joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13b252e
Capabilities:
Encode data using xor

Disassembly:
cbw
mov edx, dword [ebp + eax - 0x419effeb]
lea ebp, [ebp + eax - 0x419effe7]
inc dword [esp + eax - 0x419effe7]
movzx eax, byte [eax + esi - 0x419effeb]
sub esi, 0xfffffffb
mov ecx, 0xd9aeb3bd
xor al, bl
btr cx, cx
adc al, 0x87
mov dword [esp], ecx
ror al, 1
add al, 0x83
xor al, 0xb3
call fcn.00d402db

Function at 0x13b4050
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov esi, 0x8d857b80
mov esi, dword [esp + 0x14]
push 0xfc1d5905

Function at 0x13b4647
Capabilities:
Authenticate hmac

Disassembly:
and edx, eax
sar eax, 0xa6
xor bl, cl
not edx
mov word [esi + eax*2 - 0x3ad7b94], cx
sub word [esp + eax*2 - 0x3ad7b87], 0xee36
lea ecx, [edx*8 + 0x65aeae34]
lea esi, [esi + eax - 0x1d6bdcc]
mov dword [esp + eax - 0x1d6bdc8], edx
inc cl
xchg byte [esp + eax*8 - 0xeb5ee36], dl
pop eax
pop ecx
pop edx
jns fcn.014f8c0e
test dword [ebp + 0x14], eax
add byte [ecx + 0x4937a22c], bh
mov ecx, 0x4937a22c
lea edx, [ecx*8 - 0x44707868]
lea ebp, [ebp + ecx - 0x4937a230]
mov edx, dword [ebp + edx*2 - 0xa9931f0]
xor edx, ebx
rol ecx, cl
neg edx
btc ecx, ecx
dec edx
ror edx, 3
lea edx, [ecx + edx + 0x2d55ef14]
xor ebx, edx
add edi, edx
movsx edx, cx
neg dl
rol edx, cl
mov edx, dword [esi + ecx - 0x7a2ac493]
sub cl, cl
movzx eax, cx
mov eax, dword [eax + esi - 0xc3fc]
lea esi, [esi + ecx - 0x7a2ac3fc]
bt ecx, 0x98
imul cx, cx
bt ecx, ecx
or edx, eax
call fcn.00c3c3ba
mov dl, 0x36
loop 0x13b4685
invalid
mov ch, byte [ecx - 0x2c492285]
jnp 0x13b46d3
mov dh, 0xd3
enter 0x3042, 0xffffffffffffffcd
inc ebp
add eax, dword [eax]
loopne 0x13b4751
pop ecx
or eax, 0x9428eb84
cwde
cwde
outsb dx, byte [esi]
jle 0x13b46f4
aas
out dx, eax
ja 0x13b470c
add al, byte [eax + esi]
arpl word [ecx + 0x3f], bp
mov dh, 0xd3
enter 0xffffffffffff88a3, 0x7f
mov dh, 0xd3
enter 0xffffffffffffa4e0, 0x66
xchg ecx, eax
adc dword [ebp - 0x5ee4ee5d], 0xda212218
inc ebx
add ah, byte [esi + 0x17038cb3]
test dword [eax - 0x33f150ca], edx
fstp qword [eax + 0x393fda6d]
mov byte [0xa5e6d210], al
imul esp, ebx, 0xffffffca
test eax, 0x1a23fad9
xor al, 0xa9
pop ecx
ret 0x5a52
push edx
pop edx
xor al, 0xa9
pop ecx
inc edx
xor dl, byte [edi]
dec ebx
push 0x45
int3
Function at 0x13bb375
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebp
lea ecx, [ecx + ecx*8 - 0x7d1384a5]
dec eax
mov dword [esp + edx*4 - 0xe4], edx
dec esp
mov dword [esp + edx - 0x31], edi
movzx eax, cl
inc ebp
movzx edi, bx
inc esp
xor dword [esp + edx - 0x31], ecx
cbw
ror cl, 0x66
dec esp
mov edi, dword [esp + edx - 0x31]
cwde
cdq
dec ebp
arpl cx, cx
jae 0x154e9d4
cwde
dec ecx
adc edi, ecx
inc esi
movzx esp, byte [esi - 0x5f92]
dec eax
lea esi, [esi + ecx*8 - 0x2f9b5]
inc ebp
xor ah, bh
inc esp
movzx ebp, dx
dec eax
mov dword [esp + ecx*2 - 0xbe64], 0xcd8d1d87
inc ecx
neg ebp
inc ebp
add ah, bl
dec ecx
bts ebx, 0xb5
setb byte [esp + ecx*8 - 0x2f9ae]
call fcn.0137165d
mov edx, 0x5f1c2018
shr dl, 0xc2
mov ecx, dword [ebp + edx - 0x5f1c2006]
sal edx, 0x72
mov edx, dword [ebp + 4]
mov eax, 0x141f2518
not ax
adc al, al
lea ebp, [eax + ebp - 0x141fdaca]
bswap eax
imul eax, eax
sal al, 0x21
add ecx, edx
mov edx, eax
mov dword [ebp + eax*2 - 0x43abb240], ecx
lea ecx, [eax + 0x4b9707be]
bt edx, ecx
lea edi, [edi + eax - 0x21d5d924]
imul ecx
mov ecx, dword [edi + edx*2 - 0x1cece2c4]
cwde
and ax, ax
xor ecx, ebx
btr eax, 0x8a
ror ecx, 1
lea edx, [edx*8 - 0x5a54bf73]
mul eax
shl al, 0xe2
xor ecx, 0xfaab4ca1
push edx
shl dword [esp + eax*4 - 0x54fc4000], 0x3d
ror ecx, 1
shl byte [esp + edx*2 + 2], 0x83
add eax, eax
sar dx, 0xc2
bswap ecx
and eax, edx
adc ax, dx
btr eax, 0xbf
rol ecx, 2
shr edx, 0x2a
setp al
lea ecx, [ecx + edx*4 + 0x66bfcb39]
neg eax
neg ecx
sal edx, 0x61
xor ebx, ecx
xadd dword [esp + edx], edx
adc esi, ecx
push edx
xor dword [esp + edx], esi
ret 4

