joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11f5f6af
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xab36323f
dec ebx
push 0xd21d479b
push 0xd0074d9d
jmp 0x1341c8cf
lea esp, [esp + 0xc]
jne 0x133ae640

Function at 0x11f6ad55
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mul eax
imul edx
dec ecx
call fcn.11ff8e14
stc
clc

Function at 0x11f76e50
Capabilities:
Encode data using base64

Disassembly:
push 0x462db1bd
jmp 0x133ae636
push 0x8f24bd26
sal byte [esp], 0x81
mov dword [esp], eax
jns 0x1353c554
lea esp, [esp + 0x18]
je 0x1341c8d9
mov eax, 0x37b9c301
rol eax, 1
mov eax, dword [ebp + ebx*4]
jno 0x1201ec04
push 0xd2880fbb
mov eax, dword [ebp]
push 0x31176e8b
jmp 0x134e8de7
call fcn.11f5f6af
inc byte [esp + 2]
adc ebp, 4
xor edx, ebx
mov ecx, dword [esp + 4]
lea eax, [ecx + ecx + 0x5c9e6fb8]
xchg dword [esp + eax - 0x5c9c8eb2], ecx
rol edx, 1
and cl, cl
dec word [esp + eax - 0x5c9c8eb4]
xchg dword [esp + eax - 0x5c9c8eb4], eax
sbb edx, 0x8d90cc04
dec eax
rol edx, 1
xor ax, 0xc428
neg edx
sub word [esp + eax - 0xf7f45ac], 0x9a14
lea ecx, [ecx + eax*4 - 0x746bc1e4]
rol edx, 2
or dword [esp + eax*4 - 0x3dfd16be], 0x382a7824
setl al
lea edx, [eax + edx - 0x15174ca4]
xor ebx, edx
add esi, edx
mov dword [esp + eax - 0xf7f4501], esi
ret 4

Function at 0x11f7c051
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
imul ax, cx
jb 0x120913ec
Function at 0x11f8f3fd
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using speck

