joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1345afa1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
movsx edx, word [esp + eax*4]
movsx ecx, ax
mov edx, dword [edi + eax*4]
lea edi, [edi + eax + 4]
neg cl
inc byte [esp + eax + 2]
xor edx, ebx
lea eax, [ecx*4 - 0x59d06e77]
rol ecx, 0x14
lea edx, [edx + eax + 0x22823395]
neg ecx
xor edx, 0xaa1b7412
and eax, dword [esp + ecx*8]
not edx
bswap eax
xor byte [esp + eax*2 - 0x11200145], ah
sal dword [esp + eax - 0x89000a4], 0xd9
xor edx, 0x23ab9c32
cwde
pop eax
add eax, eax
not edx
shr eax, 0x1a
xor ebx, edx
add esi, edx
movzx edx, cl
add ecx, esi
jmp ecx
dec edx
neg dword [esp + ecx - 0x5fddfdd6]
inc esp
movzx edx, bl
dec edx
lea ebp, [ebp + ecx - 0x5fddfde2]
inc dx
mov dword [ebp + edx*8], edi
call fcn.12692a66
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0xe00d3833
rol cl, 0x25
btc cx, 0x32
xor edx, ebx
mov eax, ecx
bswap eax
neg edx
bt eax, ecx
rol edx, 1
lea ecx, [ecx + eax*8 + 0x4d33088f]
inc eax
js 0x11fedcbc
bswap edx
cbw
ror eax, cl
lea eax, [eax - 0x10d150d5]
rol edx, 3
push eax
sar al, 0xc2
call fcn.1268f1af
mov edx, 0x2e0888b0
shl edx, 0xc1
lea esi, [esi + edx - 0x5c111164]
adc edx, 0xb1098e03
mov eax, dword [edx + esi - 0xd1a9f63]
jb 0x13561638

Function at 0x1346f9bc
Capabilities:
Encode data using xor

Disassembly:
inc ebp
movzx ecx, di
inc ecx
movzx edi, di
inc ecx
not edx
inc ecx
ror edx, 3
inc esp
movsx eax, dl
inc ecx
push ebx
inc sp
xchg edi, edi
inc esi
xor dword [esp + edi - 0x57910a9b], edx
jmp 0x12631e6a
jb 0x11ed9389
dec eax
dec ebx
push 0x73253821
jmp 0x1322fd78

Function at 0x13477966
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
call eax
mov edx, 0x91b8512c
lea edx, [edx + 0x78044ba1]
movsx esi, dl
mov ebp, dword [ebp + edx*2 - 0x1379399e]
movsx edi, si
mov dword [ebp + edx*8 - 0x4de4e668], eax
mov eax, esi
xadd eax, edx
jge 0x1348edd4
pop ebx
pop esi
pop edi
add dl, dl
lea edi, [eax + edi - 0x9bc9c9e]
movsx ecx, al
adc edx, 0x188d0386
call fcn.13236140

Function at 0x134d6dc3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [ebp - 4], eax
dec word [esp + 0xe]
not word [esp + 0xe]
test ebx, ebx
push 0xcb01c23b
lea esp, [esp + 0x14]
je 0x1352906e