Function at 0x13bb731
Capabilities:
Encode data using xor

Disassembly:
bswap eax
xor ebx, eax
xor byte [esp + 3], 0xa2
call fcn.0131631d
jmp 0x1300d90
shr byte [esp + 2], 0x67
neg eax
mov word [esp], 0x9297
rol eax, 2
neg byte [esp + 1]
sbb eax, 0x77216021
push 0x2887c10b
jmp 0x129bc5a
xor dl, 0xb4
pop eax
mov eax, dword [esp + 4]
xor eax, eax
xor bl, dl
dec al
xchg word [esp + eax*2 - 0x1fc], ax
jne 0x1593659
not dword [esp]
xor eax, ebx
jmp 0x12b8cb0
lea edx, [esp + edx + 8]
mov byte [edx + eax - 0xa1], cl
movsx edx, byte [esp + eax*8 - 0x507]
mov edx, dword [ebp + eax*2 - 0x140]
lea ecx, [eax + eax*2 + 0x55b35e05]
lea ebp, [eax + ebp - 0x9b]
xor word [esp + eax - 0x9b], 0xc423
neg eax
movzx eax, byte [ecx + edi - 0x55b35fee]
adc cx, word [esp + ecx - 0x55b35fe3]
btc ecx, ecx
lea edi, [edi + ecx - 0x55b380ef]
adc ecx, dword [esp + ecx - 0x55b380e8]
xchg dword [esp + ecx - 0x79b480a2], ecx
ror cl, 0xa1
xor al, bl
ror cx, 0x8b
xor cx, word [esp + ecx*4 - 0x907f7b]
jae 0x13b04e4
Function at 0x13c4896
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc ecx
jmp 0x1576429
bswap edx
lea eax, [edx + ecx*2 - 0x2262b26c]
lea edi, [edi + edx*2 - 0xfffc4ea]
jg 0x154b619
cdq
xor edx, dword [edi + eax*4 - 0x20bd48c]
xor edx, ebx
dec ax
ror cx, 0x4a
imul ax, ax
ror edx, 3
inc cx
lea eax, [ecx - 0xef77eef]
not edx
div al
dec edx
bswap eax
bt eax, 0x35
not edx
cwde
lea edx, [edx + eax*4 + 0x7bb5d295]
rol edx, 1
not edx
shr al, 0x41
push ecx
dec edx
cwde
sar byte [esp + eax*2 - 0xf67b], 0x67
rol eax, cl
xor ebx, edx
add esi, edx
pop edx
jmp fcn.01497d09
dec edx
push 0x7a0b71f
call fcn.01518fb1
neg edx
add ecx, esp
shl al, 5
movzx ax, byte [ecx + edx - 0x73e2ff81]
lea ecx, [edx*2 - 0x5a531cfb]
or dl, cl
lea ebp, [ebp + edx - 0x73e2ff89]
xadd cl, dl
mov word [ebp + edx - 0x73e2ff07], ax
jne 0x13cec6f
push 0xe62687a5
sal word [esp + 9], 0xc1
xor eax, 0x10bf538e
push 0x14855d90
jmp 0x156ef28

