joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11a9bcc5
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jne 0x11cf02a4
mov eax, dword [ebp]
push 0x74835210
lea esp, [esp + 4]
call eax
mov ecx, 0xd93ac804
movsx edi, cx
bt cx, di
mov ebp, dword [ebp - 4]
call fcn.11a1727d
inc eax
mov edx, 0x4422b5ae
mov ecx, 0x131c6d06
sub cx, 0xa38f
neg eax
xadd ecx, edx
shl dx, 0x44
xor eax, 0x485c436
xor ebx, eax
bts dx, dx
setae dl
xchg edx, ecx
adc esi, eax
shr dl, cl
shr cl, 0xe3
mov eax, ebp
ror edx, 0xc4
sbb edx, ecx
lea ebp, [edx + ebp - 0x125760f5]
shl ecx, 0x19
mov dword [ebp + edx*4 - 0x495d83c4], eax
and ecx, edx
call fcn.11c6daef
int 0x2e
push 0x7781080b
push edx
mov dword [esp + 4], 0xad969e4
lea esp, [esp + 4]
call fcn.11d7e0e7
mov dword [0x50970873], eax
dec ebp
and bl, byte [edi]
mov dl, byte [eax + 0x14]
insd dword es:[edi], dx
jecxz 0x11a6a471
push eax
enter 0x6845, 0x50
or eax, 0xafe6f339
cmpsd dword [esi], dword es:[edi]
sbb ebp, dword [esi + 0x58]
scasb al, byte es:[edi]
invalid
inc edi
dec ebp
cmp al, 0x20
fsub dword [ecx]
mov word [edx + 0x13d4941], ds
and al, 0xc8
fist dword [edx - 0x45c9cba0]
mov dword [ebp - 0x48], ebp
dec esp
and eax, 0x405ea038
mov al, 0
mov byte [0xadd62e13], al
mov esi, 0xeab907c9
mov esp, esp
jno 0x11a6a477
pop es
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
call 0xd4b4bd6f
jmp 0xfb9a4d68
pop eax
movzx eax, dx
neg cx
sub edx, eax
inc eax
neg al
adc cx, 0x2400
call fcn.11a3d012
jmp 0x11a6a375
add byte [esi + 0x1a], dh
mov esi, dword [edi + 0x68f520f6]
jge 0x11cf0307
outsd dx, dword [esi]
push 0x15
jb 0x11d46aaa
test ebx, ebx
lea esp, [esp + 8]
je 0x11a6a37f
mov eax, 0xa8b2d095
call fcn.11cb5c10
call fcn.11a695df
clc
xor eax, 0x142b2b33
loopne 0x11cf0309
mov bl, 0xfd
pop esp
push eax
jae 0x11cf030c
and dh, byte [ecx - 0x153353ca]
inc ecx
push esp
jae 0x11cf02d8
shl byte [edi - 0x20], 1
loop 0x11cf0284
cmc
mov ch, byte [ebx + esi*2 - 0xe]
cmc
fisttp qword [edx + ebp*2 - 0x679b74a]
xor esp, dword [esi + 0x4c271ce2]
mov bl, 0x58
cmp byte [ebx - 0xf], bh
mov ecx, 0xdfeca494
and al, byte [ecx - 0x34]
imul ecx, dword [edx], 0xffffff97
in eax, 0x17
pop ss
salc
xor ecx, dword [ebx + 0xa]
aam 0xc4
sub al, 0x17
push esp
cmp ebx, dword [edi + 0x1bc535cc]
mov byte [esi], bh
inc eax
inc eax
ffreep st(4)
sbb byte cs:[eax], ah
sbb byte [eax], ah
jg 0x11cf0317
aad 0xa5
mov ebp, ebp
sub dword [ecx], 0x26
sbb esp, dword [0x123a7856]
aad 0x73
sahf
mov edx, 0xa242bbdd
xchg edi, eax
cmp al, 0x28
mov byte [0x283cf397], al
push eax
xor bh, dl
add byte [eax], 0x54
out dx, al
out dx, eax
pop edi
arpl word [eax - 0x80], si
mov esp, 0x37ce62c1
in al, dx
loop 0x11cf0324
or ah, byte [ecx]
out 0x3d, eax
stosd dword es:[edi], eax
jecxz 0x11cf02f6
adc byte [ebx - 0x20], bh
int3
Function at 0x11aace4b
Capabilities:
Encode data using xor