Disassembly:
sub dl, 0xa
mov dword [ebp], ecx
and ax, dx
rol eax, 0x97
movsx ecx, ax
jne fcn.13465885
mov cl, 0xe4
cmp al, bl
daa
aam 0x3f
scasd eax, dword es:[edi]
popfd
test dword [esi], esi
or esi, dword ss:[ebp + 0x20a84131]
push ebp
fistp qword [esi]
adc byte [edx - 0x58], dl
test byte [ecx + 0x5b], al
push edx
test al, 0x84
inc ecx
pop ebx
xor dword [edx], edx
jno 0x11ead7c7
inc esi
sub dword [ebx - 0x2a], 0x15
pop esp
in al, 0xa1
scasd eax, dword es:[edi]
or eax, 0x3d3938ed
ljmp 0xcd1
mov byte [edx + 0x2b8195f9], dh
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
xchg byte [esp + ecx*8 + 0x30], bl
loop 0x11ead762
pop edx
add ch, ah
mov ch, 0xe0
push ecx
in al, dx
sub al, 0x76
popal
jmp 0x11ead807
push 0xd2bb3e88
fnstenv [edi]
and al, byte [ecx + ebp*8 + 0x30]
push ebp
jns 0x11ead792
push esi
jecxz 0x11ead7c0
hlt
add al, 0xe8
fldl2t
jae 0x11ead82a
aam 0xe1
dec byte [ebx + 0x3189e6e4]
mov ch, 0xef
adc byte [edi + 0x467e885], ah
adc byte [ecx + edi*8 - 0x7174df6e], cl
sub byte [ecx - 0x7e], dh
pop ss
mov esi, 0x2f608541
test dword [eax + 0x2f], esp
pop esp
cmp dh, al
mov ecx, 0x3873d6c
cmp eax, 0xd951e34
xor ebp, dword [ecx + 0x36]
cwde
push edi
mul dword [eax + 0x1a8050a8]
stc
pop ecx
sbb dword [ecx + ecx*8 - 0x5ade91a2], ecx
in al, 0xae
mov bh, 0x95
jecxz 0x11ead82d
or eax, 0x9b40eac4
hlt
neg edx
bt eax, eax
xor ebx, edx
add edi, edx
movzx edx, al
neg ecx
jb fcn.120b5dc8
sbb ecx, ecx
sub eax, ecx
lea ecx, [ecx + edx*8 + 0x1222e48d]
shl dword [esp + ecx*4 - 0x4881d9ce], cl
not eax
xadd byte [esp + ecx*2 - 0x2440ece6], ch
xor ebx, eax
push edx
add ebp, eax
mov dword [esp + ecx*4 - 0x488001d0], ebp
ret 0xc
rol dx, 0xe4
rol ecx, 2
xor ebx, ecx
or edx, edx
mov dword [esp + edx - 0x1010], 0x8827f296
adc esi, ecx
cwde
ror eax, 0x54
lea edi, [edi + edx*2 - 0x2021]
movzx ecx, byte [esp + edx*2 - 0x2020]
or eax, 0x873bbd2d
mov cl, byte [edi + edx - 0x1010]
jl 0x12657aa1
dec ecx
bswap ecx
btr ax, 0x93
xor ecx, 0x41841e10
call fcn.1329dda3
imul ecx, ecx
lea edx, [edx + eax*8 - 0x7c142e1b]
setb cl
btc ecx, eax
rol edx, 2
rol al, 0x61
not edx
jno 0x11f230d5
xor cl, bl
sub dl, 0x8a
pop eax
xor cl, 0x2f
not dl
not cl
ror cl, 1
add cl, 0xb4
ror edx, 0xb9
idiv al
xor bl, cl
rol edx, 0xb9
and eax, eax
lea ebp, [ebp + edx*4 - 0x41e8]
not edx
jnp 0x11ead736
Function at 0x11fad2de
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
adc esi, 2
sub cx, cx
bswap ecx
sar cl, 0xc4
and ax, dx
shl ecx, 0xb0
movsx edx, cl
not ax
shl dl, 0x81
shl cx, 0xca
mov word [edx + esi], ax
lea ebp, [ebp + edx - 4]
mov ecx, dword [ebp + edx*2]
ror dl, 0x22
lea eax, [edx + edx*4 + 0x2597d2a3]
and eax, 0x3e01329b
xor ecx, ebx
imul dx
not edx
or eax, 0xc2b3b49b
xor ecx, 0x260c91ae
rol eax, 0x23
ror ecx, 1
ror eax, 0x7f
xor ecx, 0xfd3c2a9a
call fcn.121045be
sub eax, edx
xchg edx, eax
bswap ecx
dec ax
cdq
adc dl, ah
inc ecx
cdq
push edx
pop eax
xor ecx, 0x85a46b13
dec eax
xor ebx, ecx
add edi, ecx
xadd al, dh
movsx ecx, dl
shl cx, 0xa3
rdtsc
bts ecx, ecx
lea ebp, [ebp + ecx - 9]
shl ecx, cl
mov dword [ebp + ecx + 2], eax
mov dword [ebp + ecx*8 - 0x10], edx
jge fcn.11ec5778
call fcn.12671074
mov ecx, 0x6fa1d0a8
mov ecx, dword [edi + ecx - 0x6fa1d0a8]
mov eax, 0xb481b1bb
ror eax, 0xf3
jae 0x13423b73
mov ecx, 0x72accc95
lea edx, [ecx + ecx*8 + 0x1e26bd92]
movzx dx, byte [ebp + ecx - 0x72accc95]
mov cl, byte [ebp + ecx - 0x72accc93]
mov eax, 0xc2072f1e
and ax, ax
adc ebp, 2
cbw
shr dl, cl
movsx ecx, al
inc cx
mov word [ebp + ecx*8 - 0xf8], dx
mov edx, dword [ecx + esi - 0x1f]
lea esi, [esi + ecx*4 - 0x78]
sar al, 0xc5
not eax
xor edx, ebx
jmp 0x11f3ab2b
and ax, dx
and edx, 0xda43d2e
rol ecx, 3
xor dx, dx
neg ecx
jmp 0x11f6e8e1
xor dx, 0x4402
rol ecx, 1
bt eax, edx
btr edx, edx
xor ebx, ecx
btc edx, 6
add ax, dx
jno 0x13416eba
add ebp, ecx
movzx ecx, byte [edi + eax*2 - 0x36083e]
lea edi, [eax + edi - 0x1b041e]
call fcn.13548797
mov edx, 0xba9c11a4
mov ax, word [esi]
lea ecx, [edx + 0x6d11b02d]
jmp 0x1345af8b
lea edi, [edi + eax*2 - 0x6c6eed1c]
bt ax, 0x81
mov edx, 0x5591539d
not edx
xor ecx, ebx
bswap ecx
cbw
rol ecx, 3
btr edx, edx
lea ecx, [ecx + eax + 0x37fdfb78]
shr eax, 9
jns 0x12052bfb
mov ecx, 0x4fbc25b1
lea esi, [esi + ecx - 0x4fbc25b5]
mov ecx, dword [esi + ecx - 0x4fbc25b1]
mov eax, 0xcaae288c
movzx edx, ax
rol eax, 0x31
xor ecx, ebx
jmp 0x12019724
mov dx, word [esi + ecx*2 - 0x4f5b83a0]
dec cl
xor ecx, 0xb6173d08
ja 0x11f04ab7

