joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa10368
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
not ax
dec esp
mov dword [esp + ebp - 0x45b6], eax
inc cx
not esi
inc ebp
movsx edi, ax
jae 0xde5db2
jge 0xa103f2
jnp 0xa103c6
pop edx
jecxz 0xa10358
ror byte [ebx + 0x5a], 1
add cl, bl
rcl al, 1
dec ebx
xor cl, byte ss:[ebx - 0x71b42f30]
push ds
out 0xd0, eax
ror byte [ebx + 0x26], 1
sbb al, byte [edi + 0x254bcd57]
adc dword [edx + esi*8 - 0x5b], ecx
cli
and edi, ebx
push ss
push ebx
pop ss
out dx, eax
mov edx, esi
invalid
push edi
inc esi
cmp eax, 0x96082d48
rol dword [esi - 0x1e586951], 0x2c
or esp, dword [ecx + 0x1eb87e07]
out dx, al
cmp eax, 0x604cb964
int3
test dword [esi], ebx
cli
enter 0xffffffffffff9722, 0xffffffffffffff85
mov edx, 0x4164a85a
dec edi
pushal
adc al, 0xbe
lodsb al, byte [esi]
sti
pop es
dec ecx
dec ecx
mov eax, dword [ecx + esi - 0x4907fbac]
inc si
mov ebx, dword [esi + ecx - 0x4907fba4]
movzx edx, si
dec edx
lea esi, [ebp*2 - 0x4dfd82ee]
not cx
inc ecx
push eax
dec edx
lea edx, [esi + ebp*8 - 0x2ae39e67]
inc cx
dec ecx
lea eax, [esp + 0x50b72f1f]
dec bp
ror cx, 1
inc esp
movsx ebx, byte [esp + ebp - 0x45a7]
sal word [esp + ebp*2 - 0x8b5b], 0xa1
call fcn.00e4b8f8
neg byte [esp + ebp - 0x45b1]
inc ecx
push esp
inc ecx
movzx ecx, word [edx + ebp - 0x45bc]
shr byte [esp + ebp - 0x45ac], 0x81
dec ebp
lea edx, [edx + ebp - 0x45bc]
dec ecx
adc edi, 0xc423728d
xor cx, bx
dec eax
or dword [esp + ebp*2 - 0x8b6b], 0xf2179e3c
sub word [esp + ebp*4 - 0x116d6], 0x8f1a
inc esp
adc ah, ch
add cx, 0x1000
rol cx, 1
inc ecx
movzx eax, di
jmp 0xa3d23c
inc cx
and eax, esi
inc dx
mov dword [ebp + ecx - 0x45ae], eax
jmp 0xa54bd8

Function at 0xa13808
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push edx
inc cx
rol eax, 1
inc cx
neg eax
inc cx
xor ebx, eax
dec esi
lea eax, [esp + eax + 0x18]
shl bp, 0xee
inc ecx
mov ebp, dword [eax + edx*4 - 0x3268]
movsx eax, si
dec ebp
lea ecx, [ecx + edx*2 - 0x1938]
inc esp
movsx esi, word [esp + edx*4 - 0x3266]
dec ecx
lea ecx, [ebp + esi*8 - 0x29ef53e5]
dec eax
mov dword [esp + edx*4 - 0x3260], 0x66bc8627
inc ecx
mov dword [ecx + edx*4 - 0x3268], ebp
jp 0xdb3923
mov ecx, dword [ebp]
mov eax, 0x6c0754a5
lea eax, [eax + eax - 0x386506ce]
add ebp, 4
movzx edx, ax
push ecx
and al, 0xaf
add dl, 0xd
popfd
mov edx, dword [edx + edi - 0xa289]
mov ecx, 0x44a2e22e
not ax
lea edi, [ecx + edi - 0x44a2e22a]
xor edx, ebx
sub ecx, 0x212f6b05
shl ecx, 0xfc
lea edx, [edx + eax - 0x3e721833]
sar eax, 4
and cx, 0xe2ad
not edx
lea eax, [ecx*2 + 0x649b0b83]
shr ecx, 0xd6
inc edx
jmp 0xa1539c
dec eax
cmovns esi, dword [esp + edx - 0xc95]
dec ebp
lea edx, [edx + edx*2 - 0x1938]
inc esi
mov edi, dword [edx + edx - 0xc9a]
call fcn.00a67ae3
dec edi
lea edx, [edx + eax - 0x5dd9c906]
dec ecx
lea esi, [eax - 0x2bcc4379]
xor eax, ebx
inc ecx
xadd al, dh
lea eax, [eax + esi*2 - 0x43f80668]
jno 0xa30f87
lahf
push ebp
add dword [ecx - 0x68], eax
popal
ljmp 0xea0d
Function at 0xa19b12
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ax, word [ebp]
mov dword [esp], ecx
adc ebp, 2
movzx edx, byte [esp]
movzx ecx, byte [edi + edx - 0x21]
sal dx, 0x6a
lea edi, [edi + edx - 0x83ff]
sbb dl, 0x3d
push edx
xor cl, bl
jmp 0x9bfffc

