joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc0f5b2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
dec edx
not eax
setge byte [esp + edx - 0x6fc37001]
xor ecx, 0xb69d39a9
sal dl, 0xa1
xor ebx, eax
add edi, eax
mov dword [esp + edx - 0x6fc3700e], 0x7ebb3fac
add cl, 0xb7
mov cx, word [edx + esi - 0x6fc3700c]
lea esi, [esi + edx - 0x6fc3700a]
movzx eax, byte [ebp + edx - 0x6fc37013]
lea ebp, [ebp + edx - 0x6fc37013]
jns 0x1350d40
shr edx, 0x30
xor al, bl
dec dl
push edx
add al, 0x22
push edx
sar dx, 0xad
neg al
shl edx, 0xb8
seta byte [esp + edx*8 - 0x17fffff5]
neg dx
dec al
sal dx, 0x65
inc dl
xor al, 0x8f
xor edx, dword [esp + edx*8 - 0x17fffff8]
call fcn.0142f4dd

Function at 0xc1a282
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pop eax
dec ecx
add edi, esp
movsx edx, cl
inc esp
sub dl, ch
inc cx
rol eax, cl
inc bp
mov ecx, dword [esi + ecx - 0x6b]
inc ebp
movsx esp, bx
inc cx
add edx, 0x78e857b4
nop
adc al, byte [eax]

Function at 0xc1a338
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sal al, 0x83
lea edi, [eax + edi - 0xc0]
pop edx
xor ecx, ebx
btc eax, 0x82
and dword [esp + eax - 0xbc], 0x31a82532
lea eax, [eax + eax*4 - 0x747d09ea]
not ecx
mov edx, dword [esp]
sbb ecx, 0x859594af
shr word [esp + edx - 0x1080110], 0x21
ror ecx, 3
inc eax
not ecx
call fcn.00d23658

Function at 0xc272fb
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
rcr edx, cl
mov dword [ebp + eax - 0x631d0001], edx
mov dword [esp + eax - 0x631d0001], eax
dec eax
lea edi, [eax + edi - 0x631d0004]
movsx ecx, ax
mov eax, dword [edi + eax - 0x631d0000]
mov edx, ecx
or ecx, edx
xor word [esp + edx], dx
xor eax, ebx
ror dword [esp + ecx + 1], 0x62
bswap edx
btc edx, ecx
bswap eax
shr edx, 0x4b
inc eax
btc cx, 0x21
call fcn.0139cc16
mov eax, 0x99b6ae8f
cdq
dec dx
sub ebp, 4
cdq
cwd
lea ecx, [eax + 0x397bfad]
mov eax, dword [ebp]
ror edx, cl
shr ecx, 0x9a
xor eax, ebx
bts cx, dx
or ecx, ecx
call fcn.012bd070
test bp, bp

Function at 0xc28c01
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
shr edx, 0x9b
dec esi
lea eax, [ebp*4 + 0x601b6eb9]
rol ebx, 1
dec edx
lea ecx, [ebp*2 + 0x5e2a4426]
inc ecx
lea ebx, [ebx + ebx - 0x724eff07]
dec esp
lea ecx, [ecx + eax + 0x5c90e9ac]
dec edx
mov dword [esp + edx - 0xdf99], 0x298d2294
dec esi
mov dword [esp + edx*2 - 0x1bf2a], edi
inc edx
xor dword [esp + edx - 0xdf91], ebx
dec esi
mov edi, dword [esp + edx - 0xdf91]
dec eax
arpl bx, bx
call fcn.0138f424
push 0xa0bf61be
mov edx, dword [esi]
rol dword [esp], 0x11
mov eax, 0xac08d814
mov eax, dword [esi + 4]
adc esi, 4
mov ecx, dword [esp]
sub dword [esp], ecx
not edx
not eax
jbe 0x12d7f3c
and edx, eax
not ecx
mov dword [esi + ecx - 0x3c82be81], edx
shl byte [esp + ecx*2 - 0x79057cff], 0x27
bts ecx, 0x26
mov edx, ecx
lea ebp, [ebp + edx - 0x3c82bec5]
or ecx, dword [esp + ecx*2 - 0x79057d82]
mov eax, dword [ebp + ecx*2 - 0x79057d82]
neg cx
call fcn.0151fec8

