joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422937
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419b87
and dword [ebp - 4], 0
cmp dword [0x42ffe0], 0
mov ebx, eax
jne 0x4229e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422a99
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422a99
push eax
call fcn.00419b15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42ffe0], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42ffe4], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42ffe8], eax
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42fff0], eax
test eax, eax
je 0x4229e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42ffec], eax
mov eax, dword [0x42ffec]
cmp eax, ebx
je 0x422a40
cmp dword [0x42fff0], ebx
je 0x422a40
push eax
call fcn.00419b90
push dword [0x42fff0]
mov esi, eax
call fcn.00419b90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422a40
test edi, edi
je 0x422a40
call esi
test eax, eax
je 0x422a37
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422a37
test byte [ebp - 0xc], 1
jne 0x422a40
or dword [ebp + 0x10], 0x200000
jmp 0x422a79
mov eax, dword [0x42ffe4]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422a79
mov eax, dword [0x42ffe8]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ffe0]
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a99
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422a9b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7b4e94
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7b4e9e
pushal
call 0x7b4ea4
pop ebp
sub ebp, 0x10
sub ebp, 0x3b4e94
mov al, byte [esp + 0x28]
add byte [ecx + 0x3b4e94ed], al
add byte [edx + 0x282484], cl
add byte [eax], al
cmp al, 1
je 0x7b4ec8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7b4ed1
mov eax, 0x3b4e94
add eax, ebp
add eax, 0x63
mov ecx, 0x5f1
mov edx, 0xbecce060
xor byte [eax], dl
inc eax
dec ecx
jne 0x7b4ee8
jmp 0x7b4efb
jmp 0x7b4eaa
Function at 0x10c8a804
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec dword [esp + 4]
push 0xa0f57bd
sbb esi, 8
jmp 0x11d02540

Function at 0x10cb2463
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.10e141b9
mov ecx, 0x3a21ef84
btc cx, cx
jae 0x118fe40f
mov edx, dword [edi + ecx*2 - 0x7443df28]
mov eax, ecx
bts ax, 0xb0
mov cl, byte [edi + ecx - 0x3a21ef90]
lea edi, [edi + eax*2 - 0x7443df24]
mov byte ss:[edx + eax - 0x3a21ef95], cl
mov ecx, dword [esi + eax - 0x3a21ef95]
lea eax, [eax + eax - 0x49dce25b]
lea edx, [eax + eax*2 - 0x7cd651f4]
lea esi, [esi + eax - 0x2a66fccb]
jae 0x11b8e302
xor ecx, ebx
idiv eax
mul al
dec ecx
bswap eax
cbw
bt eax, eax
neg ecx
dec ecx
rol ecx, 1
btr dx, dx
inc eax
inc ecx
dec edx
xor edx, 0x2a8cbd04
cwd
xor ecx, 0x49aacf88
mul edx
xchg dl, al
xor ebx, ecx
sar al, 0x63
add ax, dx
adc ebp, ecx
jmp ebp

Function at 0x10cb3797
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [esi]
neg ecx
lea esi, [ecx + esi - 0x7104196e]
xor eax, ebx
mov dword [esp + ecx - 0x71041972], 0xc3ad8e1d
shl word [esp + ecx - 0x71041972], 0x4d
sbb eax, 0xf83518a5
dec cl
not eax
inc eax
rol dword [esp + ecx - 0x71041971], cl
ror eax, 2
inc edx
not eax
rol eax, 1
bswap ecx
xor ebx, eax
not dl
neg ecx
setle dl
add ebp, eax
xor dword [esp], 0x63d61b6
mov edx, dword [esi]
adc esi, 4
xor edx, ebx
lea edx, [edx + ecx*2 - 0x788e47ea]
sal dword [esp], 0xfd
std
mov eax, dword [esp]
add al, al
bswap edx
lea ecx, [eax + ecx*8 - 0x6ee5ba57]
sub dword [esp], eax
shl eax, cl
sbb edx, 0xa59e812e
not byte [esp + eax*2 - 0x7ffffffd]
push eax
neg edx
call fcn.11a5b8ae
mov eax, dword [0x5b6b2f5e]
sub ah, byte [edi - 0x15541699]
out 0x28, al
push edi
jbe 0x10cb3854
pop ecx
adc dword [ecx + edx], ebx
xchg ebx, eax
ret 0xb5ad
aad 0xab
pop es
push esi
jne 0x10cb37fd
inc eax
mov word [eax - 0x12], ss
xchg esi, eax
scasb al, byte es:[edi]
xor al, 0xcc
invalid