Disassembly:
sal dword [esp], 0xca
add dl, cl
xor edi, edx
dec ecx
inc esp
call fcn.10d90e17
push ecx
xor eax, ebx
sub eax, 0xf705aa16
neg eax
shr dword [esp + ecx - 0x591cf800], 0xe3
ror eax, 1
sal edx, 0xc1
mov dword [esp + edx*2 + 4], ecx
neg eax
sar dword [esp + edx*8 + 4], 0xd4
fadd st(1)
jl 0x11aace3f
add al, 0xd4
sete cl
xor eax, 0x713ea735
call fcn.10d04a3f
add byte [ecx - 0x44], bh
test byte [ecx - 0x77f4a608], bl
push ebp
les esp, [eax - 0x401bd785]
or edi, dword [edi - 0x10]
mov cl, 0x90
dec ebx
or al, 0xf2
jo 0x11aace67
das
int1
loop 0x11aace3c
mov ecx, 0x60927074
dec edi
invalid

Function at 0x11c39862
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not edx
push ecx
dec dword [esp + eax]
jb 0x11d04d75
xor ebx, edx
sub ax, cx
imul eax, dword [esp + eax*2]
adc esi, edx
neg ecx
movsx edx, cx
pop eax
mov ax, word [edi + ecx*2 - 0x6f680000]
xor dx, word [edi + edx*2 + 2]
xor ecx, dword [esp + ecx*2 - 0x6f67fffc]
neg word [esp + ecx - 0x4dcac420]
mov cl, byte [edi + ecx - 0x4dcac422]
adc edi, 3
call fcn.11c61a88
mov ecx, 0x9707c79c
movzx edx, cx
mov edx, dword [edx + esi - 0xc79c]
rol ecx, cl
mov ax, word [edx]
adc esi, 1
mov word [esi], ax
sub ebp, 4
lea eax, [ecx*8 - 0x3e768175]
mov ecx, dword [ebp + eax*4 - 0x3435894c]
cwde
mov edx, 0x340f908e
xor ecx, ebx
sar edx, 0x56
inc edx
inc ecx
mul dl
neg ecx
bswap eax
bswap edx
dec ecx
ror ecx, 3
cbw
btr eax, eax
sub dx, dx
xor ebx, ecx
shl edx, 0xfe
adc edi, ecx
add edx, edi
jmp edx

Function at 0x11c3b854
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub dword [esp + edx - 0xb41b123], 0x409c6f93

Function at 0x11c4feec
Capabilities:
Execute syscall

Disassembly:
adc esi, 6
call fcn.10e353bd
mov cl, byte [edi + 2]
mov edx, 0x40135e33
imul edx, edx
add edx, edx
lea edi, [edx + edi - 0x3c76fc50]
shr ax, cl
sal dx, 0x68
movzx ecx, dl
neg dx
mov word [edi + edx - 0x3c76ae00], ax
mov edx, dword [esi + edx*2 - 0x78ed5c00]
movzx eax, cx
sub al, ah
lea esi, [esi + ecx*4 + 4]
sar cx, 0xe4
imul ecx, ecx
xor edx, ebx
inc cl
or eax, 0xf5b1e3a5
lea edx, [ecx + edx + 0x1430170f]
shl eax, 0xba
sal cx, cl
bswap edx
not ecx
sbb edx, 0x8310d23
ror edx, 1
not edx
sub eax, eax
ror al, 7
shr cx, 0x85
ror edx, 1
lea eax, [ecx + eax + 0x1a7641e]
or eax, 0xb9bb13a5
or eax, eax
dec edx
dec ecx
jg 0x10dd197d
btc ecx, ecx
ror edx, 1
add cl, ch
xor ebx, edx
cbw
jmp 0x10d7eb93
Function at 0x11c6a8d7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ecx, dword [esi]
bt eax, eax
adc esi, 3
xor ecx, ebx
movzx edx, ax
idiv dl
bswap ecx
inc dx
neg ecx
mov dword [esp + edx*4 - 0x33630], eax
add word [esp + edx - 0xcd8a], dx
dec eax
ror ecx, 1
shr dword [esp + edx*8 - 0x66c60], 9
lea ecx, [edx + ecx - 0x6301878f]
bswap ecx
sbb al, byte [esp + edx*2 - 0x19b17]
lea eax, [edx*2 - 0x57e118ec]
dec eax
xor ebx, ecx
sal dword [esp + edx - 0xcd8c], 0xc1
jle fcn.11d820fa
jge 0x10dab443

