joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455585
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45569d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45569d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046c190
mov esi, eax
test esi, esi
je 0x45569d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45569d
mov ecx, esi
call fcn.00455510
cmp edi, eax
jge 0x45569d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x455623
mov dword [esp + 0x34], 1
jmp 0x45567e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45569d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00454a40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46cb33
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46cb6b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046abea
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046abc2
jmp 0x46cb77
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46e22d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46e26f
call fcn.00473cdd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46e26f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46e266
xor eax, eax
jmp 0x46e277
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046e27d
pop edi
pop esi
pop ebx
ret 4
Function at 0x47420d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47423b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x474259
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00474173
jmp 0x474259
mov eax, dword [esi + 0x14]
test eax, eax
je 0x474259
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00474173
test edi, edi
mov eax, edi
jne 0x474243
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4011f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40414d], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401238
xor eax, eax
jmp 0x401253
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4025a0
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x404240
push ecx
jmp fcn.004025ab

Function at 0x40c15a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x40c15a
lcall 0x5de5, 0x8b10c483
jmp fcn.007ff5f0
Function at 0x2720266
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xff211c88
mov ah, 0xfe
sbb bl, ah
clc
and byte [edi], dh
pushfd
push sp
les ebp, [ecx]
lea ebp, [ecx - 0x49]
mov byte [ebx - 0x79ad5e14], dl
scasb al, byte es:[edi]
xor al, 0x78
test byte [esi - 0xd], 0xf
mov esp, 0x36d8e43a
xor byte gs:[eax - 7], al
jmp 0x50f0804f
mov dword [esp + 4], edi
mov byte [esp], 0xa2
call fcn.024352c4
inc ecx
pop ds
jo 0x211e23b
or al, 0x45
mov bh, 0x41
inc ecx
sbb esp, dword [eax + ecx*2]
loope 0x211e1ac
inc esi
mov ch, 0xa0
cli
xor dword [ebp + 0x12], 0x5c
imul edi, dword [ecx + 0x4a3e054b], 0xc9eb7a7e
jb 0x211e218
invalid
jle 0x211e2af
add byte [ebx], bl
mov dl, 0x35
add edi, dword [eax]
dec edi
dec ecx
cwde
xchg edi, eax
sbb dword [eax + 0x36fb72fe], 0x4aa9e98c
pop eax
fnstcw word [edx]
lds ebp, [ebx]
scasd eax, dword es:[edi]
salc
retf 0xe9e5
stosb byte es:[edi], al
add ah, byte [ecx - 0x6b]
outsd dx, dword [esi]
dec edi
mov edx, 0x895f0dd1
lodsb al, byte [esi]
or esp, ebp
sub byte [ebx], 0x37
add dword [ebp - 0x234e46b3], esi
mov ebx, 0xc50116f4
fdivr qword [ebx - 0x3afee90c]
lodsb al, byte [esi]
sub eax, 0xb0ba0f5
scasd eax, dword es:[edi]
aas
pushfd
mov dl, 0xb3
test eax, 0xe758461
pop edx
or bh, byte [edx + 0x196997]
je 0x211e2e7
salc
push ecx
invalid
fdiv dword [edx + 6]
adc ebx, eax
mov ebx, 0xe189c810
call 0xd4c69d56
jns 0x211e376
or byte [edi], bh
jle 0x211e302
pop edx
jg 0x211e299
rcr byte [ecx + 0x4b591ebe], cl
push ds
pop ecx
dec ebx
wait
cwde
mov bl, 0xf4
pop ebp
stc
sub dword [ecx + 0x635cb332], esi
