joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f800
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46ed03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00462584
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00467c1a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00469136
test eax, eax
je 0x43f91c
mov ecx, dword [esp + 0x3c]
call fcn.00467c47
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43f8e0
push edi
mov ecx, esi
call fcn.004652b0
mov ecx, esi
call fcn.0043fac0
cmp dword [esp + 0x38], 1
jne 0x43f915
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004653eb
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x441af0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x441b23
push esi
call fcn.00444c40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x441b1c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441ba9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441b92
mov eax, dword [esi + 8]
test eax, eax
je 0x441b47
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x441b8e
cmp eax, 2
je 0x441b92
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x441b3a
cmp eax, 3
je 0x441b6d
cmp eax, 1
jne 0x441b3a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x441b3a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x441b3a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441bd0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441bb8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441bd0
add esp, 4
pop esi
ret

Function at 0x46337a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4633b2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046142e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461406
jmp 0x4633be
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x464a6d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x464aaf
call fcn.0046a51c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x464aaf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x464aa6
xor eax, eax
jmp 0x464ab7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00464abd
pop edi
pop esi
pop ebx
ret 4

Function at 0x46aa4c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46aa7a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46aa98
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046a9b2
jmp 0x46aa98
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46aa98
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046a9b2
test edi, edi
mov eax, edi
jne 0x46aa82
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1220d57
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pushfd
add dword [esp + 4], 0xfec6763b
push ecx
mov dword [esp + 8], 0x76c92269
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.01362e5c
movsx edx, word [esp + esi*2 - 0x7f316037]
inc ebp
add esi, ecx
push edx
xor esi, edx
dec eax
lea ecx, [esi*2 - 0x11fe4f41]
inc esp
mov dword [ebx], esi
dec eax
sar dword [esp + 8], cl
dec eax
lea eax, [esi + edx*2 + 0x7d3df733]
dec ecx
sbb ebx, 4
mov ebp, eax
inc esp
movzx ecx, cx
inc esp
mov edi, ecx
inc edi
mov eax, dword [ebx + ecx*2 - 0x42e]
shl si, 0x28
dec eax
sar dword [esp + ebp*2 - 0x7b48a27c], cl
ror ecx, 0x2e
inc esp
xor eax, edi
call fcn.01358c1f
stc
cmp ecx, ebx

Function at 0x12257e2
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor dword [esp + ebp - 0x36b31ff8], edx
dec eax
mov edi, dword [esp + ebp*2 - 0x6d663ff8]
dec ebp
arpl dx, dx
inc cx
xadd esp, esi
dec ebp
adc ebp, edx
inc eax
xor dh, 0xab
dec esp
mov dword [esp + eax - 0x590a], edi
call fcn.0122b9ab
dec edi
lea ebx, [ebx + ecx*2 - 0x5d15a484]
bswap eax
inc ebx
mov ebp, dword [ecx + ebx - 0x2e8ad240]
dec edi
lea esp, [edx + ecx*4 + 0x18bcbcba]
inc esp
mov bh, byte [edx + 0x4418bcbc]
movzx esi, al
xor ebp, edi
dec ebp
inc ecx
mov ecx, edx
dec ecx
not ecx
inc ebp
mov eax, edx
bswap ebp
inc ecx
add cl, dh
inc cx
sbb esp, 0xcdc17133
add ecx, dword [eax - 0x3f]
loopne 0x1225823
dec ecx
add esp, 0x2485853d
inc cx
shr esi, 0x83
bswap ebp
and eax, 0xef295c2b
dec ecx
not esp
dec ebx
lea edx, [ecx + ecx*8 + 0x3d1d8538]
push edi
push eax
jle 0x137da37
mov edx, 0x1390bebd
mov ecx, dword [edx + esi - 0x1390bebd]
add edx, edx
mov edx, dword [esi + edx*2 - 0x4e42faf0]
mov eax, 0x7e2b3286
sbb eax, 0xa41a5937
not ecx
bswap eax
sbb ax, ax
ror al, 0xc1
not edx
call fcn.012f2883
inc edx
xor dword [esp + ecx + 0x2e8ad249], ebp
dec edx
mov edi, dword [esp + edx*2 - 0x124]
jmp 0x139d007
inc cx
and ecx, ecx
dec eax
arpl bp, bp
inc ecx
setle ah
inc ecx
sar esp, 0x46
dec ecx
not edx
dec esp
adc ebp, ebp
ror dl, 0xc1
dec esi
mov dword [esp + ecx*2 + 0x5d15a482], ebp
ret 8

