joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4204ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x4204f9
cmp dword [ebx + 0x80], 0
jne 0x4204f9
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.004088d8
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.0042078f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x420533
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004088d8
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42056a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00420589
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4226ea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x422740
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x422719
call fcn.00411e2e
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x42272e
call fcn.00411e2e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x422740
call fcn.00411e2e
call fcn.004088d8
cmp dword [eax + 0x3c], 0
je 0x422755
push edi
mov ecx, ebx
call fcn.00421e1a
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00422927
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x42277e
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42278a
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x445c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x445c3a
call fcn.004088d8
mov esi, dword [eax + 0xc]
push 0x5740cc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x445c90
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x445c90
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x445c6f
xor esi, esi
jmp 0x445c85
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00445c99
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x445c92
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4dafc0
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x5633f1
call fcn.0053d2b1
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004023e0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x59c67c
call fcn.00404470
cmp eax, 0xffffffff
jne 0x4db09a
push 0
push 0x574088
lea ecx, [ebp - 0x4d0]
call fcn.00404470
cmp eax, 0xffffffff
jne 0x4db09a
push 0
push 0x5695f4
lea ecx, [ebp - 0x4d0]
call fcn.00404470
cmp eax, 0xffffffff
jne 0x4db09a
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004023e0
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4db069
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x568940]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00402ef0
jmp 0x4db0d3
lea eax, [ebp - 0x218]
push eax
call fcn.005431c9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00402a20
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00402ef0
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4db0c0
mov edi, dword [ebp - 0x4cc]
jmp 0x4db0d3
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x568940]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00402ef0
mov eax, edi
call fcn.0053d25b
ret
Function at 0x4ed66f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004ed37a
lea ecx, [0x458d91a6]
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x4ee2e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x26fffffc], ebx
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
test dword [ebx + 0x27fffffc], esp

Function at 0x4f4b49
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0054ccd0
pop ecx
test eax, eax
jne 0x4f4b8b
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040a53d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4f4b51
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x11eabddc
Capabilities:
Encode data using xor

Disassembly:
call fcn.11ffd764
mov ecx, 0xfca3ac24
movzx edx, cx
lea esi, [esi + edx - 0xac28]
mov edx, dword [esi + edx*8 - 0x56120]
shl cl, 0x41
movzx eax, cl
xor edx, ebx
shr eax, cl
lea edx, [edx + eax + 0xb7f1ac]
bswap edx
cwde
xor edx, 0x16b0a831
jmp 0x133b8c5f
mov ecx, dword [esp]
sub ecx, 0x9e275831
mov dword [esi], edx
movzx edx, cx
mov dword [esi + edx*4 - 0x3cf38], eax
add byte [esp + edx*8 - 0x79e77], dl
mov dword [esp + edx*4 - 0x3cf3c], edi
ret
adc edi, 4
xor eax, eax
push 0xd5856e9b
neg dword [esp + 1]
dec dword [esp + 1]
test edx, edx
call fcn.11fb7b74
sal dword [esp], 0xaa
mul ecx
jmp 0x11eff243
neg cl
call fcn.12101c9d
mov ecx, dword [edi]
mov edx, dword [edi + 4]
push 0x911a759b
rol dword [esp], 0xbe
jae 0x11fbda97
neg eax
imul ecx, ecx
neg cx
neg ecx
xor ebx, eax
xor ecx, 0x93386039
adc edi, eax
ror ecx, cl
movzx eax, cx
mov ecx, dword [eax + esi - 0x7bbb]
neg al
sub ax, 0xd00e
mov eax, dword [eax + esi - 0xab33]
push 0x70080c93
jb 0x1262a9f2
pop ebp
jnp 0x133b8cff
sub al, byte [ecx + 0x6c7b58b]
mov edx, 0x659ccab2
mov eax, dword [ebp + edx - 0x659ccab2]
mov ecx, edx
inc cx
call fcn.1266a2b3
cmp ecx, eax
or edi, edi
add esi, ecx
inc dword [ecx]
into
jge 0x133b8c6b
sub byte [esi], dh
pushal
dec edx
nop
outsd dx, dword [esi]
stc
xchg ecx, eax
push cs
jne 0x133b8cf5
mov al, byte [0x35ab7e7f]
in eax, dx
xchg edx, eax
outsd dx, dword [esi]
jbe 0x133b8cd5
xchg edx, eax
adc ebp, dword [ebp - 0x26ecdf8]
std
movsd dword es:[edi], dword [esi]
xor eax, dword [edx + esi*4 - 0x38338c91]
wait
xchg edx, eax
sub eax, 0x1915cf8
rcr ch, 1
mov ebp, 0x6ca58d6e
push ecx
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
and byte [ecx - 0x18], bh
xchg ebx, eax
in eax, dx
dec ebp
mov ss, word [eax + 0x1e]
nop
push 0x6c10ff6c
inc ebp
push cs
xchg edx, eax
cmc
xchg ecx, eax
jb 0x133b8d90
iretd
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
out dx, al
mov dl, 0xb4
sub al, byte [eax]
inc ebp
in al, 0x16
cld
xchg ecx, edi
invalid
Function at 0x11eb3b18
Capabilities:
Authenticate hmac

