joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe22142
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x40ac9fb6
xor bl, al
shl dword [esp], 4
and dl, dl
lea eax, [esp + eax + 4]
xadd dword [esp], ecx
sub byte [esp + ecx*2 - 0x1593f6bf], 0x91
mov edx, dword [ecx + eax - 0xac9fb60]
mov dword [ebp + ecx*4 - 0x2b27ed84], edx
movsx eax, cl
setp byte [esp + ecx*4 - 0x2b27ed80]
mov edx, dword [ebp + ecx*2 - 0x1593f6c4]
mov eax, dword [ecx + ebp - 0xac9fb60]
jae 0xe4ccff
add dword [esp + ecx - 0xac9fb60], ecx
mov cl, byte [ebp + ecx - 0xac9fb5c]
shrd edx, eax, cl
mov dword [ebp + 2], edx
mov ecx, dword [edi + 1]
mov edx, 0xa19cfd9a
lea eax, [edx + edx*4 - 0x3b6eaeec]
xor ecx, ebx
rol al, 0xc3
push edx
lea eax, [eax*2 - 0x62cf9b62]
lea ecx, [eax + ecx + 0x1b465916]
shr ax, 0x4d
ror ecx, 2
or eax, dword [esp + eax - 0x76740003]
push eax
not ecx
xor dword [esp + eax - 0x77f7655f], 0xe31c5faa
adc dword [esp + eax - 0x77f7655f], 0x223d813b
sub ecx, 0xc8b2491a
or al, byte [esp + eax - 0x77f76565]
xor ebx, ecx
add esi, ecx
mov edx, dword [ebp + eax - 0x77f765f5]
push eax
jmp 0x937f3b

Function at 0xe26296
Capabilities:
Encrypt data using speck

Disassembly:
sub esi, edi
mov dword [ebp - 0x48], esi
or si, si
mov esi, dword [eax]
test sp, 0x1b08
mov dword [ecx], ebx
rcr cx, 0x9e
shr ch, 0x16
mov ecx, dword [ebp + 0x14]
stc
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
shrd eax, ecx, 0x39
shl al, 0x39
add ecx, esi
ror ah, cl
mov eax, 0xc4b44daf
mov eax, 0x300
cmp di, 0x1f17
test ax, si
jmp 0xdb6aea
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
jmp 0xa7e219
mov esi, edi
stc
test edi, ebp
shl esi, cl
rcl ecx, 0x21
and cx, 0xe5b4
cmc
mov ecx, dword [eax + 4]
sub ebx, ebx
mov dword [ebp - 0x20], edx
test si, 0xdf85
stc
sub esi, edi
test esi, edi
clc
mov dword [ebp - 0x44], esi
not si
mov esi, edi
shl esi, cl
bswap cx
sal cl, cl
movzx ecx, si
mov ecx, dword [ebp + 0xc]
test cx, 0x4aad
mov dword [ebp - 0x18], ebx
cmp ah, 6
clc
mov byte [ebp - 1], bl
cmc
jmp 0x9397c3
shl eax, cl
cmc
mov dword [ebp - 0x3c], esi
cmp ax, di
mov dword [ebp - 0x14], ebx
test bx, bx
clc
mov dword [ebp - 0x10], edi
cmp edi, 0x90baf11f
add eax, 0x736
jmp 0xa2d2ec
call 0xe29f82
sub edi, 4
mov eax, 0xcb879db0
ror al, 0x85
movzx edx, ax
mov eax, dword [edx + edi - 0x9d85]
setae dl
xor eax, ebx
movsx ecx, dx
neg dl
neg ecx
bswap eax
not dl
sbb dl, dh
ror eax, 1
lea edx, [edx + ecx - 0x7bf52fd7]
inc eax
xchg dh, cl
bswap eax
add dx, 0x7927
dec cl
neg eax
rol eax, 1
inc cl
xor eax, 0x67979f2e
not eax
neg eax
ror edx, cl
adc edx, ecx
bswap ecx
xor ebx, eax
call fcn.00a52ee2
push ebp
mov ebp, esp
btr edx, ebp
sub esp, 0x48
mov ecx, dword [eax + 8]
test esp, 0x300f2b3d
sbb dl, 0x38
mov edx, dword [eax + 0xc]
test dl, cl
cmp dx, 0x5931
push ebx
push esi
test cl, 0x1f
bt si, cx
push edi
bsr edi, esp
sbb si, sp
mov edi, 1
and si, 0x5d35
jmp 0xd95e99
Function at 0xe34a84
Capabilities:
Encrypt data using speck