Function at 0x122900f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec esi
mov dword [esp + eax*2 + 0x2de9c6e2], esp
inc esp
xor dword [esp + ecx + 4], ecx
inc ecx
pop edi
mov edi, eax
pop edi
inc ecx
movzx edx, bh
call fcn.013f68db
add cl, 0xa4
jmp 0x13e8398
push 0xc61f2d9e
ror cl, 1
neg cl
not cl
xor bl, cl
shl dword [esp + 3], 0x33
dec dword [esp + 0xd]
lea ecx, [esp + ecx + 0x14]
setnp byte [esp + 0xe]
mov eax, 0xd5b6a72c
mov word [ecx], dx
movzx ecx, ax
mov ecx, dword [ecx + edi - 0xa72c]
lea eax, [eax*2 - 0xdff4200]
push eax
sal dword [esp + 0x14], 0x15
add edi, 4
xor dword [esp + 0x14], eax
rol dword [esp + 0xf], 0x2a
jbe 0x17b3491
xor ecx, ebx
shl eax, 0x98
call fcn.0122de6b
Function at 0x1229459
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edx
ror al, 1
and cl, 6
sar dword [esp + 3], 0xbb
add al, 0x26
xor al, 0x99
xadd dword [esp + 2], edx
dec al
shl byte [esp + edx - 0x8a1], 0xc5
not al
sub word [esp + edx*8 - 0x4523], cx
dec cx
xor bl, al
xadd dl, dh
dec dx
jne 0x13faf2f
dec edx
rdtsc
mov ecx, 0x4d9633b9
sal cx, 0xa1
lea esi, [esi + ecx - 0x4d96677a]
neg ecx
inc ecx
rol ecx, 0xc6
mov dword [esi + 4], eax
mov dword [esi], edx
mov ecx, dword [edi]
mov edx, 0x891bc828
call fcn.013539b7
ret 0x3346

Function at 0x122a7a1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
rol edx, 2
dec eax
lea ecx, [eax + eax*4 + 0x258747b7]
call fcn.017c2b08

