joyce8/EMBER2024-capa huggingface dataset:
Function at 0x149fa06
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Hash data using murmur3

Disassembly:
xor cx, word [esp + ecx*2 - 0x3f8ffffb]
xor eax, ebx
ror dword [esp + ecx*2 - 0x3f90db00], 0x12
dec eax
and ecx, ecx
ror eax, 1
pop edx
bswap eax
push edx
xor eax, 0x4a1d083d
xor ebx, eax
or dword [esp + ecx - 0x1fc86d7f], ecx
mov dword [esp + ecx - 0x1fc86d7e], 0x3d1df803
adc edi, eax
xadd byte [esp + ecx*4 - 0x7f21b5fb], cl
mov dword [esp + ecx*4 - 0x7f21b4f4], edi
ret 4
xor dl, bl
pop ecx
dec cl
rol dl, 1
movsx eax, cl
push ecx
neg dl
xor eax, 0xae3322be
cmovnp ecx, dword [esp + eax - 0x51ccdd37]
cbw
sbb dl, 7
neg dword [esp + eax - 0x51cc0037]
ror dword [esp + eax - 0x51cc0037], cl
add ecx, dword [esp + eax - 0x51cc0037]
not dl
sub ax, cx
jno 0x14a07b4
cbw
lea ecx, [ecx + edx - 0x759c4788]
not ecx
cwde
dec ecx
btc eax, edx
jb 0xc98e53
mov eax, dword [ebp + 4]
mov dword [esp], ecx
mov cl, byte [ebp + 8]
shr dword [esp], 0xa
jae 0x1576abd
rol dl, 1
dec cl
dec dl
sal byte [esp + eax - 0x51cc37df], 0xe5
neg dl
not dword [esp + eax - 0x51cc37e0]
not dl
btc ax, 0x8d
ror dl, 1
xor bl, dl
lea edx, [esp + edx + 4]
not eax
bt ecx, ecx
mov ax, word [edx]
movzx edx, byte [esp]
mov dx, ax
push ecx
shl dword [esp + 3], cl
sbb byte [esp + 3], ch
mov cx, word [esi]
mov eax, 0xc284f0f
add eax, eax
not dx
not cx
shl eax, 0x9e
ror word [esp + eax - 0x7ffffffd], 0xa6
or dx, cx
div byte [esp + eax - 0x7fffffff]
mov word [esi + eax - 0x80000000], dx
imul dword [esp + eax - 0x7ffffffc]
add eax, dword [ebp + eax*2 - 5]
movsx ecx, dx
jmp 0x1547492
lea ebp, [ecx + ebp - 0x3f95]
rol ecx, 0xf
jae 0xcba9f7
call fcn.01574fa2
mov edx, 0xfb34628a
push edx
movzx edx, byte [ebp - 1]
jmp 0xcf38bc

