joyce8/EMBER2024-capa huggingface dataset:
Function at 0x89559c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add edi, 4
mov dword [esp], 0x1423400b
xor edx, ebx
jmp 0x93ab38
ret
sub edx, 0xe0316237
call fcn.00dc6258
mov dword [edi + 8], 0
cmp cl, 0x2d
jmp 0x9717b0
mov dword [edi], eax
clc
jmp 0x99d511
add cl, 0xd3
cmc
clc
sub eax, 1
jmp 0xdddbd5
jb 0xdddbde
push esi
btc eax, edi
movzx esi, cl
setp al
shr al, 0x36
mov eax, 0x6c16c16d
sub dx, 0xe8a0
shr edx, 0xad
mul esi
mov eax, esi
sub eax, edx
cmc
adc si, 0xf538
shr eax, 1
add si, bx
sub si, bx
bt esi, edx
add eax, edx
cmovnp esi, esp
bsf edx, edi
shr eax, 5
bswap esi
cmc
movzx eax, al
test al, 0xa2
mov edx, eax
neg si
pop esi
test bp, 0x6e3e
jmp 0x95d797
sub eax, eax
jmp 0x8c58f9
jne 0x95d797
mov dword [edi + 8], edx
mov dword [edi + 4], 0
cmp cl, 9
jb 0xe18a8f
movzx edx, cl
inc eax
or ax, bp
shl eax, 0x15
mov eax, 0x38e38e39
mul edx
shr edx, 1
movzx eax, dl
shr edx, cl
mov edx, 0xaaaa33b2
bt dx, 0xa1
mov edx, eax
clc
stc
test edi, 0xae8e7c17
lea ecx, [ecx]
clc
add cl, 0xf7
test edi, 0xa5b50589
jmp 0xe0b41f
sub eax, 1
jmp 0xe18a84
jne 0xdddc1e
mov dword [edi + 4], edx
sar al, cl
movzx eax, cl
jmp 0x953d52

Function at 0x898b11
Capabilities:
Encode data using xor

Disassembly:
mov dword [ecx + ebp - 0x33082805], eax
ror dl, 0x84
mov eax, 0x202791a6
lea edi, [ecx + edi - 0x33082809]
shl byte [esp + eax*2 - 0x404f2344], 0x23
mov edx, dword [edi + ecx*2 - 0x6610500a]
or al, 1
fdiv qword [eax - 0x6b74dc41]
dec edi
imul byte [edi + 0x10c99ef]
adc byte [esp + ecx - 0x330827f6], 0xa7
or al, al
xor edx, ebx
dec al
shr eax, 0x46
not edx
ror edx, 3
sub cl, 0x96
setl al
lea edx, [eax + edx - 0x282634aa]
rol edx, 1
push ecx
xor ebx, edx
call fcn.00e06919
and dword [edx], 0x62d2c92
leave
insb byte es:[edi], dx
mov ah, 0x51
inc ebp
jp 0x898b2b
insb byte es:[edi], dx
mov ah, 0x51
jns 0x898b91
in eax, 0x6c
mov ah, 0x51
cmp eax, 0x156c154c
adc al, 0x30
push 8
in al, dx
fmul qword [ebp + eax*8 + 4]
mov bl, 0xc4
cmc
ret 0x66bd
inc esi
and al, 0x80
fidiv word [edx + 0x2a]
sub dh, ah
adc dh, ah
cmp ah, byte [edx - 0x70]
inc esp
adc eax, dword [edx]
xchg edx, eax
xlatb
sub edx, esi
mov dword [0xd3fd908f], eax
add al, byte [edx + eax*4 + 0x7c]
int1
cli
jmp 0x897998