Function at 0x122a7b1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
ror dl, 0xa7
jae 0x17c8614
lea eax, [eax + edx - 0x6f680c65]
cmovb dx, cx
not eax
mov dword [esp + ecx - 0x87c0000], ecx
neg eax
sub dword [esp + ecx*2 - 0x10f80000], ecx
xor ebx, eax
add ebp, eax
inc dx
jno 0x1367c53
mov dx, word [ecx + eax - 0x75ff2c1a]
lea esi, [esi + eax - 0x75ff2c1c]
and word [esp + eax - 0x75ff2c16], ax
mov word [esi + eax - 0x75ff2c1a], dx
movsx ecx, al
rol dword [esp + ecx*2 - 0x33], 0xd3
mov eax, dword [edi + eax - 0x75ff2c1a]
inc ecx
lea edi, [edi + ecx*8 - 0xd4]
sal ecx, 0xfb
inc word [esp + 5]
xor eax, ebx
sal ecx, 0x55
call fcn.0139ee5b
inc eax
or al, dh
or byte [esp + edx - 0x789b3190], 0x25
dec esp
lea edx, [edx + edx*8 + 0x32121ebd]
not al
jl 0x17ba175
hlt
sal word [esp + ecx - 0x87bffff], 0xd
mov ecx, dword [esi + ecx*8 - 0x43e00000]
jb 0x124452e
inc dx
mov ax, word [esi + 4]
xor word [esp + 2], dx
adc esi, 6
and dword [esp], edx
mov word [ecx], ax
pop ecx
jmp ebp
inc esp
movsx ecx, dx
inc dx
mov dword [ebx + ecx*2 - 0x632a], eax
inc ebp
movzx esp, dl
inc sp
xor edx, edx
dec edi
lea esi, [edx + edx*8 + 0x3231ee25]
dec edi
lea ebx, [ebx + ecx - 0x3199]
dec esp
add edx, dword [esp + edx - 0x789b3195]
inc edx
mov ecx, dword [edx + ebx - 0x789b3195]
inc ecx
movsx eax, dx
xor ecx, edi
push eax
inc esp
and byte [esp + edx - 0x789b3188], dh
xor ecx, 0x6c20cd05
sub ecx, 0x9d89f302
dec eax
xchg dword [esp + edx - 0x789b318d], eax
inc cx
inc edx
inc esp
movsx edi, al
rol ecx, 1
inc ecx
pop eax
call fcn.0122cb9b
mov ecx, 0x59950d29
mov word [ecx + edx - 0x59950d29], ax
jmp ebp
Function at 0x122b2af
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
rol edx, cl
xor dl, 0x15
mov ecx, dword [edi + edx - 0x635a6d9c]
lea edi, [edx + edi - 0x635a6d98]
jg 0x135d379
xor ecx, ebx
lea ecx, [ecx + edx + 0x58dfff6f]
movzx eax, dx
rol ecx, 1
call fcn.01359705
adc eax, 0x79b73408
jno fcn.0124cf7b
call fcn.01314c52
lea eax, [ecx + ecx*8 - 0x34dfbcc6]
or cl, ch
bswap edx
sub eax, eax
xchg cx, ax
lea edx, [edx + ecx - 0xc238e69]
bswap edx
jbe 0x13e001e
neg al
or cl, ch
lea ecx, [ecx + eax + 0x1dbb3193]
xor edx, ebx
inc cl
xor edx, 0x8816c3a1
push ecx
pop eax
lea edx, [edx + ecx - 0x37d06493]
bswap ecx
not edx
jmp 0x1348e35
rol eax, 0x17
xor cx, cx
sbb edx, 0x7129b185
rol edx, 3
bswap edx
xor ebx, edx
dec al
je 0x13ba1b9
and al, ah
adc ebp, edx
lea edx, [ecx - 0x24df194f]
shr al, 6
sar cx, 0xc1
mov ecx, esi
lea esi, [esi + edx - 0x6d51e6b5]
dec edx
mov dword [esi + edx - 0x6d51e6b0], ecx
not dl
jnp 0x1321f1a
Function at 0x1231311
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
movzx eax, dl
lea eax, [edx*8 + 0x99c4a20]
jmp ebp
dec esi
mov dword [esp + eax*4 - 0x2cee588c], esi
inc edi
lea edi, [eax + edi - 0x443da35b]
inc edx
dec byte [esp + eax*4 - 0x2cee5889]
inc dx
inc dword [esp + eax - 0xb3b961d]
inc ecx
ror edi, cl
dec ecx
lea ecx, [esi + edx*2 - 0x1c7cf7fc]
inc ebp
lea edi, [edi + esi*2 - 0x1671f1da]
inc ecx
rol edi, 1
inc dx
xor esi, dword [esp + esi - 0x8bd]
jnp 0x13beccd
dec edx