Function at 0x14a144f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
bswap eax
not eax
ror ecx, 3
xor ax, ax
call fcn.0143534d
Function at 0x14a1d0d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
adc edi, ecx
call fcn.01465d1c
mov ecx, 0x60ac0835
mov eax, 0xb10037a6
bt ecx, 0xa
lea ebp, [ebp + ecx - 0x60ac0839]
btc ecx, 0x8b
mov eax, dword [ecx + ebp - 0x60ac0035]
shr ecx, 0x8c
xor eax, ebx
ror ecx, 0x92
jb 0x14fc2aa
sbb ax, dx
neg ax
rol ecx, 0x7d
and cx, dx
mov dword [esp + edx - 0x40240000], 0xb49f2a8d
xor bx, ax
mov word [edx + esi - 0x40240002], ax
or ecx, dword [edx + ebp - 0x40240006]
xor ecx, ebx
movsx eax, word [esp + edx - 0x40240000]
xadd eax, edx
lea ecx, [ecx + eax*4 - 0x22838b0e]
ror word [esp + eax - 0x40242a8b], 0x48
xor eax, 0xa4109405
rol ecx, 1
xor ax, word [esp + edx*4 - 0xaa34]
xchg word [esp + edx - 0x2a8b], dx
not ecx
not dx
xor ecx, 0xadb07eac
not al
xchg dword [esp + edx - 0x604b], edx
mul word [esp + edx - 0x2a8d2a8b]
xor ebx, ecx
ror eax, 0x22
jae 0x13b8a3d
rol eax, 3
dec eax
or ecx, 0xb1aeb78f
imul ecx, ecx
ror eax, 3
xor cx, cx
bswap eax
call fcn.0146ba48
movzx ecx, byte [ebp - 1]
mov edx, 0x79a1a5b3
xor cl, bl
lea eax, [edx + edx + 0x5da4568f]
lea edx, [edx + eax*8 + 0x6b088596]
jmp 0x1571522
add cl, 0xa5
xor cl, 0x32
cdq
ror cl, 1
btc edx, eax
dec dl
div eax
not cl
inc dx
ror dl, 0xa3
push edx
neg cl
ror dword [esp + edx*2 - 0x78ea6048], 0xf3
setb byte [esp + edx - 0x3c753022]
rol cl, 1
add dl, 0x97
ror dl, 0x26
neg cl
xor bl, cl
xor al, al
and al, 0xb7
lea ecx, [esp + ecx + 4]
movzx dx, byte [eax + ecx - 0x654400]
mov word [esi + eax*2 - 0xca8802], dx
movsx ecx, ax
mov edx, ecx
mov edx, dword [ebp + eax*2 - 0xca8805]
or ecx, ecx
lea ebp, [ebp + eax*4 - 0x1951005]
push eax
dec dword [esp + eax - 0x6543fc]
btr eax, eax
xor edx, ebx
neg edx
ror edx, 1
xor edx, 0x573d6304
dec edx
inc cx
je 0xd13689
dec al
not edx
shr dword [esp + eax*4 - 0x19513f9], 0xda
xor ebx, edx
or word [esp + eax*2 - 0xca89f9], 0x5a37
shl eax, cl
adc word [esp + eax - 0xca89fb], 0x780d
adc edi, edx
movzx cx, byte [esi + eax - 0xca8a00]
mov al, byte [eax + esi - 0xca89fe]
not cl
mov edx, dword [esp + 2]
sal dword [esp + edx - 0x37780d62], 0xd4
bts edx, edx
not al
or dword [esp + edx - 0x37780d62], edx
inc dx
and cl, al
mov word [esi + edx*2 - 0x6ef01acc], cx
movzx ecx, dx
shl ecx, 0x12
add cx, dx
mov dword [esp + edx*2 - 0x6ef01acc], edi
ret 4
Function at 0x14abef9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not eax
xor ebx, eax
rol edx, cl
xadd edx, ecx
adc edi, eax
movzx eax, cx
bts ecx, 0xa
bts ecx, edx
mov ecx, dword [eax + esi - 0x71c8]
cbw
bts eax, eax
idiv al
mov al, byte [ebp + eax*2 - 7]
xor al, bl
bswap edx
inc al
push edx
rol al, 1
xchg dword [esp + edx - 0x4d793bb2], edx
dec al
ror dl, 0xc7
add dl, dl
sbb dx, dx
rol al, 1
xadd byte [esp + edx - 0x4d78fffe], dl
xor bl, al
dec dword [esp + edx - 0x4d790079]
not edx
or dl, dl
lea eax, [esp + eax + 4]
pop edx
btr edx, 0x18
mov dword [edx + eax - 0x4c793bb1], ecx
movsx eax, dx
sbb dl, 0x91
rol al, 0xe1
movzx eax, byte [ebp + eax*8 - 0x1db1e]
movzx ecx, dl
sal dx, 0x88
or cl, 0x9f
lea ebp, [ebp + edx - 0x4c791f06]
bts ecx, 0
bts ecx, edx
xor al, bl
inc al
bts ecx, ecx
rol al, 1
bswap ecx
call fcn.01433547
call fcn.01445fb6
lea esi, [esi + ecx*4 - 0x158d4]
mov dword [esp + ecx - 0x5636], ecx
xchg dword [esp + ecx*4 - 0x158d8], ecx
bt edx, 0x96
xor eax, ebx
call fcn.0157fe5b
mov edx, 0x1c221785
mov ecx, edx
mov eax, dword [ebp + edx*2 - 0x38442f0e]
xor eax, ebx
neg eax
sub eax, 0xdc91919d
sar dl, cl
btc cx, dx
ror eax, 1
sal dx, 0x23
lea edx, [edx*4 - 0x2bda33f2]
js 0xcd7a05
dec word [esp + eax - 2]
sub dl, cl
cbw
or cl, 0x84
sbb dword [esp + eax - 3], eax
ror dl, 1
push ecx
ror word [esp + eax + 2], 0xc8
adc cl, 0x9d
not dl
inc byte [esp + ecx - 0x7fff97]
ror dl, 1
dec dl
dec word [esp + ecx*2 - 0xffff38]
xor bl, dl
dec ax
lea edx, [esp + edx + 8]
cwde
ror al, 1
or dword [esp + eax*2 + 2], 0xd6a1938e
mov eax, dword [edx + eax*4 - 4]
not cl
movsx edx, word [esp + ecx - 0x7fff60]
setle cl
lea ebp, [ecx + ebp - 0x7fff05]
setbe dl
or byte [esp + ecx*4 - 0x1fffc04], dl
mov dword [ecx + ebp - 0x7fff01], eax
sbb ecx, dword [esp + ecx*2 - 0xfffdff]
lea edx, [edx*4 - 0xc73de47]
pop ecx
pop edx
jb fcn.01497d09
mov edi, 0x8a64711a
hlt
Function at 0x14bb50b
Capabilities:
Encode data using base64

