joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403550b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1403550e4
xor eax, eax
jmp 0x1403551a7
mov rbp, rbx
cmp word [rax], si
je 0x140355109
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1403550f0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1403550ec
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140351780
movsxd r14, eax
test eax, eax
jne 0x140355147
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1403550dd
mov rcx, r14
call fcn.1403495c8
mov rdi, rax
test rax, rax
jne 0x140355160
xor ecx, ecx
call fcn.14034958c
jmp 0x14035513c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140351780
test eax, eax
jne 0x140355191
mov rcx, rdi
call fcn.14034958c
jmp 0x14035519b
xor ecx, ecx
call fcn.14034958c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1403551c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14035524b
mov rsi, rbx
cmp word [rax], bp
je 0x14035520a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1403551f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1403551f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1403495c8
mov rdi, rax
test rax, rax
je 0x140355238
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1403284a0
mov rbp, rdi
xor ecx, ecx
call fcn.14034958c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1403582a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1403499a0
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140358341
cmp ebx, dword [rsp + 0x30]
je 0x14035833a
test esi, esi
je 0x14035833a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140358315
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140358322
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1403582ff
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140358326
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140358343
mov eax, 1
jmp 0x140358343
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14035a104
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140351330
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140351330
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14035a254
cmp rax, 0xffffffffffffffff
je 0x14035a254
xor edi, edi
test rbp, rbp
jle 0x14035a1ff
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140349d00
mov rbx, rax
test rax, rax
jne 0x14035a18c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14035a1f5
mov edx, 0x8000
mov ecx, r14d
call fcn.140342dd4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14034dbc0
cmp eax, 0xffffffff
je 0x14035a1d5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14035a19c
mov edx, r15d
mov ecx, r14d
call fcn.140342dd4
jmp 0x14035a1f5
cmp byte [rsi + 0x38], dil
je 0x14035a1ec
cmp dword [rsi + 0x34], 5
jne 0x14035a1ec
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14035a1f5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14034958c
jmp 0x14035a268
jns 0x14035a268
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140351330
cmp rax, 0xffffffffffffffff
jne 0x14035a220
cmp byte [rsi + 0x30], dil
je 0x14035a268
mov edi, dword [rsi + 0x2c]
jmp 0x14035a268
mov ecx, r14d
call fcn.140352d34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14035a268
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x14035a268
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14035a261
mov eax, dword [rsi + 0x2c]
jmp 0x14035a266
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140351330
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14035b4f0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140464178]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14035b53a
call fcn.14032e11c
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.14032e13c
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14032dfd0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140327a40
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x14035b545
lea eax, [rbx + 1]
jmp 0x14035b527
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14035b525
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14035b527
Function at 0x14035babc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140339030
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14035bb46
cmp byte [rbp - 0x21], r15b
je 0x14035bb41
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14035bb7c
call fcn.14034c778
test eax, eax
jne 0x14035bb68
cmp byte [rbp - 0x21], r15b
je 0x14035bb60
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14035bb7c
cmp byte [rbp - 0x21], r15b
je 0x14035bb79
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140338eb4
test eax, eax
jne 0x14035bc1c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140339030
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14035bbbb
cmp byte [rbp - 0x21], r15b
je 0x14035bbf0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14035bbf0
call fcn.14034c778
test eax, eax
jne 0x14035bbdc
cmp byte [rbp - 0x21], r15b
je 0x14035bbd5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14035bbf0
cmp byte [rbp - 0x21], r15b
je 0x14035bbed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140338eb4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14035bc1c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14035bc1f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14035bc2d
mov rcx, rdi
call fcn.14034958c
cmp byte [rbp + 0x3f], r15b
je 0x14035bc3c
mov rcx, qword [rbp + 0x27]
call fcn.14034958c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0xc6fbf5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x18b99b5
lea rsp, [rsp + 0x18]
je 0xc8244b

Function at 0xc73417
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov word [rbx], cx
push 0x5a210bc
push 0x6607823b
lea rsp, [rsp + 0x38]
jmp fcn.00c72675