Function at 0x11c6c6ad
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11b42380
and byte [esp], 0x9c
sub dword [esp], 0x35254023
neg dword [esp]
not dword [esp]
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.11877771
dec dx
sub ecx, 0x298f29bf
rol ecx, 3
movzx eax, word [esp + 8]
shl dword [esp + eax + 1], 0x29
xor ecx, 0xf9176e9f
or edx, eax
not ecx
bswap ecx
add word [esp + eax*8 + 9], 0xf835
lea edx, [edx + eax*4 + 0x1f22abb8]
not ecx
ror edx, 0x7d
xadd byte [esp + eax*4 + 9], al
mul eax
xor ebx, ecx
and word [esp + edx*8 + 9], dx
dec dl
adc edx, 0x7913c282
adc ebp, ecx
lea ecx, [eax + edx + 0x2fb46506]
cdq
push edx
xor dword [esp + edx], ebp
ret 0xc
mul ecx
push 0xb40486bf
mov dword [ebp], edx
call fcn.10cb24ab
mov edx, 0xb7b4f6a1
movzx ecx, dx
shl edx, 0x81
mov eax, dword [edx + edi - 0x6f69ed42]
jns 0x11c4facb
bswap eax
dec cx
inc ecx
neg eax
xor edx, dword [esp + edx - 0x451bc805]
dec eax
not eax
shl cx, cl
xor eax, 0xa6ba33a4
push edx
bswap eax
push edx
rol dl, 2
xor cl, ch
rol eax, 3
btr edx, edx
sal edx, 0xb6
xor ebx, eax
add esi, eax
sal byte [esp + edx - 0x453ffffe], 0xa3
imul ecx, edx
mov dword [esp + edx - 0x45400000], esi
ret 0xc
bt edx, ecx
lea edx, [ecx*2 - 0x5e5fab47]
lea edi, [edi + ecx - 0xf69d]
adc cx, dx
jb 0x11c6c690
imul ecx, edx
xor eax, ebx
shr ecx, 0x5c
lea ecx, [ecx + edx + 0x120c4600]
add edx, ecx
bswap eax
inc dl
btc ecx, ecx
call fcn.11d6d9ca
push ebx
pushfd
mov ebx, 0x9b08391b
sub ebx, ebx
jo 0x11b3a14e
xor bx, 0xfd82
push ecx
mov ecx, 0xa219eb1c
push ecx
mov ebx, dword [esp + ecx + 0x5de614f0]
mov dword [esp + 0xc], 0x448e2687
mov ecx, dword [esp + ecx + 0x5de614e8]
xchg dword [esi], esp
mov es, word [ebx + ecx*4 - 0x74]
or al, 0xe8
adc al, 0xe6
pop ebp
jl 0x11b3a130
mov eax, 0x6fa28b39
lea ecx, [eax + eax*4 + 0x23918ba0]
mov edx, dword [ebp + ecx - 0x51be43bd]
sar cx, 0x63
lea ebp, [ebp + ecx - 0x51be0873]
add eax, ecx
sal ax, 2
xor edx, ebx
or eax, eax
call fcn.119e540a
popfd
test eax, 0xf79d703d
xor eax, 0x966af8ba
inc ebx
push ecx
jae 0x11c6c6d3
push cs
xchg dword [ecx - 0x49], edx
aas
outsd dx, dword [esi]
or al, 0xc7
ret 0x4b1a

Function at 0x11c7bf65
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shr dword [esp + 8], 0x44
shr byte [esp + 0xa], 0x61
div ecx
mov dword [esi], edx
mov ecx, 0x911134bc
call fcn.10d17301
Function at 0x11c92086
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
adc edi, 5
mov dword [esp], 0x4994fe1f
ror byte [esp + 1], 0xc1
push 0xd726e33d
shrd edx, eax, cl
mov ecx, 0xf7a02fa5
xor cl, 0x2d
mov dword [edi], edx
mov ecx, dword [esi]
rol word [esp], 0xa3
mov edx, dword [esp + 3]
adc esi, 3
sal edx, 0xbe
xor ecx, ebx
sub ecx, 0x733cff9f
not ecx
pop edx
rol ecx, 2
dec ecx
mov dword [esp + edx*2 + 0x51b3cc22], edx
and dword [esp + edx + 0x28d9e611], 0xc81fdf88
call fcn.11a57dfd

