joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13634c3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor edx, ebx
rol edx, 2
inc edx
not edx
call fcn.01375dc3
push 0x7608a7a1
and esi, 0xff
mov esi, dword [esi*4 + 0x1325960]
push 0xe324c310
shr ecx, 8
xor ecx, esi
inc edx
xor ecx, 0x24934a8b
push 0xb3153e90
dec eax
lea esp, [esp + 0xc]
jne 0x13f2ebf
mov esi, 0xd086738
movsx eax, si
pop esi
mov eax, 0xac362318
sub eax, eax
je 0x13bea8b
ja 0x135de8b
mov eax, 0x7d1e6c3e
movzx edx, ax
mov edx, dword [edi + edx - 0x6c3e]
mov ecx, eax
lea edi, [edi + ecx - 0x7d1e6c3a]
jmp 0x13040a6
dec edi
lea ebx, [ebx + edi - 0x3435e5d5]
inc edi
mov eax, dword [ebx + edi - 0x3435e5d1]
dec ebp
lea ecx, [edi + ecx*2 + 0x73823c10]
inc esp
movzx esp, cx
inc ecx
movsx esi, cx
inc esp
xor eax, edi
dec ecx
lea esi, [edi - 0x2def5e47]
inc ecx
movsx eax, bh
inc ebp
mov esi, ecx
inc ecx
dec eax
inc ecx
shr dh, 7
inc ecx
movzx edx, si
dec eax
bswap esi
inc ecx
bswap eax
setp cl
inc ecx
xor eax, 0xf814aa38
inc sp
or edi, edx
inc ecx
not eax
rol ecx, 0x6c
adc ecx, edx
push esi
inc ecx
bswap eax
jle 0x1349f59
ret 0x6b
jl 0x1393566
dec edx
lea esi, [edx + edx*8 + 0x78b0c5b4]
ror cl, 0xc2
dec ebp
lea ebx, [ebx + edx*2 - 4]
jb 0x134c6f8
dec eax
mov dword [esp + edx], 0xb294f83b
inc dx
add dword [esp + edi - 0x52367e26], ecx
inc esi
mov esp, dword [edx + ebx]
inc esp
xor esp, edi
inc ebp
lea esp, [esp + edx*2 - 0x461dd4b6]
inc esi
xchg dword [esp + edx*2 + 0xb], edx
call fcn.0133d323
dec edx
mov dword [esp + edi - 0x3435f5d1], edi
inc esi
xor dword [esp + edi - 0x3435f5d1], eax
inc ecx
push ecx
dec edx
mov edi, dword [esp + edi*2 - 0x686beb9a]
dec ebp
arpl ax, ax
jmp 0x13b71c3
not ecx
jle 0x17acf49
dec edx
inc dword [esp - 0xf89]
inc cx
xor edi, edx
jmp 0x17b3de4
mov esi, 0x60b2f9f
movzx esi, byte [edx + esi - 0x60b2f9f]
xor esi, ecx
jmp 0x13040b3
mov dword [eax + esi], ecx
lea edx, [eax*8 - 0x144ad276]
add edx, edx
mov ecx, 0xdc2a4eaf
add eax, ebp
jmp eax
dec esi
lea edx, [esp + edx + 8]
inc edx
add dword [esp - 0xf88], esi
dec ebx
mov dword [edx - 0x1f12], ebp
inc edi
mov ecx, dword [ebx - 0x1f18]
inc cx
shl esp, 7
inc esp
xor ecx, edi
inc ecx
movzx eax, sp
inc eax
xor dh, dh
inc ecx
bswap ecx
sal eax, cl
dec esp
lea edx, [eax + ecx*8 + 0x18392991]
inc ecx
neg ecx
inc esp
add bh, cl
inc ecx
add eax, esp
inc ecx
inc ecx
inc esp
sub esp, ecx
inc ecx
rol ecx, 3
push esi
call fcn.017b4b2f
call fcn.0124e155
mov ecx, dword [edi]
mov eax, 0x6835213f
lea edx, [eax + eax + 0x5020b015]
rol eax, 0xe7
lea edi, [edi + eax*4 - 0x6a427ecc]
xadd dx, ax
xor ecx, ebx
xor ecx, 0xe399dc20
dec ax
not ecx
inc ecx
push eax
xadd word [esp + eax*2 - 0x3521e522], ax
not ecx
inc dx
inc ecx
call fcn.013f4657
dec ebp
arpl di, di
inc ecx
inc cl
dec ebp
adc ebp, edi
push esi
dec esi
mov dword [esp + edx - 1], ebp
ret

