joyce8/EMBER2024-capa huggingface dataset:
Function at 0x735c6e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0xd6931ca4
mov dword [esp + 4], eax
ror dword [esp], 0xf2
jb 0xa12575
ror ecx, cl
lea ecx, [ecx + ecx*2 - 0x29c51dfd]
not al
call fcn.009b2dbe
mov edi, 0x12d9620
ror dl, 1
add di, si
mov ecx, edi
and eax, eax
sbb dl, 0x21
xor dl, 0x1a
inc al
ror ax, 1
xor bl, dl
rol esi, 0xd7
shl cx, 0x4f
inc cl
add edx, esp
mov eax, dword [edx + eax*2 - 0x4341cfd4]
neg edi
adc ecx, esi
mov dword [ebp - 4], eax
mov edx, 0x699c6435
mov eax, dword [edx + ebp - 0x699c6439]
mov esi, eax
neg cl
mov edi, ebp
add ecx, ecx
jns fcn.00942dca
jmp 0x95ef17
lea esp, [esp + 0x14]
ret
dec ebx
call fcn.008f8cc8
mov eax, 0xca366db5
mov edx, eax
sar al, 0xc5
movzx dx, byte [edi]
push eax
setnp al
mov al, byte [edi + 2]
neg dword [esp]
mov ecx, dword [esp]
lea edi, [edi + ecx - 0x35c99201]
sets cl
adc ecx, 0x91bb111b
not dl
jae 0x7a8285
movzx edx, byte [esi]
xor dl, bl
mov esi, 0x490d7d13
neg dl
lea eax, [esi + esi - 0x707a2a52]
jmp 0x7d7d64

Function at 0x735c82
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + ebp*2 - 0x2c0], edi
rol ecx, cl
mov ecx, dword [ebp + edx - 0x160]
mov edx, edi
call fcn.00c96be5
dec ebp
add ebx, esi
rdtsc
dec ecx
lea edi, [ebp + edi - 0x3c1e66b3]
inc ecx
ror edi, cl
inc esp
movzx ecx, dh
inc ecx
mov dword [edi + edi - 0x426eaae], eax
inc ecx
movzx eax, cx
mov ebp, ebx
inc edx
mov dword [edi + ebp*2 - 0x783ccd56], edx
cbw
jae fcn.008c5046

Function at 0x735d05
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shl edx, 0xaa
mov word [edi + edx], cx
mov eax, dword [edx + esi]
lea ecx, [edx + edx*4 - 0x6dd5a0e4]
mov dword [esp + edx], ecx
xchg dword [esp + edx*2], ecx
lea esi, [edx + esi + 4]
xor eax, ebx
bt edx, 0x2e
neg byte [esp + edx]
and ecx, edx
lea eax, [eax + edx - 0x63b59289]
bswap ecx
neg eax
call fcn.00a3ff18

Function at 0x736dcb
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ebp
xor ecx, esp
dec eax
mov dword [esp + eax - 6], eax
inc ecx
bswap ecx
dec cl
inc ecx
mov ebp, eax
jl 0x936eb5
sysenter
call fcn.007435ab
Function at 0x737641
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ebx, dword [ebx*4 + 0x8981ac]
call fcn.00ca6f0a
mov edx, 0x4fa9a634
lea edx, [edx + edx*4 + 0x6724e800]
sub ebp, 4
mov ecx, dword [ebp]
lea eax, [edx*8 + 0x75bcd914]
cwd
xor ecx, ebx
dec dx
setg dl
jle 0x818365
inc al
ror al, 1
or ecx, ecx
add cx, cx
lea ecx, [ecx + ecx*4 + 0x393103af]
not al
sal ecx, 0x3d
ror al, 1
not ecx
xor ecx, dword [esp + ecx - 0x5fffffff]
jne 0x9c59d0
xchg ecx, eax
or edi, dword [eax + 0x48]
outsd dx, dword [esi]
add edx, esi
inc edi
xchg bl, al
pop es
jb 0x7376a0
jae 0x737713
retf
xchg esp, eax
sal byte [esi], cl
xchg edi, eax
invalid
dec ecx
call fcn.009aad84
xor bl, al
lea eax, [esp + eax + 4]
btc ecx, 0x3a
inc cx
mov word [eax], dx
movzx edx, word [esp]
jl 0x709e61
lea ebp, [ebp + edx - 0xa63c]
and edx, edx
mov ecx, dword [ebp + edx*2 - 0x14c70]
or edx, edx
xor ecx, ebx
mov byte [esp + edx*4 - 0x298de], dh
inc ecx
bswap ecx
dec edx
pop eax
inc ecx
cwde
neg ecx
sal al, 0x26
inc dl
neg eax
ror ecx, 2
xchg dx, ax
sub edx, 0x2bafb689
bswap edx
lea ecx, [ecx + eax + 0x3e85c054]
neg eax
xor ebx, ecx
add esi, ecx
neg ax
bt edx, edx
jmp esi