Function at 0xa1b88d
Capabilities:
Encrypt data using speck

Disassembly:
xor eax, ebx
inc ebp
movsx esp, dh
lea eax, [eax + ecx - 0x5dafbfe8]
xor eax, 0x5a9cf205
dec eax
bswap eax
dec esp
mov dword [esp + ecx - 0x29], esi
dec edi
lea eax, [esp + 0x553ba7a0]
dec esi
lea ebx, [esi*2 - 0xbd6ac76]
rol eax, 2
dec eax
mov dword [esp + ecx*2 - 0x52], ebx
dec eax
lea ebp, [ecx*8 + 0x24a79591]
inc ecx
rol ah, 3
xor dword [esp + ebp - 0x24a796d9], eax
dec ebp
lea ebp, [eax - 0x20d01f79]
inc ecx
and ch, bl
inc eax
dec ch
pop ebx
inc cl
ja 0xd5ba2d
inc ecx
movsx edx, ch
dec eax
arpl ax, ax
dec eax
adc edi, eax
inc ebp
movzx edi, sp
dec edi
mov ebx, dword [esi + ecx - 0x292e1aa5]
dec ebx
mov ecx, dword [esi + ecx - 0x292e1a9d]
call fcn.00e35205
inc edx
sal dword [esp + ebp - 0x1302bb15], cl
jp 0xd97a41
cmp cx, bp
inc esp
xor edi, ecx
pop ebp
inc ecx
not dh
inc ecx
ror edi, 1
inc ebp
add bl, al
inc edx
shr dword [esp + ebp*4 - 0x4c0aec7d], 0xe4
inc edi
lea edi, [edi + ebp - 0x1fc222a4]
dec edx
mov dword [esp + ebp*4 - 0x4c0aec80], ebx
inc ebp
sbb ch, bl
inc esi
xor dword [esp + ebp - 0x1302bbf0], edi
inc ecx
or bl, 0x82
dec ebp
adc eax, esi
pop ebx
dec esi
lea esi, [eax*8 + 0x21174302]
dec ebp
arpl di, di
dec ecx
adc edi, edi
ror cl, 0x82
rol cl, 0x27
dec esi
lea edi, [ebp*8 + 0x748d1028]
jmp edi
Function at 0xa1cb14
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp + esi*2 - 0x2a], ebx
inc eax
ror ch, 0x45
dec eax
arpl cx, cx
inc edx
mov byte [esp + esi*4 - 0x50], 0xab
dec eax
adc edi, ecx
dec edx
neg dword [esp + esi - 0x15]
pop ecx
jb fcn.00d6eae8
leave
cmpsd dword [esi], dword es:[edi]
jnp 0xa1cb7a
adc bl, byte [ebx + 0x18]
ror byte [ebx - 0x72], 1
inc byte [edi + 0x18]
ror byte [ebx - 0x4e], 1
jbe 0xa1cb76
sbb al, dl
dec ebx
rcr byte [edx + 0x4bd01853], cl
inc edx
ret 0x9f4f
adc al, 1
shl byte [edx + 0x28], cl
jp 0xa1cb82
sub byte [edx + 5], bh
invalid
sub ecx, dword [edx + 0x45b260f7]
aad 0xcf
lock sbb dword [esi], ecx
in al, 2
xchg esp, eax
jb 0xa1cbf5
xchg ebp, eax
jge 0xa1cc0c
jb 0xa1cbc2
fidiv dword [esi + 0x22]
push cs
ret
xchg esi, eax
adc dh, bh
cmp ebp, dword [edx]
jmp 0xa1cc02
imul ecx, dword [edx + 0x3b8375be], 0x57
pop ss
inc eax
dec eax
movsd dword es:[edi], dword [esi]
les ecx, [edi - 0x6016b12f]
ror dword [esi - 0x17], 1
lahf
xor eax, 0xf38c6c5c
in eax, dx
jae 0xa1cc65
push ebx
fld st(0)
mov esi, 0x1e920c10
push edx
insb byte es:[edi], dx
adc byte [eax + 0x40f86e1c], ch
unpcklps xmm7, xmmword [ebx + 0xf5390e6]
push edi
popal
shr byte [ecx + 0x14], 0xc3
adc bh, ah
pop ds
dec ecx
adc ebx, eax
adc bh, ah
pop ds
sub dword [ebp + 0x1ffc12f7], esp
and eax, 0x957eb39
xor al, 0xb8
and al, 0x54
push es
scasd eax, dword es:[edi]
or dword [eax + 0x428b417b], esi
pop ds
ror byte [ebx - 0x75], 1
xchg ebx, eax
pop edx
pop ds
ror byte [ebx - 0x5d], 1
pop ss
dec esi
pop ds
ror byte [ebx - 9], 1
sbb dword [edx + 0x1f], 0xffffffd0
dec ebx
mov bl, 0x87
push 0x5a
fimul dword [ebx + 0x1c]
fnsave dword [edx]
invalid