Function at 0x1364867
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc edi
movzx esp, byte [ebx + edx*2 - 0x4e418331]
call fcn.017bab97
Function at 0x1364875
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor dx, 0xa928
dec ecx
bswap esp
inc cx
mov esi, dword [ebx + esi - 0xba00]
inc cx
ror esi, 0xe4
xor si, di
dec eax
mov dword [esp + edx - 0xa933], 0x3e073bbe
dec eax
or edx, dword [esp + edx - 0xa93e]
inc si
shl ebp, 0x14
not si
inc esp
xadd ch, dl
jne 0x130b9ca
xor byte [esp + edx*2 - 0x7ffffff9], dh
lea eax, [eax + edx*2 - 0x7d5777f1]
mov ecx, edx
setge dl
shr cl, 0x62
xor ebx, eax
add ebp, eax
mov dword [esp + ecx*2 - 0x80000000], ebp
ret 4
adc si, 0x33a7
inc ecx
shr bh, 0x25
inc ecx
pop edx
not si
dec esi
lea eax, [ecx - 0x33c24d6c]
inc ecx
dec cl
neg si
sar dword [esp + ecx*2 - 0x6e], cl
dec eax
neg dword [esp + ecx*4 - 0xec]
ror si, 1
sar dl, 0xc1
inc esp
or ecx, ebp
adc si, 0x5e98
dec ecx
rol ecx, 0xe6
neg si
inc cx
rol edx, 0x4e
inc eax
setb ch
dec si
dec esp
add dword [esp + ecx*4 - 0xf1], eax
xor si, 0xa70a
inc cx
dec edi
dec esi
lea eax, [edi*8 + 0x70e1301]
xor di, si
dec eax
lea ebx, [ebx + ecx*4 - 0xf6]
inc ecx
dec ah
jno 0x1343904
dec eax
mov dword [esp + esi - 0xba00], 0x1cbaef0b
dec ebp
lea ebx, [ebx + esi*4 - 0x2e802]
jmp 0x130a0b6

Function at 0x1364a09
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc cx
add ecx, edi
inc esp
mov edi, dword [esp + edx*2 - 0x118]
mov word [ebx + edx*2 - 0x126], cx
inc cx
neg esp
sal byte [esp + edx*4 - 0x243], 0x66
dec esp
mov dword [esp + edx - 0x93], ebp
ret 0x18
ror al, 1
xor bl, al
mov word [esi - 2], ax
mov eax, dword [edi + 1]
movsx ecx, dl
xor edx, 0x80ab69bc
inc dl
xor eax, ebx
add ecx, 0x1702da82
ror dx, 0xa3
not eax
call fcn.012fd56a
jnp 0x17c5ae8
inc ecx
dec al
jns 0x1332d66
mov edx, 0xb89356ab
rol al, 1
dec al
rol edx, 0xd1
jae 0x1362279
cdq
add ebp, esp
rcl esi, 1
adc eax, 0x2151103e
not byte [0x1579103e]
ret 0x3e15
inc ebx
mov dword [edi + edx*2 - 0x27fffe], eax
dec edx
sal dword [esp + edx - 0x13fff4], cl
dec esi
mov dword [esp + edx*4 - 0x4ffffc], ebp
ret 0x18

Function at 0x13676a6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + ebp + 0x2f82fff2], ebp
dec eax
mov edi, dword [esp + eax*2 - 0x5f057bb6]
dec ebp
call fcn.013a83e8

Function at 0x136d5e0
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec eax
lea ebx, [edx + ebx - 0x45b3]
inc esp
movsx esi, dl
inc ecx
pop eax
mov dword ss:[edx + esi - 0x45bf], ecx
dec ebp
lea esp, [esi + ebp*4 - 0x514f8ef3]
call fcn.01361766
inc ecx
mov esi, 0x60aa3185
dec edi
lea ebx, [ebx + esi - 0x60aa3189]
call fcn.01345fad

