn.0070d892
popfd
rdtsc
nop
push ebp
pushfd
mov ebp, 0x87255883
push esi
mov esi, 0xd30f8e33
lea ebp, [esi*4 - 0x535ee86e]
mov ebp, dword [esp + esi + 0x2cf071d5]
mov dword [esp + 8], 0x6555cc51
mov esi, dword [esp + esi + 0x2cf071cd]
call fcn.00566b8b
add dx, 0xe4b3
pop ecx
pop ecx
pop eax
jbe fcn.00566baa
Function at 0x72691e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not ebx
dec ecx
add edi, esp
dec eax
mov dword [esp + eax*4 - 0x3052c], edx
dec eax
mov dword [esp + eax - 0xc145], eax
dec esp
lea esp, [edx*4 + 0x499cfcb5]
dec ecx
mov ebx, dword [edx + eax*2 - 0x182b6]
dec dword [esp + eax - 0xc14c]
dec eax
mov dword [esp + eax - 0xc155], 0xeb30238b
jno 0x6bc15c
mov ecx, dword [edi + ecx*8 - 0x50070]
movzx edx, ax
mov eax, dword [edx + ecx - 0x9fff]
call fcn.00741c9d
or byte [ebx + ebp - 0x6aa8d6c2], dl
jae 0x7269e6
xlatb
xchg esi, eax
shl byte [edi], cl
push ecx
mov edi, 0x2b4e02d6
push ecx
mov edi, 0x13cefed6
push ecx
mov edi, 0x2f31bad6
push ecx
mov edi, 0x952e9ad6
or al, 0x5f
insb byte es:[edi], dx
loopne 0x7269ec
lodsb al, byte [esi]
push 0xead9499c
fdiv qword [ebx - 0x13]
invalid
inc ecx
enter 0x6c5c, 0xffffffffffffffe0
xchg esp, eax
scasd eax, dword es:[edi]
push 0xeada8d58
fdiv qword [edi + 0x3dbbc7ee]
aaa
and esp, dword [ecx]
insb byte es:[edi], dx
dec ecx
mov al, byte fs:[0x445f7d7d]
movsb byte es:[edi], byte [esi]
lcall 0xa434, 0x2b0f25ff
lcall 0x1a01, 0x6b235fff
push 0x20
jg 0x726a7c
sub ebp, ebp
in eax, dx
mov ecx, 0x294e734c
lodsd eax, dword [esi]
mov ch, 0x68
jae 0x726a71
sub ecx, ebx
shr dword [ebx + esi*2 + 0x4e], 1
sub ecx, ebx
stosd dword es:[edi], eax
add eax, 0x67725f95
dec ecx
mov al, 0x3d
aaa
mov ebx, 0xb5b66914
loop 0x726a18
jne 0x726a51
in eax, dx
push eax
sub dword [ebx], esi
dec eax
retf 0xe46d
cmp eax, 0x178e4572
mov ecx, 0x5ac2b41d
out dx, eax
invalid
cld
add byte [ebx + 0x6a93647f], 0x8b
inc dword [ebx - 0x17c2f8e0]
mov word [eax], fs
sub al, 0x69
call 0x699e8b02
add cl, dh
jmp 0x726a64
ret 0xc56a

Function at 0x7287f1
Capabilities:
Encrypt data using speck

Disassembly:
pop es
jg 0x5f3f19
inc ebp
and al, 8
xor edx, ebx
bswap edx
or cx, cx
neg edx
lea eax, [ecx + ecx*2 + 0x29b024a9]
add eax, 0x788a6093
add cl, al
ror edx, 3
push ecx
push ecx
dec edx
mov dword [esp + ecx - 0x38], eax
sar cl, 0xa3
lea ecx, [eax + eax*2 - 0x44465d4b]
rol edx, 3
inc eax
inc edx
dec ecx
js 0x55462d
mov eax, dword [0x27fec3d1]
push esi
movsb byte es:[edi], byte [esi]
aam 0xf8
sti
jle 0x5f3ef4
fcom st(4)
mov eax, 0x837e2b00
fdivr dword [eax + 0x54]
call 0xd8e2bdbb
push esp
les esp, [ebx + ebp*2 + 0x74d8837e]
xor byte [eax - 0x75], al
jle 0x5f3f10
fdivr dword [eax - 0xca8f91c]
test eax, 0x735f0866
in eax, 0x35
invalid
ror ecx, 1
inc esp
movsx eax, al
dec edx
mov dword [esp + ebp*4 - 0x4c], 0xa88a8237
not ecx
call fcn.00740652
mov edx, 0xf39b6834
mov eax, dword [edi]
movsx ecx, dx
mov cl, byte [ecx + edi - 0x6830]
neg dx
ror dl, 0x27
add edi, 2
shr eax, cl
lea ecx, [edx*8 + 0x19227e17]
bswap ecx
and ecx, edx
mov dword [edi], eax
shr dl, 0x21
sar ecx, 0x13
sbb esi, 4
shl edx, 0xec
mov edx, dword [esi]
xor ecx, ecx
sal ecx, 0x68
jbe 0x5f3f2e

Function at 0x728ede
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov edx, dword [esp + ebp*4 + 0x38]
dec esi
mov ecx, dword [esp + ebp + 0x40]
call fcn.0070fce9