Function at 0xa1ecff
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
je 0xe13246
not esi
call fcn.009996fd

Function at 0xa203c5
Capabilities:
Encrypt data using speck

Disassembly:
movsx eax, word [esp + ecx - 0x2e018f74]
inc ebp
xadd al, dh
inc ebp
and ch, ah
call fcn.00d918fc
fst dword [ecx + 1]
out dx, eax
jno 0xa20430
and ah, dl
pushal
jno 0xa20392
xchg byte [edx + 0x3ec239c7], bh
xchg byte [ebp + 0x578bd8f7], bl
clc
and eax, 0x7848be4
pop eax
and byte [ebp - 0x72], ch
call fcn.00dc7a2c

Function at 0xa215f8
Capabilities:
Encode data using xor

Disassembly:
inc cx
xor esi, 0xc74854bd
add al, 0x24
xchg byte [ebx - 0x42], dl
mov byte [0xada48d4f], al
xor dword ds:[edi - 0x2ebe997d], edx
invalid

Function at 0xa2471f
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp + eax - 0x7167943d]
mov edx, 0x88346917
ror edx, 0xc7
adc ecx, eax
call fcn.00d5998f
mov eax, 0xd1a029bc
xor cl, bl
neg cl
call fcn.00dfb86c

Function at 0xa2df93
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + edx*2 - 0x4006], eax
movzx cx, byte [edx + esi - 0x2003]
not dword [esp + edx*4 - 0x8006]
jge 0x91cbeb
Function at 0xa2eb79
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec esi
mov dword [esp + esi*4 - 0x64], esi
inc ecx
pop ebx
inc ecx
sub edi, 0xbda7af02
inc ecx
push esi
xchg bp, si
inc ecx
neg edi
inc edx
xchg dword [esp + esi - 0x1c], ebp
dec edx
mov dword [esp + esi*4 - 0x6c], eax
inc ecx
not edi
dec edx
mov dword [esp + esi*8 - 0xf0], ebp
inc esi
xor byte [esp + esi*2 - 0x3c], dh
jno 0xa5fe67
jo 0xa5fe54
sbb ebx, dword [eax - 0x3768a49c]
shr bl, 0x6a
jne 0xa5fe20
dec ebp
and eax, 0xf883df1e
and al, byte [ebp - 0x33]
lahf
cmp eax, 0x22
jmp 0xf9298148
sub ebx, 0x22
sub eax, 0xc3e34bd4
sbb ch, byte [0xdff74bd4]
dec ebx
neg edi
push ss
sub eax, 0x87134bd4
sub ch, byte [edx + 0x444bc9]
fisttp qword [edi]
mov eax, dword [0xc43080fa]
push edi
dec edi
jp 0xa5fdd8
xchg esi, eax
pop ds
outsd dx, dword [esi]
scasb al, byte es:[edi]
out dx, al
xor ecx, dword [edx + 8]
mov eax, dword [0xbdf2c594]
cmpsb byte [esi], byte es:[edi]
daa
aad 0xf2
mov ebp, 0xbd6f03a6
mov ebp, 0xb18357a6
cmpsd dword [esi], dword es:[edi]
pop ds
arpl word [esi], sp
dec esi
push edi
xor dword [ecx + 0x26631fa7], 0x4e
sbb al, 0x15
nop
xor eax, 0x944b7745
xchg ebx, eax
add edx, ebx
dec edx
mov dword [esp + esi*2 - 0x26], ebx
inc dx
xadd dword [esp + esi - 0x1e], ebp
inc esi
xor dword [esp + esi - 7], edi
inc ebp
sub ah, dh
je 0x93e054
jge 0xa5fe15
jg 0xa5fec6
inc esi
invalid
invalid