Disassembly:
lea ecx, [esp + ecx + 0x14]
lea edx, [edx + edx*8 + 0x42a345a8]
call fcn.0092f4f6

Function at 0xe39f19
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
dec eax
lea ecx, [esi*2 - 0x4d7fcef0]
inc dx
and ecx, dword [esp + esi*2 + 9]
inc ebx
mov dword [esi + ecx], edx
inc ecx
pop edi
pop esi
pop edx
jae fcn.00d6eae8
mov ecx, 0xd5ba9f8f
add ecx, 0x64166f91
xor bl, dl
or ecx, ecx
adc edx, esp
call fcn.00dd8371
inc dword [esp + edx + 5]
mov dword [esp + edx], ecx
add eax, 0xe836f5ad
or edx, 0xee9778a6
neg eax
bswap edx
inc dx
jne 0xe13ef8
dec edx
sal dword [esp + ebp*2 + 8], 0xfb
dec ecx
add edx, edi
dec ax
dec esp
mov ecx, edx
call fcn.00df9793
inc ebx
mov dword [ecx + esi*4 + 4], eax
jmp 0xd9cf9d
Function at 0xe3f9ce
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ror ecx, cl
xor byte [esp + ecx - 0x616e7bcf], 0x99
movzx cx, byte [eax + ecx - 0x616e7bd4]
mov word [ebp + edx*2 - 0x16e60004], cx
sub dword [esp + edx - 0xb72fffa], edx
lea ebp, [edx + ebp - 0xb730004]
movsx ecx, dl
not dword [esp + edx*4 - 0x2dcbfffc]
pop edx
pop edx
pop ecx
jne fcn.00a61cb3
mov eax, dword [esi + 4]
mov ecx, 0x98b0ef0b
add cl, ch
and edx, eax
sub ecx, 0x42a607a3
ror ecx, cl
not edx
mov eax, ecx
dec cl
mov dword [esi + ecx - 0x15d0aea7], edx
sbb al, cl
ja 0xddc7b7
mov dword [esp], 0xe0b5c31
and word [esp], ax
lea ecx, [eax + 0x586fa2b]
mov ecx, dword [edi]
jns 0xda83de
dec edx
not edx
bswap edx
movzx eax, cx
mov dword [esp + eax - 0xe1d0], eax
add eax, ecx
xor edx, 0x270ead1c
jmp 0xa77821
sub ecx, 0xf237032d
xor ebx, edx
add esi, edx
mov edx, ecx
sub dx, dx
not al
mov eax, dword [ecx + ebp - 0xb73dea9]
jge 0x93df02
or ax, ax
mov edx, dword [esp]
lea edi, [edx + edi - 0xe0b582c]
xadd eax, edx
xor dl, al
xor ecx, ebx
inc ecx
not ecx
neg ecx
lea ecx, [eax + ecx + 0x7116478]
xor ebx, ecx
sal ax, 0x2c
neg dx
xadd edx, eax
add esi, ecx
mov dword [esp + edx - 0x4e0aa630], esi
ret
mov edx, dword [edi + ecx - 0x15d0aeaf]
not al
shr eax, cl
lea edi, [edi + eax - 0x2ba19]
xor edx, ebx
jmp fcn.00a8a645
sub edx, edx
mov word [edx + ebp], ax
jne 0xa1ed9d
call fcn.00a89696
inc ecx
push eax
inc ebx
movzx eax, byte [edx + eax - 0x5a3d8d9a]
inc ebp
movzx ebx, ax
dec ebx
lea ebp, [ebx + ebx*8 - 0x7d6cc248]
inc edx
rol byte [esp + eax - 0x5a3d8d94], 0x63
xor al, bl
inc edx
inc dword [esp + eax - 0x5a3d8d95]
dec ecx
lea esi, [eax + ebp*4 - 0x667d35d6]
sub al, 0x8a
push esi
xor al, 0xad
mov dl, byte [esi + 0x34]
lodsd eax, dword [esi]
not al
inc ecx
sar al, 0xc1
inc dx
neg dword [esp + eax - 0x5a3d8dc5]
call fcn.00a29b27
mov ah, 0x48
mov bl, 0xb7
neg byte [ecx + 0x65]
in eax, dx
xor bh, dh
idiv byte [0xf730c53d]
xor bh, dh
not byte [0xf7309509]
test byte [ebp + 0x41], 0xc5
xor bh, dh
not byte [0xf730d101]
test byte [ecx], 0x29
jns 0xe3fa09
inc dword [edx - 0x2e87cfeb]
jo 0xe3fa12
je 0xe3fa38
xchg esp, eax
dec ebp
dec esp
aaa
imul ecx, dword [edx - 0x753c8ac9], 0x2e
push ecx
xor dword [edi + ebp*2], edi
or ecx, dword [esi]
mov bh, 0xf3
cmp eax, 0xb746413b
cmp eax, 0xb7727a51
cmp eax, 0xb72a2e40
cmp eax, 0x10f50715
sbb dword [ebx - 0x39ded5b9], esp
push esi
pop esi
retf 0x61a9