Disassembly:
neg ecx
xor edx, ebx
add cx, cx
or ecx, ecx
ror edx, 3
mov dword [esp], 0xa100e0a7
shr cl, 0xc1
or dword [esp + 1], ecx
dec edx
neg dword [esp]
lea ecx, [ecx + ecx + 0x101f398c]
bt ecx, ecx
bswap edx
call fcn.11eff5e5
dec ebp
insb byte es:[edi], dx
pop eax
sbb eax, dword [edi + 0x65e58481]
pushal
outsb dx, byte [esi]
cdq
pushfd
mov al, 0xe2
jo 0x11eb3b9c
add eax, 0x7a7577f2
imul eax, dword [eax - 0x45], 0xffffff97
xor ecx, dword [eax]
mov ebx, 0x1d38d5e9
add byte [esi - 0x3f], ah
inc esp
and al, 2
add esi, edi
jmp 0x606d4acf
mov al, byte [esi - 0x7f]
mov dword [eax + eax], 0xcb90000
inc edi
cmp esp, dword [ebx + esi - 0x2d]
movzx eax, cx
neg al
setge al
lea edx, [edx + ecx*2 + 0x17c8bc01]
shr ecx, cl
pop ecx
rol edx, 1
bswap edx
mov dword [esp + ecx - 0x468ace23], eax
dec dword [esp + ecx - 0x468ace23]
ror edx, 1
push eax
xor ebx, edx
add esi, edx
mov eax, dword [ecx + ebp - 0x468ace23]
lea edx, [ecx*8 - 0x16df22f3]
xor byte [esp + edx - 0x1d774e23], 0x36
movzx dx, byte [eax + edx - 0x1d774e25]
bt cx, 0x9d
xchg dword [esp + ecx - 0x468ace21], ecx
shl dword [esp + ecx - 0x46ff0032], 0x42
lea ebp, [ebp + ecx - 0x46ff0034]
sub cl, ch
mov word [ebp + ecx - 0x46ff0036], dx
shl byte [esp + ecx - 0x46ff0034], 0x81
pop ecx
jo 0x1201aa18
pop eax
jmp esi
sal bh, cl
fldenv [esi + 0xb]
ror byte [ebp + 0x3b2f088c], 1
ret
or byte [edi], ch
cmp eax, ebx
stc
mov ax, word [esi]
mov dx, word [esi + 2]
add esi, 2
call fcn.1321d160
push esp
add al, byte es:[ecx + 0x2c6]
add al, ch
xor al, 0x27
and byte [ecx], al
inc esp
or edi, dword ds:[esi]
or edi, dword [esi]
and dl, ch
je 0x1201aa2e
lahf
push ebx
salc
and al, 0xd8
sub byte [0x92cf6811], 0xb5
cmp ecx, edi
adc dword [eax - 0x31], ebp
xchg edx, eax
mov ch, 0x39
stc
cdq
push esi
inc ebx
push ss
sahf
insb byte es:[edi], dx
loope 0x1201aa97
jno 0x1201aa7d
push cs
out 0xd2, al
popfd
jnp 0x1201a9f4
mov eax, dword [0xc3cca774]
xchg ecx, eax
xor al, 0x29
mov edi, 0x88a7d394
cwd
mov esi, dword [edi]
mov al, byte [0xee0b4bc7]
loop 0x1201aa3b
je 0x1201a9fc
int3
jb 0x1201aa97
xor eax, 0x7e6b9a
push esi
push cs
add dword ss:[edi + 0x2b], 0xffffffbd
sub dword [0x7d7f28eb], edi
jg 0x1201aafc
mov edi, 0xb07ce35
mov eax, 0xaf1b79f7
pop ebx
inc esi
jns 0x1201aa1e
and dword [eax - 0x79], 0x364271
ljmp 0x95e8
add byte [eax + ebp*8], bl
xchg ebp, eax
jo 0x1201aa52
or eax, 0xacb68f75
lea edi, [edx]
invalid
xlatb
adc ebx, dword [esi - 0x7a]
mov ebx, 0xbed76ca4
xchg edx, eax
push ebp
daa
and al, 0x91
stc
or eax, dword [edx - 0x4a27010b]
sbb ch, byte [edx - 0x60]
dec ebx
xchg edi, eax
inc ebp
push eax
sub al, 0xab
sbb cl, dl
aam 0x87
ja 0x1201ab83
xchg esp, eax
invalid
push ebp
int 0xce
sub byte [eax], cl
and ah, dh
or eax, dword [edx - 0x872bd44]
xchg ch, dh
out dx, eax
adc cl, al
jo 0x1201ab6b
inc edx
invalid
lodsd eax, dword [esi]
jmp dword [ecx + edi*8]
loopne 0x1201ab61
xchg ebx, eax
call 0x5bd21960
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x11eb68b4
Capabilities:
Encode data using xor