stosd dword es:[edi], eax
pop eax
invalid
mov ebx, 0x9a436ad0
invalid
xchg ebp, eax
mov byte [0x4c0627e0], al
mov edx, 0xf648fbc6
shl al, 1
push ebp
cmp eax, 0xaa05ac41
sub al, 0xc1
xor dword [eax + 0x3aa345c5], esi
push esp
mov gs, eax
and al, 0x64
cmp dword [esi + 0x77], 0xa99b3527
mov byte [0x95983f1c], al
xchg ebp, eax
stc
arpl word [eax + 0x2e], cx
std
add ebx, dword [eax + ecx*2 - 0x32]
pop esi
dec ecx
jle 0x211e377
leave
pop ebx
mov dword [0x7776f3b0], eax
in eax, 0x63
jnp 0x211e3ee
fstp st(1)
leave
cdq
xchg edx, eax
xor esi, esi
ljmp 0x7070
jo 0x211e36a
mov dword [0x76c19cb], eax
enter 0x56a9, 0x76
retf 0xc91b
sahf
mov ch, 0xbd
shr byte [eax], 1
stc
lodsb al, byte [esi]
push esi
fldcw word [ebp - 0x67]
adc dword [eax + 0x36881ea5], esi
pop ss
int1
out 0x1e, al
jae 0x211e435
jbe 0x211e3a1
mov esp, 0xd01b1148
sar dword [edi], 0x48
mov esp, 0x9e1f7e12
pop eax
jmp 0x211e3ef
cmpsd dword [esi], dword es:[edi]
pop esp
mov dh, 0x15
js 0x211e44c
add esi, ecx
cwde
pushfd
add eax, 0x154737d9
loop 0x211e3c8
pop eax
dec esi
jne 0x211e497
xchg edi, eax
inc eax
sbb ch, byte [ebx - 0x5e2a82d4]
cdq
mov bl, 0x6c
cmp byte [esi + ebx + 0x35], cl
mov dl, 0x2f
movsb byte es:[edi], byte [esi]
into
dec edi
and byte [eax], ah
or al, 0x45
out 0x50, eax
aas
invalid
dec esp
inc ecx
ljmp 0xce7
jmp 0x211e204
Function at 0x299c9b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
push ebx
call fcn.0299e9ea
lahf
xadd bx, dx
mov esp, ebp
rdtsc
cmc
pop edx
adc bx, bp
sar dx, 5
rdtsc
pop ebx
clc
shld di, cx, 1
btc edi, 0xe
pop edi
daa
rdtsc
pop eax
xchg edx, esi
rcr dl, cl
bsf bp, dx
pop edx
add bp, cx
shr bx, 0xf
pop ebp
pushfd
movzx bx, al
ror cx, cl
mov ecx, dword [esp + 4]
and si, dx
not bl
not esi
stc
push dword [esp + 8]
popfd
not bl
mov word [esp], 0x1296
xchg cx, si
bswap bx
mov ecx, dword [esp + 0xc]
lea ebx, [ecx + 0xd32a75e]
movsx bx, dl
bswap bx
mov ebx, dword [esp + 0x10]
call fcn.0299c624
btr eax, 9
rcr al, cl
mov eax, dword [ebp]
rcl cl, cl
cmc
mov cl, 0xb3
mov cl, byte [ebp + 4]
cmc
clc
sub ebp, 2
pushal
shl eax, cl
call fcn.0299c745
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x405b32
pop dword [ebp - 0x10]
mov eax, 0x405b32
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x6b6b21d7
add dword [ebp - 0x20], 0xe2e72374
mov dword [ebp - 0x1c], 0x3a550693
sub dword [ebp - 0x1c], 0x821ba4e
mov dword [ebp - 0x18], 0x5fa347e5
sub dword [ebp - 0x18], 0x135703b7
mov dword [ebp - 0x14], 0xd661d48b
add dword [ebp - 0x14], 0x299e2b75
lea eax, [ebp - 0x20]
push eax
mov eax, 0xd9b78427
sub eax, 0xd97703af
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x95613fc2
add dword [ebp - 0x20], 0xdf112994
mov dword [ebp - 0x1c], 0xa58bcca2
add dword [ebp - 0x1c], 0x9be094d3
mov dword [ebp - 0x18], 0x3de184e3
add dword [ebp - 0x18], 0x258de789
mov dword [ebp - 0x14], 0x126744fc
sub dword [ebp - 0x14], 0x126744fc
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5c9a4043
add eax, 0xa3a64039
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x397b8
push 0
call eax
mov ecx, 0x38fb4073
sub ecx, 0x38faee8f
xor ebx, ebx
add ebx, eax
mov edi, 0x451400
add edi, dword [ebp - 0x10]
mov edx, 0xa3091eb1
sub edx, 0xc9d41a
sub dword [ebp - 0xc], 0x20f47bf2
mov esi, dword [edi]
add dword [ebp - 0xc], 0xc8940556
sub esi, edx
xor dword [ebp - 8], esi
mov dword [ebx], esi
sub dword [ebp - 0xc], edi
add ebx, 4
add edi, 0xc59899e8
add edi, 0x3a67661c
loop 0x405c4b
add eax, 0x81a4dcc2
add eax, 0x7e5c5da1
xor ebx, ebx
add ebx, eax
add eax, 0x69e655f
add eax, 0xf9619aa6
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x405169
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x40b718
salc
mov esp, dword [ebp + 8]