Function at 0x11fca744
Capabilities:
Encode data using base64

Disassembly:
push 0xb25f4bf
lea esp, [esp + 0x20]
je 0x126608f2
push ebx
Function at 0x11fdc7b3
Capabilities:
Authenticate hmac

Disassembly:
xor edi, edx
and edi, 0xff
push 0x58a1d18a
mov edi, dword [edi*4 + 0x11fed838]
shr byte [esp], 0x61
jne 0x11ff20b8
mov dword [esp], edi
mov edi, 0xe09b63a6
dec edi
or edi, 0x7ca7209d
movzx edi, byte [ecx]
js 0x11fede5c
dec ebp
jbe 0x11fdc82c
or byte [esi + 0x74e3b594], ah
inc esp
add al, cl
sal ecx, 2
invalid
invalid
xchg ebp, eax
insb byte es:[edi], dx
sti
invalid
cmp ch, byte [0xf9c059fe]
popal
bswap edx
call fcn.11fc4ffb
jle 0x13340652
shr eax, 0x12
cwde
sal edx, cl
lea ecx, [eax*8 - 0x49def7ce]
mov dword [esi + eax*2], edx
lea ebp, [ebp + eax*2 - 4]
div byte [esp + eax + 2]
add eax, dword [eax + ebp]
xor eax, ebx
btc ecx, ecx
neg cx
sal dword [esp + 4], 0x13
adc eax, 0x137e101
movsx edx, cx
dec word [esp + 2]
sub dword [esp + 2], edx
ror eax, 1
bt ecx, 0x99
dec dl
mov dword [esp + 4], edx
neg eax
rol eax, 3
add dword [esp + 4], ecx
inc eax
rol word [esp + 2], 0xec
inc word [esp + 4]
ror edx, cl
ror eax, 2
not eax
call fcn.12082d1d
jae 0x13285bb6
jno 0x125f74d0
shr edx, 8
push 0x9a983c3c
shr byte [esp + 5], 0xa1
shr byte [esp + 1], 0xe7
xor edx, edi
dec dword [esp + 4]
inc ecx
sal dword [esp], 5
jns 0x134f75d1
shl dword [esp], 0xda
adc eax, edx
neg byte [esp]
ror word [esp + 2], 0x61
rol byte [esp + 1], 0x46
mov dword [ebp - 4], eax
je 0x133d133c
mov eax, 0xee8bb29c
pop edi
mov eax, 0x6732293d
not edx
shr al, 1
mov ecx, eax
mov dword [eax + esi - 0x6732291e], edx
mov eax, dword [edi + ecx - 0x6732291e]
bt ecx, ecx
lea edi, [edi + ecx - 0x6732291a]
mov edx, 0x26364b28
xor eax, ebx
xadd cl, dl
dec cx
bswap eax
neg eax
not eax
call fcn.11f5d9ce
syscall
push ebx
dec eax
mov dword [esp], 0xc144fcee
call fcn.1209b52e
sub eax, 0x472a7935
ror ecx, cl
xor ebx, eax
add esi, eax
rol cx, 0x63
add word [esp + edx - 0x5fffffff], 0xb688
shr dl, 0xa1
xor dx, word [edi + edx - 0x60000000]
movsx eax, cl
ror byte [esp + 3], 0x26
imul ecx, eax
mov ax, word [edi + ecx*2 - 0x792c0000]
rol dword [esp + ecx - 0x3c960001], 0x85
mov cl, byte [edi + ecx*2 - 0x792bfffe]
push 0xd28481ad
ror dword [esp + 3], 0x8f
adc edi, 4
or dword [esp + 3], 0xcfa23c09
shr dword [esp + 4], 0xd
rol byte [esp + 5], 0xc4
shrd dx, ax, cl
mov eax, 0xb300d69f
sal dword [esp + 3], 0x36
cwde
mov word [edi], dx
setp byte [esp + 7]
pop ecx
pop eax
jmp esi
call fcn.134dd9c5
ja 0x11eb106c
call fcn.133372b6
add word [esp + 6], 0x86
xor edx, 0xc5825c2b
shl word [esp + 3], 0x4f
or dword [esp + 4], 0x4068a0b
dec eax
lea esp, [esp + 8]
jne 0x11fdc7b7
jmp 0x120fdc4d
Function at 0x11feb74e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
bt ecx, 0x1a
adc esi, eax
mov dword [esp + edx - 0x16240085], 0xe086e437
lea edx, [edx + edx*8 - 0x36de871]
mov di, word [ecx + edi - 0x42ea4dbc]
sub edx, dword [esp + ecx - 0x42ea4db9]
rol dl, 0xe2
and dword [esp + ecx - 0x42ea4dba], 0x9424ac0e
pop ecx
pop eax
jp fcn.12693695