mov dword [esp + eax*4 - 0x2cee588c], edi
inc esi
xor dword [esp + eax - 0xb3b9623], edi
pop edi
shr dl, 0xc4
inc ecx
sub al, al
dec ebp
arpl di, di
jp 0x17c6c13
sub esi, 0xe208d225
rol esi, 2
call fcn.01317588
rol dl, 0x26
mov dword ss:[ecx + edx*4 - 0x12800], eax
je 0x122e899
ror al, 1
dec word [esp + 0x1e]
xor bl, al
mov word [esi - 6], ax
add esi, 0xfffffffa
mov eax, 0xa4382b30
pop edx
pop edx
pop eax
pop eax
pop eax
pop ecx
pop ecx
pop eax
jmp fcn.0124cf7b
mov esi, 0x911aaf
inc ebp
mov eax, dword [ebx + esi*2 - 0x122355e]
inc esp
xor eax, edi
movzx eax, si
dec eax
lea edx, [esi + esi*4 + 0x34973c03]
push eax
inc ecx
not eax
mov ebp, dword [esp + esi*2 - 0x122355e]
sub word [esp + esi - 0x911aac], ax
inc ecx
mov esi, 0xc5b2e238
inc ecx
bswap eax
jle 0x13e9bc6
pop edi
call fcn.01388735
inc ebp
movzx esi, ah
dec ebp
arpl ax, ax
dec ebp
add ebp, eax
movsx ebp, cx
dec esp
lea edx, [ebp + edx - 0x12d4e048]
jmp fcn.01228351
inc edi
or esi, edx
jmp 0x1354c1e
je 0x17aaf97
movzx edx, byte [ecx]
shl esi, 8
jmp 0x133876c
inc ecx
jmp 0x13bed11
dec edi
lea ebx, [esp + ebx - 0x5362407]
inc edi
mov ecx, dword [ebx - 0x5362403]
inc esp
movsx eax, al
inc esp
xor ecx, edi
call fcn.01349481
fcom qword [eax + 0x20]
fidivr dword [eax + 0x46]
jmp 0xe23de7cd
dec ecx
sub ebx, 4
jmp 0x124c192
dec ecx
sal esp, 0xfe
inc ecx
bswap esi
or byte [esp + ebp - 0x48217b25], 0xf
dec ebp
sbb esp, edi
sar edx, 0xaa
inc ebp
lea esi, [esi + ebp*2 - 0x20351f44]
dec ecx
lea esi, [ecx + edx*2 - 0x325927e6]
adc dword [esp + ebp - 0x48217b29], edx
inc ecx
xor esi, 0x67a4fa10
inc ecx
ror esi, 1
inc cx
ror esp, 0x4f
rol dl, 0xe2
jae 0x12fca15
cmp edi, 5
jl 0x13ee186
mov dword [ebp - 8], ecx
movsx edx, cx
lea esp, [esp]
sar dh, cl
call fcn.0122b989
call fcn.0135a8bc
jmp 0x13a0e6f
cmp ecx, dword [ebp - 0x40]
jmp 0x134f059
dec eax
cmovno edx, esi
inc ecx
mov edx, 0x8038d9aa
dec ebp
adc ebp, edi
inc esp
or eax, eax
call fcn.013f8f9d
mov eax, 0x3f12ee82
dec al
mov edx, dword [edi + eax*2 - 0x7e25dd02]
mov ecx, eax
push ecx
xor dword [esp + ecx*2 - 0x7e25dd02], 0xa48becb1
lea edi, [eax + edi - 0x3f12ee7d]
ror byte [esp + eax*2 - 0x7e25dd01], cl
xor edx, ebx
call fcn.0130eaed
jmp 0x13ad56f
Function at 0x1231dd5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg ecx
dec eax
and eax, 0x85083f33
inc edx
shr byte [esp + esi*2 - 0x8b6f6], 0x87
jp 0x13ebd5a
xor ecx, 0xdf839c97
dec ebp
lea ecx, [esi - 0x5be3de79]
dec esi
xchg dword [esp + esi - 0x45b78], esp
inc edx
xchg dword [esp + esi*8 - 0x22dbf5], ebp
lea ecx, [ecx + ebp - 0x6eb42a2e]
inc ecx
rol esp, 0xcb
rol ecx, 3
dec esi
lea esi, [0x1886021b]
dec eax
mov dword [esp + ebp*2 + 8], edi
call fcn.013e75be
call fcn.013e43a1
mov dword [esp + eax - 0x22bf], 0xb9b1c785
xor ebx, ecx
shl eax, 0xe4
adc ebp, ecx
xchg dword [esp + eax*2 - 0x45855], eax
pop eax
pop edx
pop ecx
pop eax
jmp fcn.0124cf7b
inc ecx
xor esi, 0xb3a74eb2
call fcn.0138dcc4
ret 0x3346
jmp 0x1309c51
dec eax
mov edi, dword [esp + edx - 0xa2f8]
mov ecx, 0xe736d6b5
dec eax
or eax, 0xf8f2324
dec eax
arpl si, si
jl 0x13a108f
jge 0x13faf3f