Disassembly:
lea eax, [ecx + ecx*8 - 0x35e56979]
dec edx
cwde
not edx
xchg ecx, eax
inc edx
cwde
ror ecx, cl
not edx
xor cl, ah
xor eax, 0x43e0312
neg edx
ror eax, 0x8d
shr ax, 0x2f
xor ebx, edx
not al
add edi, edx
bt cx, ax
lea edx, [eax + eax*4 + 0x540df599]
movzx dx, byte [ebp + eax*2 - 0x352e01fc]
setb al
setb al
add al, byte [ebp + eax*4 - 0x6a5bfffe]
sal ecx, cl
dec cx
and cx, 0x6822
lea ebp, [ecx + ebp - 0x226820]
rol ecx, cl
adc dl, al
push ecx
shr ecx, 0xce
sar dword [esp + ecx - 0x226], 0x24
mov word [ecx + ebp - 0x226], dx
mov dword [esp + ecx - 0x226], edi
ret
inc ecx
pop edi
inc ecx
bswap ebp
dec eax
adc edx, 0x921c0d89
dec eax
arpl ax, ax
dec eax
add edi, eax
sub bp, 0x5911
inc edx
mov edx, dword [ebp + esi - 0x2796f37a]
js 0x15875ab
mov ecx, 0xc3bc5c0f
mov edx, dword [esi]
rol ecx, 5
lea esi, [esi + ecx - 0x778b81f4]
imul cx, cx
btr ecx, 0x34
xor edx, ebx
jmp 0x12eafd2
ror al, 1
btc dx, 0x95
mov dword [esp + edx - 0x341eab03], edx
xor bl, al
movsx ecx, dx
add dl, 0x19
xor word [esp + esi*2 - 0x98b], dx
lea eax, [esp + eax + 0xc]
sbb dword [esp + edx*2 - 0x683d5638], 0xffaacf84
mov ecx, dword [eax + edx - 0x341eab1c]
push esi
ror dword [esp + edx - 0x341eab16], 9
xchg ecx, edi
shl word [esp + edx - 0x341eab10], 0xf
shl word [esp + esi*2 - 0x989], 0x4b
xor esi, dword [esp + edx*2 - 0x683d562c]
mov esi, ecx
mov ecx, edx
inc ecx
pop eax
pop edx
pop edx
pop ecx
jne 0x143b683
xor dword [esp + ebp - 0x27964c85], eax
inc eax
add ch, 6
inc cx
xadd esp, ecx
jne 0x14257e0
mov eax, ecx
lea esi, [eax + esi - 0x4f36c72d]
rol eax, 0x9d
cbw
bts cx, cx
xor edx, ebx
sal al, 0x84
pop ecx
not edx
cwde
ror edx, 2
shl ax, 0x4e
inc edx
xadd ecx, eax
bswap edx
rol edx, 3
cwde
xadd eax, ecx
inc cx
xor ebx, edx
xchg ecx, eax
sal ecx, 0x8c
sbb ax, 0x27a4
mov dword [ebp - 2], edx
adc ebp, 0xfffffffe
jmp fcn.00c21eff