Function at 0x407b18
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov dword [0x4381e0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0x20], 0x4381e0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407b84
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407b88
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407dfe
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x407e2c
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407e37
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00407dfe
push ecx
cmp eax, 0xffffffff
je 0x407e8c
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x407e84
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407e7d
test byte [ebp + 0xc], 4
jne 0x407e8c
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407e8c
mov eax, 1
jmp 0x407e8e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407e61
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x407e97
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x407eb2
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x408536
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x4371e0
mov dword [esp + 4], eax
call fcn.00408365
push ebx
push ebx
mov dword [esp], 0x4371e0
call fcn.00407ce2
push edx
test eax, eax
jne 0x408567
xor eax, eax
jmp 0x4085e3
mov dword [esp], eax
mov ebx, eax
call fcn.00408421
push ecx
test byte [0x41b94c], 0x80
je 0x408589
mov ax, word [ebx]
test ax, ax
je 0x408563
cmp ax, 0x5c
je 0x408563
sub ebx, 0x4371e0
sar ebx, 1
mov dword [esp], 0x4371e0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x4371e0
cmp ebx, eax
ret
jge 0x4085c8
call fcn.004084fe
push edx
test eax, eax
je 0x4085b9
test byte [eax], 0x10
je 0x408563
mov dword [esp], 0x4371e0
call fcn.00407c70
push eax
jmp 0x408591
call fcn.00408399
push eax
mov dword [esp], 0x4371e0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4085ea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408628
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x40862f
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c720
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4
Function at 0x911664
Capabilities:
Authenticate hmac

Disassembly:
sub dword [esp + edx*2 - 0x61119b48], eax
xor ecx, ebx
not edx
inc ecx
mov dword [esp], 0xf4b9a4b5
sub dx, 0xb610
or dl, dh
neg ecx
dec edx
rol eax, 0x8f
xor ecx, 0x3f0c3305

Function at 0x91503c
Capabilities:
Encrypt data using speck

Disassembly:
dec ecx
or eax, eax
dec ecx
adc edi, esp
inc edx
mov esi, dword [ebp + edx - 9]
dec esp
lea esi, [eax - 0xcc7044c]
dec eax
mov dword [esp + ebp*4 + 4], 0x913e03b7
dec eax
mov dword [esp + ebp - 1], 0xaf8d8f10
xor esi, ebx
inc ecx
sar eax, 0x77
rol esi, 1
call fcn.00a31480

Function at 0x91506d
Capabilities:
Encrypt data using speck

Disassembly:
not ecx
not edx
jl 0xa42b57
mov dword [esp + 4], ecx
add edx, 0x691789f
pop ecx
add ecx, 0x400fce
jmp ecx
and byte [esp + edx - 0x5e1db736], ah
xor ecx, ebx
sal dx, 0xcb
bswap ecx
neg eax
not word [esp + edx - 0x5e1dc800]
dec ecx
xor ecx, 0xd12a9d93
call fcn.00a41c72

Function at 0x918a54
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
inc edx
xor ecx, 0xc21ffe1e
rol eax, 0xe7
neg ecx
sal edx, 0xe8
jb 0xd7bf73
dec ecx
ror ecx, 3
xor ebx, ecx
mov dword [esp], eax
add ebp, ecx
jmp 0xa8964c
movzx dx, byte [esi - 2]
mov cl, byte [esi]
shl ax, 0x8f
xadd word [esp + 1], ax
jnp 0xda6179
mov ecx, 0x29b9ea0a
inc edx
mov esi, dword [ecx + ecx - 0x29b9ea0a]
inc ebp
mov eax, dword [ecx + ecx*2 - 0x5373d410]
inc esp
movzx ebp, cl
inc ecx
movzx eax, ch
dec ebp
lea ecx, [ecx + ecx*2 - 0x5373d410]
call fcn.00e5c036
and dl, cl
sub byte [esp + 1], ah
mov ecx, 0xf6357fb6
not dl
neg cx
sub byte [esp + 2], ch
mov word [esi], dx
xadd word [esp + 2], ax
adc dword [esp], eax
mov eax, esi
sub cx, cx
jbe 0xdf8689
dec eax
mov dword [esp + eax - 0x27a2], ebx
inc esp
xor dword [esp + eax - 0x27a2], esi
inc cx
shr esp, 0xa8
dec eax
mov ebx, dword [esp + eax*2 - 0x4f54]
dec ebp
arpl si, si
dec eax
lea ecx, [edx*8 - 0x3dd92fe2]
dec ecx
adc edi, esi
dec eax
mov dword [esp + eax - 0x27b2], edi
ret 0x10
mov edx, 0x21ae8b03
mov dword [esi + edx*2 - 0x435d160a], eax
lea esi, [esi + edx*2 - 0x435d160a]
pop ecx
je fcn.00d89820
inc ecx
inc esi
dec edx
lea esi, [edi*2 - 0x5cd2db70]
jmp 0xda7c1d

