joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd30bc0
Capabilities:
Encode data using xor

Disassembly:
neg ecx
bt ax, dx
sub al, al
shr ax, 1
xor ecx, 0xcc1a1522
btc eax, eax
dec edx
sar eax, 0x35
xor ebx, ecx
idiv dl
ror ax, 0xc1
add ebp, ecx
imul ax
btr ax, 0xb6
shr al, 0x86
movzx dx, byte [edi + eax - 0x2a02]
mov ecx, 0x8788d602
dec ecx
push eax
mov cl, byte [edi + eax*4 - 0xa800]
shr dl, cl
bswap eax
push eax
lea ecx, [eax + eax*2 + 0x2cb6fea2]
mov word [edi + eax*2 - 0x540000], dx
movsx edx, ax
mov dword [esp + eax - 0x2a0000], ebp
ret 4
inc cx
dec ebp
inc bx
mov dword [esi - 0x4813ea72], ebp
inc edx
movsx eax, byte [esp + ecx*2 - 0x40]
inc ecx
pop esp
pop eax
inc ecx
pop esp
jg fcn.012e2664
mov edx, 0xfeb1841d
movsx eax, dx
rol dl, 1
movzx edx, byte [esi]
xor dl, bl
rol dl, 1
neg dl
add eax, eax
rol dl, 1
add dl, 0x12
movzx ecx, al
xor bl, dl
add edx, esp
mov cl, byte [edx + ecx - 0x3a]
mov word [edi - 2], cx
movsx ecx, al
dec cl
mov ecx, dword [esi + ecx - 0x38]
sub esi, 0xfffffffb
xor ecx, ebx
bswap ecx
rol ecx, 2
lea edx, [eax + eax*8 - 0x34f7c8f7]
and eax, 0x11846bbe
jne 0xccab25
mov byte [esi], cl
or al, 0x13
sub eax, 0xe2103ef7
adc ebx, dword [ebp - 0x1defed78]
adc ebp, dword [0xe21016ff]
adc ebp, dword [ebp - 0x1deff9b4]
adc esi, ebp
invalid
Function at 0xd39faa
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
imul ax, ax
dec edx
cbw
ror edx, 2
xor ebx, ecx
add edi, ecx
lea ecx, [edx + eax*8 - 0x6dc8e2d8]
mov ecx, dword [eax + esi - 0x1000181b]
btc ax, 0x3a
mov edx, dword [esi + edx - 0x38a33032]
sub eax, eax
mov dword [esp + eax], 0x5280831d
cbw
adc ecx, edx
dec word [esp + eax]
mov dword [esi + eax*4 + 4], ecx
movzx edx, word [esp + eax]
rdtsc
mov dword [esi], eax
mov dword [esi - 4], edx
shl dword [esp], 0xba
mov ecx, dword [esp]
lea esi, [esi + ecx - 0x70000004]
jbe 0xd29af6
lea eax, [ecx*8 + 0x430e9ebe]
movzx edx, cl
pop edx
jae fcn.014f8c0e
Function at 0xd4051d
Capabilities:
Encode data using xor