Function at 0x11ca7d99
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec edx
sal ax, cl
bswap edx
dec cx
xadd word [esp + eax*4 - 0x1d3d], cx
dec edx
rol ecx, 0xb7
jae 0x10d8fe63
cwde
mov dword [esp + eax*2 - 0x116], esi
ret
call 0x10da2dbf
bts eax, eax
mov dword [ecx + eax*2 - 2], edx
mov edx, dword [esi + eax*2 - 2]
lea ecx, [eax*8 - 0x6564dee3]
push eax
sal cl, cl
lea esi, [eax + esi + 3]
xor cl, 0xb0
shr cl, 0xa3
xor edx, ebx
sal eax, cl
call fcn.11da2f20
mov edx, dword [esi]
mov eax, 0xc31bd6bb
or eax, eax
lea ecx, [eax - 0x65642ae9]
lea esi, [esi + ecx - 0x5db7abce]
xor edx, ebx
add ecx, ecx
push eax
xor edx, 0x110323a9
dec edx
lea eax, [ecx + ecx*8 + 0x2786cbb1]
cbw
push ecx
not edx
lea edx, [edx + ecx - 0x315bcee6]
neg dword [esp + 4]
sub word [esp + 5], cx
cwde
rol edx, 2
xor edx, 0x97b3299c
or byte [esp + eax - 0x73], 0xa7
jno 0x10d6c82c
mov dword [edi + 0xc], eax
call fcn.119bd704
xchg ah, al
dec eax
xor bl, cl
xor eax, eax
adc eax, eax
xor eax, eax
adc ecx, esp
jmp 0x10e25004

Function at 0x11cb20c9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pop edx
pop eax
pop edx
jl fcn.11d4d591

Function at 0x11ce59d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mul eax
rdtsc
lea edi, [edi + ecx - 0x59500108]
ror ecx, 0x9e
and cx, cx
dec ecx
mov dword [edi + ecx - 0x654003fc], eax
mov eax, ecx
mov dword [edi + eax - 0x65400400], edx
movzx edx, cx
ror ax, 0xa4
xadd ecx, edx
jns fcn.118812d1
ror eax, 1
add word [esp + edx - 0x24a6afff], 0xdd9b
imul ecx, edx
xor ebx, eax
add esi, eax
pop eax
jmp 0x10c99c5a
sbb cx, 0xcab2
ror eax, 0xad
call fcn.11d30609
mov eax, dword [ebp]
mov edx, 0x24a6a58b
movsx ecx, dx
lea ebp, [ebp + edx*2 - 0x494d4b12]
not cx
xor eax, ebx
xadd cx, dx
push ecx
xor dx, 0xbb16
sbb eax, ecx
rol eax, 3
sub dx, 0x31a1
dec dword [esp + edx*2 - 0x494d5f82]
sete cl
inc eax
sal dword [esp + edx - 0x24a6afc1], 0xa1
not eax
neg eax
lea eax, [edx + eax + 0x5ef23cf5]
xor eax, 0x868c518d
inc eax
xchg byte [esp + edx*2 - 0x494d5f7f], dl
add dword [esp + edx - 0x24a6afff], ecx
jl 0x11934cf1
mov edx, dword [esi]
mov eax, 0x418041b9
or al, al
movsx ecx, ax
mov al, byte [eax + esi - 0x418041b5]
lea ecx, [ecx*4 + 0x5bbf7904]
and ecx, ecx
lea esi, [esi + ecx - 0x5bc07fe2]
or cx, 0x5c87
and cl, 0x25
adc cl, ch
mov byte ss:[ecx + edx - 0x5bc07fa4], al
add ecx, ecx
neg cx
sbb ebp, 3
mov edx, ecx
neg edx
jns 0x11d31108

Function at 0x11ce9742
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 8]
jne 0x119c8b4c
push 0xf42b6ea7
dec ebx
jmp 0x11cbf880
Function at 0x11cf38b2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec cl
movzx ecx, word [esi]
mov dword [esp], eax
lea edx, [eax*4 + 0x2c0c0f1e]
xor cx, bx
xor cx, 0xda3c
rol dword [esp + 4], 0x96
ror dx, 0x8d
sbb cx, 0xf0bd
imul eax
neg cx
push eax
and ax, ax
setae byte [esp + eax - 0x2dc80a21]
inc cx
sar al, 0x61
push eax
bswap eax
not cx
xor bx, cx
lea ebp, [ebp + eax*2 - 0x2815905c]
and al, byte [esp + eax - 0x140ac821]
mov word [ebp + eax*4 - 0x502b2004], cx
add edx, edx
cdq
pop eax
pop edx
pop edx
pop edx
jae fcn.11cf5004