Function at 0xa3357e
Capabilities:
Encrypt data using speck

Disassembly:
inc ebp
mov dword [ecx + ebp*4 - 0x148], esi
pop esi
ja fcn.00d6eae8
mov eax, 0x7c28040c
mov edx, dword [esi + eax - 0x7c28040c]
movsx ecx, ax
mov eax, dword [esi + ecx*2 - 0x814]
mov dword [esp + ecx - 0x40c], ecx
pop ecx
call fcn.00913c85
mov edx, 0xc313542e
push edx
mov cx, word [esi]
movsx eax, byte [esp]
xor byte [esp + eax*2 - 0x5a], 0x95
shl dword [esp + eax - 0x2e], 0x8f
movzx edx, byte [edi + eax - 0x2f]
jns 0xd736ed
inc esp
xor dword [esp + ebp - 0x52], esi
mov ebx, 0xe614528b
inc cx
ror eax, cl
pop ebx
dec ebp
arpl si, si
push ebp
jae 0xd89cee
movsx ecx, dl
dec ecx
sub edx, 4
call fcn.00a2510e
not byte [esp + eax*4 - 0xb6]
xor dl, bl
or al, 0xb0
push eax
inc dl
ror dl, 1
not al
shr byte [esp + eax - 0x3e], 0x21
neg eax
xor dl, 0x8c
dec eax
sub dl, 0xa0
rol dl, 1
xor bl, dl
lea edx, [esp + edx + 8]
mov byte [edx], cl
ror eax, 0xcb
sal eax, 0xbf
mov eax, dword [edi - 5]
call fcn.00dc3f9e
dec ecx
adc edi, esi
dec ebp
mov esi, ecx
xor dword [esp + ebp*2 - 0xa2], 0x3fa56234
inc esp
mov edi, ebp
dec ebp
lea ecx, [ecx + ebp*2 - 0xa8]
jno 0x916b19
add edx, edx
shr dword [esp + edx*2 + 0xb], 0xde
xor ecx, 0xf0fd920
sar dx, 0xee
movzx eax, dl
lea ecx, [ecx + edx*2 + 0x791eda07]
ror ecx, 3
shr byte [esp + edx*4 + 1], 4
shr edx, 0xee
xor ebx, ecx
push eax
mov dword [esp + edx*2 + 8], edx
add ebp, ecx
mov ecx, dword [esi + edx*4 - 4]
add dx, word [ecx + edx*2]
mov word [esi + eax*2 - 2], dx
lea esi, [esi + eax - 2]
pop ecx
jmp 0xdc403e
pop ecx
pop ecx
pop ecx
pop edx
jmp fcn.00d89820
Function at 0xa34d60
Capabilities:
Authenticate hmac

Disassembly:
dec eax
add edi, edx
inc ecx
mov edx, ebp
inc edi
mov ecx, dword [ecx + eax - 0x4e8000]
dec edx
mov dword [esp + eax - 0x4e8000], 0xc7a87a01
call fcn.00d534e4

Function at 0xa34d7f
Capabilities:
Authenticate hmac

Disassembly:
jbe 0xdb9665
sal cl, cl
shl byte [esp + edx - 0x6c226c82], cl
mov edx, esi
movzx ax, byte ss:[edx]
lea edx, [ecx*2 + 0x1ca2aa0e]
shl cl, cl
mov dx, ax
movzx dx, dl
ror ecx, 0x36
mov al, byte [esi]
or dl, al
xor dl, cl
jmp 0xa35804
xor ecx, ebx
bswap ecx
mov dword [esp], 0x553d043d
jmp 0xd58990
movsx eax, cl
mov word [esi], dx
lea eax, [ecx + eax*2 + 0x66a17f1b]
xor cl, 0xaf
pop edx
jmp ebp
ror ecx, 2
mov eax, dword [esp]
or dword [esp + eax - 0x553d043d], eax
lea edx, [eax*2 - 0x63da3bcb]
neg ecx
call fcn.00d841c8
inc ecx
xor bl, 0x9f
sal cl, 0x27
je 0xa18331
mov esi, 0xff87c634
dec eax
or esi, esi
inc esp
movzx ebx, dh
dec edi
lea edx, [ebx + edx - 0x38]
inc ebx
mov eax, dword [edx + ebx*4 - 0xd0]
inc ebp
movzx edi, bl
xor eax, ebx
ror eax, 1
call fcn.00d4fc3c
inc ecx
inc bl
dec ecx
xchg edi, edx
call fcn.00e41c6e
movzx dx, byte [ebp]
jmp 0x91b595

Function at 0xa3f826
Capabilities:
Encrypt data using speck

Disassembly:
dec al
rol ecx, 1
xor ebx, ecx
sar dl, 0x41
mov dword [esp + edx*8 - 0x10018], eax
adc ebp, ecx
neg eax
call fcn.00a2df93

