joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af1c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x40b0f2
lea eax, [esi + 0x18]
mov dword [ebp - 0x30], eax
mov word [eax], bx
lea eax, [esi + 0x218]
mov dword [ebp - 0x1c], eax
mov word [eax], bx
lea eax, [esi + 0x418]
mov dword [ebp - 8], eax
mov word [eax], bx
lea eax, [esi + 0x618]
mov dword [ebp - 0xc], eax
mov word [eax], bx
lea eax, [esi + 0x818]
mov dword [ebp - 0x10], eax
mov word [eax], bx
lea eax, [esi + 0xa18]
mov dword [ebp - 0x18], eax
mov word [eax], bx
lea eax, [esi + 0xc18]
push edi
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov word [eax], bx
lea eax, [esi + 0xe18]
mov dword [ebp - 0x28], eax
mov word [eax], bx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x40caf0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40aff8
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi], ecx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [esi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b047
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x58]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x40c3dc
lea eax, [ebp - 0x58]
push eax
push edi
lea esi, [ebp - 0x258]
call fcn.0040ae8d
test eax, eax
jne 0x40b057
lea eax, [ebp - 0x58]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
mov esi, dword [ebp - 0x30]
push 0x40d874
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 0x1c]
push 0x40d88c
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 8]
push 0x40d8ac
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 0xc]
push 0x40d8c4
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 0x10]
push 0x40d8e4
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 0x18]
push 0x40d8fc
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 0x20]
push 0x40d918
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
mov esi, dword [ebp - 0x28]
push str.OriginalFileName
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.0040ae8d
xor ebx, ebx
push edi
inc ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x40b1ce
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x40c390
call fcn.0040b3e0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40b209
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b209
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40b221
cmp eax, 0x20b
je 0x40b20e
mov dword [ebp - 0x1c], edi
jmp 0x40b235
cmp dword [ecx + 0x84], 0xe
jbe 0x40b209
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40b22f
cmp dword [ecx + 0x74], 0xe
jbe 0x40b209
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4105c8], 0xffffffff
or dword [0x4105cc], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40f29c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x40f298]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4105c4], eax
call fcn.0040b3dc
cmp dword [section..data], edi
jne 0x40b292
push fcn.0040b3dc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040b3ca
push 0x40c364
push 0x40c360
call sub.msvcrt.dll__initterm
mov eax, dword [0x40f294]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x40f290]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x40c35c
push 0x40c348
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x40b2f8
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x40b3b2
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x40b346
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40b314
cmp ax, 0x22
jne 0x40b301
cmp word [esi], 0x22
jne 0x40b31f
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40b32d
cmp ax, 0x20
jbe 0x40b31a
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x40b353
movzx eax, word [ebp - 0x48]
jmp 0x40b356
cmp word [esi], 0x20
jbe 0x40b31f
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x40b346
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x40b377
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40b3ac
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040b419
ret
Function at 0x41bd00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x424c80], ecx
inc edx
cmp edx, 0x100
jb 0x41bd02
cmp edx, 0x800
jae 0x41bdd9
lea esp, [esp]
mov eax, dword [edx*4 + 0x424880]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x424c80]
inc edx
mov dword [edx*4 + 0x424c7c], eax
cmp edx, 0x800
jb 0x41bdb0
mov eax, 0x41c5e0
mov dword [0x424c7c], eax
mov dword [0x426c80], eax
mov dword [0x424c78], 0x41c500
call fcn.0041c010
test eax, eax
jne 0x41be05
mov dword [0x426c80], 0x41c500
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401fd7
Capabilities:
Create directory

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401fff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401fff
xor eax, eax
ret
push 1
pop eax
ret

Function at 0x4022c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push ebx
push eax
xor ebx, ebx
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4022ee
xor eax, eax
jmp 0x40234b
push esi
lea eax, [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 4]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
or edi, 0xffffffff
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x402339
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x18]
jge 0x402339
lea eax, [ebp + 0xc]
inc dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, ebx
je 0x402339
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, ebx
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x402430
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
jne 0x402464
lea eax, [ebp + 0xc]
push eax
push 0x2001f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402485
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4024a6
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402489
xor eax, eax
jmp 0x4024c6
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp + 0x18], edi
je 0x4024bb
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x4026f9
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.00401c0e
test eax, eax
pop ecx
je 0x402755
cmp byte [esi + 1], 0x3a
jne 0x402755
cmp byte [esi + 2], 0x5c
jne 0x402755
push 4
lea eax, [ebp - 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x40273d
cmp eax, 4
jne 0x402755
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402755
and eax, 0x10
cmp al, 0x10
je 0x402755
push 1
pop eax
jmp 0x402757
xor eax, eax
pop esi
leave
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x378e1d6c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2cf815ab
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xb37deb
Capabilities:
Encrypt data using speck