Function at 0x89b305
Capabilities:
Encode data using base64

Disassembly:
sal edx, 0xf4
neg cl
not al
not cl
or edx, eax
neg cl
xor eax, 0x96087fa8
xadd eax, edx
xor bl, cl
mov dword [esp], edx
sal dl, 0xe2
cwde
mov word [ebp + eax*8 - 0x3fe62], cx
inc edx
lea ebp, [eax + ebp - 0x7fce]
pop ecx
pop ecx
jae fcn.0094787b
Function at 0x89b33c
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + ebx*2 - 0x77a]
xor ecx, ecx
movsx edx, cx
lea edi, [edi + ecx - 4]
mov dword [esp + ecx], edx
sub eax, edx
mov eax, dword [ecx + edi]
jne 0x8a3724
xor eax, ebx
lea eax, [eax + ecx*4 - 0x1fa89a32]
neg eax
or edx, ecx
push ecx
adc eax, 0xe517173d
ror eax, 3
rol dx, 0x85
call fcn.00d9234b
cmpsd dword [esi], dword es:[edi]
sahf
xchg ecx, eax
sub al, 0x17
push eax
xchg ebx, eax
sal byte [edi - 0x28e5c0af], 1
sal byte [edi - 0x309580af], 1
sal byte [edi - 0x7ca984af], 1
salc
fnsave dword [edx - 0x1279f3a6]
test dword [esi - 0x64bb6fd5], esp
lcall 0x80a3, 0x2cf023d8
std
add byte [edi], bl
cmp al, 0x97
add eax, 0xf7346e49
mov ecx, 0xb361d7c6
jbe 0x8a37fe
sal edx, cl
push esp
dec ebx
push ss
int3
inc esp
and eax, 0x29f375b0
rol esi, 0x1f
mov al, 0x35
xor eax, 0x8eb70f93
cmp bl, bh
mov gs, esp
mov ch, 0xe0
fbstp tbyte [ebx]
pop esi
adc byte [esi - 0x61], al
inc edi
je 0x8a3864
pushfd
add byte [esi + esi*8 - 0x252b55a0], bh
lcall 0x1809, 0x6262df46
xchg ebx, eax
rcl dl, cl
out 0xb2, eax
ret
test dword [edi + 0x5f6a244b], ebp
fcompi st(0)
enter 0xffffffffffffd442, 0x2b
jmp 0x66a87b56
Function at 0x89ece2
Capabilities:
Execute syscall

Disassembly:
push 0xaa8a030a
neg edx
shl dword [esp], 0x50
ja 0x9fa21b
cwd
inc esi
xor dword [esp + ecx - 0x5120586e], edx
inc ebp
xadd eax, ebp
pop esi
inc esp
xadd ch, cl
dec ebp
arpl dx, dx
dec ebp
add ebx, edx
dec ecx
shr ecx, 0x4a
inc ecx
shl al, 0x27
dec edx
lea eax, [esp + ecx - 0x14476e]
inc edx
add dl, byte [eax + ecx - 0x144816]
inc eax
movzx edi, ch
inc edi
inc dx
mov dword [ebx + ecx*4 - 0x512058], edx
inc esp
xadd ecx, eax
inc ecx
dec ch
inc ecx
movzx edx, ah
inc ecx
jmp ebx
not edx
adc edx, 0x7d2a9997
inc word [esp + 1]
neg edx
xor byte [esp + 2], 0x84
not dword [esp]
call fcn.008a456e
sysenter
call fcn.00d982ee
mov eax, 0xf10a095
mov ecx, eax
movzx dx, byte [eax + ebp - 0xf10a095]
ror ecx, 0x79
call fcn.008cbb1f
mov edx, 0xca31f11
movsx ecx, dl
dec cl
mov eax, dword [ebp + ecx - 0x10]
xchg ecx, edx
ror edx, cl
xchg dl, cl
mov edx, dword fs:[eax + edx*4 - 0x200044]
not cl
lea eax, [ecx + ecx*8 - 0xcd1c959]
or al, cl
mov dword [ebp + ecx - 0xca31fff], edx
push eax
adc eax, 0x2392e63e
bts ecx, ecx
mov eax, dword [ebp]
lea edx, [ecx + ecx*2 + 0xb892293]
mov dword [esp], ecx
lea ecx, [esp + 0x28]
push edx
mov dword [ecx], eax
movzx eax, word [edi - 2]
or dword [esp + 4], 0xb79930ad
sbb dword [esp + 4], edx
call fcn.00a07303
enter 0x5fbe, 0x79
ret 0x9e26

Function at 0x89ffcd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea ecx, [esp + edx - 0x4c]
bswap edx
btr edx, 0x3e
push eax
movzx ax, byte [ecx + eax*8 - 0x35000]
mov word [ebp - 2], ax
and edx, edx
or byte [esp + edx - 0x7fffffff], dh
push edx
movzx ecx, byte [edi - 5]
adc edi, 0xfffffffb
dec byte [esp + edx - 0x7ffffffe]
mov dword [esp + edx - 0x7ffffff8], 0xe8a2b7a5
inc word [esp + edx - 0x7ffffff8]
xor cl, bl
inc dword [esp + edx - 0x7ffffff5]
mov eax, 0x1c398639
cwd
add cl, 0xb3
push eax
xor cl, dl
ror eax, 0x81
neg cl
sal dword [esp + 6], 0xa4
lea edx, [eax + eax*2 - 0x747424fc]
rol cl, 1
bts edx, eax
cwde
sal word [esp + edx - 0x35e22456], 0xc7
sbb cl, 0x8a
add dl, al
xor cl, 0x34
bts eax, 0x85
and dl, 5
pop edx
rol cl, 1
rol eax, 0xf5
ror dx, 9
shr edx, 0x10
xor bl, cl
lea edx, [eax + eax*4 - 0x18ed746b]
or edx, 0xd1bab400
lea ecx, [esp + ecx + 0x10]
sal eax, 0x8c
movzx dx, byte [ecx]
movzx ecx, al
mov word [ebp + ecx - 4], dx
lea edx, [ecx*8 + 0x6804d88]
lea ebp, [ebp + ecx*2 - 4]
sub ecx, dword [esp + ecx + 7]
pop edx
pop ecx
pop eax
pop eax
jno fcn.0094787b
mov ecx, 0xef093d32
mov eax, dword [ebp]
btc ecx, 0x2e
bts cx, cx
movzx edx, cl
mov ecx, dword ss:[edx + eax - 0x36]
bswap edx
xor edx, 0x6254f3d
mov dword [edx + ebp - 0x30254f3d], ecx
mov eax, 0x299ae610
call fcn.0098502b
Function at 0x8a16b5
Capabilities:
Encode data using xor