Disassembly:
rol dword [esp + edx*2 - 0x1d33bfd6], 0x59
xor eax, 0x207d50e
inc eax
sal word [esp + edx*4 - 0x3a677fba], 0xe1
shr dx, 0xac
xor eax, 0x433fb122
sal dword [esp + edx - 0xe99000b], cl
neg eax
shl byte [esp + edx*2 - 0x1d32000f], 0xc7
inc eax
push ecx
rol eax, 1
inc eax
neg eax
or dl, byte [esp + edx - 0xe990004]
pop edx
setae cl
not eax
xor cl, 0xae
add ecx, 0xcb149310
push ecx
dec eax
xor ebx, eax
xor cx, 0x6602
call fcn.0135c935
pop edi
wait
push esi
daa
adc eax, 0x360caccd
inc ecx
out dx, al
out dx, eax
stosb byte es:[edi], al
fisub word [0x1375e7b]
push edx
invalid
and eax, eax
mov dword [esp + eax*2 - 0x13912fa8], eax
dec cl
not cl
dec cl
mov dword [esp + eax*4 - 0x27225f4c], eax
rol eax, 0x47
or eax, eax
not cl
lea eax, [eax + eax*8 + 0x758e14a0]
inc cl
cwde
rol cl, 1
add cl, 0x9d
not dword [esp + eax*8 - 0x27617]
inc al
xor bl, cl
ror eax, 0xe2
lea ecx, [esp + ecx + 0x14]
mov dword [ecx + eax - 0x400013b1], edx
pop edx
mov ecx, edx
mul cx
mov eax, dword [edi + eax - 0x4000b59a]
lea edi, [edx + edi - 0x9c80bb3]
add edx, edx
js 0x1411f36
xor eax, ebx
add edx, dword [esp + ecx - 0x9c897d3]
jno 0xd199d0
sub ebp, 4
mov edx, 0x8118781b
movzx ecx, dl
not edx
mov ecx, dword [ebp + ecx*2 - 0x36]
xor ecx, ebx
push edx
lea eax, [edx + edx*2 + 0x6e329d9b]
xadd dword [esp + edx - 0x7ee787e4], edx
bswap ecx
jge 0x15047d1
mov eax, 0xd70153a5
mov ecx, dword [edi]
dec al
jno 0x1524cb5
lea eax, [eax + eax*2 + 0x443a4336]
add edi, 4
bt ax, 0xc
lea edx, [eax + eax*2 + 0x3522fd25]
shr dx, 0x6c
xor ecx, ebx
imul dx
xor eax, 0xc92f4215
sal eax, 0x83
ror ecx, 3
not edx
xor ecx, 0xb62660a0
ror ecx, 2
cwde
xchg dh, dl
rol eax, 0x26
not ecx
cwde
sal dl, 0x45
dec ecx
btr eax, edx
ror ax, 0xc5
neg ecx
xor ebx, ecx
xor eax, eax
adc ebp, ecx
movzx ecx, byte [edi + eax]
cbw
rol edx, 0x2e
lea edi, [edi + eax*2 + 1]
bswap eax
lea edx, [eax*4 + 0x7a0a09af]
call fcn.014a4898
Function at 0xd40fdc
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
sbb ebp, 3
mov eax, dword [ebp]
xor dl, dh
cmovle dx, cx
push ecx
xor eax, ebx
sub eax, 0x378fd500
call fcn.014f7f01
lea esp, [esp + 0xc]
je 0x130898b
mov eax, 0xd93f800f
rol eax, 0x4a
setae al
mov eax, dword [ebp + ebx*4]
jae 0x1313d3a
bswap edx
mov edx, dword [esp + 0x18]
lea ecx, [ecx + ecx*2 - 0x23d38c00]
call fcn.00d9fd03
mov eax, 0x3b0b600
inc eax
lea edx, [eax - 0x57c1e6d2]
mov edx, dword [esi + eax - 0x3b0b601]
movzx ecx, al
call fcn.00c560b5
je 0xd41099
add eax, 0x445382f4
invalid
retf 0xaa62
bound ebp, qword [edx + 0x32585ea1]
imul esp, dword [edx + 0x3a585ea1], 0xffffffda
mov bh, 0x89
inc dword [ebp + 0x1474659]
mov ch, 0x5f
and byte [ebx], ah
or eax, 0xa15a443
stosb byte es:[edi], al
mov eax, dword [0x6b32585e]
mov byte [0x3a585ea1], al
fidiv dword [edi + 0x5985ff89]
inc esi
inc edi
add dword [ebp + 0xd23205f], esi
inc ebx
movsb byte es:[edi], byte [esi]
adc eax, 0xde7f530a
push ebx
jg 0xd41097
pop ebx
xor dl, byte [ebp - 0x5d8faec7]
jge 0xd410f9
arpl word [esi], si
mov cl, 1
movsd dword es:[edi], dword [esi]
add eax, 0x1d3ffe8b
jnp 0xd41098
aas
sbb eax, 0xe14cc97b
in al, 0xdc
wait
leave
dec esp
loope 0xd410df
dec esp
loope 0xd410b6
fcomp qword [ebx + 0x7e14cc9]
div byte [edx - 0x3660835d]
shl dword [esi - 0x3d], 1
sti
je 0xd410e5
ret
pop ecx
and dword [0xba1eb337], 0x3b
or eax, 0x111eb337
jecxz 0xd4114e
push ss
push ds
test dword [eax], esp
inc eax
insd dword es:[edi], dx
jo 0xd410cb
inc esi
add ecx, eax
inc edx
push ebp
cwde
lahf
popfd
dec ecx
xchg ecx, eax
test al, 0xf5
or al, 0x32
lahf
jbe 0xd410d0
hlt
jecxz 0xd41193
aad 0x26
or dword ss:[ecx - 0x778550b], 0xf81b9f1a
xchg dword [ebx - 0x2c], esi
xchg ebx, eax
dec esp
adc dword [ebx + esi + 0x3f6e7844], esi
ror dword cs:[edx + 0x4b3b6bf5], cl
int3
pop eax
sub byte [edx + 0x74], cl
and bh, byte [edx]
inc ebp
scasd eax, dword es:[edi]
shr ebp, 0x90
invalid
push 0x2285fd0d
push 0x51821a97
mov eax, dword [ebp]
push 0xab278ba4
lea esp, [esp + 0xc]
call eax
mov esi, 0x8a0d739b
mov edi, esi
mov ebp, dword [ebp - 4]
movsx ecx, di
shr di, 0x81
mov dword [ebp + ecx*2 - 0xe736], eax
bts di, di
mov esi, ebp
pop ebx
mov edx, edi
pop edi
lea eax, [ecx + ecx*8 - 0x48c3e7e5]
mov ebp, edx
pop ebp
add cl, cl
lea ecx, [eax*8 + 0x1f2a842e]
jb 0xb8b9f8
lea esi, [esi + eax*4 - 0x1e5fb]
xor cl, bl
movzx edx, al
sub ax, ax
cdq
ror cl, 1
neg dl
cwde
neg cl
cbw
dec cl
mul al
inc eax
rol dx, 0x29
ror cl, 1
add cl, 0x3c
lea eax, [eax + edx*8 - 0x66d02cfa]
neg cl
xor bl, cl
add ecx, esp
shr al, 0x42
mov eax, dword [ecx + edx*8]
mov dword [edx + ebp], eax
movsx eax, dx
je 0x129ecdd
or edx, edi
jmp edx