Function at 0x73ab8f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0x90252490
test ebx, ebx
push 0x649439b3
lea esp, [esp + 0xc]
je 0x9b4e1b
mov eax, dword [ebp + ebx*4]
push 0xc6992d9c
dec byte [esp]
js 0x9b4e10
mov dword [esp], eax
dec ebx
jne 0x73abac
mov eax, 0x1b1b8aad
mov eax, dword [ebp + eax*4 - 0x6c6e2ab4]
call eax
mov edi, 0xab356f87
lea ecx, [edi*2 - 0x40ec69ca]
mov ebp, dword [ecx + ebp - 0x157e7548]
mov ebx, ecx
bt edi, edi
btc ebx, edi
mov dword [ebp + ecx*2 - 0x2afcea88], eax
pop ebx
mov esi, 0x92a57f87
pop edi
push ecx
sar dword [esp + ecx - 0x157e7544], cl
movzx eax, byte [esp + ecx - 0x157e7544]
mov esi, dword [esp + eax - 0x50]
mov dword [esp + ecx - 0x157e7540], 0xfd88a880
mov dword [esp + ecx*2 - 0x2afcea88], edi
ret 4
Function at 0x73e5c7
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop eax
dec edi
lea ebp, [eax + eax*4 + 0x5f228121]
dec esp
adc ebx, edx
dec edi
lea edx, [ecx + edx - 0x77]
dec ecx
rol ecx, 0xeb
inc cx
cmovae ecx, esi
inc sp
xor eax, ebx
inc ecx
movzx ebx, byte [edx]
inc ecx
bswap ecx
inc ebp
movsx edi, al
inc ecx
xor bl, ah
inc cx
neg eax
movsx esi, bp
inc ecx
adc bl, al
inc ecx
movsx edx, cl
inc ecx
xor esi, ecx
not bl
dec eax
shl ebp, 0x8c
inc esp
bt edx, edi
xor bl, 0xb5
rol dl, cl
adc bl, 0x17
dec esp
bts ebp, ebp
dec ecx
rol edi, 8
inc esp
xor ah, bl
inc bp
add eax, ecx
inc ecx
inc cl
dec eax
adc ebx, esp
inc esi
xor edi, dword [ebx + ecx*8 - 8]
sar cl, cl
dec edx
lea edi, [edi + ecx - 5]
inc ecx
push eax
inc bp
xchg ecx, esi
inc ecx
sub cl, 0xb4
inc ebp
mov dword [ecx + edi - 0xff2e], edi
inc esi
movzx edi, byte [esp + ecx - 0xff2e]
jl 0x7e6616
jo 0x9f57e5
inc ecx
pop ecx
jge fcn.008c5046
mov edx, 0x90266c2c
lea eax, [edx*4 - 0x657398ef]
and eax, eax
mov cx, word [esi]
mov ax, word [esi + 2]
adc esi, 2
and cx, ax
xchg dh, dl
not cx
movsx eax, dl
mov word [esi + eax*8 - 0x360], cx
mov edx, dword [eax + edi - 0x6c]
movzx ecx, al
or ecx, eax
lea edi, [eax + edi - 0x68]
xor edx, ebx
shr ecx, 0xbf
jnp 0xca90cc
neg cx
rol edx, 3
rol eax, 0xe4
neg edx
ror eax, 0x39
inc edx
neg edx
ror ecx, 0xe3
dec edx
jmp 0xa3298c
neg edx
ror cl, 0x46
push eax
xor ebx, edx
add ebp, edx
add ecx, eax
rol word [esp + eax - 0x36000], 0x65
xor ecx, ecx
mov dword [esp + eax - 0x36000], ebp
ret
mov edx, dword [esi + eax - 0x4938e8b2]
xor ax, 0x7880
xor edx, ebx
and eax, eax
movsx ecx, ax