Disassembly:
bswap ecx
ror edx, cl
mov dword [esp + ecx - 0xa81aa1], eax
add cl, cl
add word [esp + ecx - 0xa81a41], ax
sbb edx, 0xcc0232aa
rol dword [esp + ecx*8 - 0x540d210], 0x8a
neg edx
not byte [esp + ecx*2 - 0x1503483]
sar al, 0x21
inc al
xor ebx, edx
add esi, edx
bswap ecx
mov ecx, dword [edi + ecx - 0x421aa800]
mov eax, dword [edi + 4]
sar word [esp + 2], 0xd
mov dword [esp], 0xa0329f19
adc edi, 4
jmp 0x132b1012
jmp 0x132b34b8
call fcn.133eeead

Function at 0x11ec0315
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg al
call fcn.11f8c663
mov ecx, 0x89aed316
movzx eax, cx
lea edi, [eax + edi - 0xd31a]
push eax
mov eax, dword [edi + eax - 0xd316]
shl byte [esp + 1], 0xa1
xadd dword [esp], ecx
inc ecx
xor eax, ebx
push ecx
add byte [esp + ecx - 0xa615], ch
pop ecx
ror eax, 1
dec ecx
call fcn.1203a291
cdq
xor ecx, ebx
bt edx, eax
bts dx, 0xb2
xor dl, 0x1d
ror ecx, 3
inc ecx
rol ecx, 1
add ecx, 0x8364bb1
not ecx
btc ax, 3
shl edx, 0x2f
xor ecx, 0x10a00732
dec eax
rol dl, 0x25
not ecx
inc edx
xor ebx, ecx
add ebp, ecx
mov ecx, edx
rol cl, cl
sar eax, 0xc6
fld qword [esi]
bts ecx, 0x27
sbb ecx, ecx
jp 0x11fe8898

