joyce8/EMBER2024-capa huggingface dataset:
Function at 0x132b46ec
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [edi + edx*2 - 0x4c], eax
pop edx
sar ecx, 0x6c
pop eax
pop edx
jns fcn.13439565
push ecx
mov dword [edx + esi - 1], eax
pop eax
jae fcn.120b5dc8
inc eax
bswap eax
movsx ecx, dx
mov dword [esp + edx*8 - 0x1cb5c8], 0xb39a683b
lea eax, [eax + edx + 0x419ae76b]
ror byte [esp + edx - 0x396b3], 0xe2
xor ebx, eax
xchg dword [esp + edx - 0x396b1], edx
lea edi, [edi + edx - 0x2a]
and ecx, 0xe2e85b2
jne 0x125fa212

Function at 0x132bbfdb
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0xa3e68aa1
lea esp, [esp + 8]
call fcn.134a3e11
mov edx, 0x281e941e
mov eax, dword [edx + ebp - 0x281e941e]
jmp 0x12643125

Function at 0x1333231d
Capabilities:
Execute syscall

Disassembly:
neg eax
inc ecx
sar edx, cl
xor eax, 0x35bd6011
sar ecx, cl
xor ebx, eax
add esi, eax
fdiv qword [ecx + ebp - 0x9e]
mov dword [esp + ecx - 0x9e], esi
ret
dec edx
push 0xaf8b4204
not byte [esp + 0x13]
lea esp, [esp + 0x14]
jne 0x1266419d
mov ecx, 0x9e9d93bd
shl cx, 0x66
mov esi, ecx
pop esi
not eax
mov ecx, 0x6e0fd995
mov dword [ebp + ecx - 0x6e0fd995], eax
mov edx, ecx
call fcn.12010491
add edi, 4
mov ecx, 0xec204e0c
xor eax, ebx
movsx edx, cl
lea eax, [edx + eax - 0x4931718e]
jmp 0x132a3930
rol eax, 3
neg ecx
push ecx
not eax
jo 0x11faf462
bt ecx, edx
jb 0x120eb894
inc ecx
mov ecx, 0xc27778a
inc ecx
rol ecx, 0x41
inc edi
mov ecx, dword [ebp + ecx*4 - 0x613bbc50]
dec ecx
adc ebp, 4
inc ebp
xor ecx, ebx
jmp 0x125e106a
xor eax, 0xf2264bf
mov dword [esp], 0x29beb182
jmp 0x132516a0
Function at 0x1334d593
Capabilities:
Encode data using xor

Disassembly:
xor bl, al
lea ebp, [ebp + edx*2 - 0x6846]
imul dx, cx
mov dword [esp + edx], ecx
mov word [edx + ebp], ax
setno byte [esp + edx*2]
movsx eax, dx
mov ecx, dword [esi + edx*2]
jo 0x13519124
lea esi, [esi + edx*4 + 4]
jno 0x13457270
mov edx, 0x9906c0bf
mov ecx, dword [edi]
mov edx, dword [edi + 4]
add edi, 8
mov eax, 0xfb0edaa2
xor eax, eax
mov dword ss:[ecx + eax], edx
mov ecx, eax
lea ebp, [ebp + eax*4 - 4]
call fcn.11edfe39
dec dword [esp + ecx - 0x10341d32]
mov word [ecx + edi - 0x10341d32], ax
mov eax, 0xf8378e23
mov ecx, dword [esp + 8]
add ecx, 0xffef9fb8
jmp ecx