Function at 0x14c0010
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov dword [esp], 0xc93ca60e
movzx edx, byte [edi - 1]
mov eax, dword [esp]
xor dl, bl
sar eax, 0xc1
dec al
adc eax, eax
rol dl, 1
push eax
neg dword [esp + 4]
xor dl, 0x12
neg dl
lea ecx, [eax + eax*2 + 0x79029598]
add word [esp], cx
setae cl
xor dl, 0x1d
not dword [esp + 4]
rol dl, 1
bswap ecx
dec eax
not dl
ror dl, 1
ror ax, 0xc7
and eax, ecx
and cx, 0x5593
xor bl, dl
neg cx
inc word [esp + eax - 0x4103e]
lea edx, [esp + edx + 8]
mov ax, word [edx + eax*2 - 0x82088]
jno 0x1486abb
mov eax, 0x4bb29f97
movsx ecx, al
lea edx, [ecx + ecx*4 - 0x7866324b]
mov eax, dword [esi + eax - 0x4bb29f97]
shr dl, 0x41
mov ecx, dword [esi + 4]
neg dx
bts edx, 8
adc esi, 4
add eax, ecx
mov dword [esi], eax
mov eax, dword [edi]
jmp 0xcd4fdc

Function at 0x14c03f6
Capabilities:
Authenticate hmac

Disassembly:
add edx, eax
movzx eax, byte [esp + ecx - 0x3bbeabbb]
mov dword [eax + ebp - 7], edx
lea ebp, [ebp + ecx - 0x3bbeabbb]
mov ecx, dword [ecx + edi - 0x3bbeabc3]
inc al
call fcn.0139ca5d
Function at 0x14c2932
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
push esi
jmp 0x152b967
mov edi, 0x1e90038d
mov esi, 0x17acdb12
pushfd
xor si, si
sub edi, 0xa931e6b3
mov esi, eax

Function at 0x14c49f9
Capabilities:
Encode data using xor

Disassembly:
or edx, dword [esp + edx*2 - 0xff6]
ror eax, 3
dec cl
call fcn.014ecd8e
mov eax, dword [esi]
mov ecx, 0x972c1a3a
add esi, 4
xor eax, ebx
dec cl
jne 0x14dc200
bswap eax
add cx, cx
movsx edx, cx
sal dl, 0xc7
lea eax, [eax + edx*4 + 0x30aeb23]
dec ecx
js 0xd15542

Function at 0x14c5a82
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc dx
xor cl, bl
rol cl, 1
lea eax, [edx + edx - 0x605c9a59]
shr byte [esp + edx - 0x7a0ba427], 0xa6
setae al
sbb cl, al
imul word [esp + edx - 0x7a0ba428]
mul edx
neg cl

Function at 0x14c9658
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ecx + ebp - 0x11ffffd]
mov edx, dword [ebp + 8]
mov eax, 0x3305912c
call fcn.00cbfc99
mov eax, dword [esi]
mov edx, 0xd1a2fd8a
rol edx, 0x5d
lea esi, [esi + edx - 0x5a345fad]
xor eax, ebx
or edx, edx
sub edx, edx
xor eax, 0x8c21b9b7
movsx ecx, dl
and dl, 0x32
and dl, 0xf
lea eax, [edx + eax - 0x3e869b35]
sar edx, 0xad
add ecx, edx
neg eax
sal cx, 0x87
xor dx, cx
lea eax, [eax + edx*8 - 0x4d9c3daa]
push ecx
bswap edx
xor ebx, eax
push edx
xor dword [esp + edx*2 + 4], edx
or word [esp + edx*2 + 4], dx
adc ebp, eax
xor edx, 0x4a0ae482
mov ax, word [edx + edi - 0x4a0ae482]
call fcn.0154f36b
Function at 0x14c96f0
Capabilities:
Encode data using base64