Function at 0x11ecac5f
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0x99bba1e
test ebx, ebx
push 0x95a2c002
jmp 0x12643108
lea eax, [eax + ecx*8 - 0x44853f29]
shr cx, cl
add dl, 0x90
jge 0x134afe89
bswap eax
inc dx
lea eax, [eax + edx*2 + 0x1ecb8207]
sbb edx, ecx
bts dx, dx
lea ecx, [ecx + edx*4 - 0x2dd750f2]
neg eax
xor edx, 0x130bb03d
add ecx, ecx
bt ecx, edx
lea eax, [edx + eax + 0x364eed04]
lea ecx, [edx + 0x411dd3b5]
sbb dx, 0x782c
xor ebx, eax
ror dx, 0x27
push edx
add edi, eax
pop eax
bts eax, ecx
cmovae eax, ecx
jmp edi
mov ebx, ebp
lea esp, [esp + 8]
je 0x1264b01f
mov eax, 0x5c855103
sar ax, 0xcf
mov eax, dword [ebp + ebx*4]
jbe 0x13398e4b
mov ecx, 0x7180c82c
movzx edi, dl
lea ebp, [ebp + edi - 0x1a]
xchg ebp, eax
mov edi, eax
xor edx, edx
movzx eax, cx
jbe 0x126608ba
adc al, 0x98
and cx, cx
call fcn.126514dc
mov eax, 0x5b25da12
mov ecx, eax
mov eax, dword [ecx + ebp - 0x5b25da12]
and cl, cl
setl cl
lea edx, [ecx + 0x59af3ba4]
mov ecx, dword [ebp + ecx - 0x5b25d9fc]
imul edx, edx
push edx
adc ebp, 7
mov dword [eax], ecx
pop eax
mov eax, dword [esi]
dec dl
add esi, 4
movsx ecx, dx
add edx, 0xbca6cda2
xor eax, ebx
jmp 0x1202eba7
mov eax, 0xaf8e06a6
bswap eax
mov eax, dword [ebp]
call fcn.132ab1ce
invalid
jns 0x1322194a
jmp 0x120ad3b1
call fcn.12686959
ror ecx, 1
call fcn.125d5758
mov eax, 0xe61e2a3b
btc ax, ax
add eax, eax
sbb esi, 3
mov edx, dword [esi]
push eax
xor edx, ebx
call fcn.12638e46
mov ecx, 0x668fe331
call fcn.1338ba4c
lea esi, [esi + edx - 0x58771166]
call fcn.132a605c
xadd edx, eax
jge 0x1339e344
add edx, dword [ebp + ecx*2 - 0x6ef372d4]
movzx cx, byte [ecx + edx - 0x3779b96a]
mov edx, 0x5fabe98e
ror byte [esp + edx - 0x5fabe987], 0x24
lea eax, [edx + edx*2 - 0x4c72325f]
lea ebp, [ebp + edx - 0x5fabe98c]
sar word [esp + edx - 0x5fabe989], 0x4b
shr edx, 0x29
mov word [ebp + edx - 0x2fd5f4], cx
cwde
or dword [esp + edx*2 - 0x5fabe8], esi
ret 4
Function at 0x11ecb213
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
neg edx
call fcn.132a4381
mov eax, 0x9583a183
and ax, ax
sbb ebp, 4
mov ecx, dword [ebp]
xor eax, eax
mov edx, eax
btc edx, edx
xor ecx, ebx
btc eax, 0x92
ror ecx, 1
bswap ecx
jmp 0x120ef835
not ecx
inc edx
inc ecx
idiv dl
dec ax
xor ebx, ecx
inc edx
xchg dx, ax
add esi, ecx
neg al
imul ax
sbb dl, al
lea ebp, [ebp + eax*2 - 0x9f413]
sub eax, eax
mov dl, byte [eax + ebp]
lea ecx, [eax + eax + 0x31377413]
call fcn.11eb8eb2
sub byte [edi + esi*4 + 0x67], 0xdd
and ecx, 0xfffffff8
das
pop edi
das
mov edi, 0xf2170b75
rcl byte [eax], cl
rcl byte [eax], cl
lodsd eax, dword [esi]
add eax, 0xeb9b2407
xor byte [ecx + 0x5414c15b], cl
popfd
loop 0x120ef87d
frstor dword [eax]
mov al, byte [0xdb7d2b02]
adc ecx, dword [edi]
movsb byte es:[edi], byte [esi]
push ebx
push ds
xchg esp, eax
dec esp
sbb bh, al
cmc
and al, 0xda
insd dword es:[edi], dx
aas
jnp 0x120ef874
iretd

Function at 0x11ed0468
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp], 0x65959e10
shr edx, 8
shr dword [esp + 1], 0xad
neg dword [esp + 2]
sal word [esp], 0x6a
xor edx, edi
call fcn.13433c93

Function at 0x11ee6327
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x50eb023
mov dword [esp], eax
jmp 0x12009199