Function at 0x73fdd7
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mul dx
mov dword [esp], 0x22b9f88f
mov eax, dword [ebp]
mov ecx, dword [esp]
pop edx
lea ecx, [edx + edx*4 + 0x2ea66295]
xor eax, ebx
dec dx
sub eax, 0xebbc7502
call fcn.007e17e7

Function at 0x73fe01
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop edx
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edi, 0x8a068f9e
mov ebx, 0x1fa30fa1
mov edi, ebp
bswap ebx
lea esi, [ebx + ebx + 0x1c3d479d]
mov ebp, 0xfea766a8
pop ebx
movzx edx, bp
btc esi, edx
pop esi
adc edx, ebp
pop ebp
movsx eax, dl
movzx ecx, al
lea ebp, [eax + ebp - 0x55]
mov edx, dword [ebp + eax - 0x51]
setp cl
xor edx, ebx
shr ecx, 0xb6
shl eax, 0x99
ja 0x9a8d25
sbb edx, 0x95acfa2d
btc cx, ax
sub cx, 0x4088
ror edx, 3
inc edx
btr ecx, eax
call fcn.0093ac08
Function at 0x740c50
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
dec eax
inc edx
xor ecx, 0xca0a5691
neg ecx
mul edx
ror eax, 0xfd
ror ecx, 3
idiv ax
lea edx, [edx - 0x55dd1c6e]
cbw
dec ecx
bts edx, 0x90
mov dword [esp + eax - 0x160001], eax
rol ecx, 1
imul edx
xor ecx, 0xc51cb108
xor ebx, ecx
ror eax, 0x53
ror eax, 0x15
call fcn.00754100
inc ecx
mov ecx, 0x9b8b4bbb
inc ecx
mov esi, ecx
dec ecx
sub edx, 1
dec ebp
lea ecx, [ecx + esi*8 + 0xe3331a5]
inc ebp
mov edi, ecx
inc ecx
movzx esi, byte [edx]
inc ebp
movsx ebp, cl
inc ecx
xor dh, ah
inc eax
inc dh
inc eax
not dh
inc bp
imul ecx, ecx
inc ecx
mov ecx, ecx
dec edi
lea ebp, [ecx + edi*2 + 0x1aa1329]
inc eax
xor dh, 0xb5
inc eax
add dh, 0x17
inc esp
xor ah, dh
inc ecx
movzx ebp, di
inc bp
add ecx, edi
dec eax
add esi, esp
inc ecx
shr ch, 0xe6
mov ecx, dword [esi + ebp*4 - 0x36ce0]
dec eax
lea edi, [edi + ebp - 0xdb3c]
inc esp
movzx esi, bp
mov dword [edi + ebp - 0xdb38], ecx
inc esp
movzx eax, ch
inc bp
cmovns ecx, esi
dec ebp
lea edx, [edx + ebp*2 - 0x1b674]
inc ecx
mov ecx, dword [edx + ebp - 0xdb38]
inc bp
sbb ecx, edi
inc ecx
xor ecx, esp
mov esi, 0x39263609
dec edx
lea edx, [ebp + esi*8 - 0x207b21fb]
neg ecx
inc ecx
bswap esi
mov eax, 0xae3541b2
inc ecx
neg dh
lea ecx, [ebp + ecx + 0x21b1b575]
mov ebx, esi
dec ecx
imul ecx
neg ecx
lea ecx, [ebp + ecx - 0x54990ac2]
inc ebp
xadd dh, cl
inc cx
ror eax, 0x2b
inc ecx
seta al
inc ecx
push esp
inc ecx
rol eax, 0x85
xor dword [esp + ebp*2 - 0x1b670], ecx
inc ecx
pop esp
inc cx
bts edi, ebx
inc ecx
bt esi, eax
dec eax
arpl cx, cx
dec esi
lea ebp, [ebp*4 - 0x72d4bcc1]
inc ecx
rol dh, 0x44
dec esp
adc ebx, ecx
jmp fcn.008c5046