Function at 0x11cf8113
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, 0xb62cb09a
mov edx, dword [esi]
mov dword [esp], 0xef129a35
dec dword [esp]
add esi, 4
mov ecx, 0x439f800d
sar byte [esp + ecx - 0x439f800d], 0xc3
xor edx, ebx
add byte [esp + ecx - 0x439f800b], cl
neg edx
shl ecx, cl
push ecx
and ecx, 0x47b1209d
bswap edx
movsx eax, cx
lea edx, [edx + eax - 0x4bdc598]
xor word [esp + ecx - 0x40012000], 0x1f0a
sal word [esp + ecx - 0x40011ffd], 0x82
ror edx, 2
neg edx
ror cx, 0xc9
cbw
lea edx, [ecx + edx - 0x7c055b9f]
lea eax, [eax*2 - 0x5c652252]
neg dword [esp + ecx - 0x4001000c]
rol edx, 3
sar cx, 0x61
rol eax, cl
dec byte [esp + ecx - 0x40010008]
neg edx
shr ecx, 0x50
lea edx, [edx + ecx*8 + 0x362a0683]
shl cx, 0xc8
adc byte [esp + ecx - 0xfb], 5
sub ecx, dword [esp + ecx*4 - 0x3fc]
bswap edx
sal word [esp + 4], 0xaa
xor ebx, edx
add ebp, edx
cdq
mov di, word [edi]
ror eax, cl
pop ecx
pop eax
jae fcn.11d4d591
jns 0x11cf81e0
invalid
jg 0x11cf81ee
cmc

Function at 0x11d0af7b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0xe20504bd
dec ebx
lea esp, [esp + 4]
jne 0x11c449f3

Function at 0x11d0b55a
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x11a775a6
rol dword [esp + edx - 0x6ce4976f], 0xd1
lea ecx, [ecx + edx - 0x36b890e8]
sar eax, 0x17
bswap ecx
xor ebx, ecx
bswap edx
add ebp, ecx
cdq
mov ecx, eax
mov di, word [edi + edx*2]
mul dx
mov dword [esp + edx], edx
pop edx
pop eax
jno fcn.11d4d591
mov ecx, 0xd628ac1e
mov ecx, dword [esi]
mov eax, 0x3e9dea16
shl ax, 0x2e
dec eax
lea esi, [esi + eax - 0x3e9d7ffb]
xor ecx, ebx
ror al, 0xc7
xor ecx, 0xdb47aaa
inc al
sal ax, 0x43
bt eax, 0x90
sbb ecx, 0x439e2dbd
bt eax, eax
jae 0x11d27649
neg ecx
rol eax, 0xaa
sar al, 5
sbb ecx, 0x7e0ee2ac
rol ecx, 2
xor ebx, ecx
shr eax, 0xc5
idiv al
dec eax
add ebp, ecx
jmp 0x11c2d264

Function at 0x11d2af26
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x25483763
call fcn.1190dec8

Function at 0x11d2af33
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck

Disassembly:
xor al, bl
mov dword [esp + ecx - 0x25a278c8], ecx
sar ecx, 0xd6
sal dword [esp + ecx*4 - 0x258], cl
sbb al, 0x34
shl ecx, cl
neg al
jmp 0x119d66b1
Function at 0x11d7e0e7
Capabilities:
Encode data using xor