Function at 0xc2940f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sar word [esp + edx*8 + 6], 0xc3
xor al, 0x1f
or dx, dx
sar edx, 0x8a
Function at 0xc3c9db
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ebx
mov cl, byte [edx + esi - 0x330e2392]
inc cx
dec ebx
dec esp
mov dword [esp + ebp*2 - 0x1ff28], edx
dec edi
lea esi, [esi + edx*2 - 0x661c4726]
dec edx
inc dword [esp + edx - 0x330e2394]
mov edx, ebx
dec esi
lea ebp, [ebp + edx*2 + 0x450d0a8c]
inc ecx
shr cl, cl
bswap edx
inc ecx
inc ebx
inc di
mov dword [edx + esi - 0x330e2394], ecx
jnp 0xcf0a7c
cmovbe edx, ecx
inc edx
sal byte [esp + edx - 0x330e238d], 0xe1
dec ecx
neg ebx
dec eax
lea esi, [esi + ebp*4 - 0x3fe54]
inc esi
xadd dword [esp + edx*2 - 0x661c4728], edx
inc ecx
mov ebp, dword [edx + esi - 0x330e2395]
dec eax
sar edx, 0x2e
inc ecx
xor ebp, edi
inc edx
mul dword [esp + edx*2 - 0x661c4728]
jb 0x1408449
rol ebp, 1
inc edx
lea ebp, [ebp + edx - 0x1071b65a]
shl edx, 0x79
sal ax, 0x8e
rol ebp, 2
inc ecx
mov ecx, 0x7a95dbb
bswap ebp
inc ebp
inc edx
ror dword [esp + edx - 0x330e2395], 0xb
dec esi
mov dword [esp + edx*2 - 0x661c472a], edi
inc ecx
mov esp, 0x7284d094
btc bx, 0xb7
inc edx
xor dword [esp + edx - 0x330e2395], ebp
inc ecx
pop edi
dec ecx
sal ebp, 3
dec eax
arpl bp, bp
dec eax
not eax
inc ecx
ror edx, 1
dec eax
add edi, ebp
jmp edi

Function at 0xc3dc0b
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + ecx - 0xea35]
xor eax, ebx
call fcn.014fea3c
and dword [edi - 0x4a], 0x6e
invalid

Function at 0xc4297e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x5ff383ff], eax
xor edx, 0xdb0954ac
xadd eax, ecx
xor ebx, edx
sar ax, 0xe2
inc eax
shl eax, cl
adc edi, edx
and ax, 0xa1ba
setp byte [esp + eax*8 + 2]
jns 0xd3a7e7
xor cl, bl
shr eax, 0x31
imul eax, eax
adc al, ah
ror cl, 1
xor eax, eax
or al, ah
sbb cl, 0x82
call fcn.013b2858
Function at 0xc42a42
Capabilities:
Encode data using base64