Function at 0x918bab
Capabilities:
Encode data using xor

Disassembly:
inc ecx
add eax, 0xe195c90
dec esp
mov dword [esp + 0x10], ebx
dec ebx
lea eax, [ebx + ebx*8 + 0x3e2e9f0b]
dec esp
mov dword [esp], ebx
inc ecx
rol eax, 2
inc ebp
movsx esp, bx
inc ecx
xor eax, 0xa00cc70c
add al, byte [ebp + 0xf]
mov edi, 0xf08141e3
or al, 0xc7
or al, 0xa0
call int.00d8bcd1
mov edx, 0x1fd93a3
mov eax, dword [0xf0c69f03]
cmp ecx, ecx
xor ebp, dword [edi + eax*8 - 0x7dad3f6d]
add eax, 0xbd081a63
add eax, 0x37239966
add byte [0xbd081a63], 5
cwd
and esi, dword [edi]
pop ebp
in eax, dx
js 0x918bc6
jg 0x918be9
xor al, 0x74
mov ebp, 0x7ea1747f
out 0x86, eax
pushfd
pop esp
mov cl, 0x7f
je 0x918c14
mov ebp, 0x8bb33205
dec edx
retf 0xd83d
push ecx
add edi, 0x38feb4e8
mov dh, 0xb6
sti
ret
Function at 0x91b498
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
dec esi
lea edx, [eax + edx + 0x17ba01be]
inc bp
mov ebp, dword [edx + eax + 0x17ba01c0]
dec edx
mov dword [esp + edi*4 - 0xf0], 0x1987592b
dec eax
mov dword [esp + eax + 0x17ba01d8], 0x7a3ecc0a
inc sp
xor ebp, ebx
inc cx
not ebp
dec edx
lea ecx, [ebx*8 + 0x5c89539b]
dec edx
lea edx, [edi*2 + 0xb88c717]
inc cx
add ebp, 0xf44a395
mov edi, 0xfb2b4dc5
inc cx
not ebp
ror bp, 0x49
je 0xa19ae8
inc cx
rol ebp, 1
inc cx
or ebx, 0x4166253d
sbb ebp, 0x94f6fd11
inc esp
xchg esi, eax
add esi, dword [edi + ebp + 0x4a]
neg dword [esp + edi*2 + 0x18]
inc cx
xor ebx, ebp
dec esi
lea ebp, [esp + ebp + 0x20]
call fcn.00a2fb85

Function at 0x91b896
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
inc ecx
pop ebx
dec edi
lea edi, [esp + edi*8 + 0x7e05f992]
inc esp
mov esi, ecx
xor eax, 0x38247017
inc esp
or esi, ecx
inc ecx
shr edi, 4
jae 0x9baacb
inc eax
push edx

Function at 0x91ce5b
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
mov eax, dword [edx]
dec eax
mov dword [esp], 0x70ce633
xor eax, ebx
bswap eax
inc ecx
mov eax, 0xcba1f837
mov ecx, 0x1f891434
not eax
neg eax
sub eax, 0xc0be3523
dec edx
lea ebp, [ecx + eax - 0x696f4bf0]
xor eax, 0x6923aa99
dec eax
lea edx, [ebp + ebp + 0x26b4dda3]
xor dl, ch
neg edx
lea eax, [eax + ecx*2 - 0x70924199]
inc esp
movzx ebx, cl
dec dx
dec eax
mov dword [esp + ecx - 0x1f891434], ebx
xor dword [esp + ecx - 0x1f891434], eax
inc esp
or bl, dl
call fcn.00d6adde
inc cx
movzx edx, byte [ecx]
mov eax, 0x5e15693a
inc ecx
mov ch, byte [ecx + eax - 0x5e156938]
inc ax
inc eax
and dl, ch
inc ecx
mov eax, 0xab0c5809
not dl
inc dx
mov dword [eax + ecx - 0x5e156939], edx
dec ecx
sal eax, 0x55
movsx edx, al
call fcn.0092d8d4