Disassembly:
push edx
adc dword [esp], edx
xor eax, ebx
xor edx, 0x958e1dba
ror eax, 3
sar edx, 0xbd
mov dword [esp + edx*2 - 2], edx
movsx ecx, dx
bswap eax
pop edx
sbb dword [esp + ecx*2 - 6], 0x200d093a
not dword [esp + ecx - 3]
lea eax, [eax + edx - 0x2f57db9a]
add ecx, 0x702a16ae
not eax
lea edx, [edx*4 + 0x2230dc32]
xor ebx, eax
or ecx, 0x3698658c
adc esi, eax
or edx, 0xcca30d19
jae 0x993b27
mov ecx, 0xf994e431
mov cl, byte [ebp]
jmp 0x93a124
mov edx, 0x393e3aa2
movzx ax, byte [ebp + edx*2 - 0x727c7542]
lea ebp, [ebp + edx*2 - 0x727c7542]
call fcn.00a28c77
mov ecx, 0xea060b0b
shl cl, 0x81
lea edx, [ecx*8 - 0x6cc3a9cc]
mov edx, dword [ebp]
ror cl, 0x41
mov eax, 0x60ae0f3d
rol cx, cl
mov ecx, dword [ebp + eax - 0x60ae0f39]
lea eax, [eax + eax*8 + 0x1303888e]
adc edx, ecx
lea ecx, [eax + eax - 0x16740ccc]
lea ecx, [eax + ecx*4 + 0x3e0141ba]
mov dword [ecx + ebp - 0x2663add1], edx
mov eax, dword [ebp + ecx*2 - 0x4cc75ba6]
movsx edx, cl
mov edx, dword [eax + ecx*2 - 0x4cc75baa]
mov dword [ebp + ecx*2 - 0x4cc75ba6], edx
movsx edx, cl
lea ebp, [ebp + ecx*2 - 0x4cc75ba6]
rol dl, 7
shl cl, 0x62
jb 0x89e500
mov eax, dword [ebp + ecx - 0x76ba77b9]
xadd dword [esp + ecx - 0x76ba77bd], edx
or edx, edx
lea ecx, [esp + edx*2 - 0x401a1204]
sal edx, 4
xadd byte [esp + edx - 0xd0935f], dh
mov dword [ecx + edx - 0xd0e960], eax
movsx eax, byte [esp + edx - 0xd0e960]
mov eax, dword [edx + edi - 0xd0e968]
movsx ecx, word [esp + edx*8 - 0x6874b00]
lea edi, [edi + edx - 0xd0e968]
xchg word [esp + edx - 0xd0e95f], cx
xor eax, ebx
dec dl
not dx
or edx, dword [esp + edx - 0xd016a0]
xor eax, 0x80b96286
sal edx, 0xac
not eax
inc edx
xor eax, 0xed025280
add ch, ch
and dx, dx
add word [esp + ecx*4 - 0x301f0], dx
mov word [esp + ecx - 0xc07b], dx
bswap eax
push edx
dec edx
xor ebx, eax
mov dword [ebp + ecx*2 - 0x180f4], eax
call fcn.00987f3a
leave
daa
pop ecx
jns 0x993b93
inc eax
das
invalid

Function at 0x8a5d94
Capabilities:
Encode data using base64

Disassembly:
mov eax, ebp
jnp 0xda1ae8
mov dword [esp], 0xce8ede3f
call fcn.0088d211

Function at 0x8a6dc6
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop edx
not edi
dec eax
mov dword [esp + ebp - 0x63887aa7], esi
inc esp
xchg dl, ah
dec al
rol eax, 0x8d
xor dword [esp + ebp - 0x63887aa7], edi
inc ebp
movzx ecx, al
inc cx
shr esi, 0xa8
pop esi
inc ecx
btc esi, 0xa7
dec eax
sar edx, 0xe8
jnp 0x8b011f
dec eax
arpl di, di
dec esp
adc ebx, edi
cwde
dec ecx
neg ecx
sub edx, eax
inc cx
mov ebx, dword [esi + ebx - 0x638800fa]
dec ecx
sal ebp, 0x41
inc eax
movzx edi, ch
inc ecx
and edx, esp
jge fcn.00a14fd9