Disassembly:
sub esi, 4
mov eax, dword [esi]
mov edx, dword [esp]
xor eax, ebx
not word [esp + edx - 0x443799bd]
or edx, 0x5b2e691c
sbb al, 0x69
pop ebx
movzx ecx, dx
bswap eax
add ecx, ecx
mov word [esp + edx - 0x5f3ff9bd], 0xf2a0
or dword [esp + ecx - 0x1f37e], 0x73b4ad2e
neg eax
bt edx, 0x27
sal ecx, cl
rol eax, 1
or ecx, ecx
ror ecx, 0xed
jae 0x15195d0
mov edx, 0x2711d26e
adc eax, 0x9655186
mov al, byte [0x8233b5fd]
dec ebp
leave
mov dword [ebp + 0x148569b4], ecx
or al, 0x5b
js 0x136d948
lcall 0x7dcd, 0xf30366c4
mov dl, 0x21
dec edi
pop ebx
dec edx
xchg esi, eax
jp 0x136d96a
jnp 0x136d968
xchg byte [ecx + 0x65], dl
and dword [ebx], edx
inc ebp
xchg byte [ecx + 0x65], dl
pop edx
cmp ebx, ebx
cmpsd dword [esi], dword es:[edi]
cld
invalid
xor ecx, 0xfaae6834
ror ecx, 1
bswap ecx
or al, byte [esp + eax*4 - 0xee1fffa]
mov dword [esp + eax*4 - 0xee200a4], edx
xor ecx, 0xe1966a32
sub word [esp + eax - 0x3b88029], ax
setne al
pop edx
xor ebx, ecx
xor eax, eax
dec edx
not ax
adc ebp, ecx
mov eax, dword [esi + eax*2 - 0x20008]
neg dword [esp]
sbb edx, edx
not dword [esp + 4]
adc esi, 0xfffffff5
mov ecx, edx
rol edx, 0xae
xor eax, ebx
lea eax, [eax + ecx - 0x306a1b66]
neg eax
add eax, edx
xor edx, 0xd3838435
btr dx, 0x1f
shl byte [esp + edx*2 - 0x58f8f78e], 0xc6
rol eax, 2
push ecx
shl ecx, 0x85
pop ecx
xor ebx, eax
mov dword [edx + edi - 0x2c7c7bd0], eax
lea edi, [edi + edx*2 - 0x58f8f79a]
inc ecx
rol dword [esp + edx*2 - 0x58f8f791], 0x1b
pop eax
pop eax
jns fcn.01556dc6
mov eax, 0xd916c2b0
sub ebp, 4
movzx ecx, al
neg cx
jl 0xc9d339
push 0x443799bf
jmp 0x136d930
lea eax, [edx + eax + 0x1b7495c6]
call fcn.0154cac3
fmul dword [ecx + edi*4 - 0x17efff45]
aas
insd dword es:[edi], dx
invalid

Function at 0x14c9b9a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx + edx + 0x12e09049]
jno 0xcf5e5d
add ax, word [esp + 5]
xor ebx, edx
inc ax
sar cl, 5
add ecx, 0xe539fb98
add ebp, edx
rdtsc
xor cl, cl
sbb edi, 8
mov dword [edi + 4], eax
mov dword [edi], edx
shl cx, 0x89
pop eax
pop ecx
jae fcn.01556dc6
Function at 0x14cb168
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov ecx, edi
dec dword [esp + edx - 0x67d5e307]
push edx
lea edi, [edi + edx - 0x67d5e309]
movsx eax, dx
mov word [edi + edx - 0x67d5e307], cx
or byte [esp + edx - 0x67d5e306], ah
movsx ecx, dl
adc edx, edx
pop eax
pop ecx
jg fcn.0140b7dc
pop edx
rol eax, 2
not eax
xor ebx, eax
mov ecx, 0x22108bb7
shr cx, 0xc
add ebp, eax
mov edx, dword [edi + ecx - 0x22100008]
shl ecx, cl
mov eax, ecx
mov eax, dword [edi + ecx - 0x100007fc]
ror ecx, 0xad
mov ecx, dword [edi + ecx - 0x40007ff8]
call fcn.00ca3b5f
mov edx, 0x3f84a0b6
mov ecx, edx
mov eax, dword [esi + edx*2 - 0x7f09416c]
imul ecx, edx
btr ecx, ecx
lea esi, [edx + esi - 0x3f84a0b2]
xor eax, ebx
xchg dh, cl
imul edx, ecx
ror eax, 3
neg ecx
neg eax
neg edx
inc eax
not eax
push edx
lea edx, [edx + edx + 0x388d3287]
bswap eax
xor ebx, eax
neg ecx
add ebp, eax
sub cl, dl
jl 0xce4e89
mov ecx, dword [esi]
mov edx, 0x1a09bd96
lea esi, [edx + esi - 0x1a09bd92]
lea eax, [edx*4 - 0x5071c2fa]
xor ecx, ebx
lea eax, [eax + eax*8 + 0xc97abb1]
dec ecx
ror ecx, 3
lea eax, [eax + edx*2 + 0x5f9579b3]
xchg ah, dl
xchg edx, eax
lea ecx, [ecx + edx + 0x2af812b9]
bswap ecx
shl ax, 0xab
add edx, edx
lea ecx, [ecx + eax*2 + 0x79721921]
btr dx, dx
bswap ecx
cwde
xor ax, 0xb93c
and dl, ah
xor ecx, 0x938ff7a7
cdq
add eax, eax
dec ecx
bts ax, 0xbd
inc eax
idiv eax
ror ecx, 1
shl dl, 0xa4
neg edx
sbb ecx, eax
sal edx, 0x8a
shr edx, 0x64
btc dx, 0x95
ror ecx, 1
lea ecx, [edx + ecx - 0x629189c3]
sar eax, 0xbc
xor ebx, ecx
add ebp, ecx
shr eax, 0x4a
lea ecx, [eax + edx*2 - 0x61dddcc6]
call fcn.00d1c2bb
neg edx
rol al, 0x82
lea eax, [ecx + eax + 0xe0c5e9e]
sbb edx, 0xb6a50f82
not edx
lea ecx, [eax*2 + 0x2f92d528]
bt eax, 0x91
xor ebx, edx
not cl
dec al
add ebp, edx
and ecx, eax
xor ax, cx
not al
mov edx, dword [esi + eax*4 - 0x6cf0e3fc]
sal ecx, 0x4c
adc cl, byte [esi + eax*4 - 0x6cf0e3f8]
shr edx, cl
movsx ecx, ax
xor al, cl
jbe 0x13642c2
Function at 0x14cdd82
Capabilities:
Encode data using base64
Encrypt data using speck
Manually build aes constants