Function at 0x13c5444
Capabilities:
Authenticate hmac

Disassembly:
shr edx, 0x81
adc al, cl
mov dword [esp + ecx - 0x1f5b2100], ecx
btc edx, edx
rol al, 1
xor bl, al
shl dword [esp + ecx*4 - 0x7d6c8400], 0xf0
sbb ecx, edx
lea eax, [esp + eax + 4]
xor ecx, 0x93128db3
mov edx, dword [eax + ecx - 0xc49ad53]
movzx eax, cl
mov dword [ecx + esi - 0xc49ad57], edx
xadd byte [esp + ecx*2 - 0x18935aa6], ch
mov ecx, dword [ebp + ecx - 0xc490058]
jbe 0x1435c13
xor ecx, ebx
xor ecx, 0x1320728a
movsx edx, word [esp + eax*2 - 0xa6]
xadd eax, edx
neg ecx
not ecx
xadd dl, ah
sbb ecx, 0xbe8c4f10
pop edx
xadd ax, dx
cwde
rol ecx, 3
btr eax, edx
xor ebx, ecx
rol al, 0x64
adc edi, ecx
mov ecx, eax
cbw
mov ax, word [ebp + eax*8 - 0x7fe57]
neg cl
not cl
lea ebp, [edx + ebp - 0x21005307]
sar cl, 0x61
xor ax, bx
inc ecx
xor ax, 0x5a95
xor cx, cx
sbb ax, 0xa907
shl cl, 0x84
lea ecx, [edx + edx*8 + 0x1c01650d]
adc dl, cl
ror ax, 1
neg ax
inc ax
imul ecx, edx
btr ecx, edx
or dx, dx
xor bx, ax
shl ecx, cl
btc edx, ecx
bt edx, edx
mov word [esi + edx*2 - 0x4200a61e], ax
push edx
sbb cl, 0x3e
lea esi, [ecx + esi - 0x588f52c7]
movsx eax, cl
rol edx, 0xe1
cdq
pop edx
jl fcn.014f8c0e

Function at 0x13ced47
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp - 0x10c], ebp
dec esi
mov dword [esp - 0x86], edi
call fcn.012acaad
mov eax, 0xabbcd933
movsx edx, ax
sub ebp, 4
sub edx, eax
mov ecx, dword [ebp + edx - 0x54430000]
call fcn.00c76f3b
Function at 0x13cff43
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg ecx
lea ecx, [ecx + eax - 0xdaba1a1]
mov dword [esp + eax], edx
dec dword [esp + eax]
and eax, 0xac26f33d
bswap ecx
xadd word [esp + eax*4], dx
mov dword [esp + eax*2 + 4], eax
mul edx
not ecx
ror ecx, 2
sal edx, 0x5e
jne fcn.00c6ba53
sub edx, dword [esp + eax + 2]
xor ebx, ecx
add edi, ecx
push edx
mul al
setae dl
adc al, byte [esi + eax]
movsx ecx, word [esp + 5]
add esi, 1
jmp 0x14271c2
xor al, bl
xchg ch, dl
shl byte [esp + 8], 0xa5
rol al, 1
shr edx, 0xdc
sbb dx, 0x899a
neg al
shr word [esp + edx - 0x7671], 0x8b
inc cl
push ecx
adc al, cl
bt ecx, edx
neg al
xor bl, al
sub dx, cx
jle 0x12a434b
jno 0x146dbba
mov ecx, 0x2612fba3
movzx edx, cl
mov ecx, dword [edx + ebp - 0xa7]
neg edx
movsx eax, dl
adc edx, edx
xor ecx, ebx
sub edx, 0x5784d78a
setae al
neg ecx
sal dx, 0xaf
sbb ecx, 0xdc91919d
sub dl, dh
imul edx, edx
ror ecx, 1
cbw
not ecx
jmp 0x14d4dc0
lea ebp, [ebp + edx*2 - 0xeaea]
xadd cx, dx
adc cx, cx
mov word [ebp + edx*8 - 0x800], ax
pop ecx
pop eax
pop edx
pop eax
ja fcn.0149336d
or al, dl
shl eax, 0x47
xor ebx, ecx
shl dx, 0x2b
adc edi, ecx
cbw
mov eax, dword [eax + esi - 0xff80]
lea ecx, [edx*2 - 0x3d4f0868]
movzx edx, byte [ebp + ecx*2 - 0x7361ef35]
or cx, 0xd48c
xor dl, bl
rol cx, 0xc
add cx, cx
neg ecx
dec dl
lea ecx, [ecx - 0x555da6f]
ror dl, 1
btc cx, 0x28
xor dl, 0x22
ror ecx, cl
shr ecx, 0x86
ror cl, 0x44
neg dl
sar cx, 0x22
push ecx
bswap ecx
xor bl, dl
xadd dword [esp + ecx*2 - 0x61e60e04], ecx
ror byte [esp + ecx - 0x207f32f], 0xe5
lea edx, [esp + edx + 4]
mov dword [ecx + edx - 0x207f330], eax
mov edx, ecx
movzx eax, byte [ebp + ecx*4 - 0x81fccc6]
adc edx, 0xec2362ad
shr dword [esp + ecx - 0x207f330], 0x81
lea ebp, [ebp + ecx - 0x207f336]
pop edx
xadd dx, cx
xor al, bl
sub al, 0x86
lea edx, [edx + ecx - 0x425f8ac2]
lea ecx, [ecx*2 - 0x3e7109ef]
neg al
rol ecx, 3
ror al, 1
btc edx, 0x8c
btr edx, edx
shl ecx, cl
sbb al, cl
shl ecx, 0xc3
ror al, 1
not al
not cx
xor bl, al
rol dx, 0x21
or dx, 0x3a97
mov word [esi + ecx*2 - 0x1fffc], ax
not cx
lea esi, [esi + ecx + 2]
xor ecx, edi
jmp ecx