Function at 0xe44915
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
movzx edx, byte [edi - 5]
add edi, 0xfffffffb
mov ecx, 0xb2adb214
xor dl, bl
mov dword [esp], 0x250ebe88
inc dl
xor byte [esp + 4], ch
xchg dword [esp + 4], ecx
rol dl, 1
pop ecx
add dl, 0xb1
neg dl
add ecx, 0xf93eca09
or ecx, dword [esp + ecx*4 - 0x79362244]
adc dword [esp], 0x1fbf42b2
dec dl
sal cl, 5
sbb ecx, ecx
rol dl, 1
ror cl, 0x84
xor bl, dl
sub dword [esp + ecx*2], ecx
inc byte [esp + ecx*8 + 3]
sal cl, 0x46
lea edx, [esp + edx + 4]
neg byte [esp + ecx + 3]
mov dword [edx + ecx*8], eax
call fcn.00db0297
Function at 0xe4768b
Capabilities:
Encrypt data using speck

Disassembly:
call fcn.00d84b92
not al
mov ecx, dword [ebp + eax - 0x49946769]
bswap eax
call fcn.00a4c973
dec eax
arpl si, si
dec esp
mov dword [esp + edx*2 - 0x14800000], esp
dec eax
adc edi, esi
inc ecx
movsx ebp, dh
pop ebp
dec ecx
mov eax, dword [ecx + edx*2 - 0x147ffff8]
inc ecx
mov cl, byte [ecx + edx*8 - 0x51fffff0]
dec eax
shr eax, cl
dec esp
mov dword [esp + edx - 0xa3ffff8], esp
dec edx
mov dword [edx + ecx - 0xa3ffff6], eax
jmp 0xd4e994

Function at 0xe47ce9
Capabilities:
Encrypt data using speck

Disassembly:
lea edi, [edx + edi + 5]
or ax, ax
xor cl, bl
call fcn.00a8f242
sar dx, 0x61
xor ecx, ebx
mov dword [esp + edx], eax
inc ecx
sal word [esp + edx], 0x41
and edx, edx
neg ax
neg ecx
xor ecx, 0x3f0c3305
lea eax, [eax*4 - 0x66e34f6e]
sub ecx, 0xd7bd8f3f
xor ecx, 0x95a0fe08
sal eax, 0x6b
xor byte [esp + edx + 1], dh
xor ebx, ecx
ror al, 0xa1
adc esi, ecx
movsx ecx, dl
shr cx, 0x81
rol ax, 0x4f
xor cl, byte [edi + edx + 4]
inc ax
jne 0x9b13ec