Function at 0x133549c1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
jne 0x12630959
mov dword [esp + 4], eax
mov dword [esp], 0xf396b534
dec ebx
jmp 0x1329d5d5
Function at 0x13377764
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
inc esp
movsx edx, bl
dec esp
mov dword [esp + ebx*8 - 0xd0], edx
dec eax
lea ebp, [ebp + ebx - 0x18]
xchg dword [esp + ebx*2 - 0x33], ebx
rol di, 0x8b
jb 0x13450988
inc ecx
sal esp, cl
inc esp
mov dword [ebp + ebx*4], esp
xor word [esp + ebx + 3], di
shr dword [esp + ebx + 1], 0x57
inc esi
mov esp, dword [ebx + ebp]
dec ebp
lea ebp, [ebp + ebx*2 + 4]
inc ebp
movzx ecx, dx
jbe 0x1346ddd4
mov ecx, 0x7ea98a02
ror cl, 0xc1
dec esp
lea esp, [ecx + ecx*2 + 0x57231d9b]
mov edx, dword [ecx + ebp - 0x7ea98a01]
dec eax
lea edi, [ecx*2 - 0x51611bc6]
mov ebx, edi
inc esp
mov esi, edi
mov eax, dword [ebp + ecx - 0x7ea989fd]
sub cx, bx
inc esp
mov edi, dword [ebp + ecx - 0x7ea991bd]
dec eax
sub edi, edi
dec eax
lea ebp, [ecx + ebp - 0x7ea991c1]
inc ecx
div edi
mov dword [edi + ebp], edx
inc sp
xchg edi, esp
inc ebp
movzx ecx, dh
mov dword [ebp + edi*2 - 0x17738], eax
inc ebp
mov edi, ecx
inc ecx
mov edx, dword [ebp + edi*4 - 0x2ee78]
dec esp
lea eax, [ecx*4 - 0x1cfa5ad3]
dec esi
lea ebp, [edi + ebp - 0xbb9a]
dec edx
lea ecx, [esi*2 + 0x203c7fb8]
inc ecx
xor edx, ebx
inc ecx
ror cl, 7
mov eax, ecx
dec esi
lea ecx, [eax*2 + 0x43013200]
ror edx, 2
sub edx, 0xe314a8aa
bswap edx
inc ecx
and eax, 0x7586b4bc
neg edx
inc ecx
push eax
dec esp
lea edx, [edi + ecx - 0x16d2a3fd]
not dword [esp + edi - 0xbb9c]
bswap edx
rol edx, 1
call fcn.134b3a47
mov ecx, 0xb6a226
lea eax, [ecx + ecx*2 + 0x75a30494]
movzx ax, byte [esi + ecx*2 - 0x16d444c]
movsx edx, cl
mov cl, byte [esi + ecx*2 - 0x16d444a]
bts edx, edx
dec edx
shl dl, 0x41
lea esi, [esi + edx - 0xc8]
shl edx, 0x9b
adc al, cl
lea ecx, [edx*8 - 0x79ca34c2]
mov word [edx + esi - 0x50000000], ax
dec edi
lea ebp, [ebp + esi*2 - 0x4508bc]
dec ebp
adc eax, eax
inc esp
imul ecx, eax
inc ebp
xor edx, ebx
inc ecx
rol edx, 2
dec ecx
xor ecx, 0x4036979c
inc ecx
inc dh
dec esp
lea eax, [ecx - 0x3af844cd]
inc ecx
xor edx, 0x8189b2b2
inc ecx
neg edx
inc ecx
dec edx
dec eax
btc ecx, ebx
dec ecx
btc esi, 0x38
inc ecx
not edx
push ecx
dec esp
mov dword [esp + eax - 0x61e06a32], ebx
shr dx, cl
inc esp
xor dword [esp + eax - 0x61e06a32], edx
cdq
inc ecx
pop ebx
ror eax, cl
inc cx
idiv eax
xor edx, 0xf023210c
dec ebp
arpl dx, dx
call fcn.13597b66
inc ebp
xor esp, ebx
inc ecx
mov ecx, edx
inc ecx
bswap esp
inc ebp
movzx eax, cl
dec ecx
xadd eax, ebx
inc eax
not bh
inc esi
lea esp, [ebx + 0x28a00af4]
push ebx
not word [esp + ebx - 0x11]
inc ecx
rol esp, 1
inc esi
lea esp, [ebx + 0x183b6b9e]
dec esi
lea edi, [eax*4 - 0x4055c250]
inc ecx
sar eax, 0x36
dec esp
mov dword [esp + ebx*2 - 0x2c], ebx
inc esp
xor dword [esp + ebx*2 - 0x2c], esp
push ecx
inc edx
sub dword [esp + edx*8 - 0xca], ebx
add byte [esp + ebx*2 - 0x2a], bl
dec esp
mov ebx, dword [esp + ebx*2 - 0x24]
dec ebp
arpl sp, sp
mov eax, dword [esp + ebx - 0x11]
dec ecx
adc esi, esp
dec eax
mov dword [esp + ebx*2 - 0x34], esi
ret 0x10
Function at 0x13378321
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
bswap eax
neg edx
xadd cl, ah
rol edx, 3
sal word [esp + eax*2 - 0x78e049], cl
sal ecx, 0x8f
not edx
ja 0x126c568c
imul ebp, dword [esi - 0x2eb3b70], 0xfffffffd
xchg ebx, eax
pop ecx
xchg esi, eax
imul esp, dword [edi - 0x10], 0x257b6ddb
pop ds
sub eax, 0xd164116c
outsb dx, byte [esi]
lodsd eax, dword [esi]
aam 0xd0
xchg ebx, eax
rcl dword [ebx - 0x6c252fec]
test eax, 0x902e8353
jnp 0x1260b7b7
out dx, eax
test dword [ecx + 0x75], esi
nop
hlt
fidiv word [ecx - 0x62be9892]
cwde
xchg ebx, eax
mov al, byte [0x6d905fa2]
lodsd eax, dword [esi]
xchg dword [esi - 0x5e4ffe91], edi
or esp, dword [edi - 0x14dc1292]
xchg edx, eax
push eax
pop eax
iretd
xor ebx, edx
add esi, edx
xor eax, ecx
mov dword [esp + eax - 0x23ef025], esi
ret 4
adc eax, edx
mov dword [esp], 0xd78750b4
and dword [esp], 0xef8c3026
jl 0x134c785d
mov eax, 0x25953c06
dec eax
lea edx, [eax + eax*2 + 0x4b231c38]
fld qword [ebp + eax*2 - 0x4b2a780a]
movzx ecx, dl
xor edx, ecx
mov edx, dword [eax + edi - 0x25953c05]
lea edi, [ecx + edi - 0x43]
add ecx, ecx
push ecx
dec word [esp + eax - 0x25953c05]
xor edx, ebx
dec edx
bswap edx
sub al, al
ror cx, 0x2d
sbb edx, 0xcfa3c997
bswap edx
inc edx
push ecx
jmp 0x1260b764
mov dword [ebp - 4], eax
mov dword [esp + 4], 0xbb0eea01
test ebx, ebx
jmp fcn.1324114d