Disassembly:
lea ecx, [ecx + eax*4 + 0x20580f56]
mov dword [esp + eax*2 - 0x55b8f0], edx
push eax
neg ecx
inc ecx
btc edx, edx
rol ecx, 1
inc ax
je 0x12cb1c3
cwd
xor ebx, ecx
add esi, ecx
lea edi, [edi + eax*4 - 0xab71e5]
inc dx
mul word [esp + eax*4 - 0xab71e1]
movzx edx, byte [edi + eax - 0x2ab800]
pop eax
xor dl, bl
inc dl
shl ax, 0xa1
neg dl
shl al, 0xa2
jne 0x1543462
jmp 0x14e86f8
bswap eax
rol dl, 1
xor bl, dl
shl dword [esp + eax - 0x4047d5ff], 0x49
mov dword [esp + eax - 0x4047d5ff], edi
setnp al
lea eax, [eax*4 - 0x4c72227d]
push esi
jae 0x14c8952
cdq
jmp fcn.0140b7dc
adc eax, 0xf3071638
shr al, 0x61
push ebx
lea ebx, [eax*8 + 0x4d858e82]
xor ebx, 0x17304609
mov ebx, edx
mov edx, ebx
and al, ah
imul ax, ax
adc al, al
shl edx, 2
mov eax, ebp
add eax, edx
jmp 0x14d4cb1
mov dword [ebp - 4], eax
test ebx, ebx
je 0x14c9cac
mov eax, 0xbc8191a7
bt eax, eax
mov dl, byte [ebp]
lea ecx, [eax + eax*4 + 0x1590b832]
btr eax, 0xad
xor al, cl
movzx ax, byte [ebp + 2]
sal ecx, cl
xor ecx, ecx
setge cl
lea ebp, [ebp + ecx*4 - 2]
shl cx, cl
adc ecx, 0xed855a31
xchg ch, cl
imul dl
ror ecx, 0xab
movzx edx, cl
sal dl, cl
mov word [ebp + edx - 0x80], ax
movsx eax, cx
shr eax, 0xcf
sete cl
lea edi, [ecx + edi - 0x6b5db004]
call fcn.012dba5f
mov edx, 0x7b208602
lea ecx, [edx + edx*2 + 0x452b01af]
rol cl, 0x24
mov eax, dword [edx + edi - 0x7b208602]
mov ecx, dword [edx + edi - 0x7b2085fe]
btc edx, edx
sal edx, 0x12
adc edx, edx
push ebx
cpuid
push 0x171b2a0e
sbb edi, 8
dec dword [esp]
mov dword [edi + 0xc], eax
mov eax, 0xe48ee837
pop eax
mov dword [eax + edi - 0x171b2a05], ebx
movzx ebx, ax
btr ax, bx
mov dword [eax + edi - 0x171b0a09], ecx
movsx ecx, bl
bts cx, cx
mov dword [edi + ebx - 0x2a0d], edx
pop ebx
mov edx, ecx
mov ecx, dword [esi + ecx - 0x200d]
lea esi, [esi + eax - 0x171b0a09]
cbw
xor ecx, ebx
inc dl
setp al
sal eax, 0xe8
rol ecx, 3
shr al, 0x65
btr ax, ax
bswap ecx
shl al, 0xe6
bts dx, 0x2f
ror al, 0xc1
neg ecx
cwd
lea ecx, [ecx + eax + 0x36b03396]
cdq
bswap ecx
neg eax
shl eax, 0xe9
xor ebx, ecx
neg edx
adc ebp, ecx
jmp 0x137198f
inc dl
neg eax
jne 0x12a1145
mov edx, 0x6e1fc308
movzx ecx, dl
bts cx, cx
movzx dx, byte [ebp + ecx*2 - 0x210]
movsx eax, cx
mov cl, byte [ebp + ecx - 0x106]
lea ebp, [ebp + eax - 0x106]
shr dl, cl
mov ecx, eax
call fcn.00cbc935
mov edx, dword [ebp]
movsx ecx, ax
btc ecx, 0xab
sub al, 0x3b
mov ax, word [ebp + 4]
xor ecx, ecx
lea ebp, [ebp + ecx*8 + 6]
inc cx
mov word [ecx + edx - 1], ax
mov eax, dword [esi + ecx - 1]
movsx edx, cl
add cx, dx
lea esi, [esi + ecx + 2]
and dl, 0xb5
xor eax, ebx
sub edx, edx
rol ecx, 0xfe
and ecx, edx
not eax
bt dx, cx
xor eax, 0x62a902b6
bt edx, 0x95
dec ecx
dec dx
sbb eax, ecx
ror eax, 1
and ecx, edx
imul cx, cx
xor ebx, eax
add edi, eax
lea edx, [edx + ecx*2 - 0x2d69fbfe]
lea edx, [edx - 0x20c923d1]
jmp edi
Function at 0xc79236
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor eax, 0xfe9d7389
pop ecx
shr edx, 0xaf
movsx ecx, dx
ror eax, 1
sal dl, 0xc3
pop edx
xor ebx, eax
btc cx, dx
add esi, eax
xor cx, 0xebb5
sal dl, cl
mov dx, word [ebp + edx*2 - 0x40c5ad00]
movzx eax, byte [edi - 5]
jbe 0x15243bd
jb 0x14f2f51

Function at 0xc7a16b
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx*8 - 0x4ed28], 0xde96cf97
rol dx, 1
bt ax, ax
inc dx
xadd dword [esp + ecx*2 - 0x13b4a], ecx
ror dx, 1
cbw
inc eax
cbw
sub dx, 0x8a34
pop eax
not cx
xor eax, eax
rol dx, 1
add dx, 0x7436
xor dx, 0xe3a
xor bx, dx
sub ax, 0x9025
lea ebp, [ebp + eax*2 - 0xdfb8]
setnp al
mov word [ebp + eax - 0x6f00], dx
mov ecx, dword [esi + eax*2 - 0xde00]
btr eax, eax
movzx edx, al
sal edx, 0xe3
lea esi, [esi + eax - 0x6efc]
ja 0x1470953
jne 0x14d482a
push edx
xor ecx, ebx
jmp 0x146f925
and edx, edx
neg ecx
div eax
cbw
bswap ecx
sal edx, 0xd3
sar al, 7
bswap eax
neg ecx
mul eax
lea ecx, [ecx + eax*4 + 0x1232bb8c]
add al, 0xa3
rol ecx, 1
push edx
xor ax, word [esp + eax*4 - 0x288]
lea ecx, [ecx + eax*2 - 0x6da238dc]
shl dword [esp + eax - 0x9f], 0x32
xchg dword [esp + eax*4 - 0x288], edx
xor ecx, 0x7d1d2e12
sal dx, 0x6d
je 0x14d63fd
mov eax, 0xf33fcf05
cdq
mov eax, dword [edi]
lea ecx, [edx + edx + 0x6024ea8f]
call fcn.0144a77f
bts eax, 0x3c
lea edx, [edx + ecx - 0x72541bdc]
sub cl, 4
setne cl
not edx
neg edx
jmp 0x13d1235
xor ebx, ecx
xor al, byte [esp + eax*2 - 0x144]
jp 0x1570373
adc edi, ecx
call fcn.00d9cd75