Function at 0x134db547
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x5507bd89
lea esp, [esp + 8]
jne 0x11ecae20
Function at 0x134dd599
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
adc esi, eax
fstp qword [edi + edx*2 - 0x4c7d7204]
mov dword [esp + edx*2 - 0x4c7d7204], 0x591a010f
btr cx, dx
mov dword [esp + edx - 0x263eb902], esi
ret
inc ecx
sbb eax, 0x6a224781
dec cl
not dl
ror eax, 1
or ecx, edx
bswap eax
not edx
adc ecx, edx
ror cx, 0xef
dec eax
rol ecx, cl
bt edx, ecx
neg eax
push ecx
dec ecx
xor ebx, eax
sub dx, cx
and cl, ch
jle 0x1323ed94
mov edx, 0x58383180
mov eax, dword [edx + edi - 0x58383180]
sal edx, 0x77
mov ecx, dword [edi + 4]
adc edi, 4
add eax, ecx
movsx ecx, dl
ror edx, 0x33
mov dword [edi + edx*2 - 0x3000], eax
push edx
lea ebp, [ebp + edx - 0x1804]
movsx eax, cl
rol word [esp + edx - 0x17ff], 0x2b
mov edx, dword [ebp + edx*2 - 0x3000]
xor edx, ebx
xor ecx, dword [esp + ecx]
bts ecx, eax
shr eax, 0x3b
xor edx, 0x5f87333d
dec edx
rol cl, 5
inc cl
shr dword [esp + ecx - 0xc00021], 0xe7
xor edx, 0xbb23305
bts cx, 0x8a
bswap edx
pop eax
rol ecx, cl
sbb edx, 0x80134321
shl cx, 0xcb
adc esi, edx
lea eax, [eax + ecx*4 + 0x2f147d95]
mov eax, dword [ebp + eax - 0x1477d95]
call fcn.134335e3
mov ecx, 0x952aba2d
movsx eax, cl
lea ebp, [ebp + eax*2 - 0x5e]
or ecx, ecx
mov ecx, dword [eax + ebp - 0x2d]
call fcn.11f95393
mov edx, 0xb5b38284
mov eax, dword [ebp]
add ebp, 4
xor dl, 9
mov ecx, edx
xor eax, ebx
sal edx, 0x67
jae 0x1333954e

Function at 0x134f092f
Capabilities:
Encode data using base64

Disassembly:
dec eax
dec eax
call fcn.1339aee2
dec eax
inc dword [esp + 0x11]
inc ebp
xor edi, esp
dec eax
inc ebx
shr byte [esp + 0x13], 0x43
inc ecx
xor edi, 0xe18b9aaf
dec eax
sar dword [esp + 0x18], 0x35
sets byte [esp + 0x14]
jb 0x13433c8b
push 0xf792979f
mov edx, 0x1d3b9118
fcomp qword [esi + edx*2 - 0x3a772230]
movsx ecx, dx
dec dl
mov edx, dword [edi + edx - 0x1d3b9117]
add edi, 4
call fcn.11fc1c9a
Function at 0x134f9147
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edi]
rol edx, 0xd5
lea edi, [edx + edi - 0x75d0f072]
mov eax, edx
jp 0x13222437
sub byte [edx - 0x7e2305ef], 0x72
adc al, 0x21
push 0xffffffffffffffcd
xor ah, byte [ebx]
mov word [eax - 0x7c], gs
jl 0x1339345b
lcall 0x3621, 0x8ccc7626
jbe 0x133934ca
pop edx
fistp qword [edx]
inc eax
mov ebp, 0x4e8bdd2a
nop
and edi, ebp
idiv dword [ebx]
jle 0x13393476
pop ss
insb byte es:[edi], dx
sub eax, 0x2d0280df
ror dword [ebx - 0x63d7afd0], 1
jnp 0x133934cc
fadd dword [ebx + 0x20]
std
mov edx, ebp
mov dh, 0x26
push cs
scasd eax, dword es:[edi]
dec dword [ebx - 9]
scasb al, byte es:[edi]
or dword [edi], ecx
jmp 0x133934b7
jecxz 0x133934f7
sub ebp, ebp
in eax, dx
and ebx, edx
jbe 0x13393462
and byte [esi], 0x76
and ah, byte [edi + 0x13e694de]
dec edx
out dx, al
bound esp, qword [ebx + 0x1f4815e9]
or eax, 0xffdcdb8f
loop 0x133934cb
lea esi, [esi + eax*2 - 0x10752aec]
xor eax, 0x46871c89
ljmp 0x7650
pop edi
push ss
pop edi
push eax
jbe 0x133934b1
jno 0x1339350d
into
and byte [edx], bl
invalid
push 0x27
push edi
mov cl, 0xe2
sub dword [ebp - 0x7890c6f1], edi
push es
test eax, 0xbdb71a17
sub eax, dword [ecx - 0x68]
loopne 0x1339357d
push ds
out dx, eax
add edi, dword [ecx - 0x25]
sub byte [edi - 0x21], bl
inc edx
sub al, 0xc6
lahf
enter 0x8dc, 0x1e
ret
sbb eax, 0x692bcf41
lea edx, [edx - 0x5c1e9630]
mov al, byte [0xb90dafa7]
mov ebx, 0x39174238
push 0xffffffffffffffd2
cmp al, 0xbe
jg 0x1339357d
pushfd
or al, byte [esi - 0x5d]
fidivr dword [ebx]
scasd eax, dword es:[edi]
rcr ebx, 0x58
sbb dword [ecx - 0x40], ebp
mov cl, al
je 0x13393594
invalid
rol eax, 2
lea ecx, [edx*4 + 0x413f5ea5]
mov dword [esp + ecx - 0x6e2c91b9], 0x731f8d2a
and dword [esp + ecx - 0x6e2c91b9], 0xa80cc915
xor eax, 0x8e117da3
not dl
lea eax, [eax + edx*2 - 0x60cc26f1]
ror cl, 0xa6
sal ecx, 0x66
bswap eax
push edx
imul edx, edx
inc ecx
dec eax
or edx, edx
inc ecx
imul edx, edx
xor ebx, eax
bts ecx, ecx
add ecx, 0xf0209910
and dword [esp + ecx - 0x7b451296], edx
adc esi, eax
mov eax, 0x8d929f99
mul al
xor ax, cx
pop eax
pop eax
jge fcn.13439565
mov dword [esi + 4], eax
jbe 0x13393455
mov ebp, 0x6a9a3b39
xchg edx, eax
xor al, 0x93
inc edi
mov edx, dword [ebx + 0x8921768]
pop ecx
cmp byte [edx - 0x58], dh
mov word [ecx], fs
insd dword es:[edi], dx
call 0xa503b451
ficomp word [0x155c15b]
jb 0x134f916e
and dword [esp + eax*4 - 0x2f701e6b], ecx
mov byte [eax*8 + 0x37b686c], ah
push cs
pop ebx
ljmp 0x5008