Function at 0x13383d4f
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jne 0x132639fd
dec ebx
push 0x7dbea61f
jmp 0x11fd681c

Function at 0x1339ac25
Capabilities:
Encode data using xor

Disassembly:
dec cx
mul byte [esp + eax*2 - 0x4fd016c7]
sub al, 0xb8
neg ax
xor bx, cx
btr eax, edx
cdq
neg eax
lea ebp, [ebp + edx - 2]
mov word [ebp + edx*2], cx
movsx ecx, ax
or eax, edx
xor dword [esp + edx + 4], 0xf987aab7
pop eax
pop ecx
jno fcn.11ec5778
rol eax, 0xa7
xor edx, 0xd2378e94
xadd al, ch
xadd ecx, eax
xor ebx, edx
pop ecx
movsx ecx, al
add edi, edx
sal word [esp + ecx - 0x35], 0x8d
not word [esp + ecx*4 - 0xd2]
cmova ax, cx
lea esi, [esi + ecx*2 - 0x6e]
ror dword [esp + ecx - 0x32], 0x14
jnp 0x134f787d
mov cx, word [esi + ecx - 0x36]
sub dword [esp + 4], 0xc9bec5b5
sar word [esp + 4], 0x21
xor cx, bx
mov word [esp + 2], ax
not cx
mul eax
dec byte [esp + eax - 0x27e80b63]
ror cx, 1
inc cx
mov byte [esp + eax - 0x27e80b63], ah
not cx
jmp 0x126528e7
Function at 0x1339b56f
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor dword [esp + eax*2 - 0x190a59ec], ecx
dec esp
lea edi, [edx*4 - 0x407a1953]
inc eax
shl bh, 0xc3
inc ecx
pop ebx
dec eax
dec eax
dec ebp
arpl cx, cx
dec ecx
adc esi, ecx
inc esp
add esp, eax
inc esp
movzx esi, al
ja fcn.13567311
movzx eax, dx
mov edx, ebx
xor eax, eax
lea eax, [eax + eax - 0x5b64d000]
push ebp
mov edi, eax
mov ebp, esi
mov ecx, dword [esp]
pop ecx
pop eax
pop edx
jmp 0x1339b542
xchg esp, eax
or edi, ecx
dec dword [ebx - 0x2568441a]
nop
movzx esi, bl
mov ebx, 0x6790da97
movzx esi, bl
mov ebx, edi
lea ecx, [esi + esi - 0x9e0184f]
push esi
movsx eax, cl
mov eax, 0
call fcn.125e800e
dec ecx
jb 0x1339b5b6
sbb byte [edx + 0x47e39788], dl
imul ebp, dword [esi - 0x6d], 0x894cd18d
dec esp
mov dword [esp + eax - 0x44c72beb], ebx
dec eax
lea eax, [ebx + ecx - 0x7dd135e5]
inc esi
invalid
mov ah, 0xc
invalid
jbe 0x1339b53c
les eax, [ebp + 0x33]
rol byte [ecx + 0x5b], 0x4a
lea ebp, [ebp + ecx*2 - 0x7693139a]
inc esi
mov dword [ebp + ecx - 0x3b4989cb], esi
inc edi
mov ecx, dword [ebp + ecx - 0x3b4989cb]
inc esp
mov edx, ebx
movzx edi, ax
dec edi
lea ebp, [eax + ebp + 4]
dec eax
bt edi, 0x36
imul ecx, ebx
inc ebp
xor ecx, ebx
inc esp
movzx esp, bx
dec ecx
sub ecx, edx
inc edi
lea ecx, [eax + ecx - 0x3fa40bb6]
inc ecx
bswap edx
inc ecx
ror ecx, 1
inc cx
sar esp, 0xe5
imul ebx
inc ebp
adc ecx, eax
inc ecx
rol ecx, 3
bts edx, 0x11
inc ebp
movsx edi, ah
jb 0x12088d90
retf
inc ecx
xor ecx, 0x37007a9e
inc cx
inc edi
push edx
dec edx
sar dword [esp + eax], 0x50
inc ebp
xor ecx, edi
dec al
dec esi
mov dword [esp + eax*2], ebx
jno 0x120685fd
mov edx, 0x8c99c52b
movsx ecx, dx
mov cx, word [esi]
mov eax, edx
cbw
mov dx, word [esi + 2]
lea eax, [eax*4 - 0x464d22e0]
bts eax, 0x34
adc esi, 1
add cx, dx
mov word [esi], cx
mov ecx, eax
mov eax, dword [edi]
add edi, 4
xor eax, ebx
not eax
movzx edx, cx
neg eax
rol edx, cl
add dx, cx
not eax
sub cl, dh
or dx, 0xde9c
call fcn.120c933a