Function at 0xc7f00d
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + edx - 0x1a8a0005]
jb 0xca486d
mov dword [esi + edx - 0x1a8a0001], ecx
mov ecx, dword [edx + edi - 0x1a8a0001]
dec eax
lea edi, [edi + edx - 0x1a89fffd]
mov dword [esp + edx*2 - 0x35140002], edx
adc edx, 0xb49f970d
xor ecx, ebx
ror ecx, 3
xor ecx, 0xb62660a0
ror ecx, 2
not ecx
rol byte [esp + eax], 0x63
ror byte [esp + eax + 3], 0x84
sbb ecx, eax
or ax, ax
rol dl, 0xa1
neg ecx
push edx
pop edx
push edx
xor ebx, ecx
xchg dword [esp + eax + 2], eax
add ebp, ecx
pop ecx
sar cx, 0xae
pop eax
js fcn.0142c7c7
imul eax, dword [esp + 4]
mov dword [esp + eax - 0x20c663ee], 0x91addcb2
neg dword [esp + eax - 0x20c663ed]
bswap edx
call fcn.014f6f5a

Function at 0xc81201
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
neg ecx
lea ecx, [ecx + eax - 0x30f23c2f]
mov dword [esp], 0x892b3991
bswap ecx
ror ecx, 1
xor ebx, ecx
sub eax, eax
push eax
xor eax, dword [esp + eax*2 + 1]
adc esi, ecx
inc byte [esp + 2]
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
call fcn.00c44623
Function at 0xc8e4bc
Capabilities:
Hash data using murmur3