Function at 0x134fb476
Capabilities:
Execute syscall

Disassembly:
call fcn.1200d3a9
syscall
inc ecx
push ebp
pushfd
dec ecx
mov ebp, 0x65b1bb05
mov bl, byte [eax + 0xb]
or dword [ebx + ecx*4 + 0x6c], 0x24
or byte [eax - 0x39], cl
inc esp
and al, 8
ret
Function at 0x134ff20c
Capabilities:
Execute syscall

Disassembly:
call fcn.11eebb5e
mov ecx, dword [ebp]
xor ecx, ebx
mov edx, 0x59de72b
shr dword [esp + edx*4 - 0x16779cac], 0xf7
sbb ecx, 0x7c38a98e
movzx eax, word [esp + edx - 0x59de72b]
neg byte [esp + eax*8 - 0x27]
mul ax
ror ecx, 2
not eax
rol dx, 0x6d
xor al, 0xa9
dec ecx
shl dx, 0x48
rol edx, 0x2c
and word [esp + 2], ax
xor ecx, 0x3a6d029
mov dword [esp], eax
push edx
xor ebx, ecx
add edi, ecx
mov esi, dword [esi]
add dword [esp + 4], 0x86b32c28
push eax
pop edx
pop eax
pop eax
jp fcn.120b5dc8
mov eax, 0xcdb66a09
not eax
rol eax, 0xcb
fsub qword [ebp + eax - 0x4cafb192]
movsx edx, al
rol eax, 0x9d
lea esi, [esi + eax - 0x4995f636]
sar ax, 0xed
mov eax, dword [eax + esi - 0x4995ffff]
movzx ecx, dx
imul edx, ecx
xor eax, ebx
bt cx, dx
setb dl
sub edx, edx
not eax
and ecx, edx
bswap eax
not edx
call fcn.1333e5bc
syscall
inc ecx
push edi
dec eax
mov dword [esp], 0xc139e457
call fcn.1209b52e