Disassembly:
adc ebp, 6
dec dword [esp + 7]
jnp 0x1512d1b
jb 0x14a38a3
and byte [ebp - 0x46], al
xor ebp, dword [ecx + 0x14b8a683]
das
mov cl, 0x91
lea ecx, [edx + edx - 0x6573eded]
mov eax, dword [esi]
ror cl, 0xc1
setno cl
adc esi, 3
xor eax, ebx
rol eax, 3
push ecx
not dword [esp]
sub eax, 0xfaa1deae
rol eax, 1
neg eax
bswap ecx
rol byte [esp + ecx*2 - 0xc927ce], 0x83
inc ecx
xor ebx, eax
and word [esp + ecx - 0x6493e6], cx
ror dx, cl
call fcn.014aea86
mov edx, 0xea2cb515
mov ecx, edx
sar ecx, 0x4d
sbb edi, 3
movzx eax, dx
cbw
mov edx, dword [edi + eax*8 - 0xa8]
sal cx, 1
sar al, 0x64
xor edx, ebx
bswap edx
ror edx, 2
push eax
sar dword [esp + eax - 1], 0x14
dec byte [esp + eax + 1]
not edx
inc eax
lea eax, [eax + eax*8 - 0xf68379]
xor dword [esp], ecx
xor edx, 0x3aab4a9b
call fcn.014c381f
jbe 0x1328961
mov edx, 0xa181be9e
mov edx, dword [ebp]
push 0x87898734
not byte [esp + 3]
add byte [esp + 3], 0x3a
mov eax, dword [ebp + 4]
push 0x7b2d2601
sbb byte [esp + 7], 0x99
inc dword [esp + 2]
mov cl, byte [ebp + 8]
push 0xa43bd8ab
ja 0xc517a6
pop edx
movsx eax, cx
mov ecx, dword [esi]
lea eax, [eax + edx*4 + 0x7d29b783]
imul edx, eax
adc esi, 3
cwde
cdq
call fcn.00caf6c8
shrd edx, eax, cl
jmp 0x15826eb