Function at 0x13dc97a
Capabilities:
Encode data using base64

Disassembly:
cbw
lea edx, [esp + edx + 4]
push eax
inc al
xadd al, ah
mov byte [edx], cl
mov ecx, dword [edi]
jae 0x14c9b5c
mov edx, 0x9ca6fe04
dec ecx
mov ecx, dword [esi]
movsx ebp, dl
bt ebp, ebp
dec esp
mov edx, dword [ebp + ecx - 4]
inc esp
movsx eax, dl
neg dl
dec esi
lea ecx, [eax*2 - 0x68476062]
dec esi
mov dword [ebp + esi - 4], edx
inc ecx
movsx ebx, cl
rol ebx, 0xf9
mov eax, dword [ebp + esi - 8]
call fcn.013278da
mov dword [esp + 4], eax
adc edi, 4
movzx edx, ax
xor edx, eax
dec dl
xor ecx, ebx
inc ecx
call fcn.0154c2e7
mov ecx, 0xf28cb42f
lea eax, [ecx*2 - 0x284a20d0]
movzx edx, byte [edi - 1]
rol ax, 0x2b
lea edi, [eax*2 - 0x3c2d9c1]
xor al, 0x38
xor dl, bl
call fcn.013d183b

Function at 0x13df5d9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec ebx
mov dword [esp], 0x688e61a6
push 0xaca55400
lea esp, [esp + 8]
jne 0x14da84c
Function at 0x13ebb2b
Capabilities:
Authenticate hmac

Disassembly:
inc esi
mov eax, dword [esi + eax*4 - 0x64bd12e4]
inc ebp
movsx esp, ch
inc ebp
xor eax, edi
dec ecx
lea ecx, [esp - 0x5de660e0]
dec esi
mov dword [esp + ebp - 0x5b10848f], esp
inc ecx
neg eax
inc ecx
rol ch, 0x41
inc edi
lea eax, [ebp + eax - 0x49d8019f]
inc edx
movzx edx, byte [esp + ebp - 0x5b10841d]
inc ecx
xor eax, 0x211b13f
dec eax
cwde
sub al, cl
dec ecx
div esp
inc ecx
bswap eax
inc ecx
xor eax, 0x3907623a
dec esi
mov dword [esp + ebp - 0x5b108417], edi
inc ecx
push esp
dec eax
sal ecx, cl
inc esi
xor dword [esp + ebp - 0x5b10840f], eax
inc esp
mov edi, eax
dec esi
mov edi, dword [esp + ebp - 0x5b10840f]
inc dx
rol dword [esp + ebp - 0x5b10841e], 0x88
dec edi
lea esi, [esi + ebp - 0x5b108423]
inc esp
movsx ebx, cl
dec esi
mov dword [esp + ebp - 0x5b10840f], esp
cwd
inc edi
mov dword [esi + ebx*8], eax
dec edx
lea esi, [esi + ebx*4 - 4]
inc edx
mov eax, dword [esi + ebx*8]
jae 0x1489d6a
inc edx
mov ebp, dword [esp + ebp - 0x5b10840f]
inc ecx
xor eax, edi
inc edx
and dword [esp + ebp - 0x5b108414], ecx
inc ecx
setb bl
inc edx
movzx ebx, byte [esp + ebx*4 + 1]
xor eax, 0x5d24ac85
pop ebp
dec eax
dec edx
dec dword [esp + ebp - 0x5b108417]
not bp
neg eax
inc dx
mov dword [esp + ebx*8], 0xf538f93
enter 0x4266, 0xf
ror dword [esp + ebp - 0x5b10841b], 0x4a
and dword [esp + ebx*4 + 7], ebx
rol bp, 0x28
dec esi
mov dword [esp + ebx + 0x10], edi
inc ebp
xchg ebx, esp
inc edx
xor dword [esp + 0x10], eax
inc edx
ror dword [esp + ebp - 0x5b10841e], 0xf5
dec eax
not dword [esp + ebx - 0xf7]
dec esi
mov edi, dword [esp + ebp - 0x5b10840f]
dec eax
arpl ax, ax
inc edx
sbb byte [esp + ebp - 0x5b108410], bl
dec edx
neg dword [esp + ebp - 0x5b108417]
dec eax
add edi, eax
inc ecx
pop ebx