Function at 0x1350a389
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov eax, dword [ebp]
mov edx, 0x8fb04a96
mov edx, dword [ebp + 4]
mov ecx, 0x740b6f25
lea ebp, [ecx + ebp - 0x740b6f21]
rol ecx, 0xeb
add ecx, ecx
and eax, edx
call fcn.125ecb04
neg edx
dec edx
cwde
bt ecx, ecx
btr eax, eax
xor ebx, edx
add word [esp + ecx - 0x3df2e3e4], 0x49a4
adc esi, edx
or dword [esp + ecx - 0x3df2e3e5], 0x7309ae99
ror cx, cl
btr eax, 0x2a
mov dl, byte [edi + ecx*2 - 0x7be45e3e]
mov dword [esp + eax], ecx
or al, byte [ecx + edi - 0x3df22f1d]
lea edi, [edi + ecx*2 - 0x7be45e3c]
dec byte [esp + ecx*2 - 0x7be45e3c]
inc ecx
imul dl
and cl, ch
mov edx, dword [esp + ecx*2 - 0x7be45e40]
xchg word [esp + ecx - 0x3df22f20], cx
mov word [edi + edx - 0x3df12f1f], ax
mov dword [esp + ecx - 0x3df22f1f], esi
ret
sal byte [esp + 3], 0x65
shr word [esp + 1], 0xf
dec ebx
jmp 0x132b46e7
push 0x6eb64401
mov dword [esp + 4], eax
ja 0x13498cf3
jmp 0x12017671

Function at 0x1350b2f5
Capabilities:
Encode data using xor

Disassembly:
pushfd
pop dword [esp]
push 0x338fc99e
jmp 0x11fef025
jmp 0x125ffebe

Function at 0x1350d860
Capabilities:
Encode data using xor

Disassembly:
bswap eax
neg eax
xor ecx, 0xae883e2a
shr ecx, 0x53
jae 0x13383d18
rol eax, 3
push ecx
neg cl
shr ecx, 0x34
inc eax
xor eax, 0x6b8826a9
neg eax
dec eax
bswap ecx
call fcn.120dc61d
mov dword [esp + ecx - 0x178ddf13], 0x81041839
mov dword [edi + ecx*4 - 0x5e377c68], eax
mov dword [esp + ecx*2 - 0x2f1bbe36], ecx
pop ecx
lea ebp, [ecx + ebp - 0x178ddf1f]
setae cl
mov ecx, dword [ebp + ecx - 0x178ddf01]
xor ecx, ebx
ror ecx, 2
mov dword [esp], 0x1b1db2af
xor ecx, 0xbc2cce1b
push 0xfd8ac283
call fcn.13478d1c
lea edi, [ecx + edi - 0x43124902]
xor eax, ebx
neg eax
rol ecx, 0xb4
lea ecx, [ecx + ecx - 0x38ce87f9]
rol ecx, cl
ror eax, 3
not ecx
shl cx, cl
xor eax, 0xed85e128
btc ecx, 0x95
jae 0x11fa5cdd
Function at 0x135118e3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc edi
clc
or esi, edx
jmp 0x11f8e1ba
inc ecx
cmp edi, 5
jmp 0x1358bb27
adc ecx, ecx
jmp 0x13270fd1
je 0x133dc6d2
movzx edx, byte [ecx]
test dh, 0xbc
cmp edi, 0x9995b796
cmp esp, ebx
shl esi, 8
jmp 0x11f3b877
xor edi, edi
test esi, 0xe92414a9
jmp 0x13282dfc
rep stosd dword es:[edi], eax
jmp 0x120674ad
rep stosw word es:[edi], ax
add ecx, eax
mov ecx, dword [ebp + 8]
and al, 0xb7
dec ax
lea eax, [ecx - 1]
test dl, 0x8d
mov dword [ebp - 0x40], eax
xor esi, esi
clc
or eax, 0xffffffff
jmp 0x12636f37
cmp ecx, dword [ebp - 0x40]
jmp 0x120a85ea
call fcn.11fdc83a
inc ecx
mov edi, 0xa0e848d
inc edi
mov ecx, dword [ebp + edi*2 - 0x141d091a]
dec edi
lea ebp, [ebp + edi*2 - 0x141d0916]
inc ebp
movsx edx, di
inc ebp
xor ecx, ebx
inc ecx
movsx eax, bh
inc ecx
mov ebx, edi
inc esp
movsx esi, ax
inc ecx
neg ecx
inc ecx
dec ecx
call fcn.134c801b
stc
or eax, edx
shr ecx, 1
jmp 0x13244be1
jl 0x13282dfc
mov dword [ebp - 8], ecx
sub di, 0x7905
movsx cx, bh
lea esp, [esp]
sub cx, dx
cmp esp, 0xf884e2e
xor edi, 0x8b88dd1e