Function at 0xd4558c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shrd eax, edx, cl
mov edx, dword [esp + 4]
movzx ecx, dx
call fcn.0129b16e
mov eax, 0xcea3d71b
push eax
sal byte [esp + 1], 0xc7
mov edx, dword [esi]
add ax, ax
movzx ecx, ax
cwde
lea esi, [esi + ecx*2 - 0x15c68]
push eax
ror cl, 0x81
xor edx, ebx
sal eax, 0xc3
sbb edx, 0xb8382324
sar dword [esp + ecx - 0xae1b], cl
bts ecx, 0x8f
jb 0x155617a
Function at 0xd9bc36
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push eax
xor cl, 0x8d
dec ax
not cl
inc ax
add cl, 0xa0
mov dword [esp + 4], 0x32a501bf
neg eax
push eax
xor bl, cl
ror dword [esp + eax - 0x27fffff9], 0x65
neg al
setae al
lea ecx, [esp + ecx + 0xc]
shl byte [esp + eax - 0x27fffef6], 0x24
and eax, eax
shr eax, 0x3e
mov dword [ecx + eax], edx
movzx edx, byte [esp + eax*2 + 8]
bswap eax
mov edx, dword [ebp + eax + 4]
ror ax, 0x24
lea ebp, [ebp + eax*2 + 8]
movzx ecx, byte [edi + eax*4 - 2]
bts eax, eax
shr dword [esp + eax + 3], 0x79
call fcn.012e65cb
Function at 0xda34ef
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sets byte [esp + eax - 0x2e86bb77]
xor ecx, 0x660ed890
bts ax, ax
and eax, 0x60a9b0aa
dec edx
inc ecx
shl dl, 0x25
xor ecx, 0xfd28e09a
sar word [esp + eax*2 - 0x41016049], 0xad
neg edx
neg ecx
call fcn.00da13b5