Disassembly:
inc ebp
mov edx, ebx
xor dword [esp + ecx - 0x58b82e43], edx
inc ebp
or ch, ch
inc bp
xadd eax, ebx
inc ecx
pop edi
inc ecx
neg ebx
dec eax
arpl dx, dx
jnp 0x133de51
dec cl
not al
inc al
not al
inc al
sub ecx, ecx
ror ecx, 0x35
xor bl, al
dec ecx
sar ecx, 0x6f
add eax, esp
mov dword [eax], edx
movzx eax, cx
mov ecx, dword [esi + eax*2 - 0x1fffa]
mov eax, dword [ecx + eax*2 - 0x1fffe]
mov edx, 0x642fc5a1
movzx ecx, dx
mov dword [esi + ecx*4 - 0x31680], eax
lea eax, [ecx + edx - 0x57e1f750]
cwd
lea esi, [esi + ecx*2 - 0x18b3e]
imul ax, cx
jmp ebp
dec esp
mov dword [esp + ecx - 0x58b82e43], eax
pop ebx
rol edx, 1
inc esp
movzx esp, cx
bswap edx
inc bp
imul eax, eax
lea edx, [edx + ecx*2 - 0x566f9f5b]
xor edx, 0x98ead99
inc edx
lea edx, [edx - 0x7d114149]
inc ecx
mov ebp, 0xa60bbb08
dec ebp
lea ebx, [ebp + ebx*4 + 0x1fb1ed3b]
inc ecx
push edi
jmp 0xc2244b
dec eax
sbb ebx, ecx
dec eax
adc edi, edx
inc ecx
not ebp
inc ecx
btc esp, 2
inc esi
movzx ebx, byte [esi - 0x5c93]
dec ebx
lea eax, [eax + eax*4 - 0x6d760fcb]
dec eax
lea esi, [esi + ecx - 0x58b82e48]
dec ebp
lea ecx, [edx + ecx*8 + 0x340230b0]
dec eax
cdq
inc ebp
xor bl, bh
inc ecx
inc bl
shl ecx, 0xd
and bx, bx
inc cx
shl eax, 0xcb
inc ecx
xor bl, 0xd
inc ecx
dec bl
inc ecx
xor bl, 0xbb
ror bp, 0x6d
div al
inc ecx
sar ch, 0x24
inc ebp
xor bl, ch
btr ebx, ebp
inc ebp
xor bh, bl
idiv ebp
dec esp
add ebx, esp
dec ecx
bt esp, eax
jb 0x13d0888
inc ecx
sar edx, 0x24
dec ecx
mov ebx, dword [ebx + ecx*8 - 0x2e430000]
imul edx, edx
dec eax
mov eax, ebx
inc ebp
mov eax, dword [esi + ecx*2 - 0xb90c000]
dec ebp
lea esi, [esi + ecx - 0x5c85ffc]
inc cx
inc cx
shr esp, 0x42
inc esp
mov dword [eax + ecx*4 - 0x17218004], eax
inc ecx
mov ebx, 0xb2194b04
inc ecx
push esp
inc esp
and dword [esp + ecx*2 - 0xb90c001], ecx
dec eax
mov dword [esp + ecx - 0x5c86001], edi
ret
inc sp
xor edi, ebp
dec eax
lea ebp, [esp + ebp + 8]
inc esp
movzx edx, ax
inc si
mov ebx, dword [ebp + eax*4 - 0xc]
and ebx, 0xee273682
jne 0x1455181
imul ecx
dec edi
lea esi, [esi + eax - 5]
not bx
inc edx
ror byte [esp + eax + 1], 0x65
pop ecx
inc di
mov dword [esi + eax - 3], ebx
imul edx
inc ebp
xchg edx, eax
dec eax
cdq
dec edx
lea esi, [esi + eax - 7]
inc ebp
movsx ebp, cl
dec ecx
xor edx, 0xa2abe0ab
inc edx
mov ebp, dword [esi + eax*4 - 0xc]
inc ecx
xor ebp, edi
shr edx, 0x88
inc sp
adc edx, eax
push ebx
neg ebp
rol ebp, 1
xor ebp, 0xf1b2c485
inc edx
sal dword [esp + eax*2 - 2], cl
inc dx
not dword [esp + eax + 2]
inc edx
imul byte [esp + eax*2 - 2]
not ebp
dec esp
mov dword [esp + edx], edi
dec ebp
adc ecx, eax
cdq
inc edx
xor dword [esp + eax*2 - 6], ebp
dec eax
or eax, eax
mul edx
or bx, bx
inc ecx
pop edi
dec eax
arpl bp, bp
cwd
inc ebp
movzx esp, ch
dec eax
adc edi, ebp
inc ecx
bswap ebp
jmp fcn.012e2664

Function at 0xc93294
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x5632822e
jmp 0x1574718
Function at 0xc93eae
Capabilities:
Encode data using xor