Function at 0xe47d3e
Capabilities:
Encrypt data using speck

Disassembly:
inc esi
xor dword [esp - 0x18106cf9], esi
pop ecx
pop ebx
dec esi
lea ebx, [edi*2 - 0x4be321e2]
dec ebp
arpl si, si
mov ecx, 0xe0ae4523
dec ecx
add edi, esi
inc ecx
xadd bl, cl
dec ebp
lea edi, [ebx + ecx*4 + 0x430b8d85]
sal cx, 0xe6
dec edi
mov ecx, dword [ecx - 0x3020da02]
jns fcn.00d6eae8
ror ecx, cl
ror dx, 1
xor dx, 0x9e8e
call fcn.00933907

Function at 0xe4bad5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esi, ecx
movzx eax, byte [edi + edx - 0xfffb]
xor al, bl
movzx ecx, dx
sub al, 0x19
xor al, 0x29
add al, 0x2b
xor al, 0xb3
rol dl, 0x85
adc dl, 0x82
dec edx
xor bl, al
sal edx, cl
sal cx, 0x2c
push ecx
lea eax, [esp + eax + 4]
shl dx, 0xca
mov edx, dword [eax + ecx - 0xf000]
and dword [esp + ecx - 0xf000], 0x2da46c18
mov dword [ebp + ecx*2 - 0x1e004], edx
xchg byte [esp + ecx*4 - 0x3bffd], ch
add ecx, ecx
movzx eax, byte [edi + ecx + 5]
call fcn.00d64548
mov dword [esp + eax*2], eax
not ecx
lea eax, [eax + 0x69a4ab3c]
dec word [esp + edx]
xor ebx, ecx
pop edx
jmp 0xdbddad

Function at 0xe50035
Capabilities:
Encrypt data using speck

Disassembly:
sub cl, 0x80
shl eax, 0x67
xor cl, 0x3e
not cl
neg eax
sub cl, 0xbe
rol cl, 1
ror al, 0xc4
xor bl, cl
lea ecx, [esp + ecx + 8]
sal word [esp + eax - 0x72857f03], 0x47
mov byte [eax + ecx - 0x72857f08], dl
mov edx, 0x871ba49f
mov edx, dword [ebp + eax - 0x72857f06]
lea ebp, [ebp + eax - 0x72857f02]
rol eax, 0x22
movzx ecx, byte [edi + 5]
call fcn.00d9f3ac
Function at 0xe551cb
Capabilities:
Encrypt data using speck

Disassembly:
add ebp, ecx
movsx ecx, dl
mov si, word [ecx + esi]
mov dword [esp + eax*4 - 0x1bf40000], 0x5d14233b
rol dx, 0x6b
pop edx
jae fcn.00d89820
not ecx
dec ecx
add eax, eax
ror ecx, 3
pop eax
mov edx, 0xfeaafd06
inc ecx
movzx eax, dx
xor edx, eax
push eax
bswap ecx
bswap eax
not byte [esp + eax - 0x6fcfffd]
xor ebx, ecx
inc dword [esp + eax - 0x6fd0000]
jno 0x91ce3c
mov edx, 0x63b407af
sub dl, 0xbe
lea eax, [edx*4 + 0x132067a2]
mov ax, word [esi + edx - 0x63b407f1]
mov ecx, edx
xor cl, dh
shr cl, 0xc4
mov dx, word [esi + ecx - 0x63b4070d]
adc ax, dx
ror cl, 0x41
movzx edx, cx
shr dl, cl
mov word [ecx + esi - 0x63b40785], ax
movzx eax, byte [edi + edx*2 - 0xe03]
xor al, bl
rol dx, cl
add ecx, ecx
inc al
xor al, 0x82
and edx, edx
call fcn.00df6f7e
Function at 0xe5781c
Capabilities:
Encode data using base64