Function at 0x10cd235f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea ebp, [edx + ebp - 4]
neg edx
mov dword [esp + edx], edx
add dx, 0xb392
mov dword [edx + ebp - 0xb392], ecx
shr edx, 0xfb
movzx ecx, byte [esp + edx]
dec byte [esp + edx + 2]
pop ecx
ja fcn.1185bae6
test dx, si
cmc

Function at 0x10cf0545
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov word [esi + edx*2 - 0x12dfe], ax
mov dword [esp + edx - 0x96ff], 0xdebc841f
mov eax, edx
or ecx, 0x8193389
lea ebp, [ebp + edx - 0x9703]
pop eax
div dl
mov edx, dword [ebp + edx*2 - 0x12dfe]
or eax, 0xb5385685
call fcn.1193e6e9
Function at 0x10d03da2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec esi
mov edx, dword [esp + ecx*2 - 0x926e708]
dec edx
mov dword [esp + ecx - 0x4937380], ebp
dec esi
mov dword [esp + ecx - 0x4937388], ebp
dec ecx
lea ebx, [ecx + ebx - 0x493738c]
inc esp
movsx eax, ch
inc ecx
sub eax, 0x6b04b22c
inc esp
mov dword [ebp + ebx - 0x2c27ca], esp
inc si
xadd dword [esp + ecx - 0x4937385], eax
inc ecx
pop esp
inc ecx
sal ch, 0xc6
inc edi
mov esp, dword [esi + ecx*2 - 0x926e710]
dec edi
lea esi, [ecx + esi - 0x4937384]
inc ebp
xor esp, edx
inc ecx
bswap esp
pop eax
inc ecx
add ebp, ebp
inc ecx
xor al, cl
inc ecx
sbb esp, 0xfd9f3eb2
dec ecx
shl ebp, 0x60
bt edx, eax
jb 0x11947757