Function at 0x8a7320
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xfe38f495
mov dword [esp], ebx
mov ebx, 0xbfa158a2
rol ebx, 0xe3
movzx ebx, byte [edx]
call int.009819e3
Function at 0x8a733d
Capabilities:
Encode data using base64

Disassembly:
bswap eax
not eax
sar ecx, cl
dec eax
mov dword [esp + ecx*2], edx
sar ecx, 0xc9
xor eax, 0x6cb476b0
btc edx, edx
xor ebx, eax
or cl, 0x8a
adc esi, eax
dec word [esp + edx - 0x134f001d]
sub dl, ch
movzx eax, byte [edi + edx - 0x134f0024]
sbb edx, 0x88ba1abf
mov dword [esp + ecx - 0x88], ecx
jne 0xde30a7
neg al
jmp 0x9698eb
and byte [esp + ecx*2 - 0x113], dh
adc al, 0x37
xadd dx, cx
ror al, 1
pop edx
dec dl
add al, 0x33
btc ecx, edx
ror ecx, 0x6a
jae 0xdac092
xor bl, al
lea eax, [esp + eax + 4]
add cl, byte [eax + edx - 0x8a001d]
mov word [ebp + edx*8 - 0x45000ea], cx
movzx eax, word [esp + edx*2 - 0x114003a]
lea ebp, [ebp + edx*2 - 0x114003c]
add dword [esp + edx - 0x8a001d], eax
movsx ecx, byte [esp + edx*4 - 0x2280074]
sal eax, 2
pop ecx
ja fcn.00a28822
inc eax
rol ecx, cl
neg edx
not word [esp + edx - 0x62d6bde3]
ror eax, 1
pop edx
btr ecx, ecx
dec eax
bswap eax
ror cx, cl
xor ebx, eax
add esi, eax
jmp 0xa5f1f6
lea edi, [ecx + edi - 0x90]
and byte [esp + ecx - 0x86], ch
inc edx
btr dx, dx
xor al, bl
dec al
xchg dword [esp + ecx*2 - 0x110], edx
jmp 0x8a9968

Function at 0x8ab39d
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
lea ebp, [ebp + ebp*2 - 0x6e75a271]
push ebp
mov ebp, dword [esp + ebp - 0x32358dad]
call fcn.00d83be7
Function at 0x8ab3b5
Capabilities:
Encode data using base64

