joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79a8a6
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
neg esi
bts ebx, 0x91
inc ecx
rol ebp, 0x5a
dec esi
mov dword [esp + ecx - 0x1d], esp
cwde
inc dx
imul ebp, dword [esp + ecx*2 - 0x4a]
inc edx
xor dword [esp + ecx - 0x1d], esi
dec esp
lea eax, [eax + ecx*2 - 0xa686f5f]
call fcn.008c5348
mov ecx, dword [edi]
mov eax, 0x38af5f88
mov eax, dword [edi + eax - 0x38af5f84]
add edi, 4
mov edx, 0x30950725
sar dx, 0x61
and ecx, eax
movsx eax, dx
call fcn.00993935
mov eax, 0x96b7f398
movsx edx, ax
bt eax, eax
mov eax, dword [edi]
call fcn.00842abb
dec eax
mov dword [esp + ebx*2 - 0x106], ebx
xor dword [esp + ebx*2 - 0xfe], ebp
dec esp
mov esp, dword [esp + ebx - 0x7b]
dec eax
arpl bp, bp
dec eax
sar edx, 0x43
jae 0xa44848
mov ecx, 0x6bb321a0
lea ebp, [ebp + ecx - 0x6bb321a4]
mov ecx, dword [ebp + ecx - 0x6bb321a0]
mov edx, 0x6f911c36
btc edx, edx
push edx
xor ecx, ebx
inc ecx
xadd dword [esp + edx - 0x6fd11c36], edx
not ecx
ror ecx, 2
or byte [esp + edx - 0x6fd11c34], 0xbc
sbb dx, word [esp + edx - 0x6fd11c36]
xor ecx, 0x623cab2d
xor dx, 0x653c
xor ebx, ecx
call fcn.00a461df
mov cl, byte [esi + 2]
mov edx, 0x422a587
sbb dx, word [esp + edx - 0x422a583]
sal dl, 0xc7
lea esi, [esi + edx - 0x422f8fe]
or dx, word [esp + edx - 0x422f8fe]
sal al, cl
ror dx, 0x61
lea edx, [edx + edx*8 - 0x30ee2df9]
mov word [esi], ax
movzx eax, dx
mov ecx, dword [edi + eax - 0xcff4]
sub dl, byte [esp + eax - 0xcff0]
and edx, edx
shl al, 1
lea edi, [edi + eax - 0xcfe4]
neg dword [esp + eax - 0xcfe7]
xor ecx, ebx
dec edx
setl dl
ror ecx, 3
add dword [esp + eax*8 - 0x67f3d], eax
sar dl, 0x24
lea ecx, [eax + ecx + 0x470966b9]
add word [esp + eax - 0xcfe3], 0x3196
rol ecx, 1
mul word [esp + eax - 0xcfe4]
jae 0x9cc08d
pop eax
adc ecx, 0x1d896736
call fcn.009cc2fd
xor edx, ebx
imul eax, ecx
sal ecx, cl
xchg ecx, eax
not edx
add cx, 0x2e19
sbb cx, cx
xor edx, 0x7ba8b301
shl al, 0x64
jns 0x71bd9b
fiadd dword gs:[ecx + 0x4f]
mov eax, 0xcbefca48
mov al, 0xcf
aad 0x38
cmp ebp, dword ss:[esi - 0x27]
mov ch, 0x54
cmp ebp, dword ss:[esi - 0x17]
ror dword [eax], 0x36
cmp ebp, dword [esi - 0xf]
in eax, dx
and esp, dword [esi + 0x13]
aas
invalid
dec esp
adc ebx, ebp
dec eax
xadd dword [esp + ebx*2 - 0x106], edx
dec eax
mov dword [esp + ebx - 0x7b], 0x8284431c
inc ebp
imul edi, ebp
mov esi, dword [ebx + edi - 0x7f]
inc ebp
xor cl, cl
inc esp
mov esi, dword [edi + ebx - 0x7b]
inc ebp
and bh, bh
jo 0x72e5fb
dec eax
xor dword [esp + ebx*2 - 0xfe], ebx
not esi
inc ecx
mov ebp, edi
inc esp
xor byte [esp + ebx*2 - 0xf8], bh
inc ecx
not esi
dec esp
or dword [esp + ebx*2 - 0x100], ebp
inc ecx
or esi, esi
call fcn.00a057e0
push 0xb6315786
push 0x178b820b
movzx ax, byte [esi]
ror dword [esp + 4], 0x61
jae 0x8970e4
neg edx
push ecx
cwde
dec edx
lea ecx, [eax + eax*8 - 0x5560b6d0]
rol cl, 0xa4
neg edx
or cx, ax
or ecx, dword [esp + eax - 0x1e17]
bswap edx
xor ebx, edx
bt ax, ax
add edi, edx
movsx edx, byte [esp + eax - 0x1e19]
ror ecx, 0x99
ror dword [esp + eax*2 - 0x3c2f], 0x59
mov dword [esp + eax*8 - 0xf0c8], edi
ret 4
Function at 0x79d3df
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sar dword [esp + 4], 0x28
test edx, edx
jmp 0x898f8e
jmp 0x782c03
lea esp, [esp + 8]
je 0x72dc55
jmp 0x8188f3