Function at 0x11feb78b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jle 0x13479af4
lea eax, [ebp + ebp - 0x6e73f94a]
mov ebp, edi
sal edx, 0x13
movsx ebx, ax
mov ebx, ecx
or edx, edx
div eax
or edx, ebx
sal edx, 2
shr eax, 0xd6
btc eax, 0xa0
mov eax, ebp
adc eax, edx
jmp 0x1343f454
mov byte [esp + 7], 0xb1
and esi, 0xff
mov esi, dword [esi*4 + 0x11fdff34]
inc dword [esp + 4]
shr edx, 8
sub dword [esp + 4], 0x10122607
jno 0x11f67054
not ecx
sar dl, 3
lea ecx, [ecx + edx - 0x7ad1189d]
shr edx, 0x54
push eax
ror ecx, 1
sub eax, 0xda08ba5
xchg dh, al
bt eax, 0x32
xor ebx, ecx
add edi, ecx
inc edx
movsx ecx, al
sal al, 0x82
mov edx, dword [edx + ebp - 0x7de3]
shl al, 0x86
sbb al, cl
mov eax, dword [ebp + ecx + 3]
jne 0x133db8ab
lea ebp, [ecx + ebp + 7]
pop ecx
sub ecx, ecx
sub cl, 0x18
mov dword [ecx + edx - 0xe8], eax
jmp edi
push 0x9bb0a93
add byte [esp + 1], 0x16
mov dword [ebp - 4], eax
rol byte [esp + 1], 0xc7
call fcn.11ef25ad
mov edx, 0x608af9aa
movzx eax, dx
mov dx, word [edi + edx - 0x608af9aa]
call fcn.125e81b2

Function at 0x11ff100f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
adc ebp, 6
call fcn.12065aa1
push ebp
pushfd
mov ebp, 0x4016b33e
bswap ebp
add ebp, 0x2d20ec20
push edx
bswap ebp
mov ebp, dword [esp + ebp - 0x6002d463]
mov dword [esp + 8], 0xdd9bbb89
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.11eb8f1a
mov eax, 0xab127923
mov edx, dword [esi]
add esi, 4
push eax
btc ax, ax
xor edx, ebx
pop eax
movsx ecx, ax
bts ecx, eax
rol edx, 3
inc edx
ror ecx, cl
sbb cl, 0x3e
ror ax, 0x23
bswap edx
sbb ax, ax
sbb cx, cx
ror cl, 4
lea edx, [edx + ecx*8 - 0x61df37dc]
sub ecx, eax
shr cx, 0x23
xor ebx, edx
cbw
add edi, edx
movzx edx, ax
mov bp, word [ebp + edx]
shl dx, 0xc1
jle fcn.133fa0f5
fld qword [esi]
mov eax, 0xd531cb1a
cbw
mov ecx, dword [edi]
sar eax, 0x89
mov edx, eax
adc edi, 4
mul dl
xor ecx, ebx
cwde
inc ecx
imul dl
sal al, 0x83
bts eax, 0xa6
rol ecx, 1
call fcn.11f0129f
mov ecx, 0xbab3ee1f
movsx eax, cl
bt ecx, ecx
mov ax, word [ebp + eax*8 - 0xf8]
shl cx, 0x2a
mov dx, word [ebp + 2]
sbb cl, cl
btr cx, 8
call fcn.126aca05

Function at 0x11ffd764
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x14]
je 0x133d566a
jmp 0x13518fc4

Function at 0x120091c5
Capabilities:
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck

Disassembly:
dec eax
mov ebp, dword [esp + edx + 0xa8be]
dec eax
mov dword [esp + edx + 0xa896], edx
dec eax
mov edx, dword [esp + edx*4 + 0x2a258]
pop eax
jmp 0x13285bd5
Function at 0x12065868
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
bts ecx, 0xb7
xor bl, al
imul cx, dx
imul edx, ecx
sar dl, 0x84
lea eax, [esp + eax + 0xc]
add edx, edx
rol ecx, 0x62
js 0x1356b21e
mov ecx, dword [edx + eax]
push edx
lea ebp, [edx + ebp - 4]
mov dword [ebp + edx], ecx
pop edx
call fcn.1335a698
xor ebx, ecx
cdq
mov word [esp + eax*2 - 0x64fa1ff8], ax
add edi, ecx
mov dword [esp + eax - 0x327d1000], eax
ror dl, 0xa5
lea esi, [edx + esi - 1]
sbb byte [esp + edx + 0xa], ah
mov ecx, eax
or ax, dx
movzx eax, byte [esi + eax - 0x327d1000]
xor al, bl
bt ecx, ecx
sal cx, 0xc1
ror al, 1
inc al
xadd edx, ecx
ror al, 1
inc dword [esp + ecx*2 + 7]
not al
jns 0x1205d926
inc ecx
mov esp, 0xce127d27
inc ebp
mov esp, dword [ebp]
inc ecx
mov eax, 0xb7091001
inc ebp
movsx esi, al
dec edi
lea ebp, [esi + ebp + 3]
inc ecx
movzx edx, si
inc ebp
xor esp, ebx
inc edi
lea esp, [esi - 0x6c1b2103]
inc esp
mov ecx, edx
jmp 0x12068867
mov eax, edx
inc ecx
ror esp, 2
dec eax
sub edx, eax
inc edi
lea esp, [esp + eax - 0x5d021b4c]
inc ebp
add ecx, ecx
inc ecx
rol esp, 1
movsx edi, al
inc cx
mul ecx
movsx ecx, dx
inc ecx
push ebx
movsx ebx, al
inc esi
xor dword [esp + esi - 1], esp
inc ecx
pop ebx
dec eax
cwde
dec ebp
arpl sp, sp
dec esp
or ecx, ebx
dec ecx
adc esi, esp
dec ecx
neg ecx
inc esp
mov esp, edx
jb 0x12628fe6
inc edi
movzx edx, word [ebp + esi*4 - 4]
inc esp
movzx edi, bl
sbb dl, bl
dec esp
add ebp, eax
dec eax
cdq
dec eax
xor edx, 0x8297d0a
inc bp
xor edx, ebx
bts di, ax
inc cx
not edx
shl ebx, 5
shr cx, 0xcb
dec ecx
sbb esi, 0x72a09bc
inc bp
sbb edx, ecx
inc cx
rol edx, 1
inc cx
add edi, esi
setb al
inc cx
xor edx, 0x8149622a
les ebx, [edx + 0x66d2b10a]
inc ecx
rol edx, 1
inc cx
add edx, 0xab0fd5bc
cli
shl ecx, 0x4b
btc dx, 0xb9
inc bp
xor ebx, edx
inc ecx
bswap ecx
inc ecx
and al, 0xb2
dec ecx
shl esi, 0xdb
dec esp
add edx, esp
inc ecx
inc bh
dec ebp
xchg esi, eax
dec ecx
add ecx, dword [edx + edx - 0x8297f0a]
dec esi
lea edx, [edx + ecx - 0x16662b4b]
dec eax
lea ebp, [ebp + edi*2 - 0x1ec9c]
dec esp
bts edx, eax
dec eax
mov dword [ebp + edx*2 - 0x1052fe16], ecx
movsx ecx, al
jae fcn.13567311
Function at 0x1207862f
Capabilities:
Encode data using xor

Disassembly:
not ecx
mov dword [esp + edx - 0x4905], eax
mov dword [edi + edx*2 - 0x920a], ecx
lea ebp, [eax + ebp - 0x75374909]
inc eax
dec word [esp + eax - 0x75374906]
imul byte [ebp - 1]
dec dword [ebp - 0x4908d754]
enter 0x408a, 0x66
dec dword [esp + eax - 0x75374906]
neg dword [esp + edx - 0x4905]
mov ecx, dword [eax + ebp - 0x75374906]
xor ecx, ebx
dec dword [ebx - 0x4905d774]
enter 0x338a, 0xffffffffffffffcb
push eax
lea eax, [eax*8 + 0x5d06d71e]
cdq
rol ecx, 3
cwde
idiv byte [esp + eax - 0x1f4b]
bswap eax
not ecx
cdq
bt dx, 0xac
rol ecx, 2
inc edx
jg 0x1352669c
inc esp
movsx esp, al
dec ecx
or edi, 0x3028f13c
inc ecx
neg edx
call fcn.134dffc6
jo 0x1207863b
test esp, 0x92fb73b2
push cs
daa
inc eax
shr byte [edx], 1
xchg edx, eax
je 0x12078655
salc
nop
or dword [ecx], esi
pop esp
salc
insd dword es:[edi], dx
mov eax, dword [0x4d6ddd1f]
sub esp, dword [ecx + 9]
outsb dx, byte [esi]
wait
add dh, dl
insb byte es:[edi], dx
and eax, 0x4ed88092
invalid
bswap ecx
lea eax, [edx*8 - 0x5373787f]
neg ecx
sal dword [esp + edx + 1], 0x6e
lea ecx, [edx + ecx - 0x63cc422]
ror ecx, 3
not eax
sal eax, 0x8d
bswap ecx
setnp al
cbw
div eax
xor ebx, ecx
add esi, ecx
movsx ecx, dx
call fcn.12018603
mov edx, 0x63010a3d
mov esp, ebp
popfd
mov eax, edx
pop esi
movsx ebp, ax
mov edi, eax
pop ebp
bswap edi
call fcn.134fdf0d
mov edx, 0x7e99a026
call fcn.125f3c33