Function at 0x740ed3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 8]
call eax
mov ebp, dword [ebp - 4]
mov edx, 0x8d1f812f
mov dword [ebp], eax
mov esi, ebp
movzx ebx, dl
movzx eax, bl
inc eax
pop ebx
lea edi, [eax*8 + 0x3926ca2b]
add edi, 0xfd18541d
pop ebp
mov ecx, edx
shr al, 0x41
and eax, 0x2a9dd693
pop edi
sub dl, ch
mov ecx, dword [eax + edi - 0x10]
lea edi, [eax + edi - 0xc]
and eax, eax
xor ecx, ebx
xor dl, al
neg ecx
dec edx
xor ecx, 0x630ca08a
rol ecx, 3
neg ecx
or edx, eax
lea ecx, [ecx + eax - 0x69b95c1f]
adc dl, dh
rol ecx, 1
sar al, 6
or ax, 0x1c95
xor ebx, ecx
neg edx
bswap eax
add ebp, ecx
movzx ecx, al
call fcn.00c972a6
Function at 0x740f54
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ebx, eax
rol dx, 0x85
shl dx, 0xc1
adc ebp, eax
lea eax, [ecx + ecx*4 + 0x52a86f1c]
cwd
cwde
movzx eax, byte [edi + edx*2 - 0x1fffe]
mov dword [esp + ecx - 0xe00], 0x4134a6a6
inc ecx
and ecx, ecx
lea edi, [ecx + edi - 0xe00]
pop edx
neg dx
xor al, bl
inc dx
neg al
not edx
or cl, 0x23
sbb al, 0xd
neg al
inc al
rol cx, cl
jae 0x9220c7
not eax
call fcn.00913edc
dec eax
shr dl, cl
movzx ecx, al
mov word [ebp + ecx*8 - 0x738], dx
jmp edi
ror cl, 0x23
adc ecx, 0x38894a82
movzx dx, byte [eax + ecx - 0x3889bb85]
ror ecx, 0xd2
mov eax, ecx
xadd al, ah
lea esi, [esi + eax - 0x6ee12272]
mov word [esi + eax - 0x6ee12270], dx
movzx edx, al
shr dx, 0x61
lea edx, [ecx + ecx*4 + 0x1282002e]
jne fcn.007194ad
mov eax, 0x7796209e
movsx edx, al
lea ebp, [eax + ebp - 0x779620a2]
mov edx, dword [ebp + eax - 0x7796209e]
sal ax, 0x2d
movsx ecx, ax
xor edx, ebx
inc ecx
rol edx, cl
not cx
dec edx
btc eax, 0x33
xor edx, 0x4dba1a3a
sal eax, cl
sbb ax, cx
inc edx
dec ecx
xor ebx, edx
ror cl, 0x82
adc esi, edx
call fcn.0071b347
dec dl
xor al, 0x22
xor bl, al
neg edx
add eax, esp
jmp 0x7c3714

Function at 0x742c66
Capabilities:
Encode data using base64

Disassembly:
movsx ecx, al
xor edx, 0x42b9ca33
or ecx, 0x9b3f09af
not edx
neg al
ja 0x826d72
call fcn.007da072