Disassembly:
bswap ebp
call fcn.00b5d3d3
mov ebx, 0x9915a985
push ebx
dec ebp
mov edx, dword [ecx]
dec eax
shl ebx, 0x62
dec eax
rol dword [esp], 0xcd
inc cx
adc ebx, dword [ecx + 8]
inc dword [esp + 4]
push 0x3485450b
dec ecx
add ecx, 0xa
push 0xdd8ec8bf
jmp 0xba01a8

Function at 0xb41d24
Capabilities:
Encrypt data using speck

Disassembly:
sete byte [esp + 9]
push 0xba84bfba
inc cx
sub ebp, 0x1be9ba20
add eax, 0xc332002e
shl edx, 1
not al
jb 0xb623c5

Function at 0xb5cb39
Capabilities:
Encrypt data using speck

Disassembly:
push 0xe6b37b02
jmp 0xb72165

Function at 0xb623df
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0xc8b8f83f
jp 0xc9eb0d
xor cx, bx
ror word [esp], 0x21
xor dword [esp], 0xd88b501c
adc word [esp + 1], 0xa58c
inc cx
not cx
dec dword [esp]
inc cx
rol cx, 1
xor bx, cx
push 0xa8b7c38e
not byte [esp + 1]
sub edi, 2
call fcn.00b95640

Function at 0xb7cc16
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
inc edx
mov dword [esp], 0xef01a787
xor ecx, 0xde85fc1e
neg byte [esp + 0xa]
call fcn.00a8251b
outsb dx, byte [esi]
bound ebx, qword [esi + 0x62d14f0]
xchg ebx, eax
mov edi, 0xf6b2404b
mov al, 0x6c
test eax, 0x5b3f46c2
mov esi, 0xbbf3e191
add byte [esi], al
mov dh, 8
mov ebx, 0x8b60600
mov ebx, 0xc684c60e
mul dword [eax]
mov byte [ebx + 0x9897f4d], bh
stosd dword es:[edi], eax
mov edx, 0x4ccc3e0c
xchg esi, eax
xchg dword [ecx], eax
xor edi, ecx
jns 0xb7cc47
Function at 0xb92c69
Capabilities:
Encrypt data using speck

Disassembly:
in eax, 5
pop es
add byte [eax], al
jnp fcn.00b70d98
lea esp, [esp + 0x14]
ja fcn.00ca62c1
fistp dword [eax - 0x7d]
out dx, al
pop ebp
cwde
sub eax, 0x9c68e4f9
xchg edi, eax
inc edx
pop ecx
or eax, edi
adc dword [0xba58072c], edx
inc esp
in eax, dx
jo 0xb3e307
lodsb al, byte [esi]
stosb byte es:[edi], al
sbb al, 0x2e
aam 0x54
invalid
insd dword es:[edi], dx
pop ecx
sbb esi, dword [0x2714ee3f]
not byte [0x360a0b0b]
adc dword [0x917c3e7], eax
pop esi
je 0xb92c46
xor esp, dword [ebx + 0x5f]
mov bl, 0xbd
out dx, eax
inc bp
mov ebp, dword [ecx]
inc ecx
mov ebx, 0xe5809f26
dec ecx
lahf
and ch, 0x49
add ecx, 2
dec ecx
shr ebx, 0xb
inc esi
movzx ebx, byte [ebp + ebx - 0x1cb013]
dec eax
adc ebp, 0
call fcn.00b3a09b
ror cx, 1
sar dword [esp + 0xb], 0xff
jb 0xca8b74
xor bx, cx
mov dword [esp], 0xefafbd1b
push 0xd32f9213
inc dword [esp + 3]
sub esi, 2
call fcn.00b61fbb
in al, dx
jne 0xb92c22
inc esp
adc byte [ebp - 0x1e], 0x63
lodsb al, byte [esi]
or eax, 0x3de05cb9
xchg edx, eax
pop ebx
dec esp
mov ch, 0xe9
pop eax
sbb cl, bl
push edx
lahf
test byte [ebp + 0x51], al
lock or byte [ecx], 0x5a
mov esi, dword [ecx + ebp*2 + 0x77527a7c]
aad 0xff
invalid
jns 0xb3e31b
mul byte [eax + edi*4]
popfd
jecxz 0xca8bd5
cli
mov byte [0x68544c77], al
sub ch, cl
inc ecx
or dword [edi], 0xffffff93
pop esp
xlatb
jg 0xca8bf4
sbb ecx, ebx
sal dword cs:[ecx + 0x7a], 7
xchg edi, eax
xlatb
adc eax, 0x677d6960
out dx, al
mov esp, 0x2dfaae42
rol dword [edx + 0x74], 1
retf
xor byte [ebx], cl
pop esi
cmpsb byte [esi], byte es:[edi]
jae 0xca8c55
out 0xb2, al
inc edi
nop
jne 0xca8c16
cmpsd dword [esi], dword es:[edi]
and edi, dword [edx + 0x15886382]
invalid
in eax, 7
xor eax, 0xc8d6819f
push ebp
arpl word [ebx], bx
pop ds
imul ebx, dword [edi - 0x66], 0xffffffa8
test eax, 0x376d6fb9
adc eax, 0x2ffe8a8e
mov es, word [ebp + 0x7f]
cmp edx, dword [ebx]
cld
std
push ds
cmp byte [edi - 0x58f509], 0x76
and ah, cl
xchg edi, eax
ljmp 0xd4a9
int1
mov eax, 0xa8b3de91
lodsb al, byte [esi]
xor ebx, ebx
xchg ecx, eax
jg 0xca8be6
aad 0x2d
pop edx
inc ebx
push ebp
mov esp, 0x6f5c2f42
inc esi
push ebp
mov edx, 0x4ab540f9
sti
invalid