Function at 0x12a0151
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.00da18c5
ror ecx, 0x5d
xor edx, 0xc3a9930f
neg ax
ror byte [esp + 3], 0xc3
neg edx
and al, al
and dword [esp], eax
ror edx, 1
inc eax
sets cl
not edx
jno 0x12da1fb
add ecx, ecx
xor byte [esp + 2], 0xaf
rol edx, cl
jmp 0x141cac5
pop eax
jmp ebp
btr eax, ecx
shr ecx, cl
xor ebx, edx
sal word [esp + ecx*2 - 0x73ebae00], 0x63
adc ebp, edx
lea edx, [ecx*8 - 0x2bfde27f]
dec word [esp + ecx - 0x39f5d6ff]
cmovp eax, ecx
mov ax, word [ecx + edi - 0x39f5d6fe]
inc cx
sub dword [esp + ecx - 0x39f5d701], edx
lea edi, [edi + ecx*2 - 0x73ebadfe]
or ecx, 0xe28e7eaf
shr edx, 0xfe
setnp cl
lea edx, [esp + edx + 0x1a]
rol dword [esp], cl
xadd byte [esp + 2], cl
mov word [edx], ax
js 0x13ef3e9
Function at 0x12a5c24
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov word [edi + edx - 0x49284c4e], cx
mov ecx, dword [esi + edx - 0x49284c4e]
neg eax
div dl
lea esi, [esi + eax*8 - 0x3ad1ef6c]
inc eax
rol al, 0x21
xor ecx, ebx
xadd al, dl
imul eax, eax
not ecx
sal dl, 0x22
shr dx, 0x21
call fcn.01463cdb
xor ebx, edx
add edi, edx
xadd word [esp + 6], cx
xor eax, 0x802e2f2c
sal ecx, cl
mov dword [esp + ecx - 0x6785a980], edi
ret 8
movzx cx, byte ss:[eax + ecx*2 - 0x6538034e]
mov edx, 0x24a13139
movzx eax, dx
lea edi, [edi + edx - 0x24a13137]
rol edx, 0xde
or eax, 0xf8a5b707
jno 0xc5c959
dec eax
mov dword [esp], 0xe80c1fb3
dec eax
sub esi, 4
mov ebx, 0x4715a0a1
inc esp
mov esp, dword [esi + ebx - 0x4715a0a1]
movzx eax, bx
inc ecx
mov eax, 0x4636ee1a
inc ebp
xor esp, edi
dec esi
lea ebx, [eax*4 + 0x701edaa4]
dec eax
inc word [esp + eax - 0xa09b]
inc ecx
not esp
movsx ecx, byte [esp + ebx - 0x4715a0a1]
sal byte [esp + ebx - 0x4715a09b], 0x41
inc ebp
lea esp, [esp + ebx*2 - 0x370bb891]
inc sp
add dword [esp + eax*2 - 0x1413f], ebx
sar eax, cl
inc esp
sbb dword [esp + eax], eax
inc ecx
xor esp, 0x563e29a7
inc ecx
not esp
dec edi
lea ebx, [ebx + ebx*8 - 0x2cfb316d]
dec esp
mov dword [esp + eax*4], edi
dec ecx
btc eax, ebx
inc esp
xor dword [esp + ebx - 0x4715a0a1], esp
inc ecx
inc bl
inc ebp
mov ebp, ebx
dec esi
lea edi, [eax*2 + 0x4bb6d1a0]
inc ecx
pop edi
cbw
inc ecx
sar ebp, cl
cdq
dec ebp
arpl sp, sp
cbw
dec ecx
neg ebx
dec ecx
add edi, esp
call fcn.013757b5
mov eax, 0x3e0ea7af
sub eax, eax
movsx ecx, al
mov edx, dword [ebp + eax*4]
ror al, 0x21
push eax
dec ecx
or eax, dword [ebp + eax + 4]
pop ecx
ror ecx, 0xcc
inc ecx
adc edx, eax
mov dword [ebp + ecx + 3], edx
jmp 0x13b0d0c
mov esi, ebp
xor cl, bl
ror dl, 0x84
xadd si, dx
sbb cl, 0x9f
btc edx, 0x8f
lea eax, [edx*2 + 0x181891b8]
ror cl, 1
and ebp, 0xea3516b5
shl eax, 9
call fcn.0156f6e3
lea edx, [ecx + ecx*2 + 0x70862da6]
sar cl, 0x61
mov eax, dword [esi + ecx]
setno cl
lea esi, [esi + ecx + 3]
neg dx
seta cl
xor eax, ebx
sub cx, dx
adc edx, edx
or edx, ecx
inc eax
sal dx, cl
neg eax
xadd edx, ecx
sar dl, 0xc7
xor eax, 0xef2db615
lea eax, [edx + eax + 0x18f4e782]
sal edx, 8
sal edx, 0x75
xor edx, 0x92ba5291
ror eax, 3
add dx, 0xaf20
ror cl, 0xa6
not eax
ror ecx, 0xa1
rol ecx, 0x2c
je 0xc6c5cb
ror eax, 1
lea edx, [edx + edx - 0x606e95c1]
neg eax
jmp 0x14bfc0b
call fcn.0141ad74
mov edx, 0x5fb75c13
lea ebp, [edx + edx*8 + 0xf0066b2]
movzx ecx, byte [esi + edx - 0x5fb75c14]
add ebp, edx
jnp 0x1306017
mov ecx, 0xe3954625
mov ecx, dword [ebp]
mov dl, byte [ebp + 4]
mov eax, 0x739ca037
lea ebp, [eax + ebp - 0x739ca031]
shr ax, 0x28
sub ax, ax
mov byte ss:[eax + ecx - 0x739c0000], dl
bts eax, eax
lea edi, [edi + eax - 0x739c0005]
mov edx, eax
mov ecx, eax
mov edx, dword [edi + eax - 0x739c0001]
call fcn.01494a95
Function at 0x12dc359
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax + ecx - 0x2eaa469b]
cbw
ror edx, 0xe2
mov dword [esp + edx - 0x1e7e8448], 0x263ff313
neg ecx
add dl, al
mul dword [esp + edx - 0x1e7e8407]
sub byte [esp + edx*2 - 0x40d18a84], al
sbb ecx, 0xa30f30be
btc ax, 0xa9
shl eax, 0xbd
xor ebx, ecx
mul dword [esp + edx - 0x2068c542]
add dl, byte [esp + edx - 0x17e7f86c]
xor byte [esp + edx*2 - 0x2fcff129], dh
adc edi, ecx
mov eax, dword [edx + esi - 0x17e7f895]
lea esi, [esi + edx*4 - 0x5f9fe250]
neg edx
xor eax, ebx
neg word [esp + 1]
mov word [esp + 2], dx
sbb dword [esp], edx
ror eax, 1
xor eax, 0x2ea06630
not byte [esp + 1]
and al, 1
movzx ecx, dx
not eax
push ecx
bts edx, ecx
lea eax, [eax + ecx - 0x22b11eff]
call fcn.01502e50
xchg ebp, eax
push edi
add byte [ecx + 0x350d8421], bl
or byte [esi - 0x3fe5b302], 0x56
inc edx
cmp dword [ebx - 0x36], edx
xor dword [esi + 0x42], esp
cmp dword [ebx - 6], edx
and byte [esi + 0x3a533942], 0xa3
cmp esi, edx
imul edx
jnp 0x12dc3d2
and dword [ebp + 0x38], edx
or edi, ebp
invalid