Function at 0x743ae9
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
bswap edi
inc ecx
inc edi
xadd dl, cl
dec esp
mov dword [esp + esi*4 - 0x597e83d8], esp
inc ecx
imul ecx
dec eax
mov dword [esp + esi*2 - 0x2cbf41f4], ebx
inc esp
xor dword [esp + esi - 0x165fa0ea], edi
call fcn.0098958d
movzx ecx, al
mov edx, dword [eax + edi - 0x5ea17eb5]
jmp 0x7f50b3
sal al, 0x43
setbe al
mov al, byte [edi + eax - 0x5ea17dfd]
inc ecx
bts ecx, ecx
sar ecx, 0x42
lea edi, [edi + ecx*2 - 0x200054]
sub cx, 0x2fbe
not cl
btc ecx, ecx
mov byte ss:[edx + ecx - 0x11d090], al
lea ebp, [ebp + ecx*8 - 0x8e8484]
jae 0x7f9fe5
mov ch, byte [ebx]
ret
Function at 0x74645d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x5a1a40ae
lea esp, [esp + 0x10]
je 0x9bfc16
push 0x9327b00f
mov dword [esp], 0x7b07a3b0
not byte [esp + 1]
mov dword [esp], esi
mov esi, 0x98a01095
sub esi, esi
rol esi, 0xdd
movzx esi, byte [edx + esi]
xor esi, eax
and esi, 0xff
call fcn.00744ee7
mov edx, dword [ebp - 4]
push 0x2e91adba
push 0x723cbae
mov ecx, 0x882b89b1
xor edx, ebx
dec edx
movzx eax, cx
call fcn.00910657
mov edx, dword [esi + edx - 0x7b8d758f]
mov eax, 0x63aa9514
mov ecx, eax
shl ecx, cl
xor edx, ebx
inc edx
not edx
bswap edx
xchg ch, al
dec edx
call fcn.008c3019
not eax
mov ecx, 0x3f013107
mov dword [esi + ecx - 0x3f013107], eax
mov eax, dword [edi + ecx*2 - 0x7e02620e]
mov edx, 0x5a19d4b0
sal ecx, 0x81
dec cl
lea edi, [edi + edx - 0x5a19d4ac]
adc dx, dx
xor eax, ebx
inc edx
call fcn.00830187
mov ecx, 0xe234cdbd
push ecx
movsx edx, byte [esp]
mov ecx, dword [esi]
movzx eax, dl
ror eax, 5
adc esi, 3
inc dx
xor ecx, ebx
xadd eax, edx
sub eax, dword [esp]
sbb ecx, 0xf10f9ca1
sub ax, dx
bswap ecx
btr ax, 0x14
ror ecx, 1
cwde
shl dl, 0xc2
sbb ecx, 0xd0a837b7
pop edx
imul dx, dx
xor ebx, ecx
btc eax, edx
add edi, ecx
rol eax, 0xc1
movsx ecx, ax
mov dx, word [ebp + eax - 0x6002]
sbb eax, eax
or cl, cl
lea eax, [eax + ecx*2 - 0x22db595e]
mov cl, byte [ebp + ecx*2 - 0xc002]
ror ax, 0xa
adc ebp, 1
sal al, 0x43
shr eax, 0x26
sal dx, cl
mov word [ebp + eax*8 - 0x1ba4b538], dx
bts ax, ax
movzx ecx, ax
push eax
mov dword [esp + eax - 0x37496a7], edi
ret
jmp 0x8d10ea

Function at 0x748415
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
mov dword [esp + ebp*2 - 0xf29a0a8], 0x7e9efe84
shl dword [esp + ebp - 0x794d052], cl
xor al, 0x16
inc esp
xchg byte [esp + ebp - 0x794d04f], bh
rol al, 1
dec ecx
add ebp, 0x74ac17b2
jp 0x922ade