Function at 0xa40815
Capabilities:
Authenticate hmac

Disassembly:
sbb eax, edx
xor bl, cl
sar edx, 0x97
mov dword [esp + edx*2], edx
lea ecx, [esp + ecx + 4]
jb 0xe3c230
jb fcn.0092460a
mov ax, word [ecx + edx]
mov word [edx + ebp - 2], ax
call fcn.00a50ff7
movsd dword es:[edi], dword [esi]
jmp 0xe6c226ef
call fcn.00a27e6a
lea eax, [eax + ecx + 0xfb0b6d0]
xor eax, 0x2911241e
sar ecx, cl
shr dl, 0x45
shl edx, 0x84
xor ebx, eax
lea edx, [ecx + edx + 0x6627f293]
xor dword [esp + ecx], ecx
adc ebp, eax
lea edi, [edi + ecx*4 - 1]
movzx edx, byte [edi + edx*2 - 0x7418a566]
xor dl, bl
call fcn.009b3af7
lea eax, [eax + edx*2 - 0x45b787d]
rol dword [esp + edx - 0x4d3e465c], 0x36
movsx ecx, dx
neg eax
jmp 0xd640b2
mov dword [esp + 4], 0x9532658b
mov edx, dword [esp + 4]
xor ebx, eax
pop ecx
add esi, eax
mov ax, word [ebp + ecx + 0x7cc854c9]
sal ecx, cl
lea ebp, [ebp + ecx + 0x64800002]
push ecx
movzx edx, byte [edi + ecx + 0x64800000]
js 0xa8c8e4
mov eax, 0x4d3e2317
rol al, 0x41
movzx edx, ax
lea edi, [eax + edi - 0x4d3e2332]
xadd edx, eax
push eax
mov eax, dword [edi + eax - 0x232e]
push edx
xor eax, ebx
pop edx
jmp 0xdcec98
Function at 0xa4e707
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
lea edi, [edi + ecx*8 - 0xffffff4]
xor edx, ebx
rol edx, 3
lea eax, [eax*8 + 0x4f344e9f]
push eax
dec edx
xor edx, 0xca27b88
xchg cx, ax
add eax, eax
jge 0xa4b28d
neg edx
add eax, eax
call fcn.009be54a
jmp 0xd83d5e
lea ecx, [eax + eax*2 - 0x61c897d0]
dec eax
mov dword [esp + eax*2 - 0x2a66381c], esi
ret
or byte [esp], dh
mov dword [ebp], eax
neg dword [esp]
movsx ecx, word [esp]
mov eax, 0x4e17ee0b
mov edx, dword [edi + eax - 0x4e17ee0b]
rol ecx, 0x58
jne 0x9220b6
mov edx, 0x3610998b
movzx ax, byte [ebp + edx*2 - 0x6c213316]
movzx ecx, dx
mov dl, byte [edx + ebp - 0x36109989]
or ecx, 0x1389021c
jp 0x9bc532
mov ecx, 0x46157122
lea ecx, [ecx + ecx - 0x5ae9a5f5]
movsx edx, cl
mov cx, word [ecx + ebp - 0x31413c4f]
mov ax, word [ebp + edx*2 - 0x9c]
not edx
add ebp, 2
call fcn.00daa0d6
dec ecx
inc edi
sar byte [esp + 9], 7
inc ecx
xor eax, 0xada457a5
dec ecx
dec ebx
dec eax
lea esp, [esp + 0x10]
jne 0xe1e708
call fcn.009bfa8b
dec edi
lea esi, [ebp + edi - 0x3ee801dc]
inc ecx
sal ebp, 0x22
dec ecx
mov dword [ecx + ebp*2 - 0x733e2116], eax
inc ecx
mov ecx, esi
neg bp
inc edi
mov eax, dword [edx + edi*2 - 0x733e2022]
inc cx
shl ebp, 0x67
inc esp
mov esp, ecx
inc esp
xor eax, ebx
dec esp
and edi, ecx
inc ecx
xor eax, 0x14a4582e
inc ecx
sal edi, cl
jae 0xa5ea7e
push ecx
not edx
sar ecx, 0x68
inc dword [esp + ecx*2 - 0xc08da0]
lea edx, [edx + ecx - 0x7b05635d]
xor edx, 0xcd33b504
or cl, 0x2d
not ecx
xor ebx, edx
xchg dword [esp + 8], eax
add eax, 0x2f1ca5
jmp eax
mov dword [esp + eax*4 - 0x294], eax
mov eax, dword ss:[ecx + eax*4 - 0x294]
dec byte [esp]
js 0xa3c896
inc eax
dec eax
xor ebx, edx
add esi, edx
jmp 0x99df3a
inc ecx
xor esi, eax
call fcn.00a86ed2
inc ecx
movzx esi, byte [edi]
jmp 0x932737