Function at 0x136d653
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ax
xor ax, 0x924
add edx, dword [esp + edx - 0x55483488]
xor bx, ax
mov word [esi + edx - 0x554839e6], ax
sub ecx, 0x20316aaa
sar dx, 0x26
sar dl, 0xe3
lea esi, [esi + edx - 0x554800fa]
mov dword [esp + edx - 0x554800f8], edx
adc cl, cl
call fcn.017c5f5a
Function at 0x1371b8c
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + ebp - 0x3ea3423b], ebp
dec edi
lea ebx, [ebx + eax*2 - 0x847a]
inc ecx
mov ebp, dword [ebx + ebp - 0x3ea3423b]
xor ebp, edi
inc ebp
mov ecx, eax
inc ecx
shl eax, cl
dec ebp
not ebp
call fcn.01317ebc

Function at 0x1371bb5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc esp
add cl, al
shr si, 0x29
inc ecx
neg cl
dec esp
mov dword [esp + esi + 0x18], esi
inc ecx
ror cl, 1
dec eax
mov dword [esp + esi + 0x30], 0xde13d29e
sar dword [esp + esi + 0x14], 0x2a
inc ecx
not cl
call fcn.0137618a
mov ecx, 0xe41531b4
movzx edx, cl
mov ax, word [esi + edx - 0xb4]
sar cl, 0xc3
mov cx, word [edx + esi - 0xb2]
not edx
sal dx, 0x49
adc esi, 2
and ax, cx
not ax
movzx ecx, dx
call fcn.0133d0da

Function at 0x1372a65
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor al, bl
call fcn.0136a16b
call fcn.0130274b

Function at 0x1372af2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov ecx, edx
sar dx, 0x26
mov edx, dword [edi + edx - 0x34250086]
jb 0x17b1132
lea edi, [edi + ecx*2 - 0x684a4340]
call fcn.0134491d