Function at 0x123c724
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
dec eax
lea esi, [esi + esi*8 + 0x4b20b999]
dec ecx
and edx, 0xfffffff0
dec esi
dec esp
sub edx, ecx
dec ecx
mov esp, edx
not si
push esi
call fcn.013250ab

Function at 0x1241d58
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp + eax - 0x6736c511], edi
jb 0x1256f09
jmp 0x13b9e90

Function at 0x12468d1
Capabilities:
Encode data using xor

Disassembly:
inc ecx
not edx
dec cx
call fcn.0130812f

Function at 0x1248088
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc esp
xor esi, edi
neg dx
jb 0x130c9ba
inc ecx
bswap esi
inc ecx
movzx eax, al
dec esp
lea esp, [edx*8 - 0x7fca2044]
inc esp
mov edx, ecx
inc ecx
rol esi, 1
call fcn.012579d0

Function at 0x124aea0
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc edi
movzx edx, word [ebx + esi - 0x7fb387b5]
inc ebp
movsx eax, si
dec edx
mov dword [esp + esi - 0x7fb387b5], 0x448f2307
inc sp
xor edx, edi
jmp 0x134a115
inc cx
dec edx
inc cx
shl eax, 0xa3
inc ebp
mov ecx, esi
inc cx
xor edx, 0xf42bbab
mov esi, 0x784e34ac
dec esp
add byte [ecx + 0x58], 0x41
inc cl
inc cx
dec edx
inc ecx
rol esi, 3
inc ecx
mov esi, esi
inc cx
ror edx, 1
inc esp
movsx esp, ch
inc cx
xor edi, edx
call fcn.017bff18

Function at 0x1253a08
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push edx
not ecx
ror ax, 0xef
ror ecx, 2
mov dword [esp + eax - 0x1fa], 0xb293fea2
xor ebx, ecx
add ebp, ecx
xchg byte [esp + eax*2 - 0x3f7], dl
mov eax, dword [esi + eax*2 - 0x3f8]
pop edx
sar dl, 0x22
mov cx, word [eax + edx - 0x30000000]
shr dword [esp + edx*2 - 0x60000000], 0x4a
jns 0x132cdc6
mov word [esi + edx*2 - 0x5ffffffa], cx
movsx ecx, dx
lea esi, [esi + ecx*4 + 6]
mov dword [esp + edx*2 - 0x60000000], ebp
ret
Function at 0x1258004
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not al
xor edx, ebx
call fcn.01359018
sbb ax, 0xafbc
xor ebx, ecx
add ebp, ecx
lea ecx, [eax + eax*8 - 0x6f44b84b]
sub dl, 0xab
dec eax
movzx eax, byte [edi + edx*2 - 0x2d4000aa]
sal edx, cl
push edx
adc edi, 1
mov dword [esp], edx
not cl
ror byte [esp + 2], cl
xor al, bl
inc al
call fcn.013a6d75

Function at 0x1258043
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp + ecx*4 - 0x48], 0xf12bc04
dec dword [esp + ecx - 0x12]
rol edx, 3
call fcn.013ef23b

Function at 0x1258057
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not edx
xadd cx, ax
bswap edx
or cl, ch
sbb edx, 0x639afdbb
ror edx, 1
call fcn.013317df