Function at 0x135131cd
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push esi
mov edi, ebp
mov ebx, dword [esp + ebx - 0x1336de30]
movsx edx, byte [esp + 4]
mov esi, dword [esp + edx*4 - 0xd4]
pop ebp
mov ebp, dword [esp + edx*8 - 0x1b4]
lea ebp, [edx + ebp - 0x3c]
mov eax, edx
mov dword [esp + edx - 0x34], eax
mov edx, dword [ebp + edx*8 - 0x1c0]
cwde
xor edx, ebx
dec edx
rol edx, 1
pop eax
lea ecx, [eax*8 - 0x2e1ef56]
bswap edx
add ax, 0xa92a
mov dword [esp + eax*4 - 0x4cda1d80], ecx
and ecx, dword [esp + eax - 0x1336875a]
rol edx, 1
shl dword [esp + eax - 0x1336875a], cl
xor edx, 0x3942416
call fcn.13578989
mov dword [ebx + ebp - 0x1336de38], eax
mov dword [esp + ebx - 0x1336de38], ebx
js 0x11fdcb7e

Function at 0x13518fcd
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec edx
mov dword [esp + 4], 0xcf8d1ca7
call fcn.11f6c919

Function at 0x13518fdb
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x33b94ca0
mov esi, dword [esi*4 + 0x11f0702c]
call fcn.11f18047
mov esi, 0xe1a01105
movzx esi, byte [ecx]
xor esi, eax
jmp 0x12104786
and esi, 0xff
jmp 0x11ff735d
lea esp, [esp + 0x28]
jne 0x12047875
mov esi, 0x5406d0b8
pop esi

Function at 0x13518ffe
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor bl, cl
bt dx, dx
lea ebp, [eax + ebp - 0x5800002]
mov word [eax + ebp - 0x5800000], cx
movzx ecx, ax
pop eax
jae fcn.133fa0f5
mov eax, dword [edi]
mov ecx, 0xcb1b9b0e
push ecx
add edi, 4
dec dword [esp]
xchg dword [esp], ecx
call fcn.126acaff

Function at 0x13528697
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
mov ecx, dword [esp + ecx*4]
call fcn.120f0fa6
dec eax
mov dword [esp], 0x1e08d032
and ecx, 0xff
jmp 0x1350ab58
Function at 0x1352905f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp esi
xor ebx, eax
push ecx
push ecx
add esi, eax
mov dword [esp + ecx*2 - 0x406], esi
ret 4
mov eax, dword [ebp]
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov esi, 0x7cae8088
movsx edx, si
imul edx, esi
pop ebx
pop esi
mov edi, edx
lea eax, [edi + edx*8 + 0x520f6ea4]
pop edi
jo 0x11f76e5a
lea edx, [ecx + edx - 0x1e58da6a]
or cx, 0xf8a1
neg edx
xor ebx, edx
inc eax
shl al, cl
sal eax, cl
adc esi, edx
lea ebp, [ebp + eax - 0x4e2c0005]
movzx edx, byte [ebp + ecx - 0x2716f8a1]
xor dl, bl
not word [esp + eax - 0x4e2c0002]
xor dl, 0xbb
rol dl, cl
dec dl
xor eax, eax
xor dl, 0xbe
call fcn.133dd67e
jb 0x133de1e9
xor eax, ebx
lea eax, [eax + edx*2 + 0x59390286]
dec dl
neg eax
sub cl, dl
or edx, edx
btr edx, edx
rol eax, 3
inc edx
xor eax, 0x9a95c709
jmp 0x134afeed
cmovae eax, edx
mov ecx, edx
mov edx, dword [edx + esi - 0x2bae2762]
jb 0x133f2a15
dec eax
shr ecx, 0x5b
xor edx, ebx
dec edx
shr eax, 0x79
imul cx, ax
bswap edx
adc edx, 0xe533448e
sub ecx, ecx
bswap edx
btr eax, 0x2a
ror edx, 1
sal eax, 0xb6
lea ecx, [ecx - 0x3fcfdff3]
xor edx, 0xcf0ef88d
btc cx, ax
xor ebx, edx
add cx, cx
sub eax, eax
bts eax, 0x37
adc edi, edx
movsx edx, cl
bt edx, 7
push edx
mov dword [esp + eax*4 - 0x2000000], edi
ret
bts cx, cx
jae 0x120c9419
mov eax, 0x3ebabea2
mov eax, dword [ebp + ebx*4]
call fcn.12671fba
push 0x7d3a898e
lea esp, [esp + 0x10]
jne 0x134d6de2
jmp 0x12601f60