Function at 0xc750f9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov eax, r10d
btc r15d, 0x2f
adc r13b, 0x22
test esp, 0x763be613
add rsp, 0x30
pop r15
movsxd rdi, r14d
pop r14
movsxd rdi, edx
movzx rbx, r14w
pop r13
cmovb di, r12w
movzx edi, sp
pop r12
pop rdi
jmp 0x18c7418
mov dword [rsp + 4], r12d
jmp 0xc9a3b2
ret
jl 0xc9a3f2
mov qword [rsp + 0x28], rsi
nop
clc
cdqe
sub al, dh
inc r9
cmc
cmp ecx, 5
jmp 0xc78b6a
xor r8d, 0xb1a34f2b
jns 0x18b55f6
mov dword [rsp + 0x80], r12d
cmp di, r8w
add eax, 0x736
jmp 0xc750f9
je 0xc9a3cc
mov ecx, eax
setb r9b
mov eax, 0x400
mov rdi, r15
movzx eax, ax
rep stosw word [rdi], ax
mov r9, r8
lea r13, [r8 - 1]
mov edi, ebx
mov rcx, 0xffffffffea83c885
movzx rcx, ax
or r8d, 0xffffffff
btc cx, si
sub ch, 0x32
mov ecx, ebx
stc
test r9b, 0x84
cmp r9, r13
jmp 0x18b6470
scasb al, byte [rdi]
movsb byte [rdi], byte [rsi]
sub al, 0x76
movabs dword [0x3bef772bb18b121f], eax
movabs eax, dword [0x2fbb871176e5dda6]
invalid
mov r8, qword [rsp + r8*2 - 0x6f4e871a]
mov qword [rsp + 0x10], 0xffffffffe2bba6a9
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.00c7d755
outsd dx, dword [rsi]
xor eax, 0x3aa9f7bd
loop 0x18b559f
call [rbp - 0x1df678fc]
pop rbx
mov byte [rsi], dl
in eax, 0x6c
mov bh, 0xa9
sbb al, byte [rdx - 0x1a424040]
invalid
je 0xc6f033
movzx eax, byte [r9]
cmp r14w, r9w
shl edi, 8
inc ecx
clc
cmc
or edi, eax
jmp 0xc7cb52
pop rbp
movsxd rbx, edi
movzx ebx, r9w
not bh
pop rbx
jmp 0xc7858e

Function at 0xc75147
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.00c7a28a
xor r10b, cl
dec qword [rsp + 7]
lea rcx, [rsp + rcx + 0x10]
jl 0x18d6714
mov word [rcx], r8w
not word [rsp + 0xe]
lea rsp, [rsp + 0x10]
jne fcn.00c72675
jns 0xc962d7
xchg ecx, eax
faddp st(4)
or dword [rbx], r8d
mov edx, 0xdc645649
mov ss, eax
add edi, dword [rdx + 0x15dc6769]
out dx, al
invalid
invalid
jne 0xc962a7

Function at 0xc75218
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shl qword [rsp + 8], 0x2a
mov qword [rsp + 8], rax
lea rsp, [rsp + 8]