Function at 0x13f1b29
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0x27b69dac
mov dword [esp + 4], edi
push 0x362f1227
pop edi
pop edi
push esi
push edi
push edi
pushfd
pop esi
mov dword [esp + edi*2 - 0x4f6d3b54], esi
add word [esp + edi - 0x27b69dac], di
jne 0xc10954

Function at 0x13f3a77
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
ror eax, 1
mov dword [esp + ecx*2 - 0x6d009b6c], 0x68828a9d
not eax
rol byte [esp + ecx - 0x36804db4], 0x84
btr edx, edx
ror eax, 1
not cx
or cx, word [esp + ecx*2 - 0x6d016490]
dec eax
rol dword [esp + ecx - 0x3680fa69], 0x7d
xor eax, 0x6337da3d
sub ecx, edx
setae dl
rol word [esp + ecx - 0x3681fa69], 0xaa
xor ebx, eax
neg edx
add ebp, eax
call fcn.013bb363

Function at 0x13fbbd8
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor eax, ebx
rol eax, 1
call fcn.013e47a6
mov edx, 0xd89d0f34
movzx dx, byte [esi]
push 0x4d8f4133
inc dword [esp]
mov cl, byte [esi + 2]
jge 0xb80f4d

Function at 0x13fdd73
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp], 0x54234af5
call fcn.01567549
Function at 0x140648e
Capabilities:
Encode data using xor

Disassembly:
bts cx, 0x1d
bts ecx, eax
mov edx, dword [eax + ebp - 0xc1c3034]
xor edx, ebx
add al, cl
dec ecx
neg edx
not edx
sub ecx, eax
bts ecx, eax
inc edx
cwde
neg edx
and ecx, ecx
lea eax, [ecx*2 + 0x6d11c439]
sal eax, 0x64
bswap edx
not edx
xor ecx, eax
inc ax
ja 0x14cfad3
mov ah, 0xeb
cld
pushal
daa
mov eax, 0x3d00c588
shrd dword [eax - 0x826ff3b], ecx, 0x90
mov ch, al
add byte [edi + ebx*2 - 0xe], dl
cld
hlt
xor ebx, edx
jmp fcn.00ce7b78
inc dl
dec ecx
ror dword [esp + 8], 0x17
ror dl, 1
dec dword [esp + 4]
mov dword [esp], 0x4a0efcba
sar eax, cl
sbb dl, 0xbe
sub byte [esp + 5], ah
adc cl, 0xbe
xor dl, al
dec word [esp + 3]
add dl, 0x15
mov dword [esp + 8], eax
dec cx
xor bl, dl
lea eax, [ecx + 0x5b83eb7]
call fcn.00b8a641
mov edx, 0x1513c991
rol dx, 0x8b
mov edx, dword [esi + edx*4 - 0x544e3930]
mov ecx, 0x4c38fc2f
mov ecx, dword [esi + ecx - 0x4c38fc2b]
mov eax, 0xc1c302f
bts eax, 0xd
inc eax
and edx, ecx
lea ecx, [eax + 0x2d99e0a4]
and ecx, eax
not edx
mov dword [esi + eax - 0xc1c302c], edx
jne 0xc74e8a
rol edx, 2
sar cx, 0xaf
add ecx, ecx
sub eax, 0x66285d8a
dec edx
and eax, 0x28000da8
jae 0xd2fa91
mov eax, 0xf3820ba6
call fcn.01367338