Function at 0x10d0a5ef
Capabilities:
Encode data using xor

Disassembly:
neg cl
bts ax, 0x8c
sbb cl, 0xb7
neg cl
call fcn.10d69a58
mov edx, 0xaf341f97
mov eax, dword [esi]
sar edx, 0xfa
jbe 0x11a16638
mov bh, 0xf6
fld1
pop eax
hlt
arpl dx, sp
pop ss
push es
jbe 0x10d0a641
jge 0x10d0a5f8
dec eax
not dword [esp + ecx*8 + 0x2e]
clc
jno 0x10d0a66e
mov edx, 0xaa079a92
sbb byte [ecx], 0x64
sub byte [0x3575060a], bh
lcall 0x6f44, 0x7ffeafbe
out 0, al
add dword [ebp - 0x4643e937], 0xffffff9d
pop ss
int3
ror byte [ecx - 0x51], 0x7d
hlt
xor edx, ebx
shr eax, 0x15
jns 0x11b8c62b
mov ecx, 0x9426c23b
lea ecx, [ecx - 0x38de91f6]
movsx eax, cx
mov eax, dword [ecx + edi - 0x5b483045]
mov edx, 0x7e80c407
mov dl, byte [edi + edx - 0x7e80c403]
or cx, cx
btc ecx, ecx
lea edi, [edi + ecx - 0x5b48305f]
movsb byte es:[edi], byte [esi]
btr ecx, 0x16
mov byte [ecx + eax - 0x5b083065], dl
movzx edx, cx
lea eax, [edx*8 + 0x1c2121]
mov edx, dword [esi + ecx - 0x5b083065]
and eax, 0x6d866ea6
or cx, cx
xadd cl, ah
lea esi, [esi + eax - 0x464fc]
btc cx, cx
sub al, 0x9c
xor edx, ebx
not edx
xor edx, 0x7d823a07
call fcn.11d5c267
jg 0x1185e1a5
xchg ebx, eax
dec esi
hlt
movsx ecx, dx
adc esi, 3
dec cx
call fcn.10ca4d62
mov edx, ebp
mov ecx, 0x7bb0b28b
or cx, cx
movzx eax, cx
lea ebp, [ecx + ebp - 0x7bb0b28f]
sub cx, ax
not ecx
cmova ecx, eax
mov dword [ebp + eax - 0xb28b], edx
movzx edx, cl
cwde
lea eax, [edx + eax + 0x76b7f20f]
lea esi, [esi + edx*2 - 0x202]
and dl, 0x92
idiv eax
shl edx, cl
xor edx, dword [esi + eax*4 - 0x4ec]
sal al, 0xa1
jge 0x1185e16d
mov edx, 0xe0bb6780
rdtsc
mov ecx, 0x2b95d684
lea ebp, [ebp + ecx - 0x2b95d68c]
rol cl, cl
mov dword [ebp + ecx - 0x2b95d644], eax
or cx, cx
mov dword [ecx + ebp - 0x2b95d648], edx
movzx eax, cx
mov edx, ecx
lea esi, [esi + ecx*2 - 0x572bac94]
ror dx, cl
btr ecx, 0x29
sar al, 0x24
mov edx, dword [esi + ecx*2 - 0x572ba890]
dec ecx
sar eax, 0x6f
shr al, cl
xor edx, ebx
shl ax, 0xa7
xor edx, 0xba2e3793
inc edx
bt eax, ecx
neg edx
not edx
ror edx, 1
bswap eax
xor cx, cx
xor ebx, edx
or eax, eax
not cx
adc edi, edx
mov edx, eax
jmp fcn.10e24d91
or eax, eax
dec edx
xadd cl, ah
jns 0x11a0f593
xor edx, 0xe33eab39
lea edx, [edx + ecx*2 - 0x7b1820ea]
ror edx, 1
bswap eax
rol ecx, cl
xor ebx, edx
bt eax, ecx
bts ax, cx
adc edi, edx
lea edx, [ecx*2 + 0x7928623a]
jmp fcn.11cf5004
Function at 0x10d19512
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ecx, 0x579c1d08
sar ecx, 0x45
push ecx
not edx
mov dword [ebp + ecx*8 - 0x15e70740], edx
mov byte [esp + ecx*8 - 0x15e7073e], cl
movsx edx, cx
not ecx
pop ecx
jmp esi
mov edi, dword [edi*4 + 0x118a2d10]
shr edx, 8
call fcn.119710f3
mov eax, 0x4e8be2b1
mov eax, dword [edi + eax - 0x4e8be2b1]
movzx dx, byte ss:[eax]
mov eax, 0x6e81e52c