Disassembly:
mov edi, ebp
jb 0x11b761a3
adc esi, ecx
push 0x383b8f9a
lea esp, [esp + 0x14]
jmp 0x10d69b64
xor eax, 0xf8856585
mov dword [esp + 0x14], 0xa29f381e
call fcn.11d0c582
mov eax, 0xd92f7a00
mov eax, dword [ebp]
call eax
mov edx, 0x88249b0b
mov ebp, dword [ebp - 4]
movsx ecx, dl
mov dword [ecx + ebp - 0xb], eax
movsx edi, cl
shr ecx, 0xe1
jno 0x118529f0
dec ebx
lea esp, [esp + 4]
jne 0x10cc8b43
mov eax, 0x6ebea42a
lea edx, [eax*2 + 0x241d1ab3]
mov dl, byte [ebp + eax - 0x6ebea426]
sar eax, 0xef
not ax
jns 0x11aaac10
inc ebp
mov eax, esp
inc ecx
pop edx
dec esp
adc ecx, ecx
jnp 0x11a7e1ef
xor eax, ebx
mov dword [esp + 0x10], 0xfbee730
inc dword [esp + 0x10]
inc ecx
jmp 0x1192e466
dec eax
arpl dx, dx
dec ecx
imul ebp, ecx
sbb edi, 0xa094020e
inc esp
btc eax, ecx
dec esp
adc ebx, edx
mov edx, 0x7a2e792b
jmp fcn.10d538d5
bt dx, 0x39
ror dword [esp + eax - 0x1002], 0x3f
add esi, ecx
mov dword [esp + eax*2 - 0x2004], esi
ret
lea ebp, [ebp + eax*8 - 0x1140a]
mov byte es:[eax + ecx - 0x2282], dl
imul al
cbw
sub edi, eax
movzx edx, ax
movsx ecx, dx
ror dx, 0x28
mov ecx, dword [edi + eax*2 - 8]
cdq
ror edx, 0x92
xor ecx, ebx
and dx, 0xb695
xor edx, 0x67b0e305
bswap ecx
rol ecx, 3
sal eax, 0xab
sbb ecx, 0x818d74a2
xadd dl, al
ror ecx, 1
push edx
lea edx, [edx*4 + 0x3e280cb6]
xor ecx, 0x907e2b7
sar eax, 1
xor ebx, ecx
jmp 0x11a8169a
pop ebx
call fcn.11ccc970
movzx ecx, byte [edi]
mov edx, 0x8d98c91d
mov eax, edx
ror edx, 0x9f
lea edi, [edx + edi - 0x1b31923a]
cwd
btc eax, eax
xor cl, bl
lea eax, [edx*8 + 0x32a2b21e]
dec al
sar ax, 0xcd
sub cl, dl
call fcn.10cf6726
push ecx
pop es
push ebx
push 0x5b
adc bh, dh
sbb ebp, eax
cdq
lodsb al, byte [esi]
xchg edx, eax
jg 0x11b761bf
int 0x2a
retf 0x4ee8
lahf
dec ebx
sti
dec ebp
lcall 0x12e4, 0x8c9aaaef
add eax, 0xfcf3e549
jbe 0x11b76254
jge 0x11b761d0
push es
insw word es:[edi], dx
or edi, dword [0xeb46488d]
scasd eax, dword es:[edi]
or al, 0xe4
daa
pushal
cmp esi, ecx
push ds
mov ah, dl
and al, 0x1a
hlt
and eax, esp
inc edx
mov byte [eax + 0x7c], ah
inc esi
xchg ebx, eax
jp 0x11b762a3
jmp 0x6112ac59
xchg dword [ebx], esp
das
push ebx
add al, 0xb5
xchg ebx, eax
inc eax
call dword [0x8966073d]
mov al, byte [0x8aeb7fe8]
aaa
pop ss
cmp dl, byte [ecx + 0x23]
dec ebp
or ebp, esp
retf 0x2834
mov bl, 0x14
clc
jle 0x11b76282
cmp al, byte [ebx]
int3
push edx
mov edx, 0x7f3335b9
push ebx
call fcn.11c7bcc9
mov ecx, 0x7811ed0c
mov ecx, dword [ebp + ecx - 0x7811ed0c]
jmp 0x119660c7

Function at 0x11da3b9a
Capabilities:
Authenticate hmac

Disassembly:
neg eax
rol dx, 0xa2
xor ebx, ecx
shl dl, 7
adc esi, ecx
movzx ecx, al
mov dword [esp + eax - 0x26dcc072], edx
sal edx, 0x13
pop eax
pop ecx
jbe fcn.118812d1
Function at 0x11dadcfe
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
fld qword [edx + edi - 0x6a211801]
ja 0x11d86948
or dword [esp + edx - 0x6a211801], ebp
ret
mov eax, dword [ebp]
mov ecx, 0x60a862bd
lea ebp, [ebp + ecx - 0x60a862b9]
movsx edx, cl
ror dx, 0x85
sal cx, 0x81
movzx edx, byte [edi + ecx - 0x60a8c57a]
neg cx
not cl
neg cx
lea edi, [ecx + edi - 0x60a8c586]
sar ecx, 0x57
and cx, 0x8589
xor dl, bl
dec dl
xor dl, 0x91
and cl, cl
sar ecx, 0x8b
not dl
ror dl, 1
bswap ecx
xor bl, dl
btc ecx, ecx
neg cl
mov dword [esp + edx - 0x6a211801], edx
shr dword [esp + edx - 0x6a211801], cl
not eax
xor ebx, eax
shr dword [esp + edx - 0x6a211801], cl
adc ebp, eax
movsx eax, dl
and dword [esp + edx - 0x6a211801], 0x2da0a23d
jae 0x11d2092d