Disassembly:
dec ecx
lea esi, [eax + esi + 0x519e0655]
not ax
dec eax
not esi
inc ebp
xadd esi, eax
inc dx
sal dword [esp + eax + 2], 0x82
dec eax
xor ebx, esi
inc esi
xadd dword [esp + eax + 6], esp
dec ecx
ror ebx, 0x1a
dec ebx
mov dword [eax + ecx + 4], esi
jnp 0xe5814f
lds ebp, [eax + 0xfde370e]
mov dword [esi + 0x4afffac3], esi
dec edx
dec edx
xor dword [esp + eax*2 - 0x27fffe0], ecx
dec eax
bswap esi
inc ecx
pop edi
dec edx
lea esi, [esi + eax - 0x6b93d352]
dec eax
xor esi, 0x33283316
inc ax
jl 0xa15220
mov ebp, 0x96413f14
pop edi
stosd dword es:[edi], eax
xchg esp, eax
dec ebx
mov esi, 0x94ab7bb2
dec ebx
cmpsb byte [esi], byte es:[edi]
mov dh, 0x6f
stosd dword es:[edi], eax
xchg esp, eax
dec ebx
push 0xffffffffffffffda
arpl word [ebx + 0x366e4b94], bp
sub ebp, dword [ecx + ecx*4]
dec ebx
pop ebp
loope 0xe57811
mov ecx, esp
cli
xchg esp, eax
sub al, 0xb2
dec ecx
push ss
invalid

Function at 0xe5c06c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.00e0d45e
mov ebp, esi
shr edx, 0x78
movzx ebx, dl
mov ebx, eax
movsx eax, dl
mov edx, ebx
ror al, 0x27
shl edx, 2
mov eax, ebp
jmp 0xe6393a
dec ecx
bswap ecx
sar dword [esp + eax + 8], 0x3d
xor ecx, edx
mov dword [esp + eax], 0xa38c5218
sal word [esp + eax*8 + 8], 1
xor ebx, ecx
add esi, ecx
sub eax, dword [esp + eax*2 + 8]
sar al, 0x87
mov ecx, ebp
pop edx
pop edx
seta al
mov dword [eax + ebp - 4], ecx
pop ecx
js 0xa70778
lea ebp, [ebp + edx - 4]
sub cl, cl
xor eax, edx
bswap edx
jae fcn.00a61cb3
xor al, 0xae
mov edx, 0x278c209a
sar edx, 0x8e
add edx, edx
adc al, 0x2d
lea edx, [edx + edx*8 + 0x1126282]
sal edx, 0x69
xor bl, al
neg edx
xor dl, 0x3a
inc edx
push edi
push ebp
movzx ebp, dl
dec ebp
push ebx
rol ebp, 0xf1
ja 0xd64f49
jmp 0xa153cb
push 0xc3b5370c
call fcn.00e0fc8c
mov eax, 0xbf413c55
inc esi
ljmp 0xea66

Function at 0xe5de2c
Capabilities:
Encode data using xor

Disassembly:
inc ebp
lea esi, [esi + edx*8 + 0x23da7084]
dec ebp
xadd esp, ebx
inc ecx
rol esi, 2
call fcn.00e36acd

Function at 0xe60de0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Get number of processors

Disassembly:
dec word [esp + ecx - 0x2fb3e49c]
xor eax, 0x3c273405
inc eax
not eax
movsx edx, word [esp + ecx - 0x2fb3e49d]
push ecx
call fcn.00935cf2
add ecx, edx
not eax
adc cl, ch
sub eax, 0xc8b2491a
xor ebx, eax
rol edx, cl
sbb edx, 0x9d01953d
jp 0xa2dd55
call fcn.0093e6c8
mov eax, 0x3480b48c
mov eax, dword [edi + eax*2 - 0x69016917]
sub edi, 0xfffffffb
xor eax, ebx
mov ecx, 0x2fb3e49e
sub eax, 0x52259333
or cl, cl
jle 0xa7e236
hlt
Function at 0xe63190
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
not edx
inc ebx
mov dword [ecx + esi*4 - 0x80], edx
inc ecx
xor dh, 3
dec edi
lea ecx, [ecx + esi*8 - 0x100]
inc eax
setne dh
jmp edi
pop ecx
ror eax, 2
xchg byte [esp + edx - 0x640e3d8c], dh
sub eax, 0x362ea809
or dl, byte [esp + edx - 0x640ebd90]
ror eax, 2
movsx ecx, byte [esp + edx - 0x640ebd88]
xadd word [esp + edx - 0x640ebd89], dx
shl byte [esp + edx - 0x640ed85a], 0xa3
xor ebx, eax
add ebp, eax
xor dword [esp + edx - 0x640ed858], 0x80051aa7
sar ecx, 0xd2
mov eax, dword [esi + edx - 0x640ed85e]
dec word [esp + edx - 0x640ed85c]
mov ecx, dword [esi + edx - 0x640ed85a]
adc dl, dl
or dx, word [esp + edx - 0x640ed8bb]
not eax
not ecx
shr dword [esp + edx - 0x640efcb8], 0xe7
and eax, ecx
call fcn.00e21ee0
dec ecx
or esi, ebx
or edx, ebp
inc ecx
xchg esp, esi
rol esi, 2
jb 0xdec0d1
call fcn.00e08c81
ror dl, 1
mov eax, 0x948d3c8f
call fcn.00dd7db9
xlatb
inc edi
xor edi, ecx
jge 0xe6318a
sub al, 0xf7
push 0x6d
xchg ebx, eax
xchg ecx, eax
mov cl, 0xc0
psubusb mm7, qword [eax]
out dx, eax
xchg edx, eax
invalid
or al, 0xe8
mov esp, 0x81fffa05
xor edx, 0x6503553b
xor ebx, edx