Function at 0xc76c80
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x6b096e13
mov qword [rsp + 0x10], 0x4f05d6b6
lea rsp, [rsp + 0x20]
jmp fcn.00c72675
Function at 0xc78610
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rbx], rdx
mov qword [rbx + 8], rax
lea rsp, [rsp + 8]
jmp fcn.00c72675
dec ebx
jmp 0xc82445
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0xc8228c
mov r9d, 0x6f8bc70a
lea r9, [r9 + r9*2 - 0xa541ade]
lea r9, [r9 + r9*8 + 0x64bef6b5]
mov r9, rax
jmp 0xc75228
mov eax, 0x808ffe14
cwde
push rax
mov rax, qword [rbp + rbx*8 + 0x20]
dec byte [rsp + 3]
call fcn.00c75218
retf
jne 0x18b99c0
mov eax, 0x3e9bc9bf
btc eax, eax
mov rax, qword [rbp + riz]
jae 0x18b5fb7
neg r9w
inc r9w
ror r9w, 1
not r9w
xor r9w, 0x623c
sar word [rsp + 4], 0xe
rol byte [rsp + 5], 0xc2
jnp 0xc86e2d
xor r10w, r9w
sal dword [rsp], 0xe3
neg word [rsp + 5]
jo 0xc73acc
sbb rbx, 1
push 0x48b27a3b
mov word [rbx], r9w
push 0x2ea76681
lea rsp, [rsp + 0x18]
jmp fcn.018cf1d1
call fcn.00c7c0e9
sbb rsp, 0x20
push 0x4f9055a9
push 0x3616ae11
call fcn.018c161d
push r14
movabs r14, 0x8dba3f012010d42d
push r11
pushfq
mov r11, r14
mov r14b, 0x8a
xor r14d, r11d
push rbx
movabs rbx, 0x1108b3ce39a6412
mov r14, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x76db87a9
mov rbx, qword [rsp]
bswap r11d
shl r11d, 0x1b
xor r11w, r11w
test r11d, 0x44b56e36
mov r11, qword [rsp + r11 + 0x10]
call fcn.018ce544
mov edi, 0xf73af32d
mov r8, qword [rbx + riz]
neg dil
xor di, 0xb431
movzx di, byte ss:[r8 + riz]
call fcn.018d5aea
mov eax, 0xb6192e00
mov rax, qword [rbp + rbx*8]
push 0xa8dd3a7
call 0x18c89d4

Function at 0xc7881d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jno 0xc96f02
call 0x18d58f0
adc bh, byte [rbx]
movabs al, byte [0x28eb950e875c1268]
mov cl, 0x32
sub al, 0x9f
invalid

Function at 0xc788ec
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
bswap r8d
ror byte [rsp + 9], 0x45
dec r8d
add qword [rsp + 0xf], 0x14162e8b
bswap r8d
jg 0x18c6ce5
xor r8d, r10d
mov qword [rsp], 0x21261001
push 0xffffffffce350103
add r8d, 0xc69cd7bb
push 0xffffffffea938e00
jmp 0xc776ac
mov qword [rsp + 0x10], r10
mov r10d, 0xe7a29abb
call fcn.018c8d0b
in al, dx
adc eax, 0xa746ee6
leave
xor al, 0x76
mov esi, 0x50d9bbc4
wait
invalid
neg qword [rsp]
jns 0xc8e223
invalid

Function at 0xc7a8a2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x2f8f9b0a
lea rsp, [rsp + 0x30]
jmp fcn.00c72675
mov qword [rsp], 0x33bc2586
lea rbp, [rsp + rbp + 0x28]
mov byte [rbp + riz], r8b
jmp 0xc75a18

Function at 0xc7c0e9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rbx], rdx
jmp 0x18d6919
mov qword [rbx + 8], rax
push 0x1c19da9e
push 0xffffffffef1acba0
lea rsp, [rsp + 0x28]
jmp fcn.00c72675

Function at 0xc7c0f1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0xc75228

Function at 0xc7c4f1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x30]
jmp fcn.00c72675
Function at 0xc7d75f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x18c0669
invalid
mov ecx, 0x482db4bc
lea esp, [rsp + 0x10]
push 0x23231f83
sub r9b, 0x33
sar qword [rsp + 0x18], 0xb3
jae 0x18b9a88
jrcxz 0x18b4e26
test eax, 0x36c55be0
jg 0x18b4e66
stosb byte [rdi], al
sub dword [rcx - 0x1b9020d], esi
in al, dx
enter 0xc53, 0x5e
invalid
xor r10b, r9b
sar word [rsp + 0x19], 0x65
sbb rbx, 2
mov word [rbx], r9w
call fcn.018b20ea
retf
neg r9b
push 0x5e37a496
jmp 0x18b4e74

Function at 0xc7d999
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x48]
jmp fcn.00c72675

Function at 0xc80709
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rsp], 0xffffffffc59cb9b2
call 0x19373c0

Function at 0xc87bb3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x28]
jmp fcn.00c72675

Function at 0xc89859
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 8], rsi
mov qword [rsp], rdi
push r10
mov edi, 0x313c8fb3
jmp 0xc94cc6
push rax
push r15
jmp 0x18b3791