Function at 0x74c9bb
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0xee82b0b2
je 0xa15dfa
sub ebp, 4
mov ecx, dword [ebp]
jmp 0xa2a4c1
adc edi, 6
xor word [esp + 1], 0x8a04
shrd edx, eax, cl
mov ecx, 0x4f04160b
mov dword [esp + ecx - 0x4f04160b], ecx
mov dword [ecx + edi - 0x4f04160b], edx
movsx edx, cx
shl cl, 0x67
mov dword [esp + edx*8 - 0xb058], esi
ret
xor ecx, ebx
xor ecx, 0x2d386aa6
mov eax, 0xe40b8c3e
movsx edx, al
rol edx, 0x82
inc ecx
jmp 0x75325e

Function at 0x74d149
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
ror word [esp + 5], 0x2f
mov dword [esp + 4], edi
lea esp, [esp + 4]
Function at 0x7508b5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
je 0x7a3832
xor ebx, edx
cwde
add edi, edx
mov dword [esp + ecx - 0x3a08], edi
ret 8
xor eax, ebx
shl edx, 0x3f
sbb eax, edx
and ecx, ecx
shl edx, cl
neg eax
sub cl, ch
xor eax, 0xc42538ad
inc edx
sub eax, edx
bswap ecx
ror eax, 3
rol ecx, 0xa
shl cl, 0x21
adc eax, edx
not dx
ror edx, cl
rol eax, 2
xor ecx, 0x9835b00d
inc cl
ror dx, 0x45
xor ebx, eax
add ebp, eax
movsx eax, dx
mov edx, dword [edi]
rol eax, 0x3e
adc ecx, eax
cwde
mov eax, dword [edi + 4]
setne cl
sbb cx, cx
adc edi, 7

Function at 0x753057
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0xa7be47bf
mov dword [esp], edi
Function at 0x7554fa
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shr eax, 0xec
dec ecx
sar eax, 0x9c
pop eax
mov eax, edx
ror ecx, 1
lea ecx, [ecx + edx - 0xa807358]
neg ecx
or dl, byte [esp + 3]
sub al, al
xor ebx, ecx
bts eax, eax
push edx
adc esi, ecx
sar dl, 0x24
mov edx, dword [edi + 2]
mov ecx, 0xa4372389
sbb edi, 0xfffffff9
add eax, 0xf8168417
neg ecx
shr ecx, cl
movzx eax, byte [ebp + ecx*8 - 0x5bd]
jne 0x7d046e
mov eax, 0x272626b5
movzx edx, al
mov eax, dword [edi + edx*2 - 0x16a]
mov dx, word ss:[eax + edx*2 - 0x16a]
mov ecx, 0xd405b515
btr ecx, ecx
adc edi, 2
call fcn.0070354f

Function at 0x755581
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + ecx - 0x7400], ecx
lea ebp, [ebp + ecx*2 - 0xe7fa]
sbb ecx, dword [esp + ecx - 0x7400]
adc cx, 0x220f
mov word ss:[eax], dx
jge 0x8effa3
mov ecx, 0xcbae5208
mov eax, dword [esi - 4]
movzx edx, cl
not cl
xor eax, ebx
jmp 0xa3ca2c
bts ecx, 0x83
call fcn.0081f61f
bts dx, cx
sbb dl, cl
bswap eax
rol edx, 0x3b
lea eax, [eax + ecx - 0x1b29e3f4]
xchg cl, dl
bswap eax
sar ecx, cl
sar dl, 0xc1
sbb eax, 0xec8d3d0e
not eax
xor edx, 0x2fa92aad
rol eax, 1
imul cx, cx
xor ebx, eax
shr cx, 0xe2
sal dl, 0x65
imul dx, dx
add edi, eax
lea eax, [edx - 0x5c73f74a]
mov cx, word [eax + ebp - 0x4b3598b6]
not dl
add ax, dx
movzx edx, byte [esi + eax - 0x4b3529ba]
btr eax, 0x81
dec al
div al
lea esi, [esi + eax - 0x4b353840]
lea eax, [eax + eax + 0x511d3098]
btc eax, eax
call fcn.00953991
shl dword [ecx - 0x2e2cb5ba], cl
leave
xor byte [ecx - 0x420c5d45], ch
push 0xf3a2bbe1
fst qword [esi - 0xc5d44cf]
mov ecx, 0xa2bb9912
jge 0xa3cb05
jmp 0x3e976d83
inc esi
inc eax
mov al, byte [edi - 1]
xor edx, dword [esi + 0x10]
mov al, byte [edi - 1]
and dword [edi - 0xb87520], 0xffffff9b
pop ds
clc
mov al, byte [edi - 1]
fidiv dword [edi - 0xb87580]
jb 0xa3cb4f
mov byte [edx + 0x27c2ff47], cl
inc eax
mov al, byte [edi - 1]
sti
pushfd
out 0x22, eax
insd dword es:[edi], dx
mov al, 0x5e
vpsrlq xmm2, xmm7, xmm1
dec edx
cmp dword [edx + 0x16f3a2bb], ecx
mov ebx, 0xf3a2bb32
push cs
inc ebp
loop 0xa3caf1
mov byte [0x3ab132f3], al
mov ebx, 0xd596f3a2
push 0xffffffffffffffbb
mov byte [0x22b932f3], al
mov ebx, 0x2102f3a2
lcall 0x60ac, 0xb5f3a2bb
mov ch, 0xac
pushal
mov dl, 0x6a
invalid