Function at 0x133b2f2b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd090d6bb
sbb esi, 8
rol ecx, 0x6f
btc ecx, ecx
mov dword [esi + ecx - 0x6b5de944], eax
adc ecx, ecx
push ecx
mov dword [esi], edx
pop eax
pop ecx
pop ecx
jge fcn.120b5dc8
mov ds, word [edi + edx*4]
lodsb al, byte [esi]
dec edi
mov dword [0xccb34ff7], eax
adc byte [eax + 0x69], cl
mov cl, 0xa6
and al, byte [ecx]
daa
dec esp
mov eax, 0xd7493c9c
mov bl, 0xb4
rol dword fs:[ecx], 0x4d
invalid
and edx, edx
ror ecx, 2
rol dl, 4
or eax, 0x4f306bad
xor ecx, 0x8b9fd7bf
mov dword [esp + edx*4 - 0xc7492a0], 0x2b17aa37
dec ecx
ror edx, 0xcd
cwd
not ecx
rol ax, 0x6c
xor dx, ax
xor ebx, ecx
add ax, ax
add edi, ecx
shr ax, 0x41
not dword [esp + edx*2 - 0x4a804000]
lea edx, [edx - 0x55eb4e4b]
rdtsc
jb 0x120bcb84
jle 0x11ee4e59
mov edx, 0xd17562f
push edx
dec dword [esp + edx*2 - 0x1a2eac5e]
lea ebp, [edx + ebp - 0xd175633]
movsx eax, dl
mov edx, dword [ebp + edx*4 - 0x345d58bc]
xor edx, ebx
sub eax, eax
lea ecx, [eax*2 + 0x35a36f28]
je 0x12003ac2
not edx
movzx eax, cl
pop eax
add eax, 0x58a6f6
jmp eax
Function at 0x133c65da
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ax, 0xa58a
jge 0x134b2383
mov word [edi + eax - 0x7a025a3e], dx
mov ecx, eax
shl ecx, 0x61
seta al
mov dword [esp + eax - 0x7a025a01], esi
ret 8

Function at 0x133cf532
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x510f45a3
mov dword [esp], ebx
ror ax, 0xa8
movzx ecx, dl
jp fcn.11ec5778
sar eax, 0xa2
pop edx
neg cl
mov edx, eax
not cl
and edx, 0xa1bd0191
ror cl, 1
neg cl
xor bl, cl
not eax
bts ax, ax
lea ebp, [edx + ebp - 0x9c0012]
add edx, eax
imul dx
sal ax, 0x49
mov word [ebp], cx
jp 0x13387fb2
movsx edx, cl
pop esi
call fcn.135636fc
push 0x48ae4427
push 0xadbeccad
lea esp, [esp + 0xc]
je 0x1346bb42
jmp 0x11ffe16a