Function at 0x12ddee0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
ror dx, cl
ror cx, cl
mov dword [esp + eax - 0x36e8680], ecx
inc dx
xor bx, dx
neg eax
cbw
neg byte [esp + ecx*2 - 0x1797d]
lea ebp, [ebp + ecx*2 - 0x17982]
mov word [ecx + ebp - 0xbcc0], dx
jns 0x12a00b0
call fcn.013bb1c9
mov ecx, dword [esi]
mov edx, 0x6f82fb12
lea esi, [edx + esi - 0x6f82fb0e]
not dx
movzx eax, dl
xor ecx, ebx
lea ecx, [ecx + edx*2 - 0x5dde52a7]
rol ecx, 3
shr edx, 0x9d
or eax, 0x7e052f00
call fcn.014e1823
retf

Function at 0x12e0984
Capabilities:
Encode data using xor

Disassembly:
jae 0xd1380a
mov dx, word [edi]
mov ecx, 0x45b9a994
not cx
mov cx, word [edi + ecx - 0x45b95669]
mov eax, 0xb831b724
not dx
inc eax
dec eax
not cx
and dx, cx
call fcn.00b833e3
mov eax, 0x9915e22b
inc eax
jno 0x154349b
cmp dword [ebp - 0x6b00e6e], 0x3cff39fd
cmp ebp, 0xfffffffd
cmp edi, edi
mov ah, 0x87
leave
std
cmp edi, edi
je 0xc93a6a
out 0x9f, al
add byte [edi - 4], bh
jg 0xc93aed
jl 0xc93ac3
call [ebx - 0x41135c2c]
or al, 0x5a
cmp eax, dword [ebx - 0x78]
xor eax, 0x91474fb7
wait
aam 0xa3
in al, dx
mov esi, 0x433b5a0c
mov byte [0x91474fb7], dh
fadd dword [ebx + 0x5b]
mov ah, 0xa8
pushfd
and ch, byte [ebx - 0xf2bb7d8]
cmp al, 0xd6
invalid
push 0x40c0ee82
adc dword [edi - 0x70], eax
out dx, al
rol byte [eax + 0x11], 0x47
nop
jo 0xc93b4b
pushal
invalid
in al, 0xdd
xor dword [esi], edi
lodsd eax, dword [esi]
scasb al, byte es:[edi]
xor edi, 0x2ee56250
jl 0xc93aeb
sub dl, 0x67
cmc
mov ebp, 0x1970c1ab
imul esi, dword [ebx + 0xeca0de1], 0x27
push cs
imul esp, dword [ecx + 0x2b], 0x12
pop esi
mov edi, dword [esi]
mov edi, eax
int 0xd7
mov al, byte [0xd7b24719]
push edx
out 0xc0, al
rcl edx, 0xc8
jne 0xc93b21
int3
mov edx, dword [edi + edx*2 - 0x24]
xor edx, ebx
call fcn.0156099b
jmp 0xc93a70
Function at 0x12e09e2
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor ecx, edi
movzx eax, bp
inc ecx
xor ecx, 0x1a807320
mov dword [esp + ebp - 0x211ae07f], 0x5e3218a6
inc ecx
push ebx
inc ebp
movzx edx, bl
inc ebp
lea ecx, [ecx + ebp*2 - 0x76417ea1]
inc ecx
xor ecx, 0x3a2e273e
dec esi
lea edx, [ebp + ebx*2 - 0x1d6e2adc]
inc ecx
inc ecx
movzx ebx, word [esp + ebp - 0x211ae081]
dec ecx
bswap ebx
dec eax
not dword [esp + ebp*2 - 0x4235c0fd]
dec esp
mov dword [esp + eax - 0xe07a], edi
mul byte [esp + ebp - 0x211ae082]
dec esi
lea eax, [ebx + ebx - 0x39fdedd8]
inc sp
or eax, ebx
inc esp
xor dword [esp + ebp*2 - 0x4235c0fc], ecx
mul byte [esp + ebp - 0x211ae082]
inc esp
mov esp, ebp
dec esp
mov edi, dword [esp + ebp*2 - 0x4235c0fc]
mov ecx, dword [esp + eax*2 - 0x40c]
hlt
inc cx
sal edx, 0x29
dec ebp
arpl cx, cx
dec ecx
add edi, ecx
idiv bl
rol al, 0xe7
dec esp
add eax, eax
dec ebp
mov ecx, esi
dec ebp
lea esi, [esi + ebp*2 - 0x4235c106]
dec eax
mov dword [esp + eax - 0x870], ebx
inc bp
mov dword [esi + eax - 0x878], ecx
inc ecx
pop ebx
inc dword [ecx + 0x5b]
inc ecx
pop ebp
jle fcn.012e2664
sbb byte [ecx + 0x20316c07], ah
push 0xffffffffffffffe5
add dword [ecx + eax*2 - 0xc], ebp
in eax, 1
insb byte es:[edi], dx
fnstsw word [esi + esi - 0x2293fe1b]
nop
sub ah, ch
add dword [ebp - 0x3c], ebp
mov al, byte [0x88821412]
xlatb
xor al, 0x93
fcmove st(0), st(0)
pop eax
xor eax, 0x48a538de
in al, dx
mov ebp, 0x71954b25
wait
loopne 0xd3d338
salc
cmpsb byte [esi], byte es:[edi]
jge 0xd3d306
loop 0xd3d30a
mov dword [esi + 0x247320bc], eax
and dword [ebp + 0x2bbe13dd], 0xffffffb4
xchg ebp, eax
insb byte es:[edi], dx
adc eax, 0xa58c6d3e
insb byte es:[edi], dx
adc eax, 0xe53c2d3e
insb byte es:[edi], dx
adc eax, 0x5ad8533e
adc ebp, dword [edx]
or byte [ecx - 0x49f0defc], cl
retf 0xb489
inc esp
mov ebx, ebp
dec edx
lea esi, [esi + ebx*2 - 0x4235c108]
inc esp
mov ecx, dword [esi + ebp - 0x211ae082]
inc sp
btr ebp, ebx
dec esp
mov dword [esp + ebp*2 - 0x4235c104], ebx
jae 0xd3d283
mov ecx, 0xbd3d071f
rol cl, 0xe7
mov eax, dword [esi]
adc esi, 3
mov edx, 0xc2935a38
dec cl
inc edx
xor eax, ebx
bts ecx, ecx
jae 0x13ade42