Function at 0xa4febb
Capabilities:
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + edi - 0xd5], edi
dec eax
add edi, ebp
inc si
and dword [esp + esi - 0x6633ca1c], esp
inc edi
mov ecx, dword [esi + ecx - 0x6633ca31]
inc ecx
pop esp
pop ebp
pop ecx
inc ecx
pop eax
jae fcn.00d6eae8

Function at 0xa50147
Capabilities:
Encrypt data using speck

Disassembly:
inc cx
neg ebp
dec esp
mov dword [esp + ebp - 0x372303], esp
inc cx
ror ebp, 1
inc ebp
add eax, edi
setno dl
inc cx
dec ebp
dec eax
mov dword [esp + ebp - 0x37230b], 0xb79bf227
xchg ebp, ecx
call fcn.00a4e608
inc ecx
not ebx
dec esp
lea eax, [esi*4 - 0x7d469a50]
xadd word [esp + edx*4 - 0x72a69492], si
inc ecx
dec ebx
dec eax
add dword [esp + edx*2 - 0x39534a4c], ebp
dec eax
lea ecx, [edx - 0x5271ab6f]
inc ecx
rol ebx, 2
sar bp, 0xc3
dec eax
sbb dword [esp + edx - 0x1ca9a526], edx
inc esp
movsx ebp, ch
dec eax
mov dword [esp + edx - 0x1ca9a526], ebx
call fcn.00d76adb
sub esi, 0xfffffffc
mov eax, dword [ecx]
call fcn.00e44915
Function at 0xa509df
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0xc8934229
rol cx, 9
xor ebx, edx
add esi, edx
jmp esi
pop eax
mov eax, 0xb01f808c
inc edx
bswap edx
xor ax, ax
mov dword [esp + ecx*2 - 0x54], eax
inc edx
not ecx
not edx
ror byte [esp + 9], 0x61
jo 0xd608a4
neg edx
neg eax
shr dword [esp + eax - 0x4fe10000], cl
sub edx, 0xfc11b52d
inc cx
mov dword [esp + eax - 0x4fe0fffc], ecx
xor ebx, edx
neg cx
add esi, edx
call fcn.00d661ac
movzx edx, byte [edi]
call fcn.00a85b53
inc ecx
pop ebp
inc ecx
pop eax
jle fcn.00d6eae8
mov eax, dword [esp + eax - 0x2fbc022b]
call fcn.00d5d63f
dec dl
push ebp
inc ecx
shl bh, 0x62
inc esp
movzx esi, dh
inc edx
sar ecx, cl
bswap edx
pop ecx
add eax, 0xf3013eb8
lea edx, [edx + eax*4 - 0x4715ac65]
sub cx, 0x6992
jle 0xa4bfce