Function at 0x134002a4
Capabilities:
Execute syscall

Disassembly:
push ecx
sub dl, 0x35
pop eax
xor bl, dl
not eax
add al, ah
add eax, eax
lea esi, [eax + esi - 0x3098c5b4]
mov word [eax + esi - 0x3098c5b2], dx
shl cl, 0xe5
movsx edx, ax
xchg edx, eax
mov ecx, dword [edx + edi - 0x3098c5b2]
shl ax, 0x27
sal dx, 0x4b
neg edx
adc edi, 3
jmp 0x135166f3
rol ecx, 3
or al, dh
sbb dx, dx
lea ecx, [ecx + eax + 0x3d9d8a2f]
rol ecx, 1
xor ebx, ecx
add dx, 0x3e2b
adc ebp, ecx
call fcn.120b0fcb
neg cl
sub cl, 0xad
ror cl, 1
shr dl, 1
or edx, edx
xor bl, cl
ror edx, 0xdf
btr dx, dx
lea ecx, [esp + ecx + 8]
not edx
mov word [edx + ecx - 0xf76a], ax
mov ecx, edx
sbb cl, dh
call fcn.11f34633
sysenter
call fcn.1267c324
xor ecx, ebx
xor dx, ax
shl dx, 0x2c
imul edx, edx
not ecx
or al, al
shr edx, 0xe7
call fcn.135774d1
xor edx, 0xdc3aaf8d
not dword [esp + 9]
movsx eax, cx
ror edx, 3
inc byte [esp + eax*4 - 0x5176]
xor ebx, edx
add ecx, ecx
add ebp, edx
mov dword [esp + ecx - 0x2b8a28c2], ebp
ret 0xc
popfd
xadd al, ah
jmp esi
pop eax
call fcn.11fab60a
sub ebp, 4
mov eax, 0x1d1b1522
add al, 0x31
mov eax, dword [ebp + eax - 0x1d1b1553]
jbe 0x1209d766
mov ecx, 0xe6bb07ba
xor eax, ebx
bswap eax
lea edx, [ecx + ecx*8 - 0x357c4df6]
bts cx, cx
not eax
bswap edx
shr dx, 0x8d
dec eax
rol dx, 0xa5
jb 0x1323a77f
ror eax, 2
xadd edx, ecx
adc ecx, edx
dec eax
xor ebx, eax
add esi, eax
mov ecx, dword [edi + ecx*2 - 0x21520f76]
lea eax, [edx + edx - 0x37e4655b]
lea edi, [edi + edx - 0x7bb207b6]
or al, dl
jle 0x1350ca01
mov ecx, 0x67b39d8a
mov eax, ecx
movzx edx, byte [edi + eax - 0x67b39d8a]
lea edi, [eax + edi - 0x67b39d89]
xor dl, bl
jmp 0x1344bee2
dec cx
dec ecx
add dl, 0xb4
ror dl, 1
lea eax, [eax + ecx*4 - 0x52777fc1]
inc dl
ror dl, 1
jmp 0x11eb493d
xor dx, 0x231d
push ecx
bt edx, 0xe
cwde
jae 0x12645457
xor ecx, ebx
btr dx, dx
bswap ecx
sbb eax, edx
xadd dx, ax
jg 0x12005d0b
lea esp, [esp + 0x24]
jmp 0x11f9d3ce
Function at 0x134115f7
Capabilities:
Encode data using xor

Disassembly:
je 0x133c7ca4
dec esi
mov dword [esp + ecx - 0x6890bba9], ebx
inc edx
xor dword [esp + edi - 0x6890bc52], eax
inc ecx
pop ebx
inc ecx
sub esp, 0x56ba4786
dec eax
arpl ax, ax
inc ebp
adc eax, esi
push ecx
dec eax
add esi, eax
dec edx
mov ebx, dword [ebp - 0x23ac623c]
inc edx
mov eax, dword [esp - 0x11d6311a]
dec eax
lea edx, [edi - 0x1057f7d1]
inc edx
mov cl, byte [ebp - 0x23ac6234]
dec edx
sar dword [esp - 0x11d6311e], 0xad
dec edx
lea ebp, [ebp - 0x11d63114]
lodsb al, byte [esi]
and eax, 0xee29ceec
inc ecx
mov byte [esp + ebx - 0x11d6311e], cl
inc dx
rol dword [esp - 0x11d6311c], 0xad
inc si
xor esi, dword [esp - 0x23ac6239]
inc dx
xor dword [esp - 0x4758c475], 0x894ae8b0
mov ah, 0x24
loop 0x1335627d
sub esi, ebp
ret
mov eax, 0x6225138f
dec eax
mov dword [esp + edx*4 - 0x24c], 0x9e32e633
inc ecx
pop ecx
inc ecx
pop edi
inc ecx
pop esi
jo fcn.13567311
inc ebp
xor al, al
jne 0x1335622a
inc esp
xor dword [esp + ecx + 8], esi
inc cx
inc eax
inc cx
shr edx, 0x42
dec esp
mov dword [esp + ecx], eax
dec esp
mov ebx, dword [esp + ecx + 8]
dec ebp
arpl si, si
dec esp
mov dword [esp + ecx + 8], edx
dec ecx
not edx
cmovb ebx, dword [esp + ecx*2]
dec ecx
add esi, esi
dec eax
cwde
dec eax
sal ebx, 0xb
movsx edi, cl
dec esp
mov esi, dword [ebp + ecx]
inc sp
mov eax, dword [ebp + ecx + 8]
dec eax
lea ebp, [ecx + ebp + 0xa]
or al, al
ror dl, 0x82
mov byte [esp + ecx + 4], bh
inc si
mov dword [ecx + esi], eax
inc esp
movzx esi, word [esp + ecx*2 + 5]
inc ebp
movsx esp, bh
dec eax
mov dword [esp + ecx*2], esi
ret 8