Disassembly:
add ebp, edx
movzx edx, ax
mov dword [esp + edx*2 - 0x10ff6], edx
lea esi, [esi + edx - 0x87fc]
sal edx, 0x2c
movzx eax, byte [esi + edx*4 - 0x21fec000]
xor al, bl
xor al, 0x90
pop edx
xor dl, dl
rol al, 1
bt dx, dx
adc al, 0x15
neg dx
xor al, 0x1a
dec dl
add al, dl
or edx, edx
bts edx, 0x35
sbb dx, dx
not al
xor bl, al
dec dl
rol dx, 0xe3
rol edx, 0x10
push esi
sal edx, 5
imul edx, edx
push ebp
movsx ebp, dl
dec dx
neg dx
push ebx
jg 0x1539816
mov eax, 0xd00dc313
movsx edx, al
mov ecx, dword [edx + esi - 0x13]
mov dx, word [esi + edx*2 - 0x22]
imul ax, ax
bts ax, ax
dec eax
adc esi, 5
cbw
add al, al
mov word ss:[ecx], dx
cwde
jnp 0x14e39dd
mov edx, 0x7eb30035
movsx ecx, dx
mov cl, byte [edi + edx - 0x7eb30035]
movsx eax, dl
xor eax, edx
or al, byte [edi + eax - 0x7eb2fffe]
lea edi, [edi + edx - 0x7eb30033]
shr edx, 0xa1
or dx, dx
lea edx, [edx*4 - 0x457e4d66]
imul cl
movsx ecx, dl
mov word [edi + ecx*4 - 8], ax
mov eax, dword [esi + ecx*2 - 4]
rol edx, cl
jae 0x1439762
js 0xc93fbf
out 0xc6, eax
adc ah, byte [edx + 0x4ff3cee]
pushal
mov edx, 0xd4ff3cee
push ss
retf 0x3cee
lcall 0xbd5, 0x9fb955a0
push es
test eax, 0x7d029566
or dword [edi + 0x63e4ec1b], eax
mov bh, 0x6f
sub eax, 0x8f56fcb9
dec ebp
mov al, 0x77
cdq
mov ebx, dword [eax + 0x15]
dec dword [ebp - 0x29]
mov eax, 0x2bbaacb9
xor al, 0xc7
rol byte [esi + 0x7f4cfd56], cl
jnp 0xc93fd1
arpl word [edi - 0x346d291], si
push esi
invalid
loop 0xc94010
aad 0xed
adc dword [edi - 0x43d310a8], 0xdcf10ae2
fld1
inc edi
dec ebp
cmc
mov ah, 0x56
or esi, dword [eax]
or eax, 0xb56b4ad
cmp cl, 0xe5
mov ah, 0x56
stc
in eax, 0xb4
push esi
or ebx, dword [eax - 0x6f]
int1
mov ah, 0x56
or eax, dword [ecx + edi*2]
retf 0x103e
adc edx, 0x95be31a8
lea esi, [esi + ecx*2]
xor eax, ebx
rol edx, cl
imul ecx, edx
not ecx
bswap eax
or edx, edx
inc eax
bswap eax
bts edx, edx
xadd edx, ecx
rol eax, 1
lea edx, [ecx + edx*2 + 0x70390189]
not cl
push ecx
sub eax, 0xb3a4bb3e
jmp 0x1575af9
movzx edx, ax
lea ebp, [eax + ebp - 0xd4]
cdq
mov eax, dword [ebp + eax - 0xd0]
lea ecx, [edx + 0x3f8caa0c]
xor eax, ebx
ror dx, 0x41
bswap eax
xor ecx, 0x502f789
jle 0xc63d79
push ecx
ror eax, 1
bts ecx, edx
lea ecx, [ecx + edx*8 + 0x50a3d5a4]
sbb eax, edx
sub ecx, 0xddaeabbf
ror dword [esp + edx*8], 0xdb
shr cx, 0x2c
not eax
adc dx, cx
pop edx
setae cl
dec eax
sar cx, 0xe3
lea ecx, [ecx*8 + 0x44a73628]
xor ebx, eax
push ecx
imul ecx, edx
push ecx
add edi, eax
dec ecx
xadd dword [esp + edx - 0x51cbb0a6], ecx
mov dword [esp + ecx*2 - 0x50b75fa8], edi
ret 4
btr ebx, 0x80
mov ebx, eax
movzx eax, dl
xchg edx, eax
mov edx, ebx
call fcn.00d45661
add ebp, edi
lea ebx, [edx + edx - 0x7af6ed73]
jmp 0x14fc6c5
rol edx, 0xcd
xor edx, ecx
rol eax, 1
jmp fcn.00d05c67

Function at 0xc96a54
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov dword [esp], edi
push ebx
push esi
push eax
mov ebx, 0x4d03ed9a
mov dword [esp + ebx - 0x4d03ed86], edx
mov ebx, 0
push 0xb02c8a26
mov esi, 0x15375bb8
mov dword [esp + esi*4 - 0x54dd6ee0], edi
call fcn.014ccf81
Function at 0xcbb2af
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
pop edx
mov edx, 0xc8b5331f
mov edx, dword [ebp + 4]
add ebp, 4
and eax, 0x1fba5a00
xor esi, dword [ebp + 0x25548bc8]
add al, 0x81
lds eax, [eax + eax]
add byte [eax], al
call fcn.00cfc1dd
inc ebx
xchg esi, eax
je 0xcbb2b1
test dword [edx], 0xa5209d6b
mov ch, 0x82
scasb al, byte es:[edi]
invalid