Disassembly:
not edx
lea ecx, [esp + ecx + 0xc]
shr byte [esp + eax - 0x761e0010], 0x41
mov dword [esp + eax - 0x761e0018], eax
mov dx, word [eax + ecx - 0x761e0018]
mov word [eax + ebp - 0x761e001a], dx
movsx edx, al
movsx ecx, byte [esp + edx - 0x12]
mov eax, dword [edi + eax - 0x761e001d]
xor eax, ebx
mov dword [esp + edx*2 - 0x2e], ecx
not eax
xadd byte [esp + edx - 0x11], dl
sub edx, edx
ror eax, 3
sar ecx, cl
seta cl
lea eax, [eax + edx - 0x27a596aa]
shr cx, 0x43
rol eax, 1
bswap edx
shr dword [esp + edx + 8], 0x89
xor ebx, eax
inc dword [esp + edx*8 + 5]
sar cx, 0x41
jle 0xa056ce
adc esi, eax
dec cx
or dword [esp + edx*4 + 6], ecx
mov ecx, dword [edi + edx*2 - 9]
or byte [esp + edx + 4], dh
bt dx, dx
adc dword [esp + edx*4 + 8], edx
xor ecx, ebx
lea eax, [edx*2 - 0x31566760]
bswap ecx
inc ecx
bswap ecx
inc dx
and word [esp + edx + 8], ax
not al
not ecx
shr byte [esp + edx*8 + 1], 0xc7
shl eax, 0xb1
xor ebx, ecx
pop eax
jmp 0x8dc3f8
neg eax
mov dword [ebp + edx*2 - 8], ecx
neg ax
jne 0xdba5ea
mov eax, 0x5020263d
mov edx, dword [ebp + eax - 0x5020263d]
lea ecx, [eax*4 + 0x55a1ae92]
jmp 0x9fea35
dec ebp
add esp, edx
inc esp
movzx ebp, di
dec esi
mov dword [ebx + ebp*2 - 0x19346], esp
inc ebp
mov edx, ebp
inc ebx
mov edi, dword [edi + ebp - 0xc9a7]
mov edx, 0x5ca50914
inc ecx
push eax
inc edx
inc byte [esp + ebp - 0xc9a7]
xor edi, esi
inc edx
dec byte [esp + ebp*2 - 0x1934b]
inc ebp
mov esi, eax
rol edi, 1
inc ebp
mov ecx, ebp
pop eax
inc edx
lea edi, [edi + ebp + 0x4cb6c612]
ror edi, 2
dec eax
neg edx
not edi
dec ecx
lea ecx, [ebp - 0x4ee4a8e2]
cdq
dec ecx
neg eax
push esi
dec ecx
shr ecx, cl
inc edx
xor dword [esp + ebp - 0xc9a7], edi
dec esp
btr edx, edx
dec ecx
ror esi, 0x3f
pop esi
add edx, 0x586daba
js 0xa474b3
dec eax
arpl di, di
inc ebp
xchg edx, ecx
dec esp
add ebx, edi
dec eax
or eax, 0x7bba698d
bswap ecx
inc edi
movzx esi, word [ebp + edi - 0xc9a3]
inc cl
dec eax
lea ebp, [ecx*2 - 0x25f545e4]
dec esi
lea ecx, [edx*4 - 0x53d4ebf1]
inc sp
xor esi, esi
inc cx
sub esi, 0x416686b2
or edx, 0x46550a34
movsx esp, word [esp + ebp - 0xc9a4]
inc cx
ror esi, 1
inc ecx
ror al, 2
inc esi
xadd dword [esp + ebp*2 - 0x1934a], ebp
inc bp
adc esi, ebp
cwde
inc cx
rol esi, 1
inc edx
and edx, dword [esp + ebp + 3]
jno 0x9bcc74
dec eax
not ecx
inc bp
sbb esi, ebp
inc cx
not esi
inc ecx
push esp
inc cx
neg esi
dec eax
cwde
shl ecx, cl
inc cx
xor esi, esi
inc edx
dec ebp
lea ecx, [esp + eax*4 + 0x351014b0]
inc edx
shl byte [esp + ebp*2 + 0xd], 6
dec esi
lea esi, [esp + esi + 0x10]
dec ebx
mov ebp, dword [esi + ebp*4 - 4]
inc si
xor dword [esp + ebp*2 + 8], ebp
jns 0xd6e727
lea ecx, [esp + eax - 0x50202635]
add ax, ax
sbb eax, 0xfc25df9a
call fcn.00a38420
xor ecx, ebx
call fcn.00dd37d9
dec esp
mov esp, dword [ebx]
inc ecx
mov eax, 0xe62570a4
dec ebx
lea edi, [eax + eax*2 + 0x5c3b77bb]
dec esp
mov edx, dword [ebx + 8]
jmp 0x963b71
mov ecx, dword [edx + edi - 0xe]
pop eax
or dword [esp + edx*4 - 4], edx
and al, 0xb0
lea edi, [edx + edi - 0xe]
xor ecx, ebx
not ax
xor ecx, 0xbda61605
sub eax, eax
ror ecx, 1
pop edx
call fcn.00a165b1
Function at 0x8ab5c9
Capabilities:
Encode data using base64

Disassembly:
xadd cl, dl
mov dx, word [edx + ebp - 0x264908f7]
call fcn.009c6454

Function at 0x8ab625
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop esi
inc ecx
pop ebp
jae fcn.00a14fd9
mov ecx, 0x1612cbbb
lea edi, [edi + ecx*2 - 0x2c25977a]
mov edx, dword [edi + ecx*2 - 0x2c259776]
xchg ch, cl
xor edx, ebx
dec cx
mov eax, 0x951d7f30
bswap edx
xor edx, 0xf529aea4
bts eax, eax
setb al
push eax
ror edx, 1
inc edx
add ecx, eax
lea eax, [ecx*8 + 0x78b6098c]
ror edx, 3
xadd dword [esp], eax
pop ecx
dec edx
sar al, cl
sub ecx, eax
not cx
xor ebx, edx
dec cx
dec cl
add esi, edx
sar cl, 0x26
sbb edi, 1
movzx edx, al
xadd ecx, edx
cwde
movzx edx, byte [edi + eax*2 - 0xfe00]
or eax, eax
bswap ecx
xor dl, bl
add dl, 0x20
shr cx, 0x8b
sets al
sbb ax, ax
rol dl, 1
add dl, 0xac
jmp 0x8d1711
bt cx, ax
add ax, 0x4d1a
rol dl, 1
bt ecx, 0x35
adc dl, 0x24
push ecx
add eax, ecx
adc cx, word [esp + ecx - 0x200006]
ror dl, 1
bt ecx, 0xaa
add eax, eax
xchg byte [esp + ecx - 0x200009], ch
xor bl, dl
rol dword [esp + ecx - 0x20000c], 0x3f
xchg word [esp + ecx - 0x20000b], ax
shl dword [esp + eax - section..text], 0xbe
lea edx, [esp + edx + 4]
mov eax, dword [ecx + edx - 0x20000c]
movzx edx, byte [esp + ecx - 0x20000c]
lea ebp, [ecx + ebp - 0x200010]
bt ecx, 0xae
not dword [esp + ecx*2 - 0x400018]
dec ecx
mov dword [ebp + ecx*2 - 0x400016], eax
mov byte [esp + ecx - 0x200008], 0x8c
or ecx, edx
bts edx, edx
pop ecx
jae fcn.00a28822
Function at 0x8b464b
Capabilities:
Encode data using base64