Function at 0x14d03be
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov word [ecx + esi - 0x2000009], dx
mov edx, dword [edi + ecx*8 - 0x10000058]
sub ecx, ecx
add ecx, 0x5998431e
lea edi, [edi + ecx - 0x5998431a]
btr ax, cx
bt eax, eax
xor edx, ebx
ror ecx, cl
setae al
jae 0x14d03f1
pop eax
xor bl, dl
and ecx, ecx
jbe 0x1383d27
shl cx, 0x47
add edx, esp
mov eax, ecx
lea ecx, [eax + eax*4 + 0x5241b9f]
btr cx, 0x1a
movzx ax, byte [edx + ecx*4 - 0x14a0ae7c]
jb 0x14b70e1
call fcn.013610b9
neg edx
shr cl, 0x24
shr eax, cl
call fcn.0143e7b3
mov edx, 0xc13f9c9e
btr edx, edx
ror edx, 0xd3
mov dx, word [esi]
mov ecx, 0x8f027903
mov eax, ecx
btc eax, eax
mov cx, word [esi + 2]
and dx, cx
not dx
movzx ecx, al
bts ecx, 0xb9
jae 0x136b3b6

Function at 0x14d5e74
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 4]
je 0xcdbd35
push esi
Function at 0x14ecdc6
Capabilities:
Encode data using xor

Disassembly:
rol edx, 1
cwde
bswap edx
neg eax
xor ebx, edx
div al
cbw
add edi, edx
mov eax, dword [ebp]
mov edx, 0x333623be
or ecx, edx
mov dx, word [ebp + edx*2 - 0x666c4778]
adc ebp, 6
call fcn.0139e62f
salc
mov al, byte [0x496121c5]
mov esp, dword [eax - 0x36]
imul bp, word [ebp - 0x2d46f0aa], 0xffbc
push ebp
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
loope 0x14ecddb
and esi, dword [esi]
xor ecx, dword [ebx]
retf 0x8b66
mov esp, 0x19ff7d55
sar byte [ebp + edx*2 - 0x2dee497b], cl
mov esp, 0x51f78e55
sar byte [ebp + edx*2 + 0x39a92ccd], cl
outsd dx, dword [si]
jge 0x14ecdcf
mov word [ecx], cs
loopne 0x14ecdad
mov ch, 0x93
push ecx
stc
or eax, 0x5b8231ee
popfd
les eax, [edx + 0x5a]
sahf
jne 0x14ecea4
iretd
sub al, 4
push es
aad 0x92
sub al, 4
push cs
inc edi
sbb eax, 0x2cffd3d2
js 0x14ecea2
retf 0x1454
Function at 0x14f6aeb
Capabilities:
Authenticate hmac

Disassembly:
add cl, 0x33
ror edx, 1
and ax, ax
sbb al, ch
sbb edx, 0x719c72d
add ecx, 0x7ca542ad
sar eax, cl
inc eax
xor edx, 0xca0b202b
not eax
and ecx, 0x8f881eb7
shl eax, 0x23
xor ebx, edx
add edi, edx
jmp 0x14c049c
not eax
lea edi, [edi + ecx*2 - 0x10fdc35]
cwde
inc eax
call fcn.0138badf
mov eax, 0x8b3d59a6
mov edx, dword [esi]
add eax, 0x6a167128
xor edx, ebx
movsx ecx, al
sal ax, 0x4b
add ecx, 0xcc3f74be
bswap edx
shl al, 0xe5
jae 0x14494e6

Function at 0x14f7173
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
je 0x137b572
push esi