Function at 0x140b381
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not edx
inc eax
jg 0x14e47f5
mov word [edi + edx - 0x10219b32], cx
mul edx
mov edx, dword [esi + edx*8 - 0x78fc0bf0]
rol al, 0x82
adc esi, 4
xor edx, ebx
shr dword [esp + 8], 0xc2
movzx ecx, word [esp]
dec edx
rol eax, cl
lea ecx, [ecx + eax*8 + 0x2e8edc94]
rol edx, 2
sar ax, 3
push ecx
jbe 0x151eda9
neg edx
bt cx, cx
pop ecx
sub eax, eax
xor edx, 0x21b57e28
ror dword [esp + eax + 5], cl
pop eax
xadd byte [esp + eax - 0x42dfa19f], al
rol edx, 2
bswap edx
not eax
dec cx
xchg al, cl
inc edx
not dword [esp + ecx - 0x30a93a03]
dec ecx
rol edx, 1
dec cx
sar ax, 0xc1
pop eax
xor ebx, edx
add byte [esp + ecx - 0x30a93a02], 0x88
push eax
inc dword [esp + ecx*2 - 0x61527406]
add ebp, edx
cdq
or word [esp + edx*2 + 1], cx
call fcn.0139e381
xor ebx, eax
btr dx, cx
add cx, dx
bts cx, 0x3d
lea edi, [edi + ecx*2 - 0x4ba3d994]
jb 0x12bbbf5
dec dx
mov dword [edi + edx*2 - 4], eax
neg dx
sub edx, ecx
mov eax, dword [esi + ecx - 0x25d1ecc8]
add dx, cx
dec dl
lea esi, [esi + ecx*2 - 0x4ba3d98c]
ror edx, cl
sub dl, cl
lea ecx, [edx*2 - 0x36e4b768]
xor eax, ebx
neg cx
rol eax, 1
lea eax, [eax + ecx - 0x4842a564]
not eax
neg eax
sar edx, 0xfa
lea ecx, [ecx*2 + 0x19253213]
shl dx, 0xea
xor ebx, eax
not cx
sub dx, cx
adc ebp, eax
bswap ecx
sal dx, cl
jne fcn.0140b7dc
jmp ebp
jae 0x150a3cf
Function at 0x1413822
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
movzx eax, byte [esi + 4]
mov ecx, 0x418adf9d
lea esi, [esi + ecx - 0x418adf98]
push ecx
ror dword [esp + ecx - 0x418adf9b], 0xc2
xor al, bl
add dword [esp + ecx - 0x418adf9b], 0xe7b5523f
dec al
btr ecx, ecx
not al
xadd dword [esp + ecx - 0x418adf9d], ecx
or ecx, ecx
dec al
call fcn.0129c607
call fcn.0157018d
dec ecx
sub edx, 0xe5be1835
ror ecx, 1
lea ecx, [ecx + edx - 0x1dd4fa6c]
xor ebx, ecx
inc al
xor al, dl
adc edi, ecx
mov dword [esp + edx - 0x1a41e7d5], eax
lea edx, [edx*8 - 0x2375b0c3]
dec edx
mov edx, dword [ebp - 4]
not word [esp]
xchg word [esp], ax
jno 0xcd2e99
mov ecx, 0xcc154d84
inc cl
mov ecx, dword [esi]
jne 0xce1888

Function at 0x14154ff
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ebp + 2]
sub dword [esp + 3], 0xbeb56f31
and cl, al
not cl
mov word [ebp + 2], cx
mov eax, dword [esp + 2]
movzx edx, word [edi + eax - 0x4f31599e]
sal al, 0xc7
js 0x12e63e2
lea edi, [eax + edi - 0x4f315906]
jnp 0x1411eda
xor dx, bx
shr dword [esp + eax - 0x4f315900], 3
lea ecx, [eax + eax*4 + 0x65952ea1]
inc dx
ror ecx, cl
setno byte [esp + eax - 0x4f3158fb]
rol dx, 1
pop ecx
and al, cl
inc dx
ror eax, 0x49
rol dx, 1
ror ecx, 0x26
neg dx
xor bx, dx
or ecx, eax
shr ax, 1
mov word [ebp], dx
inc cx
movzx edx, al
mov dword [esp + edx - 0x56], esi
ret
not edx
mov edx, dword [edx + ebp - 0x62dc5afa]
mov ecx, 0x8c840713
sar cl, 0x66
sbb cl, ch
dec al
xor eax, 0x8a98c636
add cl, byte [ebp]
mov dword [esp], eax
not ax
jmp 0x1335e65