Function at 0xb9ad6b
Capabilities:
Encrypt data using speck

Disassembly:
xor cl, bl
inc dword [esp + 0xc]
mov dword [esp + 8], 0x1a07dd0d
not cl
setp byte [esp + 0xc]
rol dword [esp + 0xc], 0xfa
mov dword [esp], 0x7e1b3385
ror cl, 1
inc cl
shl byte [esp + 0xa], 0xe7
jnp 0xbb8077
shr byte [esp + 0xe], 0xc7
not cl
xor bl, cl
sal dword [esp + 0xc], 0x81
lea ecx, [esp + ecx + 0x10]
call fcn.00ca8b72
Function at 0xbb102a
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, 0x53
stc
dec dword [ebx - 0x36f0f7ab]
or byte [edi], cl
leave
mov edi, dword [esp + ecx - 0x142dd52a]
call fcn.00b7a8c5
mov word [0xca1733e2], ds
mov esp, 0xd22ad60c
jmp 0xbb101a
cld
dec dword [ebp + ebx - 0x35e8cc1e]
xlatb
and al, 0x95
or ah, bh
xchg dword [edx - 0x42], edx
ja 0xbb102b
pop ebp
ficom dword [edi - 0x69]
jbe 0xbb1013
pop es
mov word [0x4aff77c2], cs
push es
fistp qword [ecx + ebx*8 + 0x7a]
xlatb
push edx
pop edi
push ebp
jg 0xbb1034
invalid

Function at 0xbb808e
Capabilities:
Encrypt data using speck

Disassembly:
neg cl
rol cl, 1
push 0xe589b610
mov dword [esp + 4], 0x488e068c
neg byte [esp + 9]
neg cl
inc byte [esp + 9]
inc byte [esp + 0xd]
xor bl, cl
sar byte [esp + 0xb], 0x84
rol dword [esp + 7], 0x25
inc byte [esp + 4]
sbb edi, 1
jmp 0xca6c4c
mov word [edi], cx
push 0x7d988f9e
call fcn.00b76f94
jmp 0xa84a80
jmp 0xb9e72a

Function at 0xc9cf68
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0xa86761
movzx cx, byte [eax]
sbb esi, 2
jmp 0xba0d6f
adc al, 0xa6
pop ecx
mov ecx, 0xfbac6923
xor bl, al
sal cx, cl
add eax, esp
ror cl, 0xa1
jae 0xbc0482