Function at 0xa50a6e
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
sub ecx, 4
inc ebp
mov dword [ecx], esp
dec ecx
sub edx, 4
inc esp
movsx esi, dl
inc ecx
sub esi, esi
inc ecx
movzx ebp, si
inc ecx
mov eax, dword [edx + ebp*2 - 0x1ff68]
inc esp
movsx ebp, dx
xor eax, ebx
inc ecx
mov eax, 0x63184a00
ror eax, 1
call fcn.00db28aa
inc ecx
movsx eax, dh
inc esi
mov ebp, dword [esi + edx - 0xdcad]
jmp 0xd6f6bb
inc ecx
not esi
inc esp
xor ebp, ebx
neg edx
inc ecx
movsx ebp, bh
inc ecx
not ebp
inc ebp
xchg eax, edi
inc cx
rol edi, 3
inc ecx
neg ebp
push edx
dec eax
inc ebp
xadd byte [esp + esi*2 - 0x1b952], dh
inc esi
lea ebp, [edx + ebp + 0x6e3366dd]
dec eax
adc edx, 0x340ce03c
inc ecx
bswap ebp
dec eax
mov dword [esp + esi*2 - 0x1b952], ebx
jg 0xdc4b1e
inc esp
xor dword [esp + esi*8 - 0x6e548], ebp
pop ebx
dec ebp
arpl bp, bp
inc ecx
mov ebx, 0x7a9dd500
dec ecx
add edi, ebp
call fcn.00e33e83
Function at 0xa53ad0
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, 0x5bb41e1f
not edx
inc edx
inc ecx
shl esi, cl
dec esp
xchg dword [esp + eax*4 - 0x47f8], ebp
dec eax
mov dword [esp + eax - 0x11f8], ebx
shl word [esp + eax - 0x11fb], 0xa1
mov ebx, ecx
xor dword [esp + eax*2 - 0x23f8], edx
push eax
inc ebp
movzx ebx, dh
dec eax
mov ebx, dword [esp + eax - 0x11f0]
inc ecx
inc esi
add byte [esp + eax - 0x11f1], cl
inc ebp
movsx esp, si
dec eax
arpl dx, dx
dec eax
adc edi, edx
inc ecx
sal ebx, 0x76
dec eax
mov dword [esp + eax*8 - 0x9000], edi
ret 0x10
shr dword [esp + 0xc], 0x3b
dec eax
mov dword [esp], 0xc5972212
dec esp
shld ebp, ebx, cl
rol byte [esp + 9], 0xa7
dec ecx
mov dword [ecx], ebp
sar dword [esp + 7], 9
js 0xe0e597
jns 0xddd5e0
lea ecx, [edx*8 + 0xa24182]
mov ecx, dword [esi + edx*2 - 0x60a3fffc]
mov edx, dword [esi + edx*2 - 0x60a3fff8]
mov eax, 0x560aa598
lea esi, [esi + eax - 0x560aa58c]
add ecx, edx
movsx edx, al
mov edx, ecx
or al, al
movzx eax, byte [eax + edi - 0x560aa59d]
mov ecx, 0x90acf10f
call fcn.00a30e21
dec ecx
sbb edx, 4
movsx eax, word [esp + 0xb]
dec esp
or dword [esp + eax*2 - 0x23fc], ebp
inc ecx
mov edx, dword [edx + eax*4 - 0x4800]
dec byte [esp + eax - 0x11f4]
mov ecx, 0x56b34da9
xadd dword [esp + eax*4 - 0x4800], ecx
xor edx, ebx
sal dword [esp + eax*4 - 0x47f7], 0x6f
inc edx
lea edx, [edx + esi - 0x526f63fb]
jne 0xa1bcd0
inc esp
movzx ebp, cl
dec edi
lea edx, [edx - 0x355cb866]
dec ecx
inc esp
inc esp
sub ch, cl
dec eax
inc ecx
inc ebp
mov edi, dword [edx + ecx - 0x5c32]

Function at 0xa5c403
Capabilities:
Get number of processors

Disassembly:
dec ebp
arpl sp, sp
ror cx, 0x88
inc ebp
mov esp, dword [edx]
dec eax
mov dword [esp], ebp
inc esp
movzx eax, byte [esp + 2]
inc esp
xor esp, ebx
dec esi
xchg dword [esp + eax - 0x8c], eax
sal word [esp + 1], 0xc1
dec esp
lea ebx, [ebp - 0x2ec951eb]
inc ecx
rol esp, 3
inc dx
shr dword [esp + ebx - 0x6bc3291c], 0xee
inc ecx
not esp
dec ebx
lea eax, [eax + eax*4 - 0x62498d7d]
inc eax
movzx ecx, ch
sar byte [esp + ecx - 4], 0xe2
inc ecx
ror esp, 1
inc esp
movsx edi, al
dec eax
or dword [esp + ecx*2 - 0x10], ecx
inc ecx
inc esp
inc ecx
ror eax, cl
inc ecx
shl al, 0xa1
inc ecx
neg esp
movzx esi, cx
inc ecx
dec esp
inc eax
and dh, al
dec edx
mov dword [esp + eax*2 - 0x113519ec], ebx
inc esp
sbb edi, ecx
inc esi
xor dword [esp + eax - 0x89a8cf6], esp
pop ebx
inc esp
movsx esi, ax
jmp 0xa448a8

Function at 0xa657d6
Capabilities:
Encrypt data using speck

Disassembly:
neg dl
inc esp
xor bh, dl
inc ecx
dec bh
movzx eax, dx
call fcn.00df5c39
mov ecx, 0xfc298805
push ecx
call fcn.00e1554b
mov ecx, 0x753ac2a0
xor cl, 0x96
lea eax, [ecx*2 - 0x17e99ed3]
mov eax, dword [esi + ecx - 0x753ac236]
lea ecx, [esp + ecx - 0x753ac206]
mov edx, 0xb188ed13
call fcn.00e4a1a6