Function at 0xc8f015
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sal r9w, cl
mov word [rbx], r9w
call fcn.018bdba2
add byte [rcx], al
or al, byte [rax + rax]
or dh, byte [rdx + rax]
add eax, 0x68000134
mov ebp, 0x68e7939f
add ebx, edi
mov edi, dword [rax]

Function at 0xc9127b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x1939723
lea rsp, [rsp + 0x28]
jmp fcn.00c72675

Function at 0xc959fe
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0x18d38e4
sal ax, cl
jmp 0x193961d
push 0xffffffffad26832e
lea rsp, [rsp + 0x10]
jmp fcn.00c72675
mov word [rbx], ax
jmp 0xc82e88
Function at 0xc9724e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x18]
jmp fcn.00c72675

Function at 0x18b3047
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x38]
jmp fcn.00c72675

Function at 0x18b4d2a
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rsp], 0xffffffffee020c38
lea rsp, [rsp + 8]
jmp fcn.00c72675

Function at 0x18b7dbc
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg al
not word [rsp + 0x14]
push 0xffffffffbe846b86
rol al, 1
add al, 0x2f
sal word [rsp + 3], 0xeb
mov qword [rsp + 8], 0x52b2cc28
call fcn.018d3ba2

Function at 0x18bdba2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rsp + 8], 0xffffffffc900d291
lea rsp, [rsp + 0x18]
jmp fcn.00c72675

Function at 0x18bdbfb
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg di
shr word [rsp + 0xa], 0xef
setns byte [rsp + 2]
neg byte [rsp + 0xe]
adc di, 0x4526
jmp fcn.00c72352
lea rsp, [rsp + 0x18]
jns fcn.00c72675
jmp 0xc87a2d
xor qword [rsp], 0x4713d793
adc rbx, 2
call fcn.018bcd38
jmp 0xc94722
jmp 0xc723a7
mov word [rbx], r8w
push 0xd1ef3b6
lea rsp, [rsp + 0x30]
jmp fcn.018cf1d1
sub rbx, 8
mov qword [rbx], rdi
call fcn.019373bb
xor r9w, r10w
not r9w
neg r9w
mov qword [rsp], 0xffffffffd52a2ca5
dec byte [rsp + 3]
and byte [rsp + 3], 0x11
inc r9w
dec byte [rsp + 4]
not byte [rsp + 5]
rol r9w, 1
xor word [rsp + 3], 0xb4a9
neg r9w
neg word [rsp + 3]
xor r10w, r9w
dec word [rsp + 1]
lea r9, [rsp + r9 + 8]
push 0x3ca42119
mov byte [r9], bpl
push 0x3726fd9d
jg 0xc72e00
mov cx, word [rbx]
push 0xfffffffff820a13c
mov r9w, word [rbx + 2]
jmp 0xc7c4b9

Function at 0x18c0364
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
cld
push 0xffffffffa313961d
rep movsb byte [rdi], byte [rsi]
mov esi, dword [rsp + 0x10]
sal rsi, 0x9b
push qword [rsp + 0x18]
popfq
mov rsi, qword [rsp + 0x20]
push 0x2d076236
not word [rsp + 1]
lea rsp, [rsp + 0x30]
jmp fcn.00c72675

Function at 0x18c4be6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x2fa19430
mov word [rbx], ax
lea rsp, [rsp + 0x28]
jmp fcn.00c72675

Function at 0x18c6492
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [rbx], r9d
push 0x3d21503f
lea rsp, [rsp + 0x18]
jmp fcn.00c72675
mov qword [rsp + 8], 0x10abe511
jmp 0xc94962

Function at 0x18d20d0
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x4b2ef7b6
push 0x32134696
lea rsp, [rsp + 0x20]
jmp 0xc75228

Function at 0x18d23ab
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov rbx, rbp
lea r11, [r11 - 0x707e4df0]
not r11b
pop r10
pop r11
pop rsi
call fcn.018b4d2a
push 0xffffffffc337749e
lea rsp, [rsp + 0x10]
call rax
mov ebx, 0xfa3ba424
jmp 0x18c00d9
mov rsp, qword [rbp + riz - 0x10]
lea r11, [rbx - 0x687959f3]
not bx
mov rbp, qword [rbp + riz - 8]
mov qword [rbp + riz], rax
jmp 0xc8f9f5
jmp 0x18bfbdd
jmp 0x18b6fc0
Function at 0x18d38bd
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add bpl, r9b
push 0xffffffffea349d38
mov word [rbx], bp
jmp 0x18b60e0
lea rsp, [rsp + 8]
jmp fcn.00c72675
call fcn.00c9724e
adc rbx, 2
jmp 0x18b58e5