Function at 0x758bb2
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
push 0x10b3b9b0
call fcn.009845ed

Function at 0x75aec1
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + 4], ebp
push 0xe9b6039e
mov dword [esp + 4], edx
pop edx
jmp 0x9c2dc6
jmp 0x7109b6
Function at 0x75cd29
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
rol edx, 0x41
mov dl, byte [ebp + 4]
mov dword [esp], 0x38b28981
adc ebp, 6
call fcn.008a85ee
mov eax, 0x3129fa2b
push eax
mov eax, dword [eax + esi - 0x3129fa2b]
add esi, 4
mov edx, 0x709dfd3b
xor eax, ebx
and byte [esp + edx - 0x709dfd39], dh
bswap eax
inc eax
lea ecx, [edx + edx*8 - 0x77d704c8]
sal edx, 0x66
pop edx
rol eax, 2
xor eax, 0xcbbf1eb4
shl dl, 0xe1
xor ebx, eax
add edi, eax
lea eax, [ecx + edx*2 + 0x241d3d81]
or ecx, edx
sbb cl, ch
mov edx, dword [ebp + ecx - 0x7dbffa65]
sbb cl, ah
jae 0x7f6804
Function at 0x75d8db
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
adc ebp, ecx
mov ecx, esi
call fcn.008f1e74
xor bl, dl
lea edx, [esp + edx + 0xc]
shl ecx, cl
jne 0x91c633
mov dword [edx + ecx - 0x80000000], eax
push ecx
movsx eax, cl
call fcn.0094f70b
mov ecx, dword [edi]
mov edx, 0xef2e6d13
movsx eax, dl
shl ax, 2
lea edi, [edi + eax*2 - 0x94]
xor ecx, ebx
xor edx, edx
not ecx
ror ecx, 1
neg ecx
bswap ecx
jmp 0xa11f6d
rol ecx, 1
not ecx
push edx
sub dl, 0x8c
and dword [esp + edx - 0x74], edx
xor ebx, ecx
mul dword [esp + edx - 0x74]
shr dl, 0x42
jns 0x741e24

Function at 0x75e087
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x7aa74a
jmp 0x75bf41

Function at 0x75f033
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jns 0x8fd8c8
mov dword [esp + edx*8 - 0x1fff0], edi
ret
imul eax, edx
mov dword [esp + eax*2 - 0x1d8bfff8], ebp
movsx ebp, word [esp + eax - 0xec5fffc]
add dword [esp + eax*2 - 0x1d8bfffc], esi
shl eax, 0x10
sal dword [esp + eax], 0xf0
mov dword [esp + eax*2], ebx
cwd
shr ax, 0x4e
xor ebp, edi
lea eax, [eax*8 - 0x1879f861]
mov ebx, ecx
btr edx, eax
mov edx, ebx
shl edx, 2