Function at 0x11ee972f
Capabilities:
Encode data using xor

Disassembly:
add edi, eax
inc esp
and al, 0
mov dh, 0xcb
cdq
mov esi, dword [esi*4 + 0x12066f6c]
mov dword [esp], 0xf299cbb6
mov esi, dword [esi*4 + 0x12066f6c]
shr edx, 8
xor edx, esi
push 0xb51b0900
shl word [esp + 9], 3
push 0xa793fea1
inc ecx
sar dword [esp + 5], 0xd7
call fcn.1340a7b7
clc
xor ebx, dword [ecx + 0x6c362890]
sub eax, 0x97338f0c
outsb dx, byte [esi]
mov dl, 0x24
and al, 0xe0
adc dl, byte [ecx]
sub esi, ebp
jns 0x11ee972e
jae 0x11ee9783
adc byte [edx + 0x43], dl
xor al, 0xcf
sbb esi, edx
xchg esp, eax
or byte [si + 0x70], bh
int3
or byte [eax + esi*2 - 0x34], bh
cli
invalid
Function at 0x11efa874
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
mov ax, word [edx + ebp - 0x2d288c3d]
lea edx, [edx + edx*4 + 0x132c510e]
btr edx, 4
adc ebp, 2
lea edx, [edx*8 + 0x2fb1e636]
xor dx, 0x4788
or cx, ax
bt dx, 0x3f
xadd dl, dh
not cx
and dx, dx
mov dword [esp], edx
neg edx
mov word [ebp + edx*2 - 0x512a13d6], cx
mov eax, edx
lea ecx, [edx + eax*4 + 0x698c85ab]
shr byte [esp + edx*2 - 0x512a13d4], 0xc1
mov ecx, dword [eax + esi - 0x289509eb]
shl eax, 0x87
inc dword [esp + edx - 0x289509eb]
lea esi, [edx + esi - 0x289509e7]
jl 0x1266ac7a
mov ecx, 0xadb6aba9
neg cl
sbb ebp, 3
mov eax, dword [ebp]
btr cx, cx
xor eax, ebx
call fcn.11efb434
mov edx, 0xed8da5a9
sub ebp, 4
push edx
mov edx, dword [ebp]
mov ecx, 0x71625af
rol ecx, cl
xor edx, ebx
movzx eax, cl
xor edx, 0xabb5fab3
inc byte [esp + ecx - 0x12d78389]
sub dword [esp + eax - 0x8b], ecx
neg eax
neg edx
dec eax
xor ecx, eax
add dword [esp], ecx
bswap edx
adc al, 0x3e
inc edx
cwde
neg eax
shl dword [esp + eax - 0x4d], 0xaf
bswap edx
not cl
seta cl
ror edx, 2
xor ebx, edx
imul eax, ecx
not ecx
add edi, edx
shr byte [esp + ecx*2 - 0x25af07fb], 0x41
mov si, word [esi + eax - 0x552d4c00]
lea edx, [ecx*8 - 0x63c0a3f3]
pop edx
jbe fcn.120b5dc8
xor ebx, ecx
add edi, ecx
sar eax, 0xea
call fcn.11fb2489
lea edx, [ecx + ecx - 0x4e76b9ec]
xor eax, ebx
or cx, dx
neg dx
sal ecx, 0xbc
lea eax, [eax + edx + 0xf58460e]
neg eax
or edx, edx
bts cx, dx
lea edx, [edx - 0x4e6a0369]
not eax
bswap eax
dec eax
imul cx, cx
lea ecx, [edx + edx - 0x3d7680d9]
sbb dl, 0x2a
xor ebx, eax
shr dl, 0x82
btc dx, dx
adc ebp, eax
movsx eax, cx
cdq
mul al
xor edx, dword [esi + eax*2 - 0x4392]
call fcn.1343df75
movsd dword es:[edi], dword [esi]
pop edx
ja 0x120be619
adc dword [0x4e1e7a77], esp
pushal
aam 0x73
fidivr dword [edx]
xchg edi, eax
push es
xchg dword [0x96a32915], esi
mov ebp, 0xfcbdb736
cmpsb byte [esi], byte es:[edi]
invalid
sub eax, 0x9b9c405
xor ecx, ebx
lea edx, [edx - 0x584f60cf]
xchg byte [esp + eax - 0x40cb317a], al
not ecx
lea ecx, [eax + ecx - 0x1c0ee3ee]
xchg word [esp + eax - 0x40cb31f5], dx
rol ecx, 1
xor al, dl
sbb ecx, 0xb086f4b5
xor ecx, 0x572d13a7
ror eax, 0x1d
not dword [esp + eax*4 - 0x196631a8]
jae 0x120be617
mov eax, 0xe6836499
mov eax, dword [edi]
mov edx, 0xf7827d9c
mov cl, byte [edi + 4]
dec edx
lea edx, [edx + edx*4 + 0x5922c0a8]
lea edi, [edi + edx*2 - 0x5d5e6958]
call fcn.1339b0ac

Function at 0x11f03ac4
Capabilities:
Execute syscall

Disassembly:
inc edi
lea esi, [esi + edx*4 - 0x556f70c]
inc ecx
neg esi
dec ebp
btr edi, edi
dec esp
mov dword [esp + eax - 0xbcda3bb], ebx
dec ecx
shl ecx, cl
call fcn.13332a24
sub edx, eax
or word [esp + edx - 0x28f879a], dx
mov edx, dword [ecx + edx - 0x28f879e]
sar ax, 0x62
movsx ecx, word [esp + 5]
lea ebp, [ebp + ecx - 0x61eb]
jae 0x11fdee99
sysenter
push edx
pushfd
mov edx, 0x89bb35a3
mov edx, dword [esp + edx + 0x7644ca61]
mov dword [esp + 4], 0xb55ed4ae
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.134e35a6
Function at 0x11f0acba
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0xcea4328a
sub word [esp + 2], 0xdf14
test ebx, ebx
lea esp, [esp + 4]
je 0x120091a9