Function at 0x1207c369
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ebx, edx
add ebp, edx
mov ecx, dword [esi + ecx - 0x36bcc780]
mov dword [esp], eax
mov eax, dword [esi + 4]
call fcn.133541b7

Function at 0x1209f0cc
Capabilities:
Execute syscall

Disassembly:
xor edx, ebx
cwde
ror ecx, 0x9f
xor byte [esp + eax*2 + 1], ah
inc edx
or ax, cx
bt ecx, ecx
imul eax, dword [esp + eax]
neg edx
rol edx, 1
xchg ecx, eax
cbw
bswap edx
push eax
lea edx, [edx + eax + 0x6caa459d]
btc ax, ax
rol cx, 0xa6
xor ebx, edx
xchg cx, ax
add esi, edx
push ecx
sar word [esp + ecx*2 + 6], cl
lea edx, [eax - 0x5fcaa35e]
mov dword [esp + eax*2], esi
ret 8
lea esi, [edi*2 - 0x43f3a978]
lea edi, [esp + edi*2 - 0x1b556]
jae 0x11fd6665
mov dword [esp + eax - 0xd8ab], edx
sub ax, cx
mov ebp, dword [esp + eax - 0xfde2]
and esi, ecx
not cl
ror ebp, 2
neg ebp
inc ebp
bswap ebp
jmp 0x13232f27
lea ebp, [ebp + esi + 0x23c2a3e9]
bts ecx, 0x98
push esi
not word [esp + eax*8 - 0x7f007]
adc ebp, edx
and eax, dword [esp + eax - 0xfe01]
mov dword [esp + eax - 0xcddc], ebx
btc eax, ecx
lea ecx, [eax + edi - 0x40ced8]
mov esp, ecx
rol ebp, 2
sub esi, ecx
setnp al
jl 0x1322191a
Function at 0x120c11ed
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x84351602
push 0x82b1683b
mov ecx, dword [esi]
mov edx, 0xe280dc8e
inc dl
mov eax, dword [esi + 4]
setg byte [esp]
add esi, 8
mov dword [ecx], eax
dec edx
jp 0x11fe26d7
inc ebp
xor eax, ebx
inc ecx
movzx ecx, di
dec esp
lea edx, [ecx*2 - 0x255a1b79]
inc ecx
movsx ebx, dl
inc ecx
dec eax
dec edi
lea edi, [edx + edi*2 - 0x2862404a]
inc ebp
add esi, ecx
dec edx
lea eax, [ecx*2 - 0x2c8c3d8]
inc ecx
ror eax, 1
inc ecx
dec eax
jmp 0x13539de9
jmp 0x1349aa59
dec eax
rol eax, cl
inc ecx
not eax
inc ecx
rol eax, 2
cwde
inc ecx
push ebx
ror cx, 0x63
dec eax
cdq
dec ebp
and edi, edi
inc esi
xor dword [esp + ecx - 0x90b1], eax
inc cx
dec esi
not di
inc ecx
pop ebx
shl ax, 0x69
dec ebp
arpl ax, ax
idiv bl
dec ecx
add esi, eax
inc ecx
shr cl, 0xc2
dec edx
mov eax, dword [ebp + ecx*2 - 0x12058]
dec edx
lea ecx, [edx + esi - 0x75c90f6f]
dec ecx
bswap esi
inc esp
mov eax, edx
inc esi
mov ecx, dword [eax + ecx*4 - 0x240b0]
inc esp
sub dh, cl
ror dl, 0xc1
inc ecx
add ecx, eax
dec edx
lea ebp, [ebp + edx*2 + 0x4ab1f436]
inc esp
bt ebx, esi
sar ecx, 0xdc
dec esp
lea edi, [edx + ecx*4 - 0x7ffbd5fa]
inc ebp
mov dword [edi + ebp + 0x7ffbd5ea], ecx
dec ebx
lea eax, [eax + edx*2 - 0x44db03cd]
dec eax
or edx, esi
jmp edx
shl ax, 0xa4