Function at 0x1377210
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not dx
rol al, 1
call fcn.013d5c86
dec esp
mov esi, dword [ebx]
inc ecx
mov edx, 0x6a198ab6
inc ebx
mov esi, dword [esi + edx - 0x6a198ab6]
inc ecx
movzx eax, dx
inc ebp
movzx eax, dl
inc ecx
mov ebp, edx
dec eax
lea ebx, [ebx + eax*2 - 0x11568]
dec ecx
sal edx, 0x4d
mov dword [ebx + eax*2 - 0x1156c], esi
jae 0x1341793
inc esp
mov edi, ebp
ja 0x1316f5f
inc ecx
push ecx
inc cx
xor esi, 0x8d4a8608
add al, 0xcd
pop ds
ret
xor edx, ebx
rol eax, cl
bswap edx
sub eax, eax
ror al, 0x26
rol edx, 2
lea edx, [edx + eax*2 + 0x2d8f6786]
add cl, cl
and ecx, ecx
mov dword [esp + eax], 0x57a0ed26
xor edx, 0xbe918bbd
shr ax, 0x81
pop eax
xor ebx, edx
add ebp, edx
dec cl
xor ecx, eax
movzx eax, byte [edi + ecx - 0x57a02571]
movsx edx, cx
and dx, cx
lea edi, [ecx + edi - 0x57a02570]
sbb cl, ch
not ecx
xor al, bl
sal edx, 0xb9
inc al
jmp 0x122444b
Function at 0x137d9b4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
ror dh, 0xa6
inc esi
xchg dword [esp + ecx*2 - 0x102f904a], esi
dec eax
arpl cx, cx
dec edx
mov dword [esp + ecx*4 - 0x205f20ac], 0x349aef94
dec esp
add ebp, ecx
dec esi
mov esp, dword [ebx + ecx - 0x817c82b]
sar bp, 0x21
inc esi
adc edx, dword [ebx + edi*8 - 0x7fffc38]
inc eax
shl dh, 0x44
dec edx
lea ebx, [ebx + ecx*2 - 0x102f904a]
inc edi
mov dword [esp + ecx*4 - 0x205f20ac], edx
inc cx
inc eax
call fcn.0132eb95
xor ecx, 0x6b8acb02
mov edx, 0x4d2c7a1a
dec ecx
neg dword [esp + edx - 0x4d2c7a1a]
jb 0x13a1137
mov ecx, 0x978026b5
mov ecx, dword [edi]
mov eax, 0x5414212d
lea edx, [eax*8 + 0x7eb2011b]
xor ecx, ebx
jmp 0x13a0b2a
add dl, al
inc ecx
sal edx, 0xe2
adc edx, 0xc1232b17
bswap ecx
shr eax, 0xe1
neg ax
sar edx, 0xbe
ror ecx, 3
inc ecx
xchg edx, eax
xor ebx, ecx
shl edx, 0xcb
call fcn.0138dca5
ror ecx, 2
sub dword [esp + edx - 0x4d2c7a1a], 0x6a3ff100
bswap edx
pop eax
sbb ecx, 0xfc8684ad
xor ebx, ecx
or dx, dx
dec edx
jbe 0x13ed9d7
adc ebp, ecx
mov eax, dword [edx + esi - 0x1a7a2c4c]
movzx ecx, dl
call fcn.013c626d
mov ax, word [eax + esi - 0x2c2ddd9b]
push 0xd6afa320
mov dword [esp], 0x6fa58d24
mov cl, byte [esi + 2]
and dword [esp + 4], 0x17a6bea1
pop edx
adc esi, 2
or dl, dh
rol edx, 0xb4
js 0x138c39f
inc sp
mov dword [ebx], ecx
dec eax
lea ecx, [esi + ebp*8 + 0x65865f92]
dec ecx
sbb ebx, 4
ror ax, 0xcc
sbb dl, 0x1c
setne al
inc ecx
mov eax, dword [ebx]
xor eax, edi
push ebp
inc eax
xchg ch, dl
ror eax, 3
inc esp
movzx esi, dh
dec ecx
not eax
inc ebp
movzx edi, ax
inc ecx
lea eax, [eax + eax + 0x6a2f08c7]
inc ecx
push esi
inc dx
sal dword [esp + esi*2 - 0x143], 0x43
dec ecx
sub edi, 0xce25fdbb
neg eax
inc ecx
mov edx, 0x9d86a7af
inc eax
dec ebx
lea ecx, [esi + esi*4 + 0x502766b7]
dec ecx
inc edx
not eax
inc ecx
shr esi, 0xd6
dec eax
mov dword [esp + ecx - 0x502769f2], edi
inc edx
xor dword [esp + esi + 8], eax
dec eax
mov edi, dword [esp + ecx - 0x502769f2]
dec ecx
add ebp, esi
dec eax
arpl ax, ax
dec esp
adc ebp, eax
dec eax
mov dword [esp + ecx - 0x502769f2], ecx
dec ecx
sar edi, cl
dec esi
mov dword [esp + esi], ebp
ret 8

Function at 0x1384525
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec ebx
lea ebp, [edx + edx*4 + 0x368e7209]
inc esp
xor ecx, edi
inc eax
movsx eax, ch
dec esi
mov dword [esp + edi - 0x48ae670a], edx
inc ecx
neg ecx
inc ecx
dec dl
inc ecx
ror ecx, 1
shl al, 0x27
inc ecx
sub ecx, 0xa393873a
mov ecx, 0x8fb8bb2d
inc ecx
rol ecx, 3
ror ecx, cl
inc esi
mov esp, dword [esp + edx*4 - 0x24]
call fcn.01236b0f
mov edx, 0x540fa18f
mov edx, dword [esi + edx - 0x540fa18f]
call fcn.0122b186