Function at 0xcbdae3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp + ecx*4 - 0x8304], ecx
inc edx
pop eax
xor edx, 0x5e1e64b9
btc ecx, 0xac
or dword [esp + eax*2 - 0x4182], ecx
not edx
rol edx, 2
shr ax, cl
xor ebx, edx
xchg dword [esp + eax*2 - 0x20c0], ecx
rol ax, 4
btc eax, ecx
adc esi, edx
mul dword [esp + ecx - 0x400037d3]
inc eax
inc cl
lea ecx, [ebp + ecx - 0x400037d2]
mov dword [ebp + edx - 3], ecx
jle 0x156492b
mov edx, 0xd0885b3b
mov eax, edx
ror edx, 0xed
mov edx, dword [edi]
mov al, byte [edi + 4]
mov ecx, 0xb33fd8af
jb 0x14c63c6
call fcn.01359ce2
or dl, dl
mov word [ebp], ax
sbb dword [esp + edx*8 - 8], eax
lea ebp, [edx + ebp - 3]
imul word [esp + edx*2 - 2]
pop ecx
jo fcn.01310689
mov eax, 0x1025a2a
mov ecx, 0x4f9fd9a7
btc eax, eax
lea esi, [esi + eax*2 - 0x204bc58]
mov edx, dword [esi + eax - 0x1025e2a]
adc eax, ecx
and ecx, ecx
xor edx, ebx
add eax, 0x41018884
add ax, ax
setns al
xor edx, 0x87800222
lea edx, [edx + ecx*2 - 0x64a6ab90]
jmp 0x139c7ee
adc edi, 5
dec ecx
mov byte [edx], al
call int.0156a1d5
jle 0xccbb5b
jl 0x15649a8
ret
mov esp, 0x144773eb
pop edx
inc esi
sbb eax, 0xbacee960
daa
pop esp
invalid

Function at 0xcc4b21
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
jno 0xc3a8a7
dec eax
sub esi, 4
inc ecx
mov edx, 0x92bf5d1c
mov eax, dword [esi]
inc ecx
movsx ecx, dx
inc ecx
xor eax, edi
call fcn.014759c0
movsx eax, dl
xor bl, cl
xor edx, dword [esp + 5]
rol dl, 0x23
lea ecx, [esp + ecx + 0xc]
inc ax
movzx ax, byte [ecx]
mov word [esi - 4], ax
lea ecx, [edx + edx*8 - 0x45540bdb]
not cx
adc esi, 0xfffffffc
add edx, dword [esp + 8]
jle 0x14bfdb9
mov dx, word [esi]
mov ecx, 0x7c9c14b2
mov cx, word [esi + ecx - 0x7c9c14b0]
mov eax, 0x2427b901
btr eax, eax
sbb al, ah
and dx, cx
lea ecx, [eax + eax - 0x8d68770]
bswap eax
neg ecx
not dx
mov word [eax + esi - 0x48b92722], dx
movzx edx, cl
movzx ecx, word [edi + edx*8 - 0x700]
jbe 0x14f2f1f
sal cx, 0x28
pop edx
pop ecx
pop ecx
jne fcn.013c73b8
bswap eax
seta al
xor cx, bx
sal eax, 0x70
mul edx
xor cx, 0x109b
ror cx, 1
sub cx, 0x4ba4
not dx
sar eax, 0x8e
call fcn.00ccc623
Function at 0xcc4bbb
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [ecx - 0x2f55fddb]
xor bx, ax
sar dword [esp + edx + 7], 0xc7
mov dword [esp + edx], edx
btc cx, 0x36
lea edi, [edi + edx*2 - 2]
jae 0x13ae438
xor byte [esp + edx], dl
pop ecx
mov word [edi + edx*4], ax
jp 0x155eb8f
mov eax, 0xfab6dc3c
mov eax, dword [esi]
mov edx, 0x2bbf6183
mov edx, dword [edx + esi - 0x2bbf617f]
mov ecx, 0x57bf6b37
add eax, edx
mov dword [ecx + esi - 0x57bf6b33], eax
and ecx, 0xf6053db0
mov edx, dword [ecx + ebp - 0x56052934]
lea ebp, [ecx + ebp - 0x56052934]
shr ecx, cl
xor edx, ebx
dec edx
rol edx, 1
movsx eax, cl
not edx
sub cx, 0x9022
xor edx, 0xf6149bb6
xor ax, ax
bswap edx
inc ax
lea ecx, [eax*2 - 0x3a5d21e3]
inc ecx
xor ebx, edx
add edi, edx
push ecx
lea edx, [ecx*8 + 0x792aac1a]
mul al
mov ecx, dword [esi + eax*2 + 2]
mov edx, dword ss:[ecx + eax*2 - 2]
or byte [esp + eax*8 - 7], ah
movsx ecx, word [esp + eax - 1]
shl eax, 0xcd
mov dword [eax + esi - 0x1ffc], edx
mul dword [esp + eax - 0x2000]
rol dl, 0xe6
lea esi, [esi + eax - 0x5bc3fffc]
xadd al, dh
cmove cx, word [esp + edx*2 - 0x59]
mov dword [esp + edx - 0x2d], edi
ret
pop edx
pop edx
jae fcn.014f8c0e
sets cl
ror dword [esp + edx + 4], 0xe6
lea esi, [esi + edx*2 - 4]
and byte [esp + edx + 2], cl
lea eax, [ecx*4 - 0x22f53655]
adc ecx, dword [edx + esi]
xor ecx, ebx
xor ecx, 0xfaae6834
ror ecx, 1
shl edx, 0x36
bswap ecx
dec al
shl edx, 0x93
lea eax, [eax*8 - 0x62ec0868]
xor ecx, 0xe1966a32
imul dx, ax
xor ebx, ecx
push edx
imul ax
add ebp, ecx
xor dword [esp + edx - 0x128a], eax
xor edx, edx
pop edx
pop edx
pop edx
jp fcn.01556dc6
pop eax
xor ebx, edx
lea eax, [ecx + ecx + 0x7e86c312]
add edi, edx
mov eax, dword [esi + ecx*2 - 0x4a1c24b6]
push ecx
mov ecx, dword [ecx + esi - 0x250e1257]
push 0xa0232c2c
mov edx, 0xb98fe19a
push edx
mov dword [esp + 8], ebx
cpuid
sub dword [esp + 4], 0x540a1007
jl 0x15878b9
dec ecx
adc esi, 1
inc esp
mov edx, dword [esp + 3]
dec esi
lea ecx, [edx*2 - 0x345fe3cd]
call fcn.0139d4a3
sbb esi, 8
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
mov ecx, 0x791a0db8
mov dword [esi + ecx - 0x791a0db8], edx
xchg word [esp + ecx - 0x791a0db4], cx
pop ebx
shl cl, 0xc4
mov ebx, dword [esp + ecx - 0x791a1c4c]
cmovb ecx, dword [esp + ecx - 0x791a1c50]
jne 0x1515b72