and eax, eax
adc eax, eax
adc edi, 2
inc eax
jno 0x10d4e6c2
inc ecx
mov esp, 0x4dbfa838
inc ebx
mov eax, dword [esp + esi - 0x4dbfa838]
inc ecx
movsx ebp, ah
inc ebp
movzx ebp, sp
dec eax
bswap ebp
dec edi
lea esi, [ebp + esi - 0xa834]
inc ecx
mov ecx, esp
push ecx
inc ebp
movzx eax, ah
inc ecx
xor eax, edx
rol eax, 3
inc eax
dec ebp
bts eax, eax
xor eax, 0xc688783f
rol eax, 2
inc edx
ror byte [esp - 0x4dbfa832], 0x46
mov esi, 0x17889120
xor eax, 0xcb3b58b9
dec edx
add dword [esp - 0x4dbfa838], 0x9a0698a6
not eax
dec ecx
ror esp, cl
dec ebp
lea ebp, [esp + 0x3d8aaf19]
dec esp
mov dword [esp + esi*4 - 0x5e224480], edx
dec ecx
sbb esi, eax
xor dword [esp + ecx - 0x4dbfa838], eax
call fcn.10d454c5
movzx ecx, al
mov word [ecx + edi - 0x59], dx
xchg cx, ax
mov edx, dword [ebp + ecx*2 - 0x194b2]
push ecx
lea ebp, [ebp + ecx - 0xca55]
not eax
xor edx, ebx
add word [esp + eax*2 - 0x45f9ff4b], cx
neg edx
jmp 0x10df086e
setg byte [esp + 3]
adc ebp, 3
shl dword [esp], 0xd1
xor edx, edx
test eax, eax
push 0x5d8fbf8b
lea esp, [esp + 8]
je 0x10d0ef60
jmp 0x11d55b8f
sar cl, 7
ror cx, 0x8d
xor edx, 0x28c5725
call fcn.11c8752b
mov eax, 0xe18bd40c
sub edi, 4
push eax
mov edx, dword [edi]
not eax
xor edx, ebx
inc edx
mov ecx, eax
ror cx, 0xc
ror edx, 3
and al, byte [esp + eax - 0x1e742bf2]
adc word [esp + eax - 0x1e742bcf], cx
neg edx
inc ecx
push ecx
pop eax
lea edx, [edx + eax*4 + 0x3a59c64f]
lea ecx, [ecx*2 + 0x6518af0c]
xor ax, cx
shl dword [esp + eax*2 - 0x3ce92482], 0xc1
neg edx
bswap edx
dec word [esp + eax*2 - 0x3ce92481]
xadd dword [esp + eax - 0x1e749241], ecx
bswap ecx
ror edx, 1
not dword [esp + ecx*4 - 0x602e5b08]
dec eax
xor ebx, edx
or al, 0x1f
adc esi, edx
sub eax, dword [esp + eax*4 - 0x79d2497c]
add al, al
dec cx
mov ecx, dword [ebp + ecx*2 - 0x30172d82]
mov word [esp + 2], ax
mov eax, dword [ebp + 4]
sal byte [esp + 2], 0xc1
jnp 0x10d7c459
sub cx, dx
adc eax, 0xc70cb803
neg dx
or dx, 0x9f93
neg eax
dec ecx
btr dx, cx
sub ecx, edx
lea eax, [eax + ecx - 0x675a92b2]
lea ecx, [edx + ecx*8 - 0x1fe523f5]
lea edx, [edx*2 - 0x12d2b06a]
xor eax, 0xce054239
btr cx, dx
xadd dl, dh
imul ecx, ecx
xor ebx, eax
shl cl, cl
adc edi, eax
movsx eax, dl
jmp edi
push 0x394c4b4
shl byte [esp], 0x22
mov dword [esp], edi
mov edi, 0xf822de8a
movzx edi, byte [ecx]
call fcn.11d58042
mov ecx, 0x369d372e
xor ecx, ecx
mov edx, dword [ebp + ecx*2]
movsx eax, cl
or eax, dword [ebp + ecx*8 + 4]
sal cx, 0x4b
lea ebp, [ebp + ecx*8 + 4]
sar ecx, 0xaf
adc edx, eax
movsx eax, cx
and ax, 0x10a0
shr cl, 0x86
mov dword [ebp + ecx*2], edx
mov edx, ecx
rol dl, 0xe7
xchg dl, al
lea esi, [esi + ecx*4 - 4]
xor eax, dword [esi + ecx*2]
xor eax, ebx
jmp 0x11857db2
Function at 0x10d1bf82
Capabilities:
Authenticate hmac