Function at 0x1341c864
Capabilities:
Encode data using base64

Disassembly:
inc edx
mov edi, dword [edi + ebp - 1]
dec esi
lea ebp, [eax + ebp + 0x727d5ae8]
dec eax
mov dword [esp + ebx + 0x6ce067c], 0xd537270e
inc ecx
xor edi, ebx
dec ebp
lea esi, [edi + ebx*2 + 0x69357638]
inc ecx
pop esi
shl word [esp + eax + 0x727d5ae5], 0xe5
ror edi, 3
dec ecx
mul esi
and dword [esp + ebx*2 + 0xd9c0cfb], 0xe094e783
inc cx
sal edx, 0x69
lea edi, [edi + ebx*4 - 0x1686d1c5]
ror edi, 1
inc ebp
mov ecx, edi
inc ecx
mul edi
dec edi
rol dword [esp + ebx*4 + 0x1b3819f1], 0x98
dec esp
mov dword [esp + eax - 0x4561e298], ebx
call fcn.13458dd2
Function at 0x13433ca7
Capabilities:
Encode data using base64

Disassembly:
sal byte [esp + ecx*4 - 0x75fbfffb], 0x22
xor eax, ebx
xor eax, 0xb8078aa6
ror word [esp + ecx - 0x1d7efffe], 0xc7
not eax
movsx edx, byte [esp + ecx - 0x1d7effff]
bswap eax
shl ecx, 0x8b
neg eax
xor ebx, eax
shl dx, 1
xchg dword [esp], ecx
xadd word [esp + ecx*2 - 0x10001d9], cx
add ebp, eax
pop eax
mul edx
jo fcn.1342bca5
shr edi, 8
jmp 0x133d49cd
lea ebp, [edx + ebp - 0x100a]
neg cx
mov eax, dword [ebp + edx*4 - 0x4018]
sub cl, dh
xor eax, ebx
lea ecx, [ecx + ecx - 0x6e52bc49]
ror eax, 1
inc cx
xadd ecx, edx
bswap eax
sar ecx, 0x18
and edx, edx
rol eax, 3
and edx, ecx
call fcn.125dfc38
mov edx, 0x1109fe28
mov eax, edx
movzx ecx, al
movzx eax, byte [edi + edx*4 - 0x4427f8a0]
not cx
lea edi, [edi + edx - 0x1109fe27]
sub ecx, edx
push edx
xchg dword [esp + edx*4 - 0x4427f8a0], ecx
xor al, bl
rol al, 1
rol edx, 0x74
dec al
inc ecx
not edx
not al
add al, 0x99
not al
ror dl, 0x24
mov word [esp + edx*2 - 0x3afdde0b], dx
neg al
xchg ecx, edx
ror byte [esp + edx - 0x1109fe27], 0x65
xor bl, al
shr word [esp + edx - 0x1109fe27], cl
xadd word [esp + edx*4 - 0x4427f8a4], dx
lea eax, [esp + eax + 4]
bt ecx, 0x81
inc ecx
mov dx, word [edx + eax - 0x110906af]
mov byte [esp + ecx - 0x1d7eef07], ch
shr cl, 0x26
sub cl, ch
lea esi, [esi + ecx*4 - 0x75fbbc46]
rol word [esp + ecx - 0x1d7eef10], 0x81
inc ecx
mov word [ecx + esi - 0x1d7eef12], dx
mov eax, dword [esp + ecx*4 - 0x75fbbc48]
sbb dword [esp + ecx - 0x1d7eef12], eax
mov eax, dword [ecx + edi - 0x1d7eef12]
xchg word [esp + ecx - 0x1d7eef12], cx
neg dword [esp + ecx - 0x1d7effff]
lea edi, [ecx + edi - 0x1d7efffb]
add byte [esp + ecx - 0x1d7effff], ch
jne 0x11f937b1
xor edi, edx
xor word [esp + 0xc], 0x2cb9
sub byte [esp + 0xd], 0x8b
push 0x239b2120
dec ecx
inc edx
jmp 0x134e7dce
inc ecx
mov edx, dword [esp + edx*4]
jno 0x1328d6bb
mov ecx, dword [edi + 4]
mov edx, 0xd21bd08a
sub dx, dx
adc edi, 4
sal dx, 0xa
push edx
inc word [esp + 1]
not eax
add dx, 0x1715
sub word [esp + 2], dx
not ecx
and eax, ecx
xadd word [esp + 2], dx
call fcn.12604438
jl 0x120a6ea5
mov edx, dword [edi]
call fcn.1204cc0a
dec eax
mov dword [esp + 8], 0x4a30980f
xor edi, 0xd606e93d
ror dword [esp + 0x11], 2
call fcn.1346f9bc
mov eax, 0x4f37749b
mov edx, dword [eax + ebp - 0x4f37749b]
lea ecx, [eax*8 - 0x69601448]
push eax
ror cl, 0xe7
lea ebp, [ebp + ecx*4 - 0x416e4080]
adc ax, ax
cwde
shl eax, cl
xor edx, ebx
ror edx, 2
push eax
bswap edx
btc eax, eax
not edx
bswap ecx
sub dword [esp + ecx - 0x21905b0c], 0xab87eb18
or byte [esp + ecx*2 - 0x4320b619], 5
neg edx
xor ebx, edx
add esi, edx
cwde
mov edx, edi
cwde
lea edi, [edi + ecx*2 - 0x4320b624]
mov dword [edi + ecx*2 - 0x4320b620], edx
bt ax, 0x3d
cdq
pop edx
pop ecx
jae fcn.12693695
mov ecx, 0xbdb71006
movzx edx, cx
fld qword [edi + edx - 0x1006]
jmp 0x133b31e6
Function at 0x13435bf1
Capabilities:
Execute syscall