Function at 0x12e9c94
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0xdd3d3901
mov dword [esp], edi
mov edi, 0x9f97bb9a
movzx edi, byte [edx]
xor edi, ecx
and edi, 0xff
jmp 0x13aa235
jmp 0x1488fac
jmp 0x12fc16a
Function at 0x12f32bb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and bl, ch
pop ebx
pop ebp
movsx edx, cx
movsx edi, cl
dec cl
pop edi
dec edx
lea eax, [edx + 0x6d2f7b0d]
mov eax, dword [edi + ecx*8 - 0x1c978]
imul dx, dx
lea edi, [edi + ecx - 0x392b]
sar cl, 0x44
xor eax, ebx
and dx, cx
xor eax, 0xe7a0c998
sub eax, 0xe314b99d
push ecx
not eax
and cx, cx
jge 0x14e914c
mov edx, 0x503c7d9b
mov ecx, dword [edi + edx - 0x503c7d9b]
xadd dl, dh
ror dx, 0xeb
mov eax, dword [edx + edi - 0x503c630f]
lea edx, [edx*4 + 0x1be9c23]
shr dx, 0xe9
lea edi, [edx + edi - 0x42b0000c]
add edx, 0x829b9abb
call fcn.013b0d7c
inc ecx
movzx ebx, dl
inc ecx
neg ah
movsx ecx, al
inc sp
btc ecx, ebx
dec esi
lea ebp, [ecx*2 - 0x2450a1d0]
inc ecx
ror ah, 1
dec ecx
sal eax, 0x5e
cbw
inc ecx
inc ah
dec ecx
shl ebx, 0x7c
inc ecx
rol ah, 1
inc ebp
xor bh, ah
dec esp
add esp, esp
dec ebp
btr edx, ebp
rol bl, 0x46
dec ebx
mov dword [ecx - 0x1d], edx
jb 0x12f9d40
sub eax, 0x6a6561ed
dec edi
outsb dx, byte [esi]
pop ebx
pop eax
and al, bh
outsb dx, byte [esi]
push esp
xor ecx, edx
push cs
invalid
inc dword [esp + 0xc]
mov esi, dword [esi*4 + 0x142d46c]
shr eax, 8
jmp 0x1517c4a
jb 0xc629c9
bswap eax
lea eax, [edx + eax + 0x5a43ae30]
mov dword [esp + ecx*4 - 0xb0], ecx
neg eax
shr dx, 0xca
ror word [esp + edx - 0x7d3c003d], 0xae
ror eax, 1
add cx, cx
setl byte [esp + ecx - 0x56]
sub dx, 0x9808
not eax
xadd word [esp + ecx*2 - 0xae], cx
sbb ecx, ecx
neg dword [esp + ecx*2]
xor ebx, eax
sar dl, 0x41
inc word [esp + edx - 0x7d3c681b]
add edi, eax
call fcn.01517556
std
stc
mov dl, 0x96
invalid
rol edx, 0x43
bswap eax
xor ebx, eax
and dword [esp + ecx - 0x3902], 0x652327ab
add edx, dword [esp + edx*8 - 0xc0000]
adc ebp, eax
bt ecx, edx
mov dword [esp + ecx*4 - 0xe408], ebp
ret
or word [esp + 0xe], 0xb513
mov dword [esp + 8], 0xfa999a29
xor eax, esi
and byte [esp + 0xc], 9
inc edx
xor eax, 0x99bedc38
dec ecx
lea esp, [esp + 0x14]
jne 0x156aabb
mov edx, 0xb6957417
lea ecx, [edx + edx*8 + 0x4fa83e34]
pop esi
not eax
mov dword [ebp], eax
jmp edi
mov esi, 0x80b21092
bt si, si
movzx esi, byte [edx]
call fcn.0142f82a
sub ebp, 4
mov eax, 0x10a2e021
neg eax
mov eax, dword [ebp]
mov edx, 0x6e9acdbb
movzx ecx, dx
btc edx, 0x8d
xor eax, ebx
sar dx, 0xad
xchg edx, ecx
push ecx
dec eax
push edx
xor dx, cx
xor eax, 0x39f0619
xor edx, dword [esp + edx - 0x3241]
sal dword [esp + ecx - 0x6e9affff], cl
neg eax
ror eax, 1
sal ecx, 0x77
or ecx, edx
shl ecx, 0xd7
xor ebx, eax
add edi, eax
sub dword [esp + 2], edx
ror ecx, 0x18
mov eax, dword [ecx + esi - 0xa2]
ror cx, cl
call fcn.0155da1f
mov ecx, 0xcb26b86
lea edx, [ecx*8 - 0x1a6770c5]
mov eax, dword [ebp + ecx*2 - 0x1964d70c]
xor dl, ch
or cl, dl
mov ecx, dword [ebp + ecx*2 - 0x1964d708]
lea edx, [edx*8 - 0x765914e4]
push ebx
jge 0xb7d37c
cpuid
call fcn.01590337
sal dword [esp + ecx*2 - 0x1a8], 0xab
mov eax, dword [ebp + edx - 0x7d3cffff]
xor eax, ebx
neg cl
sub word [esp + ecx - 0x2a], 0xe38a
xor eax, 0x9b11dc37
jmp 0x13cdf49
Function at 0x12f785c
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
and ax, 0x2f9f
push eax
lea eax, [esp + 0x40]
mov edx, dword [eax]
shl dword [esp], 0x75
mov dword [ebp - 6], edx
call fcn.014c420a