Function at 0x12ef505
Capabilities:
Encode data using xor

Disassembly:
not edx
sbb eax, eax
sbb eax, ecx
neg edx
add al, ch
jg 0x17bb1d9
call fcn.01351757
div ecx
mov ecx, dword [esp]
sar ecx, cl
neg cl
mov dword [esi + ecx - 0xb061], edx
or word [esp + ecx - 0xb063], 0xad2f
call fcn.0136dc67
mov ecx, 0x5dbaf924
xor dl, bl
mov dword [esp + ecx - 0x5dbaf920], 0x6e2d62ab
xor dl, 0x3b
sar dword [esp + ecx - 0x5dbaf918], 0x41
call fcn.0134357d
salc
inc esi
xor ecx, eax
ja 0x12ef574
pop ss
retf 0xca2d
and edx, esi
mov ebp, 0x6dab888d
adc byte [ebx + esi], al
ror dword [edx + 0xf], cl
enter 0xffffffffffffd2f7, 0x66
add ecx, ecx
bswap edx
cmovle ax, cx
lea edx, [edx + eax*2 - 0x7353503f]
xadd eax, ecx
sar cl, 0x67
ror edx, 1
sar ecx, 8
sbb edx, 0xb004ff13
neg ecx
jno 0x122ccc9
push ds
mov esi, 0xaa51d1fd
adc dh, dl
xchg byte [ecx], dl
stosb byte es:[edi], al
adc dl, bl
mov dh, 0x61
stosb byte es:[edi], al
adc byte es:[esi + 0x26aa19ce], bh
fidiv dword [esi + 0x1026aa61]
mov esi, 0x26aa19ce
adc dh, cl
outsb dx, byte [esi]
xor eax, 0xcc102600
fdivr dword [ebp - 0x69]
push edi
adc byte [ebx + 0x4b], dl
stosb byte es:[edi], al
inc eax
xchg edi, eax
inc esp
mov ah, 0xc8
adc dl, al
xchg ecx, eax
jnp 0x12ef5bb
pop ecx
test eax, 0x3c23da21
push edx
sub edx, dword [ecx - 0x6a]
jecxz 0x12ef646
wait
mov ch, 0x7e
mov cl, 0xdf
push es
pop ebx
retf
fsub qword [0xd7203a9]
into
dec ecx
pop es
popfd
sub byte [eax - 0xc], cl
outsd dx, dword [esi]
invalid
sal ecx, cl
xor ebx, edx
call fcn.01236f30
mov word [eax + esi - 0x433a31ae], cx
movzx ecx, dl
mov ecx, dword [eax + edi - 0x433a31b0]
setns al
xor ecx, ebx
add dl, al
add dx, 0xa63a
sbb ecx, 0xb103d09c
neg edx
call fcn.012fc924

Function at 0x12fb8c1
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pop eax
mov dword [edx], ecx
mov ecx, dword [edi + 1]
mov edx, 0x7395bb35
movzx eax, dx
neg eax
lea edi, [edi + edx - 0x7395bb30]
xor ecx, ebx
dec dl
ror ecx, 1
or dx, 0x938e
call fcn.013905b6

Function at 0x12fc96b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp + 0xc], 0x76d6af99
lea esp, [esp + 0xc]
call fcn.01362e5c

Function at 0x13001a7
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
bt ebp, edx
mov ebp, esp
mov edx, dword [ebp + 8]
jmp 0x133db0d
sub esp, 0x114
push esi
cmp dl, cl
test edx, edx
jmp 0x1343a72
Function at 0x130141e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xchg byte [esp + eax + 0xc], ah
lea esi, [esi + eax*2 - 0x1bffc]
sbb dword [esp + eax - 0xdff5], eax
jnp 0x13c731f
movzx eax, byte [eax + edi - 0xe000]
adc edi, 1
xor al, bl
mov dword [esp], 0xe1938434
add dword [esp + 0xc], 0xb306c91d
xor al, 0x3b
mov ecx, dword [esp + 0xc]
push ecx
add al, 0x1e
inc ecx
jnp 0x138a486