Function at 0x1417a0f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
mov ecx, 0xf0b2540e
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edi, ebp
lea edx, [ecx*2 - 0x3fe85f56]
movsx eax, cx
pop ebx
pop ebp
lea esi, [edx + eax*4 - 0xf7ac64]
pop esi
lea esi, [esi + eax*2 - 0xa820]
mov ecx, dword [esi + eax*8 - 0x2a070]
xor ecx, ebx
bt eax, edx
lea eax, [eax + edx + 0x1a46d94]
setae al
not ecx
shr dl, 0xa1
mul eax
mul edx
inc ecx
ror ecx, 2
inc ecx
sar dl, 0x42
not edx
ror ecx, 1
xor ebx, ecx
bts eax, 0x3a
btc edx, eax
or dl, dl
adc ebp, ecx
movzx ecx, dl
call fcn.00caf69b
Function at 0x141efb8
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebx
xor ecx, 0x6117ad86
bts eax, 0x31
dec ecx
not ecx
lea ecx, [ecx + eax + 0x327807aa]
mov dword [esp], eax
mov edx, 0x6db4bd82
mul eax
ror ecx, 1
xor ebx, ecx
shr al, 0xc4
adc esi, ecx
imul eax, eax
sub dword [esp + edx - 0x60feb947], eax
movsx ecx, byte [esp + edx - 0x60feb949]
mov eax, dword [ebp + edx - 0x60feb949]
setbe dl
pop ecx
mov ecx, dword [ebp + edx - 0x60feb8fb]
btc dx, dx
bswap edx
jae 0x15050cc
mov eax, 0x54a8d090
lea ecx, [eax + eax*2 + 0x8b29338]
mov edx, 0x6f39adb0
mov edx, dword [esi + eax - 0x54a8d090]
and cl, 0x3f
lea esi, [esi + eax - 0x54a8d08c]
sal cl, 0xe2
seta cl
sub al, 0x86
xor edx, ebx
not edx
ror cl, 0x63
rol edx, 1
cwde
sal al, 0x83
lea edx, [ecx + edx + 0xc6861f3]
neg cl
neg ax
bswap edx
push ecx
js fcn.014e78a8
xor dword [esp + ecx - 0x6ad04e0], 0xc1290682
xor ebx, edx
add ecx, 0x160a3cb0
add eax, 0x851f8188
add ebp, edx
movsx edx, byte [esp + ecx*4 - 0x72dd0640]
btc ax, cx
or edx, ecx
mov edi, dword [edi + ecx*2 - 0x396e8320]
cwde
pop ecx
jno fcn.00cec8a7
inc ecx
movzx eax, ah
dec esi
lea esi, [edx + esi - 0x10]
inc ebp
movsx eax, cl
dec eax
sal ebp, 0x6b
inc cx
sar ebp, 0x82
jne fcn.012e2664
adc eax, ecx
mov dword [ebp + edx - 0x3b9fe5a], eax
movzx ecx, dl
shl cx, 0x45
lea ebp, [ebp + edx*2 - 0x773fcba]
lea edx, [ecx + ecx*2 - 0x665bbf78]
dec ecx
mov dword [esp + ecx - 0xbff], esi
ret

Function at 0x14209e2
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
and al, 0x9c
xor bl, cl
xor ax, word [esp + 4]
sbb eax, dword [esp + 4]
lea ecx, [esp + ecx + 0xc]
pop eax
call fcn.012e8850

Function at 0x14209f9
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
sal ecx, 0xb5
ror al, 1
bt dx, cx
mov dword [esp + edx*8 - 0xfa3040], 0x9f96cf36
sar ecx, 0x36
inc al
neg al
sar dword [esp + edx*8 - 0xfa3034], cl
ror edx, cl
sub cl, 0x23
sbb al, 0x31
dec cl
ror al, 1
ror edx, cl
not ecx
rol dl, 0x62
xor bl, al
mov word [esi + ecx*4 - 0x526], ax
lea esi, [esi + ecx*4 - 0x526]
mov eax, 0x6d310231
dec dword [esp + ecx - 0x134]
dec ecx
pop edx
pop eax
pop ecx
pop eax
pop edx
pop ecx
jp fcn.014f8c0e
push ecx
mov ecx, dword [edi + ecx - 0x4228f7f8]
jb 0xc8fc15
sub byte [esp], 0x16
and dword [esp], 0x5f20aa1a
xor ecx, ebx
jmp 0x1400ca7

Function at 0x142522c
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop ecx
pop edx
pop edx
jg fcn.00cec8a7
shr dx, 0xa1
ror ecx, 1
shr word [esp + eax*8 - 0x1587fc], 0xa2
bswap ecx
xor ebx, ecx
mov dword [esp + eax - 0x2b0f4], 0xf6b0f992
mov dword [esp + eax*2 - 0x56200], eax
add ebp, ecx
dec dl
lea ecx, [edx + eax + 0x2a91123d]
jns 0xcc99ee
popfd
pop ebx
insb byte es:[edi], dx
invalid
Function at 0x14262bc
Capabilities:
Authenticate hmac