Disassembly:
push ecx
inc cx
ror eax, 1
sub dl, 0x22
xor eax, 0x7a13f794
mov dword [esp + 4], 0xc0d3ba8
sar dword [esp + 1], cl
or edx, 0xea954ab4
neg eax
lea eax, [eax + ecx - 0x680517d5]
add dword [esp + 3], edx
push edx
lea ecx, [edx*4 + 0x4390fc2e]
xor ebx, eax
inc dx
shr cl, 0xe1
dec edx
lea ebp, [ebp + ecx*2 - 0x6610500e]
jno 0x94746c
jmp 0x8d0c10
call fcn.00898b11
mov eax, 0x6513b018
inc eax
mov ecx, dword [ebp + eax - 0x6513b019]
jg 0xa0dc04
movsx edx, ax
inc dx
lea ebp, [eax + ebp - 0x6513b015]
jns 0x9b813c
mov edx, 0xa8883a83
sub edi, 4
jmp 0xdac0f1
mov eax, dword [edi]
shr edx, 0xdf
xor eax, ebx
or edx, edx
xor eax, 0x45aaec19
sub eax, edx
movsx ecx, dl
shl ecx, cl
cmovs ecx, edx
neg eax
xor ecx, ecx
call fcn.0089a804

Function at 0x8b5ca4
Capabilities:
Encode data using base64

Disassembly:
dec ebx
jmp 0xa09a92
jmp 0x9d9a6f

Function at 0x8b9af8
Capabilities:
Encode data using base64

Disassembly:
neg eax
neg dl
not edx
xor eax, 0xf9a3694
not dx
sal cx, 0xc8
add edx, edx
lea eax, [edx + eax + 0x332b5318]
inc edx
xchg dh, cl
not eax
shl edx, cl
adc cx, 0x5fbc
setg dl
rol eax, 1
xor ebx, eax
lea edx, [edx + ecx - 0x30c2d9c4]
dec edx
bts dx, dx
adc esi, eax
shr ecx, 0xb8
call fcn.00d96c40
inc ecx
mov ecx, dword [edi]
dec eax
mov dword [esp], 0x2f30549e
inc ecx
mov edx, 0x789e4788
xor ecx, esi
inc ebp
movzx ebp, dl
xor ecx, 0x8966b93
inc esi
sub byte [esp + ebp - 0x86], dl
inc edx
lea ecx, [ecx + edx + 0x1fe633b2]
not ecx
xor ecx, 0xcbba8da6
pop edx
neg ecx
inc ecx
push ebp
inc esi
sub dword [esp + ebp*2 - 0x10e], edx
inc esi
movsx esp, word [esp + ebp*8 - 0x43e]
inc edx
lea ecx, [ecx + ebp - 0xd99bd95]
ror ecx, 2
inc edx
or dword [esp + edx - 0x789e4788], 0x9e230f88
dec edx
mov dword [esp + edx - 0x789e4788], esi
inc ecx
adc ch, 0x98
xor dword [esp + edx*2 - 0x5f50a93c], ecx
pop esi
inc esp
mov ecx, edx
dec eax
arpl cx, cx
dec edi
lea eax, [esp + ecx*4 - 0x38ec33fb]
dec ecx
shl ecx, 0x6e
dec esp
adc ebx, ecx
inc ebp
xchg eax, ecx
inc ecx
dec ah
mov ecx, edx
dec ecx
mov edi, dword [edx + ebx - 0x789e4788]
inc cx
btr esp, 0x2b
inc ebp
or eax, dword [ebp + edi - 0x20]
call fcn.00d90a8e
mov eax, dword [edi]
add edi, 4
mov edx, 0xd10ccd85
movsx ecx, dx
not ecx
xor eax, ebx
xor cx, cx
shl ecx, 0xf0
je 0x894e40
les edi, [esi + 0x42]
and ebp, eax
jns 0x8b9c49
inc ecx
add cl, cl
pop ss
xchg edx, eax
popfd
fadd dword [ebx]
invalid
jns 0x8b9bd7
inc edi
sbb byte [eax + 0x7a049cf7], 0x8c
invalid