Function at 0x11f2e925
Capabilities:
Execute syscall

Disassembly:
mov dword [esp], 0xe79b5022
push edx
rol eax, 2
xchg byte [esp + 4], dl
sub eax, 0xdf8534b6
xchg word [esp + 3], dx
pop edx
pop edx
not eax
xor word [esp + 1], dx
xor eax, 0xca3dc0a2
xor ebx, eax
inc dx
sub dx, dx
push edx
adc esi, eax
movzx eax, byte [edi]
xadd word [esp + 5], dx
adc edi, 1
inc dword [esp + 4]
setnp dl
push edx
xor al, bl
call fcn.13375dad

Function at 0x11f30a94
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
dec esp
mov dword [esp + edi - 0x4eae63af], eax
inc ecx
bswap ecx
inc ecx
mov esp, 0x6203a83c
jge 0x1352eebd
dec esp
mov dword [esp + edi - 0x4eae63af], ebx
inc bp
imul esp, eax
inc esp
xor dword [esp + edi - 0x4eae63af], ecx
inc esp
mov edx, eax
inc ecx
mov esi, 0x3e3eac15
inc ecx
pop ebx
dec eax
lea ebp, [ebp + eax*2 - 8]
dec eax
cdq
dec esp
mov dword [ebp + edi - 0x4eae63af], ecx
inc edx
mov ebx, dword [edi + ebp - 0x4eae63af]
dec ebp
lea ebp, [ebp + eax + 4]
inc ecx
xor ebx, ebx
not ebx
lea ebx, [edi + ebx + 0x588ad1e9]
inc cx
ror esp, cl
xchg cl, al
inc cx
and edi, edx
xor ebx, 0xfea0cd80
mul edi
inc bp
adc edx, edi
btc cx, dx
ror ebx, 1
dec ebx
lea edx, [esp + esi*8 - 0x50eefa56]
inc ecx
push ebx
dec esi
lea ecx, [edi*8 + 0x31b88f3a]
inc ecx
ror dh, 0xe6
dec eax
xor ecx, ecx
xor dword [esp + edi - 0x4eae0000], ebx
dec eax
neg eax
inc ebp
xchg edx, esi
inc ebp
and ah, bh
inc ecx
pop ebx
btc di, 1
cwde
jae 0x134117ad
dec eax
arpl bx, bx
dec ebp
add eax, edx
dec cx
dec eax
sub eax, 0x81d6dbb
dec eax
add esi, ebx
cbw
inc ecx
sar al, 0x24
inc eax
setns bh
jne fcn.13567311
movsx ebp, byte [ebx]
lcall 0x8243, 0x236c9de1
js 0x134117e4
add dl, byte [esi]
imul ebp, ebx, 0xffffffe5
insb byte es:[edi], dx
mov dl, 0x86
ficom word [ecx]
invalid
inc ebp
lea ecx, [ecx + edi*2 - 0x92acb32]
dec eax
adc dword [esp + eax], 0xee11a8b7
imul byte [esp + eax + 1]
jno 0x133533d3
ljmp 0xf28e:0xef55b080

Function at 0x11f30aab
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck

Disassembly:
jo 0x132b6d13
ror eax, 2
add eax, 0xd29a52d
pop ecx
add ecx, 0x14c111f
jmp ecx

Function at 0x11f3b818
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor dl, bl
cbw
mov dword [esp + eax*2], eax
btr eax, eax
ror dl, 1
call fcn.11f91f9e
lea esi, [esi + ecx - 0x77894327]
rol ecx, 0x67
push ecx
imul ecx, dword [esp]
xor edx, ebx
push ecx
pop ecx
sar cl, 0x66
dec edx
add cl, cl
movzx eax, byte [esp + ecx*8 - 0x2649b7e0]
not edx
ror edx, 1
pop ecx
call fcn.11f5b79a

Function at 0x11f3b855
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pushfd
dec eax
add dword [esp + 8], 0xecbe3704
dec eax
mov dword [esp + 8], 0xce56a5f3
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.1209b52e