Function at 0x138a338
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
inc al
sub ebp, 0xae155791
dec edi
lea ebx, [ebx + edx*4 - 0xd]
inc ecx
pop edx
dec eax
mov dword [esp + eax - 0xef841b2], edx
dec eax
xor esi, edi
not word [esp + ebp - 0x51eb24ed]
dec eax
neg esi
jmp 0x13ce016
Function at 0x138e13a
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jne 0x133da5c
mov eax, dword [ebp]
push 0x59a32128
lea esp, [esp + 4]
call eax
jmp 0x13eba06
lea edi, [edi + ecx*2 - 0xe]
xor edx, ebx
ror dword [esp + ecx - 5], 0xb7
not eax
lea edx, [edx + eax*8 - 0x4433e7d4]
ror edx, 3
neg ecx
ror al, 0xe1
dec edx
inc eax
dec dword [esp + eax*2 - 0x47bc1f3a]
not edx
or eax, dword [esp + eax*2 - 0x47bc1f3e]
pop ecx
inc edx
xor ebx, edx
neg dword [esp + ecx - 0x8e4f99]
call fcn.0139a13a
lea esp, [esp + 0xc]
je 0x13051a8
mov eax, 0xc03b1090
dec eax
mov eax, dword [ebp + ebx*4]
push eax
call fcn.0130519d
mov ebp, dword [ebp - 4]
mov ebx, 0x8e4f99
lea edx, [ebx + ebx*4 + 0x1124f31c]
mov dword [ebp + ebx - 0x8e4f99], eax
bswap edx
movzx ecx, bx
mov esi, ebp
sar ecx, 0x6b
push ebx
mov ebx, dword [esp + ebx - 0x8e4f95]
mov ebp, dword [esp + edx*2 - 0x3303d81e]
lea eax, [edx + ecx*2 - 0x3d5ffb63]
mov edi, dword [esp + edx*2 - 0x3303d81a]
mov dword [esp + edx - 0x1981ec0b], ecx
pop edx
mov dword [esp + edx - 0x8e4f99], edx
mov edx, dword [edi + edx*4 - 0x2393e64]
jb 0x124a638

Function at 0x1390583
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
arpl si, si
dec esp
adc ebp, esi
dec esi
mov dword [esp + ecx - 0xf0], ecx
inc cx
dec edi
dec edi
lea ebx, [ebx + ecx - 0xf4]
jp 0x1392ad8
call fcn.013707ce

Function at 0x13905a3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x43201127
lea esp, [esp + 4]
jne 0x138c6f1
mov dword [esp], eax
jp 0x13c229f
js 0x13f86ef
dec ebx
jmp 0x121ff95

Function at 0x1398939
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [esi]
movzx eax, byte [edi]
mov ecx, 0xfa25d9aa
mov dword [esp], 0xf633d31f
xor al, bl
sub cl, byte [esp + 1]
xor al, 0x3b
add al, 0x1e
add cx, cx
shr cl, 0x61
xor al, 0x13
call fcn.017bf8e4

Function at 0x1399321
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec esp
lea esi, [eax*8 + 0x1b25f08]
inc ecx
pop esi
dec edi
lea ebx, [edx + ebx - 0x11]
inc edx
neg byte [esp + edx - 3]
inc edi
mov dl, byte [ebx + edx*4 - 0x40]
inc ecx
dec eax
inc esp
xor dl, bh
inc ebp
movsx esi, di
dec ebp
lea eax, [esp + 0x5e800090]
dec ebx
lea ecx, [ecx + eax*4 - 0x6ff72e77]
inc ecx
inc dl
dec eax
bswap eax
dec ecx
shr esp, 0x3d
inc ecx
ror dl, 1
call fcn.0122b83b

Function at 0x139ef07
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
shl bh, 0x41
inc cx
ror ecx, 1
dec eax
neg edx
inc cx
neg ecx
inc cx
not ecx
dec eax
mov dword [esp + ebp - 4], edx
and ax, 0x2793
jle 0x136eb5b