Disassembly:
or dword [esp + ecx - 0x5ae70804], 0xc60742b6
dec ax
xor bx, ax
btc cx, 0x9f
add ecx, edx
mov dword [esp + ecx - 0x41ef90a0], ecx
lea ebp, [ebp + ecx - 0x41ef90a2]
rol cl, 0x24
inc cl
mov word [ebp + ecx - 0x41ef900b], ax
sub byte [esp + ecx - 0x41ef8ffe], dl
pop edx
pop ecx
pop eax
pop eax
jnp fcn.11ec5778
sysenter
push ebx
call fcn.11fc6772
shr al, 0x27
xor ebx, edx
bts ax, 0x1c
pop eax
adc esi, edx
movzx ax, byte [ebp + ecx*8 - 0x5a0]
neg cx
mov cl, byte [ebp + ecx*8 - 0x7fa5e]
and word [esp], 0x8ba0
mov edx, 0x1782dc9f
lea ebp, [edx + ebp - 0x1782dc9d]
shl dword [esp + edx*2 - 0x2f05b93e], 0x21
shr al, cl
mov word [ebp + edx - 0x1782dc9f], ax
neg edx
xchg dword [esp], edx
movsx eax, dx
mov dword [esp + edx*2 - 0x200], esi
ret

Function at 0x134370ed
Capabilities:
Encode data using xor

Disassembly:
mul eax
add esi, ecx
cdq
mov dword [esp + 4], 0xb552a1
sal al, 0x67
pop edx
pop ecx
pop eax
pop ecx
pop edx
pop ecx
pop ecx
pop eax
jbe fcn.11fd52e9
lea esp, [esi - 0x42f8d68]
add esi, ebx
mov edi, 0xf5d264b3
adc ah, byte [edx + 0x1763abd5]
add esi, eax
invalid

Function at 0x134377b4
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x38c5af74
call fcn.1321bf7f

Function at 0x134380d1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea ecx, [eax*4 + 0x5d0f9434]
shl ecx, cl
bswap edx
adc eax, eax
add eax, ecx
not edx
inc edx
push ecx
neg edx
pop eax
xor ebx, edx
inc eax
add edi, edx
jmp fcn.133fa0f5
mov dword [esi + 8], ebx
mov ebx, 0xb8a6f402
mov dword [esi + 4], ecx
movsx ecx, bl
sar word [esp + ecx + 6], 0xa3
mov dword [esp + ecx - 2], ebx
mov dword [esi + ecx - 2], edx
pop ebx
adc bx, cx
shr cl, cl
mov ebx, dword [esp + ecx + 8]
pop ecx
pop edx
pop ecx
je fcn.11ef2f4b
call fcn.133c9cb3
pop edx
mov eax, dword [esp]
ror ecx, 1
lea ecx, [ecx + eax - 0x484744e5]
sub dword [esp + eax - 0x7672421a], eax
mov dword [esp + eax - 0x76724216], eax
bswap ecx
or dword [esp + eax - 0x76724216], 0x61986c95
lea edx, [eax + eax + 0x2cb7e188]
jbe 0x11ed04a1
lea ecx, [ecx + eax*2 + 0x9d56903]
call fcn.133f5a85
xor ecx, ebx
push 0x1f02301d
not word [esp + 2]
neg ecx
sar word [esp], 0x27
bswap ecx
sete byte [esp]
sbb ecx, 0x449bf036
call fcn.12084cf1
dec ebp
insb byte es:[edi], dx
pop eax
sbb eax, dword [edi + 0x6aef8381]
pushal
inc ebx
cld
rdtsc
mov ecx, 0xaf2b8d32
sub ecx, 0xbcb9e096
sbb ebp, 7
mov dword [ebp + 4], eax
lea eax, [ecx + ecx*2 + 0x34868422]
imul ax, ax
mov dword [eax + ebp - 0xbdb3864], edx
mov edx, ecx
cdq
or cx, ax
xor edx, dword [esi + eax - 0xbdb3864]
xor ecx, eax
neg cx
lea esi, [esi + eax*2 - 0x17b670c4]
inc cl
cwde
xor edx, ebx
jmp 0x11feb528
Function at 0x1344e601
Capabilities:
Encode data using xor