Function at 0x11dadd2d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea edi, [edi + edx*2 - 0x6a6c1668]
movsx eax, word [esp + edx*2 - 0x6a6c166a]
mov word [edi + edx*2 - 0x6a6c166a], cx
mov ecx, eax
dec dl
pop eax
jmp ebp
add dword [esp + edx - 0x35360b31], edx
mov eax, dword [edi + edx*2 - 0x6a6c166a]
xchg dword [esp + edx*2 - 0x6a6c1666], ecx
pop ecx
movzx cx, byte ss:[eax + edx - 0x35360b35]
jb 0x10d90df9
add ebp, eax
jmp 0x10e350c1
xor edx, 0x5cb01b26
xor ebx, eax
jmp 0x118f90d5
movzx eax, dl
mov eax, dword [esi + eax*2 - 0x68]
lea ecx, [edx + edx*2 + 0x2fa28896]
shr dl, 0xc1
adc edx, edx
lea esi, [esi + edx - 0x133a8630]
add dl, dl
xadd cl, ch
xor eax, ebx
push edx
mov dword [esp + edx - 0x133a8664], edx
inc dx
dec eax
not ecx
bswap edx
xor eax, 0x559f2d97
lea ecx, [ecx + edx + 0x1abe0a0f]
lea eax, [edx + eax + 0x45b102a4]
or dl, ch
and dx, 0xd49b
rol ecx, cl
not eax
sbb dword [esp + edx - 0x6986100f], 0x45a85a92
inc eax
jmp 0x11a67b19
Function at 0x11db4507
Capabilities:
Encode data using xor

Disassembly:
dec eax
arpl ax, ax
dec eax
lea ecx, [esi*2 - 0x13e4d851]
inc esp
add dword [esp + ecx*2 + 0x27c9aec3], eax
dec esp
adc ebx, eax
inc ecx
push ebp
movsx eax, byte [esp + ecx + 0x13e4d772]
inc ecx
xor al, byte [esi + ecx + 0x13e4d761]
inc ecx
movsx edx, al
dec ebp
lea esi, [esi + edi*8 - 0x57]
inc ecx
dec eax
inc cx
rol esp, 0xcc
inc ecx
xor al, dl
dec eax
shl dword [esp + ecx*2 + 0x27c9aec4], cl
inc al
not al
xor al, 0x1e
inc esp
xor ebp, ecx
ror al, 1
inc ebp
btr eax, ecx
dec esp
mov dword [esp + ecx + 0x13e4d779], edi
not al
dec edx
lea esi, [ebp + eax*4 - 0x17ca21ed]
inc esp
xor dl, al
dec eax
lea eax, [esp + eax + 0x20]
mov dx, word [eax + ecx*2 + 0x27c9aec2]
inc esp
and edi, edi
dec eax
lea ebx, [ecx + ebx + 0x13e4d75f]
dec eax
not dword [esp + ecx*2 + 0x27c9aed4]
mov word [ebx + ecx + 0x13e4d761], dx
shr byte [esp + ecx + 0x13e4d768], 0x61
mov edx, 0x70bdaa0b
rol byte [esp + ecx*2 + 0x27c9aed4], 0x63
inc ecx
pop ebp
inc ecx
pop ecx
pop ecx
inc ecx
pop ebp
jb fcn.10d538d5
cmpsd dword fs:[esi], dword es:[edi]
inc ecx
in al, dx
jmp 0x3b14a921
not eax
xor ecx, edi
inc eax
inc esp
movsx ecx, byte [esp + ecx - 0x2e]
dec eax
lea ecx, [esi*2 - 0x6b556d4d]
rol eax, 1
inc ecx
push ecx
dec esp
mov dword [esp + ecx + 0x6b556c5d], eax
inc edx
lea eax, [eax + eax + 0x641d9d80]
dec esp
mov dword [esp + ecx + 0x6b556c6d], edx
dec eax
mov dword [esp + ecx + 0x6b556c65], edi
inc ecx
shl al, 0x47
dec esi
lea edi, [ecx*8 + 0x80a6139]
xor dword [esp + ecx + 0x6b556c6d], eax
inc ecx
ror edi, 0xbe
inc ebp
xadd ebp, esp
dec esp
mov edx, dword [esp + ecx + 0x6b556c6d]
jg 0x10e53da3