Function at 0x13a063e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc eax
sub byte [esp + edx - 0xf534f43], dh
call fcn.01258cf8
mov ecx, 0xcd16ad3b
call fcn.013b71be
Function at 0x13a0655
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov word [esp + edx*4 - 0x40280e78], dx
rol eax, 1
rol dl, 0x26
lea eax, [eax + edx - 0x590f61cf]
rol eax, 1
sub dword [esp + edx - 0x100a03a7], 0x6e16aa8a
not eax
lea edx, [ecx*2 - 0x49fef5d8]
neg dx
inc eax
sub dl, 0x10
call fcn.01308d07
mov eax, 0x33138bb1
pop eax
mov eax, dword [ebp]
call fcn.01314c94
dec ecx
sub ebx, 4
inc ecx
mov ebp, dword [ebx]
inc ecx
mov edi, 0x400df5b4
inc ecx
neg bh
inc ecx
movzx edx, bh
xor ebp, edi
bswap ebp
jmp 0x17bc451
inc ecx
sar edi, 0xf9
inc ebp
mov eax, edi
ror ebp, 1
dec ebp
push edi
inc edx
xor dword [esp + edi - 0x20], ebp
pop edi
inc ecx
xadd edi, edx
dec eax
arpl bp, bp
dec ecx
sbb edx, edi
not dl
inc ecx
push edi
dec esp
add ebp, ebp
dec ebp
mov edi, dword [edi + ebx - 0x6c]
movsx ebp, byte [esp + edx + 0xb7]
inc ecx
mov esp, 0x46059a97
inc cx
movzx edx, byte [edi + edx + 0xb5]
dec edi
lea esi, [esp + eax + 0x72bf6814]
inc cx
not esp
shl eax, 0xd9
dec eax
lea ebx, [eax + ebx + 6]
mov word [eax + ebx], dx
jbe 0x13e261a
movsx ecx, word [esp]
mov word [esi - 2], dx
sal dword [esp], cl
mov eax, dword [edi + 1]
movzx edx, cx
shl dword [esp + edx - 0x8e39], 0xba
xor eax, ebx
xor edx, 0x100a8da7
jno 0x1308b71
dec ecx
sar eax, 0x6f
dec esp
mov dword [esp + eax*4], ebp
ret
inc ecx
movzx eax, di
not ebp
inc esp
movsx esi, dl
inc esp
movzx ecx, dx
inc ecx
sub al, dh
dec ebp
jmp 0x13d1f7b

Function at 0x13a0fb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
mov dword [edx + ebx - 0x4ab76100], esi
dec eax
xor esi, 0x2f06fdae
call fcn.01392a9b

Function at 0x13a116b
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck

Disassembly:
pop edx
pop edx
pop ecx
jae fcn.0124cf7b
movzx ecx, byte [edi + ecx - 0x2ab9a735]
adc edi, 1
xor cl, bl
and eax, 0xb4a50a1d
mov dword [esp], eax
inc cl
rol cl, 1
rcl eax, 0xc1
movsx edx, ax
neg dword [esp + edx*4 - 0x206c]
shr dword [esp + edx*8 - 0x40e2], 0x41
dec cl
not dx
sar edx, 0xe9
shr edx, 0xb
ror cl, 1
xor bl, cl
sal ax, 0x48
ror al, 0xe4
lea esi, [edx + esi - 2]
xadd eax, edx
mov word [esi], cx
shl edx, 0x9d
shr dx, 0x4f
je 0x12ff949
inc cx
jb 0x13a1247
cwde
push eax
xchg ebx, eax
mov dword [edx - 0x6a574ffd], eax
nop
mov cl, 0x3f
adc byte [edx + 0x7d66cdbf], 0xd7
jg 0x13a1184
outsd dx, dword [esi]
push edx
shl byte [ebp + 0x37], 0xbd
outsd dx, dword [esi]
push edx
sar byte [ebp + eax*8 - 0x634689fb], 0x7a
inc ebx
inc ecx
push edx
mov ah, 0x3f
invalid
cmp eax, dword [ecx]
fimul word [edx + 0x13bcf95]
push cs
insd dword es:[edi], dx
iretd