Disassembly:
inc ecx
push edx
inc ecx
ror al, 0x25
mov dword [ebp + edi - 0x60c0428], eax
sal ebx, cl
ja 0x13340358
inc ecx
pop edi
pop ebx
inc ecx
pop esi
jns fcn.13567311
add edi, eax
push ecx
mov dword [esp + ecx - 0x76c4033c], edi
ret 4
inc ebx
mov edx, dword [ebp + edx - 0x5f00c70c]
inc ebp
mov ecx, edx
inc ecx
rol ah, 7
dec ebp
lea ebp, [ebp + ebx*2 - 0xd351430]
inc ecx
dec ah
inc ecx
dec dl
inc ecx
xor edx, ebx
call fcn.132959aa
mov edx, 0xaa9cca1a
lea eax, [edx*2 + 0x192d8d37]
mov eax, dword [edi + eax - 0x6e67216b]
movsx ecx, dx
mov ecx, dword [edi + 4]
shr dl, 0xa3
push ebx
cpuid
sbb edi, 8
mov dword [edi + 0xc], eax
mov eax, 0x343c15a5
bts ax, 0x36
mov dword [edi + eax - 0x343c15dd], ebx
mov ebx, eax
mov dword [edi + eax - 0x343c15e1], ecx
and ax, bx
sbb bx, 0x8f34
xchg ebx, eax
mov dword [edi + eax*2 - 0x68790d62], edx
not eax
movzx ecx, al
pop ebx
sar cx, cl
push eax
lea ebp, [ecx + ebp - 4]
movsx edx, al
setne al
xchg byte [esp + ecx + 3], al
mov eax, dword [ebp + ecx*4]
xor eax, ebx
bts dx, dx
or cl, dh
neg dword [esp + ecx - 0x40]
neg eax
or ecx, 0xafad6617
rol eax, 1
or word [esp + edx - 0x404c], 0x669c
dec eax
and cl, 0xbe
sub edx, edx
sar ecx, cl
xor eax, 0x4310e3f
bts ecx, 0x3f
xor ebx, eax
sub word [esp + edx + 2], cx
btc edx, 0xc
jae 0x11fa6558
mov ebx, 0xfe18d62d
inc ecx
mov eax, dword [ebp]
inc esp
movzx esi, bx
dec edi
lea ebp, [ebp + esi*4 - 0x358b0]
jmp 0x13526384
neg al
inc cx
sal esi, cl
dec ecx
add esi, 0x7f91d99c
dec al
or dword [esp + edi - 0x60c0474], 0x4f232c9a
inc ecx
dec cl
ror al, 1
dec ebp
lea edi, [ecx + ebx*2 - 0x43ef6b4b]
dec eax
mov dword [esp + edi*4 - 0x18301200], 0xcd136b8c
dec ebp
add eax, ecx
neg al
inc eax
xor bh, cl
adc al, 0xbb
inc ecx
ror eax, cl
dec ecx
lea ecx, [edi + ebx*2 + 0x252682b4]
inc byte [esp + edi*2 - 0xc18084c]
xor al, 0x1a
sal bx, 0xc
inc esp
xor bl, al
dec edx
lea ebp, [ebp - 0x5bee]
jmp 0x12073b88
inc ecx
movsx edx, dh
dec eax
dec edx
inc ecx
xor eax, ebx
dec ecx
ror esi, 0xc3
inc ecx
mov edi, esi
lea eax, [eax + edx - 0x1f18e4ea]
dec edi
dec esp
lea eax, [edx*4 + 0xc34c43d]
xor eax, 0x5c2d482d
jmp fcn.134dae08