Function at 0x130605b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx eax, byte [esi]
xor al, bl
mov ecx, 0x2ad7db6
and ecx, 0x1b0d948f
not al
bswap ecx
and ecx, 0xfe8cc206
inc al
sar ecx, cl
neg al
bswap ecx
bt ecx, ecx
mov dword [esp + ecx - 0x81dd], ecx
rol al, cl
mov dword [esp + ecx - 0x81e1], 0x430d180e
dec al
xor bl, al
lea eax, [esp + eax + 8]
mov dword [eax + ecx*4 - 0x20784], edx
mov edx, ecx
or byte [esp + ecx - 0x81df], cl
call fcn.014c5bcf
ror al, 0x45
xor ebx, ecx
call fcn.01328080
mov edx, 0xa3347803
mov ecx, edx
movsx eax, cx
mov eax, dword [edi + eax*2 - 0xf006]
lea edx, [edx + edx*4 + 0x34a12320]
mov cx, word ss:[edx + eax - 0x64a77b2f]
jmp 0x1583eb3
add ebp, eax
btc ecx, 0x91
sub ecx, edx
movzx eax, dx
jmp ebp
neg eax
not ecx
not cx
ror eax, 1
sar cl, 1
not eax
xchg ecx, edx
lea edx, [ecx + ecx*4 - 0x77f52de0]
rol eax, 2
xor ebx, eax
imul ecx, ecx
sbb dl, dl
js 0x14931de
mov word [edi + edx - 0x64a77b2d], cx
mov edx, dword [edi + edx - 0x64a77b2d]
mov cl, byte [edi + 6]
mov eax, 0xad3f1390
xor eax, eax
shl edx, cl
movzx ecx, al
dec cx
sets cl
mov dword [edi + eax*2 + 4], edx
and cx, cx
not ecx
mov edx, ecx
lea edi, [edi + eax + 4]
shr dx, 0xc7
add eax, dword [esi + eax*2]
sub esi, 0xfffffffc
sal edx, cl
xor eax, ebx
xor eax, 0xc3a9930f
shl dx, 0xa1
jns 0x14b962c
mov ecx, 0x60aa7c95
movsx eax, cl
mov dx, word [ebp + ecx - 0x60aa7c95]
or eax, eax
dec ecx
or ecx, 0xe800b92b
mov ax, word [ebp + 2]
call fcn.01497198
Function at 0x1308978
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Execute anti-debugging instructions