Function at 0xe63256
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
or al, 0x54
inc ecx
inc ah
inc ecx
xor bl, ah
sal dword [esp + ebp - 0xedb6], 0xbf
or ebp, dword [esp + ebp - 0xeda0]
call fcn.00d8e01f
mov word [esi + 0x3c], ds
inc ecx
mov bl, 0x7a
loope 0xe6320f
invalid
dec ebx
xchg edi, eax
mov edi, 0x4b97e176
mov edi, 0x97e1229b
dec ebx
sub ebp, dword [ebx + 0x4b97e152]
out dx, eax
sbb dword [esi], 0x66
mov cl, byte [ebx - 0x68]
cwde
in al, dx
mov cl, 0xc3
loop 0xe63291
add bl, byte [edx]
dec ebp
jbe 0xe63261
inc esi
scasd eax, dword es:[edi]
push ebx
mov byte [0x83ba6d6f], al
mov byte [ebx + edx*2 - 0x2a3eb359], ah
cmpsb byte [esi], byte es:[edi]
pushal
sbb eax, eax
adc cl, al
test edx, esi
cwde
dec edi
cmp byte [edx - 0x32], cl
aam 0x15
invalid

Function at 0xe63c3b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec esp
mov ebx, dword [esp + 0x30]
mov ebp, 0x892e588f
sub di, bp
inc esp
movzx edx, di
dec esi
mov esi, dword [esp + edx - 0xcb8d]
call fcn.0099c41f
mov ax, word [esi]
mov edx, 0x9d38e804
movsx ecx, dl
call fcn.00d6e1a3

Function at 0xe673c6
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [edi + edx - 0x5a83c0eb]
xor eax, ebx
or dword [esp + edx - 0x5a83c0e0], 0x1b3b3027
pop ecx
xchg word [esp + edx - 0x5a83c0e6], dx
lea eax, [eax + edx*2 + 0x1788c432]
movzx ecx, byte [esp + edx - 0x5a8383be]
call fcn.009abdc0
rol dx, 1
inc ebp
mov edi, esp
call fcn.00a38a2c
Function at 0xe68a6c
Capabilities:
Authenticate hmac

Disassembly:
shr dx, cl
dec ecx
sar esi, cl
inc ecx
not bh
inc cl
inc ebp
or esi, ebp
inc eax
seta dh
inc esp
sbb bh, dh
inc ecx
add ch, dh
shl ebp, 0xad
call fcn.00dcc392
neg eax
inc ecx
neg esi
inc ecx
mov esp, 0x382d233e
dec eax
dec eax
sal esi, cl
inc cx
rol esi, 1
inc ecx
pop edi
dec eax
mov dword [esp + ecx - 0xdaf7], ebx
xor dword [esp + ecx - 0xdaf7], eax
inc ecx
pop ebp
not dl
pop ebx
inc ecx
not esi
dec ebp
xchg eax, ebp
neg ecx
dec eax
arpl ax, ax
inc ecx
sal dh, 0xa6
inc cl
dec eax
adc edi, eax
inc eax
shr dh, 0xe2
inc edi
movzx edi, byte [edx + esi*2 - 0x4506]
dec eax
sar ebp, cl
inc ecx
or ch, bl
dec edi
lea edx, [esi + edx - 0x2286]
inc esp
xor bh, bl
inc ecx
sub bh, 0x8a
inc si
inc ecx
xor bh, 0xad
jmp 0xd5d49c