Disassembly:
not edx
not ecx
lea edx, [edx + ecx*4 + 0x7b9edaad]
inc eax
rol edx, 1
not edx
xadd ecx, eax
bts ecx, ecx
dec edx
or eax, ecx
sets cl
xor ebx, edx
shr cl, cl
add esi, edx
lea edx, [ecx + 0x3b296e98]
push edx
lea edx, [esp + edx - 0x2b2fa790]
movzx ax, byte [edx]
xor byte [esp + 1], 0xa5
neg cl
add ecx, ecx
mov word [ebp - 2], ax
movzx eax, byte [edi - 5]
or dword [esp], ecx
dec word [esp + 1]
inc byte [esp + 1]
adc edi, 0xfffffffb
rol cx, 0xa1
xor al, bl
not al
inc al
movzx edx, word [esp]
ror edx, 7
push edx
ror al, 1
or dword [esp + edx*2 - 0x600001c6], 0x9110c0bd
not al
ror al, 1
dec al
push ecx
or cx, dx
xor bl, al
add word [esp + edx - 0x300000df], cx
rol dword [esp + edx - 0x300000de], 0x6f
and edx, 0xac88a49b
lea eax, [esp + eax + 0xc]
sal dword [esp + edx - 0x2000007e], cl
xchg dword [esp + edx - 0x2000007e], ecx
mov ecx, dword [edx + eax - 0x20000081]
mov dword [ebp + edx*2 - 0x40000108], ecx
lea ebp, [ebp + edx*2 - 0x40000108]
pop ecx
pop eax
pop edx
jp fcn.01497d09
mov eax, dword [edi]
mov ecx, 0x1a11e029
mov cx, word ss:[eax + ecx*4 - 0x684780a4]
add edi, 2
mov edx, 0x36b87408
lea eax, [edx*4 + 0x7ab002bb]
mov word [edi + eax - 0x5591d2db], cx
mov eax, dword [eax + esi - 0x5591d2db]
movsx ecx, dx
jmp 0x14764e9
mov word [edi + ecx - 0x4cae8199], dx
lea esi, [esi + ecx - 0x4cae819d]
lea ecx, [ecx*4 - 0x756c0461]
mov eax, dword [esi]
xadd word [esp + 6], cx
add ecx, ecx
shl ecx, cl
xor eax, ebx
sub eax, 0x609c1f8c
movsx edx, byte [esp + ecx - 0x7ffffffc]
sub dword [esp + ecx - 0x7ffffffc], 0x360a9ca6
or cx, dx
rol eax, cl
mov dword [esp], edx
inc cx
sal dl, cl
inc eax
or ecx, ecx
shr byte [esp + 5], cl
shl ecx, cl
not eax
btc edx, 0x30
xor ebx, eax
btc ecx, edx
jae 0x14e43b4
add ebp, eax
sar cl, 0xc7
pop ecx
pop ecx
jp fcn.01556dc6
mov edx, 0xe1035e3a
movsx ecx, dx
mov eax, 0x6bb24f12
mov ecx, dword [edi + ecx*2 - 0xbc74]
sal eax, 0x5c
mov eax, dword [eax + edi - 0x1ffffffc]
sub dx, dx
and dx, 0x8b0f
sar dx, 0x6f
adc edi, 8
bswap edx
imul dx, dx
sub edx, 0xfcb35c13
mov dword fs:[ecx + edx*2 - 0x6995f5c], eax
sal dl, 0x41
lea esi, [esi + edx - 0x34caf60]
movsx ecx, dx
add ecx, edx
inc edx
mov ecx, dword [edx + esi - 0x34caf5d]
movsx eax, dx
xor ecx, ebx
add dx, dx
sar eax, 0xb7
rol ecx, 1
sub ecx, eax
rol dx, 0x45
call fcn.0148471b
mov edx, 0x36bc7f18
mov edx, dword [edi + edx*2 - 0x6d78fe34]
mov ecx, 0xf38d0e2f
xor edx, ebx
movzx eax, cl
ror edx, 3
shl eax, cl
ror eax, 0x33
not edx
dec edx
sar ecx, 0xc9
btc eax, eax
jae 0x14089f1
xor eax, ebx
not edx
jmp 0x1475ae2
push edx
lea esi, [edx + esi - 0x36b87404]
neg byte [esp + edx - 0x36b87408]
rol ecx, 0xac
js 0x1442f74