Function at 0xa65818
Capabilities:
Encrypt data using speck

Disassembly:
inc bp
sbb ebx, esi
dec edi
mov ecx, dword [ecx + edi*2 - 0x7872]
inc edx
movzx ecx, word [esp + edi*2 - 0x7866]
movsx esi, cx
dec edx
ror dword [esp + edi - 0x3c31], 0x23
inc ecx
pop esp
pop ebp
pop edx
pop ecx
jae fcn.00d6eae8
Function at 0xa69007
Capabilities:
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + ebp - 0xcdd8], esi
xor bx, bp
dec eax
lea ebp, [esp + ebp + 8]
inc ecx
xchg ebp, edx
dec ecx
and esi, ebx
dec esp
mov dword [ebp + edx - 0xcdd8], edi
neg byte [esp + edx - 0xcdd5]
inc ecx
sar ebp, cl
xadd word [esp + edx - 0xcdd6], cx
dec ebp
mov eax, dword [edx + edx - 0xcde4]
pop esi
dec ecx
xadd ebp, esi
dec ebp
xadd esp, ebx
dec esp
xor eax, ebx
add dx, 0xd03
dec ecx
sbb esi, ebp
inc ecx
movzx eax, ah
dec ecx
dec eax
bswap esi
inc ecx
add edx, ebp
dec ecx
bswap eax
inc ecx
sbb al, ch
dec eax
ror eax, 0xdf
inc ebp
and esi, ebx
dec edi
lea eax, [eax - 0x4a226552]
inc ecx
sal ch, 7
movsx ebp, si
dec ecx
xor eax, 0x33283316
dec ebp
lea edi, [esi + eax*2 - 0x17d4b665]
inc ecx
not esp
dec esi
lea eax, [edx + eax - 0x6f6adadb]
inc ecx
shl dh, 0xc5
inc cx
rol ebp, 0xc3
dec ecx
not eax
inc cx
or esi, esi
dec eax
shl eax, 0xfb
inc ecx
xadd bl, dl
dec ecx
xor ebx, eax
dec eax
rol esi, 0x7b
adc ebp, ebp
or ax, 0x5613
dec edi
mov dword [ebx + ecx + 0x38c76580], eax
dec ecx
inc ebx
jno 0xd4e9a9
not si
dec eax
add edi, ecx
inc ecx
push esp
dec eax
mov dword [esp + edx*4 - 0x26c], esi
dec eax
mov dword [esp + edx - 0xa3], edi
ret 0x20
call fcn.00e64565

Function at 0xa69da0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.00a69eaf
not edx
call fcn.0093d240
mov eax, 0x403298ab
jmp 0xe631b1
mov eax, dword [esi + eax - 0x403298ab]
mov ecx, dword ss:[eax]
push 0x401bc799
mov eax, 0xc017a225
mov dword [esi], ecx
sub edi, 4
movsx edx, al
mov eax, dword [edi + edx*8 - 0x128]
xor eax, ebx
rol eax, 1
movzx ecx, dx
bswap eax
not word [esp + edx*2 - 0x4a]
sar word [esp + edx - 0x23], 0x21
xor eax, 0x9397e734
xor dword [esp + edx - 0x25], 0xa8a81a1d
shr edx, 0x74
inc word [esp + edx*4]
lea eax, [eax + edx*2 - 0x149f7724]
and word [esp + edx*8], cx
bswap eax
sub dl, ch
ror dword [esp + edx*2], cl
xchg dword [esp + edx], ecx
xor ebx, eax
ror ecx, cl
call fcn.00d8cee0

Function at 0xa6defb
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, 0x591b5e2a
dec esi
lea edx, [edx + edx - 0x591b5e2e]
inc edx
mov ebp, dword [edx + edx - 0x591b5e2a]
xor ebp, ebx
sub ebp, 0x779ff18e
not ebp
dec ebp
inc esp
movsx eax, dx
inc ecx
pop esp
inc ecx
push eax
bswap ebp
xor ebp, 0x22354417
call fcn.00d5287e

Function at 0xa74a4c
Capabilities:
Encrypt data using speck

Disassembly:
inc ebp
lea esp, [esp + ebp*4 - 0x3cb25866]
dec eax
mov dword [esp + ebp - 0x2d56], ebx
inc ebp
movzx edi, si
jp 0xd5a687
inc esp
xor dword [esp + ebp - 0x2d56], esp
shr cl, 0x81
rol word [esp + ebp*4 - 0xb5a5], 0x86
dec eax
mov ebx, dword [esp + ebp - 0x2d56]
dec ebp
arpl sp, sp
dec esp
mov dword [esp + ebp - 0x2d6e], esi
dec ecx
add edi, esp
inc ecx
dec ebx
inc ecx
pop ebx
inc ecx
pop esi
pop esi
inc ecx
pop ebp
jno fcn.00d6eae8
mov ecx, 0xd63b3c35
mov eax, dword [ebp]
call fcn.00de29d7

Function at 0xa755da
Capabilities:
Authenticate hmac

Disassembly:
inc eax
and eax, ecx
xor ebx, edx
call fcn.00e5ffb3