Function at 0xcd2dfd
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc edx
mov dword [esp], 0xe388821e
xor eax, 0xd49bbc9e
push 0x13330e1c
push 0x428f5c1a
dec ecx
not dword [esp + 0x1a]
push 0x3b36033d
lea esp, [esp + 0x28]
jne 0x13278bf
pop edi
Function at 0xcd2ed8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
movzx ebx, byte [ecx]
call fcn.01529bf1
das
xchg edi, eax
pop esp
add byte [ecx + 0xffe3], al
and ebx, 0xff
rol dword [esp + 4], 0x3a
inc word [esp + 6]
and ebx, 0xff
rol dword [esp + 4], 0x3a
inc word [esp + 6]
jp 0x148eb32
sub eax, 0x7ab75d89
push ss
mov dword [ebp - 0x49], ebx
jp 0xcd2f0a
les edx, [edx + 9]
idiv dword [eax]
int 0x47
jb 0xcd2eef
mov esp, 0xd78e1024
and bh, byte [ebx]
iretd
or bh, al
pop ebx
pop ss
daa
dec edx
mov fs, word [esi]
and byte [eax - 0x57], dl
jecxz 0xcd2ed4
and al, al
jg 0xcd2f38
jb 0xcd2f85
mov esp, 0x8c5b1024
call 0x73a5fe62
invalid
iretd
sbb byte [0x5a503d9a], dl
pop esp
inc ebx
loop 0xcd2fb6
xchg esp, eax
push ecx
sbb dl, byte [0x3a26b263]
xor ebx, ecx
xor byte [edx], dl
scasb al, byte es:[edi]
invalid
ljmp 0xc117:0x91ee23b5
mov ebx, dword [ebx*4 + 0x1537dcc]
shr eax, 8
xor eax, ebx
mov dword [esp], 0x9a81842f
inc ecx
xor eax, 0x162eb037
push 0xe004858e
xor byte [esp], 0x18
sar byte [esp + 7], 0xa5
dec edx
lea esp, [esp + 0xc]
jne 0xc1c6c8
mov ebx, 0x2d14cb2a
pop ebx
mov ecx, 0x85b612a4
or cl, ch
not eax
mov edx, ecx
xor cl, cl
mov dword [ebp], eax
mov ecx, dword [esi]
movzx eax, dx
neg eax
adc esi, 3
xor ecx, ebx
xadd al, dh
sar al, 0x44
not ecx
sbb dx, dx
xor ecx, 0xdb33b733
dec dl
xchg edx, eax
bswap ecx
mul eax
or eax, edx
rol edx, 0xab
inc ecx
ror ecx, 2
inc ecx
push edx
bt edx, 0x33
setae al
bswap ecx
dec dx
neg ecx
mul dword [esp]
call fcn.0155d70b