Function at 0xe69291
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esi + eax*2 - 0x18003708], edx
movsx edx, al
mov ecx, dword [eax + edi - 0xc001b8d]
pop eax
sbb edi, 0xd
and edx, edx
xor ecx, ebx
pop eax
add eax, 0xfffe858f
jmp eax
jo 0xe695f1
xor edx, 0x6503553b
xor ebx, edx
neg cx
sal ax, 0x47
ja 0xdc54e4
mov eax, 0xbd9a9cb7
and al, 0x99
mov eax, dword [edi]
jle 0xdbd45a
xor cx, word [esp + eax - 0x15033e76]
not edx
xor edx, 0x90b18791
or word [esp + eax - 0x15033e76], cx
or dword [esp + eax - 0x15033e78], ecx
xor ebx, edx
add esi, edx
xor dword [esp + eax*4 - 0x540cf9e0], eax
mov edx, dword [ebp + eax*2 - 0x2a067cf0]
mov eax, dword [ebp + eax - 0x15033e74]
mov cl, byte [ebp + 8]
sal dword [esp], 0x57
add ebp, 6
push 0xcf13d489
call fcn.00d69a92

Function at 0xe69365
Capabilities:
Encrypt data using speck

Disassembly:
inc eax
rol dx, 0x21
jae 0x9a6e35
pop edx
xor eax, 0x19b5000c
dec eax
bswap eax
mov dword [esp + edx*4 - 0x37fc9288], 0x2e1a0317
jmp 0xddfd15
not eax
jmp 0xa1b723
add cl, 0x80
or ax, dx
mov edx, ecx
sar dword [esp + 4], 0xbb
add ecx, 0xa537da33
mov word [ebp + ecx - 0x50d2e7b3], ax
movzx eax, dl
inc al
mov eax, dword [edi + eax*8 - 0x408]
lea edi, [edi + ecx - 0x50d2e7af]
xchg byte [esp + ecx - 0x50d2e7ac], dh
mov word [esp + ecx - 0x50d2e7af], 0x24a2
pop ecx
xor eax, ebx
lea eax, [eax + edx - 0x768aa96b]
neg eax
sar dx, 0xa
jne 0xd87132
call fcn.00d7fa9e

Function at 0xe6943b
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using speck

Disassembly:
add eax, edx
mov dword [ebp - 4], eax
inc dword [esp + 8]
test ebx, ebx
lea esp, [esp + 0xc]
je 0xd53bbe
mov eax, 0x8a3142af
sub eax, eax
adc eax, dword [ebp + ebx*4]
call fcn.00d53bab
jmp 0xd7478d
push 0x982c5e35
push 0x9a3a5133
mov eax, dword [ebp]
lea esp, [esp + 8]
call eax
mov edi, 0x740a6806
mov ebp, dword [ebp + edi - 0x740a680a]
movzx edx, di
mov ecx, 0x8a09421c
xadd di, dx
mov dword [ebp + edx*4 - 0x1a018], eax
call fcn.0091df5a
mov dword [esp + eax - 0xffe11fa], ebx
xor eax, dword [esp + eax - 0xffe11fe]
push eax
sar ax, 0x83
mov ebx, edx
mov edx, ebx
sal edx, 2
not eax
rol eax, 0x98
mov eax, ebp
jb 0x9b7ec1
Function at 0xe6b260
Capabilities:
Encode data using xor