Function at 0xc9efdb
Capabilities:
Encrypt data using speck

Disassembly:
neg ax
not ax
rol byte [esp + 0x12], 0xc3
call fcn.00bbcef5

Function at 0xc9fbe8
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x81
mov byte [eax + eax], 0
add bh, al
inc esp
and al, 0
lcall 0x2444, 0x8973172b
add al, ch
fimul word [edx + 0x18]
add dh, dh
not al
push 0x6eae5b92
and al, 0
call 0xe246c6
not al
push 0x6eae5b92
mov dword [esp + 4], 0x9ba3cb02
ror al, 1
not byte [esp + 1]
neg word [esp + 6]
sbb al, 0x1f
mov byte [esp + 7], 0x17
and al, 7
pop ss
call fcn.00bbb336
dec ebx
sbb ebx, eax
sbb edx, esp
bound ebp, qword [ecx + 0x71]
and eax, 0x887ba56f
adc byte [ebx], bl
or ecx, dword [edi + 0x6d]
out dx, eax
sub byte [edi - 0x4e], ch
out dx, al
xor cl, byte [ecx]
xchg edx, eax
jnp 0xc9fc06
push ss
jbe 0xc9fc76
inc ebp
cli
and eax, 0xb13605a6
jae 0xc9fbe1
xchg edi, eax
les ebx, [edx - 0x45]
add edx, ebp
imul esp, dword [edi - 0x3a], 0xffffffc2
daa
salc
inc ecx
mov dl, 0x9b
jnp 0xc9fbd0
xor edx, dword [ebx]
mov al, 0xac
dec edx
pop edi
insb byte es:[edi], dx
or dh, ah
or eax, 0xb01364df
sub al, 0x5e
push eax
shl byte [eax - 0x60aa8cf9], cl
invalid
mov edx, dword [edi]
push eax
mov ebx, ecx
out 0xf8, eax
cmc
adc ah, byte [ebx + 2]
adc eax, 0x44206e31
mov bl, 0xca
fcomi st(6)
retf 0xa20f

Function at 0xca0ecb
Capabilities:
Encrypt data using speck

Disassembly:
dec cl
mov dword [esp], ebp
xor bl, cl
ror ebp, 0xcf
not ebp
lea ecx, [esp + ecx + 4]
sub ebp, ebp
movzx bp, byte [ebp + ecx]
jbe 0xe32328

Function at 0xca449c
Capabilities:
Encrypt data using speck

Disassembly:
lea ecx, [esp + ecx + 0x18]
jne 0xb427d9
jb 0xba5b62
test ax, 0x443d
Function at 0xe1abd9
Capabilities:
Encrypt data using speck

Disassembly:
movsx edx, al
mov ecx, dword [esp + edx*2 - 0x52]
call fcn.00e361f4
clc
add eax, 0x3c0ba8b
mov ebp, es
push ecx
jae 0xe1ac4d
or esi, dword [edx - 0x49736718]
add byte [eax], al
inc ebx
push 0x65736f6f
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0xe1ac45
add byte [eax - 0x7f], cl
lds eax, [ecx]
add byte [eax], al
add byte [eax + 3], ch
xor ebp, dword [ebp + edx*4 - 0x30cdbf]
dec esp
and al, 3
neg cl
push 0xe8afe429
neg byte [esp + 0xb]
neg dword [esp]
dec cl
jmp 0xe2fee7
fcos
aaa
ret 0x4cff

Function at 0xe1ac47
Capabilities:
Encrypt data using speck

Disassembly:
push 0x6db62e87
mov dword [ebp], ecx
lea esp, [esp + 0xc]
jmp fcn.00e313b5
mov dword [esp], 0xc2377623
dec dword [esp]
not dl
add dl, 0xb3
shr byte [esp + 2], 0xe6
sets byte [esp]
neg dl
and dword [esp], 0xc30a20f
rol dword [esp], 0xfb
adc dl, 0x15
not dword [esp]
not byte [esp + 2]
neg dl
shr dword [esp], 0x2b
jns 0xe367a0
sub ebp, 4
push 0xa5048033
push 0xdb0ab3a0
jmp 0xc9ba43
not byte [esp]
xor bl, dl
neg dword [esp]
lea edx, [esp + edx + 4]
ja 0xb9d214
jg 0xb9ad6d
jg 0xbb94cd
mov word [edx], cx
lea esp, [esp + 4]
jb fcn.00bcd21a
pop edx
div byte [edi + 0x67]
invalid
shl word [esp + 1], 0xc1
ror dl, 1
sal dword [esp], 0x18
jns 0xe1cc5c

Function at 0xe1cb32
Capabilities:
Encrypt data using speck

Disassembly:
mov ebp, dword [edi + 4]
push 0xc951d0e
call fcn.00baed53
jp 0xe1ee65
mov edx, dword [edi]
mov ebp, 0xc0986f28
bt ebp, ebp
jb 0xb42506
jle 0xe2c6ea
sbb ebp, 2
mov word [ebp], di
call fcn.00b5ad98
xlatb
insb byte es:[edi], dx
invalid

Function at 0xe2a065
Capabilities:
Encrypt data using speck

Disassembly:
add esi, 2
not dx
mov dword [esp], 0x6a3c5517
push 0x5d9841af
not cx
call fcn.00b99ed9
invalid
jmp 0xe18618