Disassembly:
adc eax, edx
shr dword [esp + 4], 0x87
jp 0x11c0d022
jns 0x11872676

Function at 0x10d272ba
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov esp, ebp
pop edi
mov ecx, edx
pop ebx
movzx ebp, cl
pop edx
not bp
sar ebp, 0x7b
movzx eax, cx
pop eax
jbe 0x11d4e34b
jmp fcn.11a5b900
popfd
pop esi
push ecx
not cx
mov dword [esp + ecx - 0x76120000], ecx
mov ecx, dword [esp + ecx - 0x7611fffc]
not word [esp]
jmp 0x11a52fe8
call fcn.11955cb2
movzx esi, cl
pop ebp
not si
or ecx, esi
jno 0x10d84262

Function at 0x10d77b1a
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp], 0xc4804fb7
call fcn.11cfcc01
mov ecx, 0x510a171f
jmp 0x1198a79a

Function at 0x10d9088f
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
mov dword [esp + ebx - 0xffca], 0x52346036
call fcn.11863961
Function at 0x10d95a72
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.10d52bcc
push 0x7e333294
call fcn.11c382d7

Function at 0x10d97ec6
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + edi - 0x4311f31d], 0xb90afc8a
inc ecx
btr esp, 0x1b
dec esp
mov edx, dword [esp + edi - 0x4311f315]
dec ebp
arpl ax, ax
jae 0x1189f4e6
dec ebp
adc ebx, eax
call fcn.1189f903
mov eax, 0xb58a8e1f
xor ax, ax
mov edx, dword [ebp]
xor ax, 0x3534
shr al, 0x41
adc ebp, 4
lea ecx, [eax + eax*8 - 0x40ff3ce3]
cbw
xor edx, ebx
call fcn.118e8a34
sbb al, 0x2c
dec esi
push 0xafb8fce5
or ch, byte [ebx]
jbe 0x1189f581
mov bl, byte [edx]
fild word [ecx + 0xbd4ffd1]
test eax, 0x652fe5f4
test byte [ebp + 0x6dd0fa28], 0x76
sbb ah, al
cmpsb byte [esi], byte es:[edi]
sub edi, edx
or eax, 0xe54a354b
dec ebx
sub dword [edi + 0x292ae497], edi
dec ebx
xor eax, 0x294be54a
mov edi, 0x292ae497
or eax, 0x8b661580
sub cl, al
lahf
inc eax
adc al, 0xdf
and edi, edx
add byte [ebp + esi*4 + 0x1ad398f3], cl
idiv esp
push ebx
xor ebp, eax
retf 0xcf9e
add byte [esi], dl
dec byte [edi - 0x14e63046]
popal
sub eax, dword [ebx]
mov cl, 0xc5
pop eax
mov eax, 0xb0604a0f
mov eax, 0xd3e5a8f1
or esi, eax
sbb al, 0x2f
jl 0x1189f58c
salc
jae 0x1189f53f
jb 0x1189f611
xchg dword [edi + esi*2], edi
mov edx, 0x84d82ee8
adc al, 0x98
push 0x7a
sbb eax, 0xb118ba7d
push ebp
mov dword [0x5cc4ac55], eax
invalid
pop esi
insd dword es:[edi], dx
cmc
dec esi
and byte ds:[ebx + edx*4], dh
std
in al, dx
adc edx, dword [esi]
jne 0x1189f628
mov ebx, 0x4f010013
xchg esp, eax
or byte [edx + 0x72839d09], cl
mov al, 0x6a
push edi
popfd
xor dword [edx + 0x26], 0xffffffb0
push 0x57
fcomp qword [edx - 0x25fa4db7]
invalid
Function at 0x10dbd48f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + ecx - 0x50000000], ecx
xor ebx, edx
add ebp, edx
dec dword [esp + ecx - 0x50000000]
shl word [esp + ecx - 0x4ffffffb], 0x28
shl eax, 0x41
mov ecx, dword [edi + eax - 0x4ddabd48]
shr byte [esp + eax - 0x4ddabd3d], 7
mov dl, byte [edi + eax - 0x4ddabd44]
je 0x11951b34
lea edi, [eax + edi - 0x4ddabd42]
push eax
sbb word [esp + eax - 0x4ddabd3b], ax
mov byte es:[ecx + eax - 0x4ddabd48], dl
mov dword [esp + eax - 0x4ddabd48], ebp
ret 0xc

Function at 0x10dee92a
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xc3bd7aa2
btr ecx, 0x9e
or ecx, edx
call fcn.11c0c496
rol eax, 3
neg eax
neg cx
xor ebx, eax
add edi, eax
push ecx
mov dword [esp + 4], edx
xor edx, 0xed1ae0a7
pop eax
pop eax
jne fcn.11d56d63
movzx ax, byte [ebp]
mov edx, 0x9383ebbb
lea ecx, [edx*4 - 0x3be66f60]
mov dl, byte [ebp + ecx - 0x12293f8a]
neg cl
or ecx, ecx
inc cx
lea ebp, [ecx + ebp - 0x12293f73]
and al, dl
not al
xor cx, cx
bswap ecx
btr cx, cx
mov word [ebp + ecx - 0x2912], ax
movzx edx, cl
movsx eax, dx
lea edi, [edi + ecx - 0x2916]
lea eax, [eax + ecx + 0xb16af02]
inc cl
mov eax, dword [edi + ecx - 0x2913]
add cx, cx
sub cl, 0x94
xor eax, ebx
lea ecx, [ecx + ecx*4 + 0x5734ae13]
inc cl
xadd edx, ecx
ror eax, 2
jmp 0x10d89060

Function at 0x10df27a8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
adc edi, 2
call fcn.11c5b03f
stc