Function at 0x1353d540
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
lea esp, [esp + 0x14]
jne 0x11f695f3
call fcn.1266501e
dec ebp
jno 0x1353d5d1
or byte [esi + 0x4fe3b185], dl
imul esi, dword [ecx - 0x78], 0xffffff8f
mov edi, 0x66307af5
shl ecx, 0x25
int3

Function at 0x1353e6e6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, dword [esp]
mov eax, dword [ebp]
push edx
xor eax, ebx
lea ecx, [edx*4 - 0x566a55cc]
xadd dword [esp + ecx - 0x6fad5a88], ecx
shl word [esp + 6], 0x2c
not eax
and word [esp + 3], cx
call fcn.11f30aab
dec dx
not cl
shl edx, 0x39
xor bl, cl
mov dword [esp + 4], eax
mov dword [esp], eax
neg edx
lea ecx, [esp + ecx + 8]
shl al, 0xc6
call fcn.11ef870c
dec eax
dec ecx
shr ecx, 0xc7
dec ecx
add esi, eax
dec edx
mov dword [esp + esi - 6], 0xb121c0b5
call fcn.13299dd9
push 0xf185ec15
sub ebp, 4
jmp 0x1206f615
Function at 0x13543a71
Capabilities:
Execute syscall

Disassembly:
lea esi, [esi + eax*2 - 0x18404]
jbe 0x13552e1f
bt eax, 0xae
mov dword [eax + esi - 0xc200], edx
pop edx
pop edx
pop eax
jb fcn.1342bca5
mov ecx, 0x55b1d990
mov eax, dword [esi + ecx - 0x55b1d990]
imul ecx, ecx
and ecx, ecx
add cl, byte [esi + ecx - 0x320570fc]
mov edx, 0xecb72b22
add esi, 6
mov byte ss:[eax], cl
movzx eax, dx
mov eax, dword [edi + eax*8 - 0x15910]
call fcn.11ed10b8
bt ecx, edx
xor ebx, eax
sal ecx, 0x54
add ebp, eax
or cx, dx
mov edx, esi
movzx eax, word [esp + 6]
mov dword [esp + eax*2 - 0x18400], eax
jne 0x11ed5dac
and ax, 0xd739
ror edx, 3
dec edx
rol eax, 0xbd
btr cx, ax
ror edx, 1
inc cx
xor ecx, eax
inc edx
push eax
xor ecx, dword [esp + eax - 0x9d13001]
neg ecx
not edx
xor ebx, edx
add esi, edx
mov dword [esp + eax - 0x9d13001], esi
ret
jmp ebp

Function at 0x13548278
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pop ecx
pop ecx
pop edx
jmp fcn.1342bca5
lea edi, [edi + edx - 0x74a09a99]
or dx, 0xa48c
or dword [esp + edx - 0x74a0be9d], 0x5886983a
movzx eax, word [esp + edx - 0x74a0be9d]
xor ecx, ebx
shr dx, 0x87
sar eax, 0x37
not ecx
cwde
xor ecx, 0x730d71a9
push edx
ror word [esp + eax*8 + 5], 0x2d
cwde
rol ecx, 1
push eax
cdq
mov byte [esp + edx + 9], ah
bswap ecx
shl edx, 0x68
and dx, ax
ror ecx, 2
xor ebx, ecx
jmp 0x1350e6c2
not dx
add ebp, ecx
jmp 0x132457c0
pop edx
movzx edx, cl
mov word [edx + esi - 0x78], ax
xchg dword [esp + edx - 0x78], edx
not edx
mov ecx, dword [edx + edi - 0x74a09a9d]
jae 0x13375c87