Function at 0x8b9c27
Capabilities:
Encode data using base64

Disassembly:
push 0x3eb5b539
mov dword [ebp], edx
mov dword [ebp + 4], eax
mov eax, 0x7db8738b
lea edi, [edi + eax - 0x7db8738f]
mov edx, dword [edi + eax - 0x7db8738b]
mov dword [esp + eax - 0x7db87387], eax
cwde
neg dword [esp + eax - 0x7386]
xor edx, ebx
shl eax, 0xb6
inc edx
cwde
ror edx, 1
xor eax, eax
sub eax, eax
and dword [esp + eax*4 + 5], eax
bswap edx
inc edx
neg eax
rol word [esp + eax], 0xea
add eax, eax
xor ebx, edx
add esi, edx
sar byte [esp + eax*2 + 1], 0xa6
jb 0x9e2b79
Function at 0x8bd3d1
Capabilities:
Encode data using base64

Disassembly:
xchg byte [esp + ecx - 0x1ffffffb], dl
neg edx
xor ebx, eax
sal cl, 0x81
xchg word [esp + ecx*2 - 0x3ffffffb], dx
push edx
adc esi, eax
bswap ecx
movzx eax, byte [ecx + edi - 0x26]
or cx, 0xc18e
inc cl
lea edi, [edi + ecx*8 - 0x60d7e]
ror ecx, 0x2e
shr dx, 0x4e
pop ecx
xor al, bl
shr cx, 0x85
adc al, 0x1f
rol al, 1
neg cl
adc al, 0xab
neg edx
xchg dword [esp + ecx - 0xf5], edx
xor dx, dx
rol al, 1
add ecx, 0xc521a093
jb 0x97395d
rol dx, cl
adc al, 0x25
shl dword [esp + 4], 0xdf
push edx
bswap edx
ror al, 1
btc dx, cx
xor dl, dh
not dx
xor bl, al
mov dword [esp + edx - 0xef03], ecx
not edx
sub ecx, 0x2c2bf5b5
lea eax, [esp + eax + 0xc]
add word [esp + 6], 0xb303
or edx, dword [esp + 8]
mov edx, dword [eax]
movsx eax, cl
xadd dword [esp + 8], ecx
mov dword [ebp + ecx], edx
inc ecx
shr cl, cl
mov dword [esp + ecx], esi
ret 8
ror edx, 0x29
mov edx, dword [ecx + edx - 0x44725b88]
sbb ebp, 4
mov dword [ebp], edx
mov ecx, 0xa33100a8
mov edx, eax
push eax
mov eax, dword [edi]
dec dx
rol edx, 0xb8
ja 0x9f7527
inc ecx
mov ecx, 0x6d34e62a
inc edi
movzx edx, word [edi + ecx - 0x6d34e62a]
inc ecx
inc cl
dec edi
lea edi, [ecx + edi - 0x6d34e629]
inc sp
xor edx, esi
inc cx
add edx, 0x41668538
xor edx, 0x4166c610
inc edx
inc ecx
mov esi, 0x76a3a426
inc cx
xor edx, 0x8b4583bb
loope 0x973a07
movzx eax, cl
call fcn.009a5449
and al, 0xe0
mov ecx, 0x4166ca5c
lea edi, [edx + edi - 0x50a7739a]
xor eax, ebx
add word [esp + edx - 0x50a7739d], 0x5098
xor eax, 0xe5281293
shr dl, 0xc2
rol eax, 1
lea eax, [eax + ecx - 0x7b2bfeed]
bswap eax
sar cx, cl
setns byte [esp + edx - 0x50a77326]
dec edx
xor ebx, eax
shl dword [esp + edx - 0x50a77326], 0xb2
jb 0x969b71
or ecx, 0xf925028c
adc esi, eax
call fcn.00a52c6b

Function at 0x8db540
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
mov dword [esp + eax - 0x24ce4ab], 0xe2b1f59b
xor ebx, edx
neg ax
sar eax, 0x21
add esi, edx
cdq
mov ecx, dword [eax + ebp - 0x1260da8]
cwde
movzx eax, byte [eax + edi - 0xda6]
shr edx, 0x4a
xor al, bl
btr edx, edx
ror edx, 0x98
mov dword [esp + edx*2 + 4], edx
ror al, 1
rol word [esp + edx*8 + 6], 0xae
adc al, 0x1e
not edx
rol al, 1
add al, dl
not dl
pop edx
dec edx
not al
shr dx, 0xa8
xor bl, al
lea eax, [esp + eax + 4]
mov dword [eax], ecx
call fcn.00956708

Function at 0x9384a0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp]
mov eax, dword [ebp + 4]
mov dword [esp], 0x1d845a0f
push 0xda068b2e
sub dword [esp + 3], 0x739ba009
mul ecx
mov dword [esp + 8], 0xe68bc98e
mov ecx, dword [esp + 6]
mov dword [ebp], edx
add byte [esp + 5], ch
pop ecx
neg byte [esp]
mov dword [ebp + 4], eax
mov edx, 0xa915c22b
mov eax, dword [edi]
dec byte [esp + 4]
xor dl, ch
adc edi, 4
xor eax, ebx
jmp 0xda2eb3