Function at 0x13a1e8f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebp
xor edx, eax
inc ecx
sar dh, cl
inc ecx
neg edx
dec esi
mov dword [esp + ecx], edi
dec edx
mov dword [esp + ecx + 0x10], edi
push esi
inc esi
xor dword [esp + ecx + 0x18], edx
inc edx
shl dword [esp + ecx*4], 0x10
call fcn.0137dda8
Function at 0x13a1eb1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
bswap eax
ror eax, 2
call fcn.0137fb9f
lea eax, [edx*4 + 0x5f882d37]
or eax, dword [esp + edx - 0x82b4cc8]
inc cx
call fcn.0134afb6
mov ecx, 0x7fb3d438
dec esp
mov edi, dword [ebx + ecx - 0x7fb3d438]
mov cl, byte [ebx + ecx - 0x7fb3d430]
inc ecx
mov esi, 0xe02227aa
inc ecx
movsx esi, dh
dec ecx
shl edi, cl
inc ecx
sar esi, 0xda
call fcn.01357b88
inc ecx
mov esi, 0xb8a330aa
call fcn.0122f2f7

Function at 0x13a47d3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
not ebp
inc bp
and edx, eax
inc cx
xor esp, 0xf440e9f
mov esi, 0x4e5041f1
xchg dword [esp + esi + 0xe], ecx
inc sp
xor esp, ebp
call fcn.013f9639

Function at 0x13a47f4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
ja fcn.01391c17
mov edx, dword [edi + 1]
add dword [esp + 4], eax
call fcn.013d478d

Function at 0x13a9263
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
xor bh, cl
dec esi
lea esi, [edx*4 - 0x4a799f4f]
dec esi
lea ecx, [esp + ecx + 0x18]
inc ecx
pop edi
inc esp
movsx eax, bp
inc ebx
mov dword [eax + ecx - 0x2763], edx
inc cx
sar eax, 0x45
inc edx
rol byte [esp + eax - 0x131], 0x44
dec edi
lea ebx, [ebx + eax*2 - 0x27a]
inc eax
adc ch, 0xc
inc esi
movsx esp, byte [esp + eax*8 - 0x9ce]
dec edx
sal dword [esp + eax*2 - 0x26f], 0x90
inc ebx
mov esi, dword [ebx + eax - 0x13b]
xor esi, edi
inc ecx
shr esi, 0x59
jne 0x138aa83

Function at 0x13af8eb
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pushfd
mov ebx, 0x2912c80a
shr ebx, 0x33
jb fcn.017ab6ac
mov dword [esp + 0xc], 0x7719a259
mov ebx, dword [esp + ebx*4 - 0x1480]
jae 0x139553c
mov eax, 0x62bcaba4
call fcn.013fb077
lea eax, [edx*2 - 0x26d7867e]
lea esi, [edx + esi - 0x53abcf11]
dec cx
pop eax
pop ecx
pop edx
jl fcn.0124cf7b
Function at 0x13bdbfb
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc edx
add dword [esp + edi - 0x308d43d], 0x988b8b31
bswap eax
inc ecx
rol bh, 0xe4
jne 0x125472a
inc si
add eax, dword [eax + ebx - 0xb933902]
mov esi, eax
push eax
inc sp
xor eax, edi
inc esp
mov esi, dword [esp + eax*2 - 0x17267200]
inc ecx
dec esi
inc cx
not eax
shr dword [esp + eax*2 - 0x17267200], 0xc1
dec byte [esp + esi*8 - 0x5c99c800]
inc cx
inc eax
inc cx
ror eax, 1
jmp 0x13e27f2
dec edx
mov dword [esp + edi*8 - 0x1846a718], edi
inc edx
xor dword [esp + edi - 0x308d4e3], eax
inc ebp
mov edx, ecx
pop edi
dec eax
lea ecx, [edx + 0x7b8c088f]
dec eax
arpl ax, ax
movzx ebp, dl
dec esp
add ebp, eax
dec esi
mov edi, dword [ebx + edi - 0x308d4e3]
mov esi, ecx
inc si
mov eax, dword [ebx + eax*2 - 0x4216]
push esi
dec edx
lea ebx, [ebx + ecx*2 - 0x14]
xchg ecx, edx
inc bp
mov dword [edi + edx*2 - 0x6964533c], eax
dec esp
mov dword [esp + edx*2 - 0x6964533c], ebp
ret
mov dword [esp], 0x76dedc89
call fcn.01362e5c
loop 0x13bdc64
xor al, 0xe8
imul eax, dword [ecx], 0x29
salc
sub ch, byte [ebx - 0x1f3ebe9a]
inc cx
shl eax, 0xee
dec eax
mov dword [esp + edx - 0x674ec], edi
dec esp
mov dword [esp + edx - 0x674fc], edx
dec edx
lea eax, [eax*8 + 0x3f881a3c]
inc ecx
dec ecx
xor dword [esp + edx - 0x674ec], ebp
and eax, dword [esp + edx*4 - 0x19d3ed]
dec eax
mov edi, dword [esp + edx - 0x674ec]
jl 0x1244f27
dec esp
mov dword [esp + edx*2 - 0xce9f0], esi
push edx
dec eax
arpl bp, bp
inc ecx
inc dl
call fcn.01342904
jmp 0x45c9af74
inc cx
neg eax
inc cx
not eax
call fcn.01325947