Function at 0x76426f
Capabilities:
Execute syscall

Disassembly:
lea esp, [esp + 0x10]
je 0xa3d4a9
push 0xbcb22dad
call fcn.0074d149
syscall
inc ecx
push ecx
dec eax
mov dword [esp], 0xbc31cfcf
call fcn.0073fd82
xor eax, 0x13b7933e
push edx
pop edi
in eax, 0x52
salc
bound edx, qword [ecx - 0x31bf2a60]
bound edx, qword [ecx - 0x25b70060]
bound edx, qword [ecx + 0x39d2b6a0]
mov al, byte [0xdc69060d]
mov al, byte [0xbf550a51]
in al, 0x69
mov byte [eax - 0x3ebaacde], ah
or al, cl
xor dword [eax - 0x1d], eax
xlatb
dec edi
mov byte [0x8e60ac69], al
ret

Function at 0x7666fd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 0x1c]
jne 0x746481
jmp 0x9bfc0d
mov edx, 0xf881d69e
sar dl, 0x63
pop esi

Function at 0x76742f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sal dx, 0xc9
xor bl, al
sar edx, cl
mov dword [esp + ecx - 0x413b4167], ecx
imul ecx, ecx
lea eax, [esp + eax + 4]
jb 0x8f7b27
mov ecx, 0x37320792
push ecx
movzx ecx, word [ecx + ebp - 0x37320794]
mov eax, 0x39c287
xor cx, bx
dec al
mov edx, eax
pop edx
rol cx, 1
shl edx, 0x99
xor edx, eax
neg cx
ror cx, 1
or al, 0x3a
inc cx
ror cx, 1
xor bx, cx
xadd al, ah
shl eax, 0x28
mov word [edi + edx*2 - 0x4873850e], cx
movzx ecx, dx
adc dl, ah
movzx edx, word [eax + ebp - 0x39be8004]
neg ecx
sar eax, 0x25
rol eax, 0x6d
xor dx, bx
sub cx, ax
call fcn.00809b88
mov edx, 0xc41608b1
mov eax, 0xdaf94bf
mov eax, dword [ebp + eax*4 - 0x36be52fc]
lea ecx, [edx*4 + 0xe35ce2d]
add dx, cx
jno 0x7754e0
Function at 0x76bb85
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, 0x951192a1
not dword [esp + 3]
call fcn.007fced2
mov dword [esp], esi
mov esi, 0x5114a932
movzx esi, byte [esi + ecx - 0x5114a932]
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0x83ad70]
jmp 0x82d809
push 0xb902b0bb
shl dword [esp], 0xbb
shr eax, 8
xor eax, esi
inc ecx
push 0x87a578b4
jmp 0x73100d

Function at 0x76dd2e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, dword [ebp + ecx*2 - 0x1700994c]
mov dword [esp + ecx - 0xb804ca6], edx
xor eax, ebx
lea eax, [eax + ecx*2 + 0x8ac396a]
xadd cx, dx
not eax
sal cx, 0xa9
ror eax, 1
ror dword [esp + ecx - 0xb809800], 0x70
sal dl, 0x81
bswap eax
xor ebx, eax
sal edx, 0xf5
or edx, edx
adc edi, eax
lea ebp, [ecx + ebp - 0xb809802]
pop eax
cwd
cdq
movzx ecx, word [ebp + ecx*8 - 0x5c04c000]
bt edx, eax
sub eax, eax
xor cx, bx
neg cx
and eax, 0x90bebd0f
sbb cx, 0x4b6
ror cx, 1
sub cx, 0xf988
rol cx, 1
xor cx, dx
sal al, 4
sar eax, 0xf1
sbb cx, dx
cwd
shr edx, 0xc4
xchg edx, eax
xor bx, cx
btr edx, eax
neg dl
lea eax, [edx + edx + 0x35b1f88a]
lea esi, [edx + esi - 2]
cwd
add edx, 0x9a806004
mov word [esi + eax - 0x35b1f88a], cx
jp fcn.0073c645