Function at 0x13548802
Capabilities:
Encode data using xor

Disassembly:
clc
call eax
shr cl, 0x21
fcomp dword [ecx]
xor edx, ebx
neg edx
mov dword [esp + eax - 0x41a74496], ecx
lea eax, [eax + ecx - 0x56d9a2d6]
neg eax
not edx
ror edx, 1
sal al, 0x61
and cl, 0x19
jae 0x126a4533
cdq
jl 0x1209b634
mov ebp, 0xdbe26675
jle 0x1209b691
cmp esi, esi
dec byte [edx]
push ebx
ljmp 0x5cbb
invalid
mov dword [esp + ecx - 0x3eb01ac4], 0x8300e6b5
mov edx, dword [edi + edx - 0x6c13a3d2]
and ecx, ecx
mov eax, dword [esp + ecx - 0x3eb01ac4]
lea edi, [edi + ecx - 0x3eb01ac0]
ror word [esp + ecx - 0x3eb01ac4], cl
and eax, dword [esp + ecx - 0x3eb01ac4]
xor edx, ebx
not al
neg edx
sal cx, cl
xchg dword [esp + ecx - 0x3eb0ac40], eax
sbb dword [esp + ecx - 0x3eb0ac40], ecx
inc edx
cwde
rol ax, 0x68
bswap edx
xchg word [esp + ecx - 0x3eb0ac3f], ax
neg edx
bswap eax
lea edx, [edx + ecx + 0x77dd4164]
rol eax, 0x62
jb 0x1209b653
xor ebx, edx
sub ecx, eax
add esi, edx
pop ecx
jmp fcn.13580cdf
Function at 0x1354d906
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
not dword [esp + ecx*2]
xor ecx, dword [edi + ecx + 4]
mov byte [esp + edx*2 + 1], dh
mov dword [esp + edx*4], ebx
cpuid
sub edi, 8
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov dword [edi + 4], ecx
mov eax, 0x41319d32
movzx ecx, ax
mov dword [edi + ecx*4 - 0x274c8], edx
movzx ebx, ax
movzx edx, al
lea ecx, [ecx + ecx*4 - 0x5057b66c]
pop ebx
add dx, dx
jge fcn.11fd52e9
mov dword [esp + eax*2 - 0x86], eax
sar eax, 0xad
xor ebx, edx
xchg dword [esp + ecx*2 - 0x8000], eax
sar dword [esp + ecx - 0x4000], 0x39
adc esi, edx
add eax, eax
xchg word [esp + ecx - 0x4000], cx
shl word [esp + ecx*2 + 1], 0x4a
mov eax, dword [edi + ecx*2]
movsx edx, cl
jb 0x132b0d9a

Function at 0x1355f22d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xchg word [esp + 8], bx
mov ebx, dword [esp + 0x10]
call fcn.11f16cda

Function at 0x13584975
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebp
lea ecx, [ecx + edx*4 + 0x3b2efd2a]
inc ecx
ror ecx, 2
dec eax
cdq
inc ecx
not ecx
jmp 0x1342e21d
dec ebp
lea ebp, [ebp + edx*2 + 4]
inc ebp
xor ecx, ebx
inc esp
mov edi, ebx
and bl, ah
dec esp
mov dword [esp + edx], edi
inc ebp
lea ecx, [ecx + edx*2 + 0x5213be98]
push eax
inc ecx
rol ecx, 2
inc ecx
sub ecx, 0xdabe3782
cbw
inc ecx
push esi
inc ecx
ror ecx, 1
inc esp
movsx esp, word [esp + edx*4 + 0xa]
jmp 0x11f9ec87