Function at 0x10dfd1f2
Capabilities:
Execute syscall

Disassembly:
shl word [esp + 5], 7
mov dword [esp], 0x30b3e310
adc esi, 4
call fcn.11c7bf65
Function at 0x10e13781
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
rol dword [esp + eax - 0x3346], 0x21
or al, byte [esp + edx - 0x5de79e09]
xor ebx, ecx
add edi, ecx
bswap edx
movzx ecx, ax
mov eax, dword [edx + ebp - 0x99ee75d]
xor dl, dl
mov ecx, dword [ebp + edx*2 - 0x133dcdfc]
setp dl
sbb edx, dword [esp + edx - 0x99ee701]
mov dword [esp + edx*2 - 0x133dca32], ebx
ror dx, 0xef
mov ebx, 0xe9b1329b
cpuid
call fcn.10cbea62
mov eax, dword [edi]
mov ebp, 0xd03f4a25
add edi, 4
lea ecx, [ebp + ebp*4 - 0x1793765]
xor ebp, ebp
or ebp, eax
mov eax, 0x463d9889
jmp 0x10c88be4
cwde
xor ebx, ecx
rol ax, 0xe6
mul edx
bswap eax
add edi, ecx
mov ecx, dword [edx + ebp - 0x3622def1]
rol eax, 0x45
jae 0x11c0e3c9
neg ecx
xor dx, 0xfa1f
and edx, 0x9eaaa40e
mov dword [esp + edx - 0xa404], 0xa698a1ad
bswap ecx
push eax
rol eax, 0xf7
xor ecx, 0x19b58bab
neg dx
sbb dword [esp + edx - 0x5bfb], edx
xor edx, 0x3622a92a
lea ecx, [ecx + edx - 0x58d11714]
jl 0x10d8f10e
jae 0x10d65138
mov edx, dword [eax + esi - 1]
movzx ecx, ax
and ecx, 0x13257206
lea eax, [eax + ecx*4 - 0x2e58d575]
xor edx, ebx
sal word [esp + ecx + 1], 0x2f
rol edx, 2
pop eax
jmp 0x11d04d4e
mov byte [esp + edx - 0x3622deee], dl
mov ax, word [ebp + edx - 0x3622deed]
lea ebp, [ebp + edx*2 - 0x6c45bddc]
mov word [ecx + edx - 0x3622def1], ax
mov dword [esp + edx*2 - 0x6c45bde2], edi
ret 4
xor ecx, ebx
sub dword [esp + eax - 0x16ffe341], edx
rol ecx, 1
mul dx
inc ecx
cwde
bts edx, edx
ror ecx, 3
sar dword [esp + edx - 0x5de79e09], 0xd6
inc ecx
jmp 0x10ce931b
ror eax, 0x53
lea edx, [edx + eax - 0x2593b626]
xchg cl, al
or eax, 0x600ca309
neg edx
xadd ax, cx
rol edx, 2
xor ebx, edx
btc cx, 0x1e
xor eax, ecx
ror cx, 6
adc edi, edx
div al
xor cx, ax
movsx edx, ax
jns fcn.11cf5004
sub esi, 4
mov edx, 0xc13ed2aa
lea eax, [edx*4 - 0x69ef2a49]
mov ecx, dword [esi]
push eax
mul eax
jb 0x11c4d376
Function at 0x10e20de5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
ror al, 1
neg al
sub al, 7
xor al, 0x90
sub al, 0xb0
add ecx, ecx
xchg dword [esp + ecx*2 - 0x328e8], ecx
pop ecx
xor bl, al
rol word [esp], 0xcf
mov ecx, 0x3ba1a6b1
lea eax, [esp + eax + 4]
mov word [eax + ecx*2 - 0x77434d62], dx