Disassembly:
inc ebp
mov edi, dword [edx]
mov eax, 0xb98b050a
mov ebp, eax
inc esp
xor edi, ebx
inc ecx
xor edi, 0x27bf3629
inc ecx
add edi, 0xe195c90
inc ecx
rol edi, 2
inc ecx
xor edi, 0xa00cc70c
inc esp
movsx esp, ch
inc edi
lea edi, [edi + 0x3298379c]
dec eax
lea ecx, [ebp + 0x46057f9b]
inc eax
and ch, 0x3e
inc ecx
not edi
inc esp
movsx esi, cx
dec ecx
add esi, 0xe4bcfeb7
dec ecx
sar esi, 0x7a
push ebx
ja 0x9b1fe6
inc esi
xor dword [esp - 0xa], edi
inc cx
ror esp, 0x4d
inc ecx
movzx ebx, si
inc esp
xor dh, bl
pop ebx
dec esi
lea ebx, [0x1f10d9a9]
dec ebp
arpl di, di
inc cx
sub ebx, 0x13491219
invalid
add ebp, eax
mov dword [esp + edx - 0x598c4df], ecx
movzx eax, byte [edi + edx*4 - 0x16631381]
not dword [esp + edx - 0x598c4df]
sub dword [esp + edx - 0x598c4df], ecx
sbb edx, 0xc89411ae
lea edi, [edi + edx - 0x3d04b335]
xor al, bl
rol edx, cl
jae 0xa2f478
dec ecx
sub edx, 4
jmp 0xe65c54

Function at 0xe6b675
Capabilities:
Authenticate hmac

Disassembly:
movsx eax, cl
xor ebp, ebx
not ebp
call fcn.00a2eebb
Function at 0x40cdc9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40cdd3
repz ret
jmp fcn.004135f9

Function at 0x413b3e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104a0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413bef
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ca0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ca0
push eax
call fcn.0041042e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041042e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041042e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041042e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413bef
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041042e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c47
cmp dword [0x423e2c], ebx
je 0x413c47
push eax
call fcn.004104a9
push dword [0x423e2c]
mov esi, eax
call fcn.004104a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c47
test edi, edi
je 0x413c47
call esi
test eax, eax
je 0x413c3e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c3e
test byte [ebp - 0xc], 1
jne 0x413c47
or dword [ebp + 0x10], 0x200000
jmp 0x413c80
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413c80
push eax
call fcn.004104a9
pop ecx
test eax, eax
je 0x413c80
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413c80
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413c80
push eax
call fcn.004104a9
pop ecx
test eax, eax
je 0x413c80
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104a9
pop ecx
test eax, eax
je 0x413ca0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ca2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10005a89
pop dword [ebp - 0x14]
mov eax, 0x8ed56370
sub eax, 0x7ed508e7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x78628e09
add dword [ebp - 0x24], 0xd5efb742
mov dword [ebp - 0x20], 0xb76ca73c
add dword [ebp - 0x20], 0x7ac6a509
mov dword [ebp - 0x1c], 0xf83ca773
add dword [ebp - 0x1c], 0x540f9cbb
mov dword [ebp - 0x18], 0xe65b7384
add dword [ebp - 0x18], 0x19a48c7c
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x48cfb01
add dword [ebp - 0x24], 0x6fe56e55
mov dword [ebp - 0x20], 0x4f34343b
add dword [ebp - 0x20], 0xf2382d3a
mov dword [ebp - 0x1c], 0x89c25ba2
sub dword [ebp - 0x1c], 0x2652ef36
mov dword [ebp - 0x18], 0x3a62edf1
add dword [ebp - 0x18], 0xc59d120f
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8aee5414
sub eax, 0x7aed93e8
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3948a
push 0
call eax
mov ecx, 0xbab5f76
add ecx, 0xf454eda0
mov edi, eax
mov edx, 0xacc5691d
sub edx, 0x9cc0f51d
add edx, dword [ebp - 0x14]
mov esi, 0xcfce1535
add esi, 0x27355ec9
mov dword [ebp - 0xc], 0xe1c77233
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0xebf1f075
add ebx, esi
sub dword [ebp - 0x10], edx
mov dword [edi], ebx
add edi, 0xe2dc1183
add edi, 0x1d23ee81
add edx, 4
loop 0x10005ba6
add eax, 0x4e81f16e
add eax, 0xb17f35bd
xor ebx, ebx
add ebx, eax
add eax, 0xde27b0d5
add eax, 0x21d84f30
mov ecx, 0xc86229b2
add ecx, 0x479dd64e
add ecx, dword [ebp - 0x14]
call ebx
leave
ret