Function at 0x14fd0c7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
dec dword [esp]
push 0xe4b8c53a
bswap eax
jne 0x1553228
mov dword [esp], 0x5b157730
xor eax, ebx
sal byte [esp + 3], 0x41
neg byte [esp + 3]
not dword [esp]
xor eax, 0x91894e85
jmp 0x143311f
mov eax, dword [ebp]
jmp 0x146213b
not eax
xor ebx, eax
not dword [esp + 4]
add edi, eax
not byte [esp + 1]
call fcn.01489a6e
Function at 0x14ff237
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov ecx, edx
mov dword [edi + edx + 8], eax
lea edi, [edi + edx*2 + 8]
call fcn.0153d1c4
neg edx
mov dword [ecx + edx - 0x4783c9d5], eax
mov edx, dword [esi + edx - 0x4783c9d4]
sbb esi, 0xfffffffa
mov ecx, 0x8e818cb3
xor edx, ebx
ror edx, 1
dec edx
lea eax, [ecx*4 + 0x7494288d]
bswap edx
inc ecx
sub ecx, ecx
cmovno eax, ecx
not edx
jg 0x144b2a4
and cx, ax
xor ebx, edx
add ebp, edx
movzx edx, ax
cdq
or eax, dword [edi + ecx*4 + 4]
add edx, 0x7c18fc21
setbe cl
xadd cl, dh
mov ecx, dword [edi + ecx*4 - 0x3e8]
ror edx, 0x76
sbb edx, edx
sal edx, 0x70
adc eax, ecx
jmp 0xd13d37
adc edi, ecx
mov ecx, edi
mov edx, 0xef9ccc97
mov eax, edx
ror eax, 0xc
sbb edi, 3
mov dword [edi], ecx
sar eax, 0x9c
lea ecx, [edx + edx*8 + 0x3bbfdab9]
shr cl, 0xa1
sbb esi, 4
rol eax, cl
xor dl, cl
xor dl, al
mov eax, dword [esi]
jle 0x14da291
xor eax, ebx
rol eax, 3
inc ecx
add cx, 0xed36
inc eax
not eax
neg edx
xor dx, dx
bts dx, 0x8a
dec eax
xchg edx, ecx
btc dx, cx
neg cx
neg eax
rol eax, 2
and dx, 0x3d2b
setns dl
sbb cx, cx
sbb eax, 0xb83ed08a
xor ebx, eax
dec ecx
add ebp, eax
jmp fcn.01556dc6
inc cx
ror eax, 3
sal dl, 0x44
bswap eax
not eax
push edx
xor al, bl
shl dword [esp + edx*2 - 0x7d22ea92], 0xf5
shr dl, 0xc1
and edx, edx
neg al
sal word [esp + edx*2 - 0x7d22ea48], 0x8f
xor al, 0x2d
add edx, 0x78981e11
call fcn.0156b44d
push ebx
push edx
lea ebx, [ebp + edx*8 + 0x65056333]
mov ebp, esi
mov ebx, eax
movsx eax, byte [esp]
add word [esp + eax - 9], 0x5193
mov edx, ebx
xor al, ah
shl edx, 2
or dword [esp + eax - 9], eax
ror al, 0x63
mov eax, ebp
call fcn.00c21f4d
mov eax, 0x7d9d0f98
mov eax, dword [eax + edi - 0x7d9d0f98]
movzx ecx, byte [esi]
mov edx, 0x110b7f16
xor cl, bl
bts dx, 0xa4
xor edx, edx
sbb cl, 0x82
or dx, 0x2c8f
sar dl, 0x44
or edx, edx
xor cl, 0x10
ror cl, 1
shr edx, 0xd8
not cl
bts dx, dx
sbb cl, 3
and edx, edx
shr dl, 7
push edx
xor cl, 3
pop edx
shr dx, 0xc2
adc cl, 1
inc edx
xor edx, edx
sbb edx, 0x4783c99b
xor bl, cl
add ecx, esp
rol dl, 0x43
jb 0xd2bf81
mov dword [eax + esi - 0xc1], ecx
mov dword [esp + eax - 0xbd], edx
mov edx, dword [ebp + eax*2 - 0x17f]
sub word [esp + eax*2 - 0x178], ax
lea ebp, [ebp + eax*8 - 0x5ed]
cwde
xor edx, ebx
add dword [esp + eax - 0xbd], 0xa40d7720
call fcn.01448919
mov ecx, 0xfaa94898
movsx edx, cl
add cl, dl
mov cx, word [edi]
add edx, 0xcb8db0e
movzx eax, dx
not edx
lea edi, [eax + edi - 0xdaa4]
sal dl, 0x81
cwde
movzx eax, byte [esi]
shr edx, 0xf
sal dx, 0x81
inc dx
lea esi, [esi + edx*4 - 0x73473]
imul edx, edx
jb 0x14edbc4

Function at 0x150b59c
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
shr edx, 0x5c
inc ecx
call fcn.00cf0c76
xor ebx, edx
add edi, edx
mov dword [esp + ecx - 0x4387f8d4], 0x3022d5ba
mov eax, dword [ebp + ecx - 0x4387f8d2]
dec cx
lea edx, [ecx + ecx*8 + 0x7534a51d]
mov ecx, dword [ecx + ebp - 0x4387f8cd]
and dx, word [esp + 0x12]
sub dl, dh
adc eax, ecx
sub edx, 0x19830b8b
mov dword [ebp + 6], eax
pop edx
lea ebp, [ebp + edx*2 - 0x6045ab6e]
je 0x1432cc9
mov dword [esp + edx - 0x3022d5ba], edi
ret 0xc