add esi, edx
shr ax, 0xc6
setb al
lea ebp, [eax + ebp - 0x64040103]
xadd eax, ecx
movzx edx, word [ebp + eax - 0x3e7c1501]
jne 0x133d1efe
setne bl
inc ecx
xor eax, 0x4392398b
movsx edi, bl
inc ecx
neg eax
inc di
xchg ecx, eax
inc edi
lea eax, [ecx + eax + 0x191ed8dc]
inc ecx
movzx edx, di
inc ecx
ror eax, 3
inc ecx
inc cl
inc eax
setp bh
inc ecx
bswap eax
bts di, 0xbf
jae 0x13285c9d
inc edi
lea eax, [esi + eax + 0x93415da]
jb 0x1344794a
mov edx, 0x55bc0aa1
movsx eax, dl
cwde
lea ebp, [ebp + edx - 0x55bc0aa5]
bt eax, edx
btr ax, 0x82
movzx ecx, dx
mov edx, dword [ebp + ecx*2 - 0x1542]
sub cl, 0x87
sub ecx, ecx
xor edx, ebx
ror al, 1
inc ecx
bswap edx
lea eax, [eax + 0x6404b526]
imul ecx, eax
imul ax, ax
not edx
xadd cx, ax
lea edx, [edx + eax*2 + 0x2609202b]
ror cl, 0x27
rol edx, 3
lea ecx, [ecx + eax*8 - 0x2dd6dcef]
add ecx, 0x8424b806
inc ecx
xor edx, 0x8a831f11
sar cl, 0x67
xor ebx, edx
jmp 0x12614225
Function at 0x120c85be
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea eax, [eax + edx*2 - 0x6d87e886]
not ecx
xor ebx, ecx
imul dword [esp + eax - 0x33a7cb7b]
add ebp, ecx
cdq
mov dword [esp + eax - 0x62080000], ebp
ret 8
sal dword [esp + 4], 0x53
and dx, dx
inc ecx
push edx
cwde
not ecx
not dword [esp + eax - 0x5b60]
lea eax, [edx + eax + 0x33a79936]
xadd al, ah
neg ecx
inc edx
jp 0x11f1d811
bts ecx, ecx
add word [esp], 0x6ca7
xor eax, ebx
lea eax, [edx + eax + 0x529b70ce]
sar edx, cl
imul edx, dword [esp]
neg eax
push edx
rol eax, 3
or ecx, 0x25375c05
xor eax, 0x9a95c709
pop ecx
ror cx, 0x85
lea edx, [ecx*2 + 0x7d218602]
xor ebx, eax
add esi, eax
mov eax, dword [edi + ecx - 0x35827a6d]
push ecx
btc cx, cx
mov cx, word [ecx + eax - 0x35825a6d]
adc edi, 1
jmp 0x13541177
sub al, byte [esp + eax - 0x3cb64929]
xor dl, bl
sal eax, 0x5e
not dl
mov dword [esp + eax], eax
jnp 0x1203d249
adc al, ah
ror dl, 1
or eax, eax
ja 0x134be043
xor dl, al
add dl, al
or eax, eax
sar eax, 0x8b
bts eax, 0x80
xor dl, 0xb9
xor bl, dl
sal ax, 0xc
mov dword [esp + eax - 0xffc], edi
adc dword [esp + eax - 0x1000], ebp
not al
movzx ebp, al
lea ebp, [ebp*2 + 0x3a33060b]
push ebx
mov ebp, esi
ror eax, 0xb3
ror al, 0xe7
mov ebx, edx
sal al, 0xc3
movzx edx, ax
mov edx, ebx
ror eax, 0xe6
dec eax
shl edx, 2
shr eax, 0x34
shr ax, 0xe1
or eax, ebp
push 0x7f1478a4
shl word [esp], 0x62
jae 0x11eda2c5
add eax, edx
ror byte [esp], 0x63
call fcn.133471a5
pop eax
iretd
lea eax, [edx*8 - 0x2b79255a]
cdq
mov word [edx + edi], cx
mov dword [esp + edx*2], esi
ret 4