lea esi, [esi + ecx*2 - 0x77434d66]
jae 0x11d34ff2
movsx edx, cx
pop edx
mov eax, dword [ecx + esi - 0x3ba1a6b1]
xor eax, ebx
sub dx, cx
btc edx, edx
btc edx, ecx
bswap eax
jae 0x11c93b98
pop eax
jno fcn.10e24d91
mov ecx, 0x2c177638
mov edx, ecx
xor cl, cl
lea esi, [esi + ecx*2 - 0x582eec04]
movsx eax, dx
mov edx, dword [esi + ecx - 0x2c177600]
xor edx, ebx
shr eax, 0x3c
cwde
ror edx, 3
dec edx
sub ax, cx
or ecx, eax
sbb al, 7
ror edx, 1
dec cl
not edx
div al
add al, ch
ror cx, 0xc2
xor ebx, edx
and eax, ecx
sal eax, 0x9b
adc edi, edx
movsx edx, al
ror eax, cl
mov eax, dword [edx + ebp]
sal cl, 0x81
sar ecx, 0x78
mov cl, byte [ebp + ecx - 0x28]
btc dx, dx
rol dx, 0x22
or dx, dx
lea ebp, [edx + ebp - 2]
shr edx, 6
and edx, edx
shr eax, cl
bswap edx
lea ecx, [edx + edx*2 + 0x503aebbf]
mov dword [ebp + edx*4], eax
movsx eax, cl
lea ecx, [ecx + eax*2 - 0x3370d860]
or edx, edi
jmp edx
or ax, ax
not cl
inc al
not ax
mov word [edi], cx
mov edx, 0xc7a75f89
ror dx, 0x48
btr edx, edx
mov ecx, dword [esi + edx - 0x47a7895f]
sal ax, 0xc2
cbw
sub ax, 0x9833
lea esi, [esi + edx - 0x47a7895b]
xor edx, edx
xor ecx, ebx
lea ecx, [ecx + eax - 0xc78a1d7]
dec edx
xor ecx, 0xf7909d92
ror eax, 0x12
adc ecx, edx
btr dx, 0x20
adc edx, edx
ror ecx, 1
not eax
shr eax, 0x2b
ror ax, 0xa9
xor ebx, ecx
add ebp, ecx
jmp ebp
shl dx, 1
sar ecx, 0x14
inc eax
call fcn.11864075
mov edx, 0x93298011
mov ecx, dword [ebp]
rol dl, 0x24
mov eax, edx
mov edx, dword ss:[ecx]
inc eax
mov dword [ebp], edx
movzx edx, ax
call fcn.10cce75a
xor bl, dl
lea edi, [ecx + edi - 0x389876a1]
sar cx, 0x8a
push ecx
mov word [ecx + edi - 0x3898001d], dx
movzx edx, cl
neg word [esp + ecx - 0x3898001c]
bts eax, edx
mov eax, dword [ecx + esi - 0x3898001d]
lea esi, [ecx + esi - 0x38980019]
xor eax, ebx
add ecx, dword [esp + ecx - 0x3898001d]
sar cx, 0xe7
neg dx
inc eax
call fcn.118467c2
mov ecx, 0x29b4f335
movzx cx, byte [edi + ecx*2 - 0x5369e66a]
mov edx, 0xe1082224
mov dl, byte [edi + 2]
add edi, 2
mov eax, 0x8e88b731
not ax
or cl, dl
bt eax, eax
jb 0x11a10a29
sal word [esp + edx*2 - 0x784d0d8a], 0x2e
pop ecx
btc cx, 0xaa
bswap eax
shl ecx, 0xc8
imul ecx, ecx
mov dword [esp + ecx], edx
xor ebx, eax
sub dword [esp + edx*2 - 0x784d0d8a], ecx
bt ecx, edx
adc ebp, eax
xchg word [esp + edx - 0x3c2686c3], cx
push ecx
mov dword [esp + edx - 0x3c2686c5], ebp
ret 4