Function at 0x13c239d
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec eax
push ecx
sar cx, 0x66
not eax
and edx, dword [esp]
or word [esp + 4], cx
xor eax, 0xa187d817
not eax
shl dword [esp + 1], 0xc7
cmova edx, ecx
inc dl
bswap eax
jb 0x13d7f07
salc
inc esi
xor ecx, ecx
pop edx
das
sbb eax, 0xf0257029
shr cl, 0xc7
mov dword [esp + ecx*8 - 0x76ade008], 0x3a9aa2b0
shl ecx, 0xe4
rol eax, 1
add dl, 0x8b
ror dword [esp], cl
jp 0x131753a
or dl, byte [esp + 6]
rol dword [esp + 4], 0x9f
xor ebx, eax
sal edx, 0xfc
add ebp, eax
rdtsc
pop ecx
xor cl, ch
sbb esi, 8
mov dword [esi + 4], eax
shr word [esp], 1
lea ecx, [ecx - 0x7f7af845]
mov dword [esi], edx
lea edx, [ecx*2 + 0x7584260a]
cmovo ecx, edx
pop ecx
jne fcn.0124cf7b
Function at 0x13d14e4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jae 0x1312ef6
mov word [esi + eax - 0x3f808675], dx
call fcn.01232e5a
dec ecx
sub ebx, 4
inc ebp
mov eax, dword [ebx]
inc esp
xor eax, edi
inc ecx
sub eax, 0x27af0aad
inc ecx
mov esp, 0x98062e8d
call fcn.013eb998
mov si, word [ebx]
inc ecx
mov esi, 0x523c4793
call fcn.013eaf98
inc ecx
mov esi, 0x2b17dfb5
dec edx
lea edx, [esi*8 + 0x7983fa0e]
inc ebp
movsx edi, dh
dec edi
lea ebx, [esi + ebx - 0x2b17dfb9]
inc edi
mov edi, dword [ebx + esi*2 - 0x562fbf6a]
call fcn.013c5007
lea edi, [edi + eax - 0xfc]
dec dword [esp + eax*2 - 0x1f6]
xor dl, bl
inc dl
sub byte [esp + eax*2 - 0x1f2], ah
xor word [esp + ecx*2 - 0x615e01f8], ax
rol dl, 1
bswap eax
dec dl
or al, 0x8c
add eax, 0xe5b8599d
sbb ax, 0x4fb5
ror dl, 1
xadd dword [esp + ecx*2 - 0x615e01f8], eax
shl ecx, 0x43
xchg dword [esp + eax - 0x3f8000fd], ecx
xor bl, dl
sar cx, cl
add ax, word [esp + eax - 0x3f8000fb]
lea esi, [esi + eax*2 - 0x7f010cec]
setg cl
js 0x122afe8
mov dword [esp + eax*8 - 0x7e8], 0xb71d3b02
movzx edx, byte [edi + eax*8 - 0x7e8]
jmp 0x134b06b

Function at 0x13d1f67
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not edx
dec edx
mov dword [esp + edi - 0x6634090f], 0x26a86583

Function at 0x13d20e0
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
xor eax, ebx
shr dword [esp + 8], 0x2d
dec eax
inc ebp
xor eax, 0x2629f982
dec ecx
dec esi
dec eax
lea esp, [esp + 0x10]
jne 0x123dd81
mov edx, 0x4b0c6d32
inc ecx
pop ebx