Function at 0x120d8d48
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sal edx, 0x2f
mov dword [esp + edx*2 + 0x10], ebx
cpuid
jbe 0x1333c781
ja 0x120658a1
mov dword [esp], 0x378176a2
sbb esi, 8
mov dword [esi + 0xc], eax
mov eax, 0x629de89b
ror dword [esp + eax - 0x629de88f], 0xe4
bt eax, eax
mov dword [esi + eax - 0x629de893], ebx
mov ebx, eax
sar byte [esp + eax - 0x629de89a], 0x27
mov dword [eax + esi - 0x629de897], ecx
mov dword [esi + ebx - 0x629de89b], edx
movsx ecx, bx
lea edx, [ecx*4 - 0xa52c47e]
mov ebx, dword [esp + ebx - 0x629de88b]
neg eax
rol dl, 0x47
pop edx
pop edx
pop ecx
pop edx
pop eax
jp fcn.1342bca5
add bl, dh
ret

Function at 0x120eac30
Capabilities:
Encode data using xor

Disassembly:
bts eax, eax
neg ecx
mov dword [esp + eax*2 - 0x4004aa], eax
bswap ecx
pop edx
push eax
dec ecx
dec word [esp + eax*2 - 0x4004a9]
or ax, word [esp + eax - 0x200253]
bt ax, ax
rol ecx, 1
sal edx, 0xbf
shr word [esp + eax - 0x200270], 0xc7
lea ecx, [ecx + eax*4 + 0x792c8bda]
cdq
xor eax, dword [esp + edx*8]
call fcn.11f1083e
invalid

Function at 0x120fefaf
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xbabd5c8f
xor edi, ecx
call fcn.132bb54f
Function at 0x125da866
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shl word [esp + 1], 0x6c
call fcn.11eb9b73
mov eax, dword [ecx + ebp - 0x78abda7]
inc edx
lea edx, [edx + 0x678ea534]
xor edx, ecx
xor eax, ebx
sub cx, 0xdc11
sbb eax, 0x7c142e1a
xor ecx, 0xe1bd6ea6
rol eax, 2
bts edx, 4
not eax
push ecx
neg eax
xor ebx, eax
btc ecx, ecx
sal dl, 0xa3
add edi, eax
lea eax, [ecx*2 - 0x4cdef7f8]
btc eax, 0x91
lea ebp, [ebp + edx - 0x600419d9]
xor dx, cx
movzx eax, byte [ebp + eax - 0x7f8c2668]
xadd dl, cl
xor al, bl
dec al
xor cx, cx
ror al, 1
call fcn.1344c11f
mov eax, 0xc08e7632
cdq
btc eax, eax
sbb ebp, 3
cwde
xor edx, 0x8905182f
cdq
add edx, dword [ebp + eax*8 - 0x3b190]
cwde
dec eax
xor eax, 0x5d00ae9e
xor edx, ebx
sar al, 6
not edx
mov ecx, eax
jne 0x134442c9
sub dx, di
inc cx
movzx ebx, byte [esp + eax - 0x37000183]
cwde
call fcn.1266d648
push 0xef190f37
add eax, edx
sar dword [esp], 0xa8
mov dword [ebp - 4], eax
js 0x11f6b5af
xor eax, 0xedd1180a
cmp eax, 0x4e1225ea
sbb ebx, dword [ebx]
rcr dword [ecx + 0x597e2c08], cl
and dl, byte [eax]
push ds
cmc
adc eax, 0x57483ef5
add al, cl
imul edi, dword [ebx + 0x27], 0xfffffff8
cmpsb byte [esi], byte es:[edi]
mov al, 0x20
lodsb al, byte [esi]
mov ebx, 0x351f1b18
mov eax, 0xace62c2e
adc ecx, dword [ecx + ecx*2 - 0x25]
popfd
cmpsb byte [esi], byte es:[edi]
inc eax
xor byte [eax], 0x9d
jae 0x125da856
push edi
jge 0x125da888
in eax, 0x55
ret
shr ax, 0x85
dec edx
neg edx
lea edx, [edx + ecx - 0x6388f081]
sub al, cl
sar eax, 0x63
xor ebx, edx
cwde
neg cx
add edi, edx
rol cl, 0x67
sal eax, 0xbe
mov edx, dword [eax + esi - 0x40000000]
and ax, 0x5d9d
not ax
mov ecx, dword [esi + ecx - 0x5d0026fd]
push eax
bts eax, 0x15
setb al
lea esi, [eax + esi - 0x4020fef8]
shl ax, 0x2d
call fcn.133c49ba