Function at 0x18d3ba2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0xc87fa2
lea rsp, [rsp + 0x30]
jmp fcn.00c72675
xor r10b, al
lea rax, [rsp + rax + 0x30]
mov byte [rax], r8b
jmp 0xc81591
ror al, 1
push 0xffffffffe3af5883
jmp 0xc9a1ff

Function at 0x18d5e45
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
adc rbx, 1
sub rsi, 2
mov r9d, 0x4e250dab
movzx r9d, word [rsi + r9 - 0x4e250dab]
jmp 0xc825e5
or word [rsp + 0xa], 0x82bf
dec r8d
rol dword [rsp + 4], 0xe9
call fcn.018cd267
jb 0xc78185
mov ebp, 0xda342f05
neg rbp
mov bp, word [rbx + riz]
jnp 0xc75911
push 0x50b8e63a
xor r10b, dil
mov qword [rsp + 8], 0x19906db4
sub rbx, 2
not byte [rsp + 2]
call fcn.0193e721
mov qword [rbx], r9
call fcn.00c9a8ee
jmp 0x18d3e6f
jb 0xc781ae
xorps xmm2, xmmword [rcx]
cwde
push 0x5d
mov edi, 0x3f12ebda
and esp, ecx
sahf
invalid
lea rsp, [rsp + 0x30]
jb fcn.00c72675
lea esi, [rbp + 0x3bf2b8f7]
rcr byte [rsi - 0x7f0052eb], 1
loop 0xc78159
sbb byte [rdi + 0x25], ah
insd dword [rdi], dx
jb 0xc781a0
and eax, 0x7248476d
cli
invalid
invalid
call 0x18bdbfb
mov r9, rsp
mov ecx, 0x140
lea rbp, [rbx + riz - 0x80]
mov edi, 0xf9bff20a
not di
bts di, di
and rbp, 0xfffffffffffffff0
btr di, 0x18
sub rbp, rcx
jmp 0xc77333
not di
mov rsp, rbp
push rdi
not edi
mov qword [rsp + rdi*8 - 0x320067a8], rsi
push rdi
pushfq
pop rdi
mov qword [rsp], rdi
mov esi, 0x7ca28223
mov rsi, r9
mov edi, 0xabb7aa29
not edi
shl di, 8
mov rdi, rbp
push 0x7f2e9e84
call fcn.018c0364
lea esp, [rdi + rbx*4 - 0x39]
in eax, 0xab
and byte [rax - 0x71a84b36], bl
insd dword [rdi], dx
xor ah, byte [rax]
push 0x2e970c42
fld qword [rbx - 0x50]
push 0x4f07550a
jne 0x18d3ed1
mov byte [rcx], dl
xchg edx, eax
pushfq
invalid
and edi, esi
invalid
mov qword [rsp], 0xfffffffff429b296
lea rcx, [rsp + 0x1c8]
rol byte [rsp + 4], 0x23
jae 0xc761ca
push 0x3aab80a3
cmp rbx, rcx
push 0xffffffffd3b58b0b
lea rsp, [rsp + 0x18]
ja fcn.00c72675
mov ebp, 0xcfbfaa22
jmp 0xc8ac67

Function at 0x18d61fe
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x48]
jmp fcn.00c72675

Function at 0x18d7709
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x462b2923
lea rsp, [rsp + 0x30]
jmp fcn.00c72675

Function at 0x1937ff9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
cmp ebx, 2
call fcn.00c8f204
invalid
push 0x2f399b05
lea rsp, [rsp + 0x18]
jne 0xc6d336
mov ecx, 0x3ca8e3b0
mov rcx, rax
call fcn.00c8e43d

Function at 0x1939d09
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
jmp fcn.00c72675