Function at 0x91e7ef
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec esi
mov dword [esp + eax*2 - 0x7ffffff8], esi
call fcn.00db3ea0
sub edi, 4
mov eax, 0xb7a300a6
xadd al, ah
mov eax, dword [edi]
ja 0x9aa85a
inc esi
mov edi, dword [esp + ebx*2 - 0x144]
dec edi
mov dword [ecx + ebx*4 - 0x2cc], esi
inc ecx
shl al, cl
inc dx
sar dword [esp + ebx - 0x9d], 0x47
jp 0xa3b0b6
inc ecx
shr al, 0xa2
inc ecx
mov ecx, esi
not esi
and dx, dx
je 0xda704b
mov ecx, 0x3ca73d26
lea edi, [edi + ecx*2 - 0x794e7a50]
or ecx, ecx
mov ecx, dword [edi + ecx - 0x3ca73d26]
jns 0xda1172
inc ecx
mov eax, 0xfe94e610
inc ecx
movzx ebp, byte [edx - 1]
dec ebp
lea esi, [eax + 0x48aea11a]
inc eax
xor ch, bl
inc eax
sub ch, 0xe
call fcn.00df5c73
mov ecx, 0xd91a4fb3
and cx, cx
xor eax, ebx
neg cx
dec eax
call fcn.00d5dc7d
dec edi
lea ecx, [ebx + ecx - 0xbc]
inc ecx
pop esi
pop eax
pop edx
pop edx
jp fcn.00d6eae8
inc ecx
pop ebp
xor edx, ebx
bswap edx
jmp 0xd67f1d
inc esp
mov ebx, eax
jmp 0xdec093
mov eax, 0x2b55630
xor ecx, ebx
lea ecx, [ecx + eax*2 + 0x3120cbc6]
rol ecx, 1
sub ax, ax
movzx edx, ax
bswap ecx
xor ecx, 0xbc89e03e
xor ebx, ecx
push eax
sal al, 0x21
jns 0xdc799d
jno 0xd77f08
adc ebp, ecx
push eax
call fcn.00a357e1
inc bp
mov esp, dword [ecx]
jmp 0x938ee1
Function at 0x91ec4c
Capabilities:
Encode data using xor

Disassembly:
neg al
mov edx, dword [esp + 4]
dec al
neg al
push edx
call fcn.00e155ba
neg ecx
call fcn.00a58e94

Function at 0x9220e4
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, dword [edi + eax - 0x73200000]
xchg dword [esp + eax - 0x731ffff4], eax
movsx ecx, ax
lea edi, [eax + edi - 0x731ffffc]
sar cx, 0xeb
xor edx, ebx
sal ax, 0x2b
bswap edx
xor ecx, ecx
mov dword [esp + ecx*2 + 4], eax
sbb edx, 0xdcbe0b09
rol edx, 1
mov dword [esp + ecx + 8], ecx
inc edx
neg ecx
setbe byte [esp + eax - 0x731ffff8]
ror edx, 1
mov dword [esp + ecx*2], ecx
neg dword [esp + eax - 0x731ffff9]
bswap edx
dec ecx
rol ecx, cl
xor ebx, edx
or eax, dword [esp + eax - 0x731ffff9]
adc esi, edx
mov dx, word [ebp]
neg cl
lea eax, [ecx - 0x14553a76]
push eax
mov cx, word [ebp + 2]
jns 0xa3f83f
inc cx
xor ebx, esp
inc si
or dword [esp + edi + 7], ebx
call fcn.00e574b6
xlatb
inc edi
xor ecx, ebx
inc eax
or eax, 0x92676be4
xchg ecx, eax
fisttp word [edi]
xor al, 0xe8
invalid
not dx
shr byte [esp + 0xf], 0xe1
and dword [esp + 0xd], eax
not cx
and eax, 0x11817487
shl eax, 0xc
sbb al, al
and dx, cx
mov word [eax + ebp - 0x4482ffe], dx
lea edx, [eax + eax*4 + 0x5415a7bd]
inc eax
lea ebp, [eax + ebp - 0x4482fff]
call fcn.009ac02b