Function at 0x93b409
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + 8]
mov dword [esp + 8], 0xddc90899
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.00da2058
Function at 0x93d2fb
Capabilities:
Encode data using base64

Disassembly:
dec ebp
mov ecx, dword [ebp + ebx - 0x28f31dbb]
dec edx
lea ebx, [ebx + ebp - 0x28f31db3]
dec esi
mov dword [esp + ebp - 0x28f31dbb], ecx
inc ecx
xor esp, 0xee1a3809
inc ecx
xor ch, 0xbb
inc ecx
not dl
popfd
call fcn.009a8ffa

Function at 0x93d694
Capabilities:
Encode data using base64

Disassembly:
xor edx, edx
adc dx, word [edx + ecx]
mov ecx, eax
jmp 0x8a5da9
lea ecx, [eax + ecx + 0x392a42ba]
jae 0x9e3252
call fcn.00946c4a
sub edi, 4
call fcn.00de50a3
shl al, 0x21
mov word [ebp + eax*4 - 0x704e3e72], dx
mov eax, dword [edi + eax - 0x1c138fa1]
lea edx, [ecx + ecx*8 - 0x205a324d]
jg 0x9cb3a2
bt ecx, ecx
lea edi, [edi + ecx*2 - 0x38271fa1]
xor eax, ebx
push edx
push edx
bswap eax
add ecx, 0xf48ef608
rol edx, 0x77
dec eax
pop ecx
sal ecx, 0x86
xor eax, 0x532d62b7
jmp 0x9cfa06
lea edx, [esp + edx + 0xc]
mov cx, word [eax + edx]
lea ebp, [eax + ebp - 2]
sar ax, 0xe3
mov dword [esp + eax], 0x6c86f42b
not al
mov word [ebp + eax*2 - 0x1fe], cx
neg eax
sar al, 0x26
pop eax
pop edx
pop eax
jns fcn.0094787b
jmp 0xdf1826
rol cx, cl
xor ebx, edx
sar ecx, 4
xor ax, cx
adc esi, edx
sar eax, 0x22
jnp fcn.008e0841
cdq
xor ecx, 0xaf366fa2
not ecx
push edx
shr eax, 0x81
xor ebx, ecx
shr dx, 3
adc esi, ecx
xor al, byte [ebp + eax - 0x2bc00000]
sub word [esp + edx*4 + 2], 0xd43a
jbe 0xda4a3a
mov ecx, 0x51aad429
bt cx, cx
movzx ecx, byte [edi + ecx - 0x51aad42a]
mov edx, 0x99928e09
xchg dh, dl
mov eax, edx
xor cl, bl
lea edx, [edx*8 - 0x74ef86e9]
ror cl, 1
bswap eax
sub cl, 0x1e
sub ax, 0x8eb9
bt eax, edx
neg cl
inc cl
or ax, dx
adc eax, eax
sar edx, 0x1a
ror cl, 1
shl edx, 0xff
dec cl
neg cl
xor bl, cl
add ecx, esp
jmp 0x89622d
push edx
mov cl, byte [edx + ebp + 2]
inc dx
lea ebp, [ebp + edx*2]
sal al, cl
movsx ecx, dl
neg ecx
mov word [ebp + edx*8 - 8], ax
or dword [esp + edx*2 - 2], esi
ret 4
mov eax, 0xb2088ab
lea ecx, [eax*8 + 0x699f9e9d]
mov ecx, dword [edi + eax*2 - 0x16411156]
movzx edx, al
shl al, 0xe5
ror eax, 0xf
lea edi, [edi + eax - 0x10c0163d]
sar ax, 0xea
xor eax, edx
bswap edx
xor ecx, ebx
sal dl, 0x82
inc eax
sal eax, 0xf7
not ecx
btc eax, edx
jae 0x8a36d3

Function at 0x93e521
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, ax
mov word [ecx + ebp - 0x69a6], dx
mov edx, dword [ecx + edi - 0x69a6]
bts ecx, ecx
push ecx
mov byte [esp + ecx*2 - 0xd3ca], cl
lea edi, [ecx + edi - 0x69e2]
mov dword [esp + ecx - 0x69e2], 0x1dadd70b
sub dword [esp + ecx - 0x69e2], eax
xor edx, ebx
pop eax
neg word [esp + eax - 0xe669e6]
inc edx
xor edx, 0x7302042d
shl cl, 0x82
push eax
setp cl
inc edx
shr eax, 0x5a
rol edx, 1
call fcn.00d9e8f8

Function at 0x9503c3
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
je 0x8d7857
mov eax, dword [ebp + ebx*4]
push 0xbb029295
push 0xee21e597
mov dword [esp + 4], eax
dec ebx
push 0x78aac182
lea esp, [esp + 8]
jne 0x8d7835
call fcn.00964c34
not dword [esp + 4]
mov dword [esp + 8], 0xc028c41f
test ebx, ebx
jmp 0x8d782b