Function at 0x10e3fc6d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add ecx, eax
pop eax
pop edx
pop edx
jno fcn.10e07d72

Function at 0x10e3fc78
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg ecx
xor bl, dl
lea edx, [esp + edx + 8]
lea ecx, [ecx*2 + 0x13984e18]
mov byte [edx], al
inc byte [esp + 7]
pop edx
pop edx
jmp esi
mov dword [esp], ecx
not dl
dec ecx
neg dl
xor cl, cl
jle 0x10d13d17
Function at 0x11852a6e
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov edx, 0x999dd6ad
mov edx, dword [esp + edx + 0x6662295b]
mov dword [esp + 8], 0xc7ff98c9
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10d29b93
push cs
clc
sub dl, 0x10
cdq
push ebp
xlatb
mov ebp, 0x61432923
invalid

Function at 0x1187c56f
Capabilities:
Encode data using base64

Disassembly:
cwde
xor edx, 0x450ca482
mov dword [esp + ecx - 0x581d1130], ecx
xadd cl, al
rol edx, 2
mov dword [esp + eax*4 - 0xbc], 0xee3a0728
lea edx, [edx + eax*4 + 0x35a8a8c4]
xor ax, word [esp + eax - 0x27]
cwde
xor ebx, edx
lea eax, [eax + 0x5732e219]
inc word [esp + eax - 0x5732ff0f]
sbb byte [ecx], 0xe2
xor dl, byte [edi + 0x66]
inc dword [esp + eax - 0x5732ff0f]
xor ecx, 0x3b242f93
adc edi, edx
sub eax, ecx
movsx edx, al
movzx cx, byte [ecx + esi - 0x63393ea3]
jb 0x11a7332f
dec esi
mov dword [0x15546a63], eax
pop edx
sub ebp, eax
cwde
adc al, 0xa2
salc
sbb bl, byte [0xa21b41c3]
adc eax, 0x33ebc0e
popal
add esp, dword [ebx + ebx]
stc
sahf
bound edx, qword [edx - 0x10]
jb 0x1187c631
pop ds
push eax
add al, 0x6b
jle 0x1187c59e
invalid
enter 0xffffffffffffb57a, 0xffffffffffffffa4
int 0x62
mov esi, 0xa5bc04be
mov dl, 0xe1
push ds
arpl word [esi + 0x7c8e89a9], bp
daa
and al, 0x3e
add al, 0xa6
mov ah, 0xe0
jmp 0x1187c6a5
int 0xc
invalid
shl eax, 0x3e
setns byte [esp + eax - 0x7ffffff8]
mov dl, byte [esi + eax - 0x7ffffffe]
jbe 0x11a3f2f0
push ebx
push edx
push edx
lea edx, [edx*2 + 0x56855f2b]
cpuid
or dword [esp + 4], 0x3a9b112a
not dword [esp + 1]
ja 0x11d2b2c6
sbb esi, 8
dec byte [esp + 7]
call fcn.1185b2e3

Function at 0x1188507f
Capabilities:
Encode data using xor

Disassembly:
neg ecx
shl dword [esp + eax - 0xb], 0xaa
neg edx
inc ax
sal dword [esp + eax - 0xc], cl
add eax, 0x6b375315
dec edx
not edx
xadd ecx, eax
shr word [esp + ecx - 0x6b368f20], 0xaf
not eax
xor edx, 0xa6ba33a4
bswap edx
lea eax, [eax + ecx - 0x4a5bc762]
neg cx
rol edx, 3
dec ecx
xor dword [esp + eax - 0x20db8bbe], ecx
shl byte [esp + eax*2 - 0x41b7177a], 0x84
xor ebx, edx
add esi, edx
and word [esp + eax - 0x20db8bbc], 0x4d1f
sub byte [esp + ecx - 0x6b3670df], 0xa1
mov ecx, dword [edi + eax*2 - 0x41b7177c]
inc eax
mov edx, eax
mov eax, dword fs:[ecx + eax*2 - 0x41b7177e]
movsx ecx, dl
and dword [esp + edx - 0x20db8bbf], 0x1d101fb8
jae 0x11cff548
lea esp, [esp + 0x20]
ret
mov dword [esp], 0xfd8b11a6
ror edx, 1
xor edx, 0xf72d5586
ror byte [esp + 7], 0x82
bswap edx
and al, 7
or byte [edi], 0xca
jb 0x11ce98ec
xchg esp, eax
lodsb al, byte [esi]
push 0x25374cec
sub al, 0x84
js 0x11885091
pop ebp
mov dword [0xf0e99ed3], eax
ror byte [edx - 5], 1
xor bh, byte [edx + 0x2c]
or al, 0x4c
inc edx
or ecx, dword [ebx + 0x65d40d2c]
sub al, 0x82
dec edx
invalid
push 0xd72d4c81
xor ebx, edx
and word [esp + 9], 0x318a
adc esi, edx
call fcn.11a803cf
lea eax, [ecx + ecx*4 - 0x746a2fa]
inc byte [esp + ecx - 0xc3ff]
lea edx, [edx + ecx - 0x60322404]
bswap edx
neg edx
inc edx
cwde
cbw
bswap edx
jmp 0x10cf226d
mov dword [edi + edx - 0x20db8bbf], eax
btr ecx, 0x83
rol dl, 7
mov dword [esp + edx - 0x20db8bdf], esi
ret