Function at 0x7f9740
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7f974a
pushal
call 0x7f9750
pop ebp
sub ebp, 0x10
sub ebp, 0x3f9740
mov al, byte [esp + 0x28]
in eax, dx
inc eax
xchg edi, eax
aas
add byte [edx + 0x282484], cl
add byte [eax], al
cmp al, 1
je 0x7f9774
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7f977d
mov eax, 0x3f9740
add eax, ebp
add eax, 0x63
mov ecx, 0x5f8
mov edx, 0x29337797
xor byte [eax], dl
inc eax
dec ecx
jne 0x7f9794
jmp 0x7f97a7
sbb al, 0x5a
sbb al, 0x1e
stosd dword es:[edi], eax
xchg edi, eax
xchg edi, eax
xchg edi, eax
push ss
push esi
outsd dx, dword [esi]
xchg edi, eax
xchg edi, eax
xchg edi, eax
xchg esp, eax
pop edx
das
xchg ebx, eax
xchg edi, eax
xchg edi, eax
xchg edi, eax
sub eax, 0x979797bf
pushal
jne 0x7f9758
pop edi
sbb al, 0x16
wait
xchg edi, eax
xchg edi, eax
xchg edi, eax
xchg esp, eax
push edx
invalid
Function at 0x7b7a68
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7b7a72
pushal
call 0x7b7a78
pop ebp
sub ebp, 0x10
sub ebp, 0x3b7a68
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7b7a9c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7b7aa5
mov eax, 0x3b7a68
add eax, ebp
add eax, 0x63
mov ecx, 0x5f5
mov edx, 0x21145b14
xor byte [eax], dl
inc eax
dec ecx
jne 0x7b7abc
jmp 0x7b7acf
lahf
fstp dword [edi + 0x1414289d]
adc al, 0x95
aad 0xec
adc al, 0x14
adc al, 0x17
fldcw word [eax + edx - 0x51ebebec]
adc al, 0x14
adc al, 0xae
cmp al, 0x14
adc al, 0x14
jecxz 0x7b7ae1
pop ss
fcomp qword [edi + 0x14141895]
adc al, 0x17
rol dword [esp + eax*2 + 0x7c], 1
adc al, 0x9c
sbb dl, byte [esp + edi*2]
jb 0x7b7ae5
cmp byte [edx + 0x277c3038], dl
and dh, byte [eax]
add bh, ah
adc dword [esp + edx], edx
adc al, 0xfd
cmp dl, byte [esp + edx]
adc al, 0x99
jo 0x7b7b46
call 0x9fabb3b8
clc
lahf
xchg ecx, eax
sbb al, 0x14
adc al, 0x14
lahf
sbb dword [eax], 0x9f141414
cdq
add al, 0x14
adc al, 0x14
aad 0xfd
push ss
and eax, 0x10d69716
pop ebp
sbb edx, dword [ecx - 0x14141420]
dec ecx
salc
sbb byte [edi + ebx*4], dl
cwde
xor byte [eax], dl
adc al, 0x14
adc al, 0x7c
adc al, 0x9c
adc al, 0x14
jl 0x7b7b5e
pushfd
sbb dl, byte [esp + edi*2]
jb 0x7b7b36
out 0x38, al
adc al, 0x15
cmp byte [eax], dh
inc ebp
cld
cmp byte [edx - 0x3bacfc8], dl
adc dword [esp + edx], edx
adc al, 0xfd
inc edi
push ss
adc al, 0x14
inc ecx
cdq
js 0x7b7b94
adc al, 0xeb
popal
sbb bl, ch
popal
sbb al, 0xfc
nop
adc al, 0x14
adc al, 0x9f
test eax, 0x1414141c
xchg ebp, eax
in eax, 0x45
mov eax, dword [0xe595a3ee]
inc ebp
mov eax, dword [0xdd27a3ee]
xchg ebp, eax
out 0x13, al
sbb eax, 0xe6958927
adc ebx, dword [0xc6278927]
xchg edi, eax
cld
adc dword [ebx + ebx - 0x70], ebx
pop edx
adc al, 0x14
adc al, 0x1b
pushfd
pop esp
adc al, 0x14
adc al, 0x72
lahf
or byte [0x1bfcef94], ch
nop
push cs
adc al, 0x14
adc al, 0x94
out dx, eax
std
sbb edx, dword [eax + 0x14141405]
jb 0x7b7b4f
out dx, eax
jmp 0x7b7bee
jo 0x7b7c20
adc dh, dl
sbb byte [ecx + eax*2], dl
lahf
clc
inc edx
inc ebx
inc ecx
lahf
popal
sbb byte [edi - 0x5917e397], bl
xchg esp, eax
sahf
adc dl, byte [ebp + 0x141415d2]
adc al, 0x9c
adc edx, dword [ebp + 0x141415d3]
adc al, 0xaf
push ss
adc al, 0x14
adc al, 0x16
invalid
sahf
add dl, byte [edx + 6]
invalid