Function at 0x13593bfe
Capabilities:
Execute syscall

Disassembly:
inc esp
movsx ecx, byte [esp + eax - 0x713d14e5]
inc ecx
neg eax
cbw
inc ecx
ror eax, 3
inc esp
xor dword [esp + eax - 0x713dffe3], esp
dec esp
mov dword [esp + ecx*2 - 0x64], ebx
movzx edx, al
inc esp
xor dword [esp + ebx - 0x32], eax
jmp 0x13481922
inc ecx
pop ebx
dec ebp
arpl ax, ax
inc ecx
rol cl, 1
dec ecx
adc esi, eax
inc esp
mov esi, ecx
inc esp
movzx eax, al
dec esp
mov ecx, dword [ebp + edi - 0x713d2d32]
inc ecx
xor eax, 0xe13ddb86
dec eax
mov dword [esp + eax - 0x713d2d32], eax
inc eax
div bh
inc byte [esp + edi - 0x713d2d2b]
inc ecx
inc eax
jmp 0x13289309
Function at 0x13595baf
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor eax, eax
dec ebp
test edx, edx
dec eax
lea esp, [esp + 8]
je 0x126528bb
mov edi, 0x5723850b
jmp 0x120a1544
dec eax
lea edi, [0xfff84cc3]
mov esi, 0x29b829a4
movzx esi, byte [eax + esi*2 - 0x53705348]
xor esi, ecx
and esi, 0xff
call fcn.1266f7e7
dec eax
sar edi, 0x52
push esi
movzx esi, di
jb 0x11f4d026
dec edx
call fcn.11f43105
lea eax, [ecx*8 + 0x5d9f3ab3]
popfd
sal ecx, 0x45
mov ecx, dword [ebp + edx*4]
btc eax, edx
btc eax, edx
jae 0x1264c15a
dec eax
adc ebp, 0xc
push 0xe6b17c90
jmp 0x11f3de63
ror edx, 3
inc edx
add al, al
ror edx, 3
bswap edx
sar cx, 0x86
sar eax, 0x1b
jns 0x120e7c86
bt dx, cx
dec dx
mov ecx, dword [eax]
mov dword [esi], ecx
setg dl
push edx
add word [esp + 1], dx
pop ecx
jmp edi
push 0xd6926ab4
lea esp, [esp + 0x20]
jne 0x11feccb9
mov esi, 0x5e8ee88b
shr si, 0xad
lea eax, [esi*2 + 0x280749b]
pop esi
not ecx
mov eax, 0xfda64bb6
movsx edx, al
mov dword [esi], ecx
movsx ecx, ax
xchg edx, eax
lea ebp, [ebp + ecx*2 - 0x9770]
rol ecx, cl
mov edx, dword [ebp]
xor edx, ebx
xor eax, ecx
jns 0x1266cd48
xor eax, 0xf50884b9
inc edx
rol eax, 1
shr edx, cl
setp dl
xor ebx, eax
or dl, dl
adc ebp, eax
imul ecx, ecx
lea eax, [ecx*8 + 0x342802b5]
rol cl, 5
mov eax, dword [edx + esi]
xchg cx, dx
mov dl, byte [edx + esi - 0x6025]
sbb cl, 0x35
ror cx, cl
lea esi, [ecx + esi - 0x327a]
mov byte ss:[eax + ecx*2 - 0x6500], dl
jmp ebp

Function at 0x1359c66a
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], esi
call fcn.126c5534
mov edx, 0x5f1c8512
movsx ecx, dl
lea ecx, [ecx - 0x656aa1e0]
movzx cx, byte [esi + edx - 0x5f1c8512]
mov al, byte [esi + edx - 0x5f1c8510]
sub dx, dx
lea esi, [esi + edx - 0x5f1bfffe]
and dl, dl
rol edx, 0xf6
seta dl
adc cl, al
mov word [esi + edx*8 - 0xbe3800], cx
movzx ecx, dx
lea ebp, [ebp + edx*2 - 0x2f8e04]
mov edx, dword [ebp + edx - 0x17c700]
lea eax, [ecx + ecx*4 - 0x5952eaeb]
sar ecx, 0x61
popal
call fcn.11fdc8c7
xor eax, 0xbc1c2185
jecxz 0x1359c6eb
movsb byte es:[edi], byte [esi]
cmp bl, byte [ebx + ecx*2]
test eax, 0xdc23c94f
sbb eax, ebx
and eax, dword [edi]
sub al, 0x7d
shl byte [edx - 0x5bfe7f64], 1
out 0x42, eax
inc edx
jb 0x1359c6c8
ret 0xb02
Function at 0x1163130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x1163140
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x1163150
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1163710
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x13816ec]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
mov ecx, dword [edi]
or edx, 0x2001f
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.011636a0
mov ebp, eax
cmp ebp, esi
je 0x1163774
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x116376d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x116380d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
jne 0x11637da
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.01163710
mov ebp, eax
cmp ebp, esi
jne 0x116375e
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
push esi
push ecx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
je 0x11637a0
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x11637ef
push eax
call ebp
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x24]
mov eax, edi
mov dword [esp + 0x18], esi
call fcn.01163890
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x116380b
push eax
call ebp
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.012a8a41
add esp, 0x228
ret 4