Function at 0x13022b6
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg dl
mov dword [esp], ecx
pop ecx
dec ecx
xor bl, dl
lea edx, [esp + edx + 8]
sal cl, 0xa3
dec cx
mov byte [edx], al
mov eax, dword [edi]
mov dword [esp], ecx
call fcn.0138442e
jp 0x1311dbd
sub ecx, 0xc68ddd82
sub al, al
push eax
adc al, byte [esp + eax - 0x497f1000]
ror ecx, 3
xor ebx, ecx
dec word [esp + edx*4 + 1]
xor eax, 0xca063dab
sar dl, 0x25
adc ebp, ecx
inc eax
shr dword [esp + edx], 2
movzx ax, byte [esi + edx*2]
mov cl, byte [edx + esi + 2]
jp 0x138dc25
push eax
xor ecx, 0xa187d817
lea edx, [eax*2 - 0x5e4785f4]
pop edx
call fcn.012295a2
or dword [esp + edx], 0x8b27348d
sar dl, 1
lea esi, [edx + esi + 2]
sal edx, 0x8b
setbe dl
not al
lea edx, [edx*2 - 0x29e60b7f]
not cl
shr edx, 0x7b
ror dl, 0xe6
and al, cl
call fcn.012566ef

Function at 0x1302380
Capabilities:
Encode data using xor

Disassembly:
call fcn.01346d18
inc ecx
sub esi, edi
inc edx
neg dword [esp + eax + 0xc]
inc eax
xor bh, ch
dec eax
lea ebp, [esp + ebp + 0x10]
dec edx
shr dword [esp + eax + 3], 0x1d
inc ecx
setb al
dec edx
mov ecx, dword [ebp + eax*8]
dec edx
sub esi, dword [esp + eax + 8]
dec ecx
lea ebx, [eax + ebx - 8]
inc edx
shr dword [esp + eax*2 + 0xb], 0x6b
dec eax
lea ebp, [edx*4 + 0x3c1b8815]
dec eax
mov dword [esi + ebx + 0x625aff78], ecx
inc esi
xadd byte [esp + eax + 1], ah
dec edi
lea ebx, [ebx + eax - 4]
inc ecx
mov edx, dword [ebx + esi + 0x625aff78]
inc ecx
sal bh, 0x24
shr word [esp + esi + 0x625aff81], 0xa3
xor edx, edi
xor edx, 0x92067814
inc edx
lea edx, [edx + eax + 0x5e9ddaa9]
inc esp
movzx esi, bp
mov bh, 0xf5
xor edx, 0xb290b101
inc edx
mov eax, dword [esp + eax + 9]
neg edx
inc ecx
bswap esp
dec edx
dec esi
lea edx, [esi + ecx*4 - 0x1f6ed874]
inc ecx
pop edx
dec eax
xor dword [esp + esi + 0x625aff78], edi
call fcn.017c1d35
xchg edx, eax
outsd dx, dword [esi]
jecxz 0x13023f6
fnstsw word [ebx + 0x38]
adc byte [edx + 0x1e], bl
mov dword [ebx + 0x38], edi
adc byte [edx + 0x4e], dl
fnstcw word [ebx + 0x38]
adc byte [edx + 0x2e], bl
stc
jnp 0x1302472
adc byte [edx + 0x16], ch
int 0xd1
cmp byte [eax], dl
xor al, 0x6c
leave
inc esi
dec ecx
adc bl, bl
mov esi, 0x5298da66
xchg edx, eax
int1
and dword [esi], edi
mov word [edx + eax*4 - 0x94a0d43], gs
mov ah, 0x19
push ecx
inc ebp
add al, 0xac
pushal
jns 0x13024a6
push ecx
add al, 0xac
pushal
inc ecx
jne 0x13024c9
add al, 0xac
pushal
popal
jge 0x13024d7
add al, 0xac
pushal
xor dword [ebp + 0x61], esi
jne 0x13024d5
add al, 0xac
pushal
cmp eax, 0x1f5887a9
inc esp
mov edx, 0xfa23e04
dec edx
mov word [edx + edi*4], ss
add al, 0x3e
mov byte [0x9cf7d833], al
adc al, 0xba
add al, 0x3e
mov byte [0xbe0fe803], al
ret 0x2166