Disassembly:
dec ebx
mov dword [esp], 0x5c846aaa
lea esp, [esp + 4]
jne 0xd40fe6

Function at 0x130e5f7
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi + ecx + 4], edx
mov dword [esp + ecx*4], 0xbc9d6e37
dec eax
lea ecx, [esi + ecx + 4]
and dword [esp], eax
mov dword [esi], ecx
mov ecx, dword [ebp - 4]

Function at 0x1315c93
Capabilities:
Authenticate hmac

Disassembly:
xor ecx, 0x47a48a03
lea edx, [eax + eax*4 + 0xa0033a1]
imul edx, eax
rol ecx, 2
mul edx
dec dx
mov dword [esp + edx*2 - 0x15532af0], 0x4b344e21
lea ecx, [ecx + edx*4 + 0x79151da7]
mov dword [esp + edx - 0xaa99578], 0x4ebcc200
sub edx, 0xa4bc2c27
bswap ecx
sal edx, 0x95
sbb dl, dl
imul edx
dec ecx
call fcn.01553cca

Function at 0x131631d
Capabilities:
Encode data using base64

Disassembly:
call 0x1521332
or ecx, eax
dec ecx
lea edi, [edi + eax*2 - 0x8406]
mov dword [edi + eax - 0x4201], edx
mov ecx, dword [eax + esi - 0x4201]
add eax, 0x50e4502
movzx edx, ax
lea esi, [esi + eax - 0x50e86ff]
xchg ah, al
xor ecx, ebx
xor al, 0xae
bts eax, eax
not al
rol ecx, 1
lea ecx, [eax + ecx + 0x777eafc0]
not ecx
ror edx, 0xa4
neg ecx
btr edx, edx
xor ebx, ecx
not dl
add ebp, ecx
cdq
mul ax
jo fcn.0140b7dc
mov eax, 0x7a4458e
cdq
movsx ecx, dl
mov eax, dword [ebp + eax*2 - 0xf488b20]
lea ebp, [ebp + edx*2 - 4]
shl cl, 0xc5
bts ecx, edx
xor eax, ebx
btr ecx, edx
sub ecx, ecx
inc eax
neg ecx
shl ecx, 0x66
neg eax
and edx, edx
setne dl
xor eax, 0x331f088
xor ecx, 0xb6a4e08d
ror edx, 0xc7
bswap eax
dec edx
xchg ch, dl
lea ecx, [ecx + edx - 0xc8a560]
xor ebx, eax
add edi, eax
movzx eax, cx
neg eax
mov edx, dword [esi]
sub ax, 0x2f11
or cx, ax
mov ecx, dword ss:[edx]
and eax, eax
movzx edx, al
or eax, 0x81174f0c
mov eax, dword [edx + esi - 0xde]
jle 0xc71eb7
mov eax, dword [edi + eax*2 - 0x364aa0]
mov ecx, 0xabb6dd94
mov edx, ecx
mov ecx, dword [edi + 4]
add eax, ecx
mov dword [esp + 4], edx
mov ecx, eax
mov eax, dword [edi + 8]
push edx
ror byte [esp + 4], 0x84
jae 0x13bc409
movzx edx, byte [esi]
mov eax, 0x2d384fa3
sal eax, 0xfb
xor dl, bl
mov ecx, 0x6237e224
add dl, 0x86
ror dl, 1
and cx, 0x45ba
cmovb cx, ax
inc dl
btc ecx, eax
xor dl, 0x9f
imul eax, eax
add cl, al
xor bl, dl
idiv cl
add edx, esp
btr cx, ax
xor eax, dword [edx + eax*2]
mov edx, ecx
mov dword [ecx + ebp - 0x62374024], eax
call fcn.0140d324

Function at 0x131645f
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edx*2 - 0xa836], 0x22af8d09
neg eax
jmp 0x14a6fb0
sub ecx, ecx