Function at 0x7a144a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add esi, 4
rol al, 0xc1
add edx, ecx
lea ecx, [eax + eax*2 + 0x30948080]
lea eax, [ecx + 0x4c9d2823]
mov dword [ecx + esi - 0x3094806b], edx
ror ecx, 0x8f
jae 0x7c1652
add ebp, edx
dec cx
dec cx
cmovne ax, word [esp + 8]
mov cx, word [edi]
add edi, 2
movzx eax, byte [esi]
mov edx, 0x9a1dc195
sal edx, 0x13
bswap edx
lea esi, [esi + edx*4 - 0x2a02f]
shl edx, 0xea
neg dx
not edx
xor al, bl
ror dl, 0x61
sub al, dl
inc dl
mov dword [esp], edx
neg al
or edx, edx
btr dx, dx
setb dl
sbb al, 0x1c
sal byte [esp + 6], 5
sar dword [esp + 2], 9
shr edx, 0x68
neg al
xor bl, al
neg edx
neg byte [esp + 1]
sbb dx, dx
lea eax, [esp + eax + 0xc]
adc dx, dx
mov word [eax], cx
movzx ecx, byte [esp + 2]
ja 0xa38d60
js 0x92cd25
dec ecx
dec edx
xor ecx, 0x9f96bd99
neg edx
bt edx, eax
xor ebx, ecx
push eax
pop eax
xchg edx, eax
add ebp, ecx
lea ecx, [eax + edx*2 + 0x16a57193]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
jmp 0x75031f
jmp ebp
mov dword [esp + ecx*4 - 0x3f8], ebp
ret 8
mov dword fs:[ecx + eax*2 - 0x5e853002], edx
lea edx, [eax + eax - 0x13e6cf6c]
Function at 0x7a67e7
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
sub dx, dx
not edx
mov word [ebp + 2], ax
mov dword [esp], edx
mov ecx, edx
pop eax
mov edx, dword [esi - 4]
sbb ecx, eax
xor edx, ebx
inc cl
jns 0x9fa91a
inc ecx
mov edi, 0x5dbfd81f
call fcn.007df655
push 0xa90d7bb0
xor ecx, ebx
call fcn.00933cbd
rol edx, 1
add cl, 0xa2
neg edx
bswap eax
not edx
push eax
lea edx, [edx + eax - 0x209610ab]
not edx
add eax, 0xba1f9e28
inc dword [esp]
ror ecx, cl
xor ebx, edx
add esi, edx
cdq
push eax
idiv dword [esp + 3]
pop eax
pop ecx
jmp esi

Function at 0x7aa004
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 0x18]
jne 0x76bb89
mov esi, 0x2084f921
mov edx, esi
mov ecx, esi
pop esi
mov edx, 0xce974918
not eax
lea ecx, [edx + edx*4 - 0x6d4560e9]
mov dword [ebp], eax
jmp 0x9bfb4a
or dl, cl
jmp edi

Function at 0x7aa756
Capabilities:
Authenticate hmac

Disassembly:
movzx edx, cx
mov dword [ecx + ebp - 0x1290dc00], eax
bts edx, edx
lea eax, [edx + ecx - 0x60d06cc3]
mov edx, dword [esi + ecx*4 - 0x4a437000]
lea esi, [ecx + esi - 0x1290dbfc]
or al, al
rol al, 0xe7
add cx, cx
xor edx, ebx
dec edx
bswap edx
bswap ecx
cbw
inc ecx
not edx
cbw
inc al
bt eax, ecx
bswap edx
sbb ecx, ecx
dec ecx
ror eax, cl
xor ebx, edx
not cl
sub ecx, eax
lea eax, [eax*8 - 0x655575dc]
adc edi, edx
jmp edi
movzx eax, cl
or al, cl
bswap edx
jbe 0xa2d182
xor edx, 0xc07afae
neg eax
or ax, 0x26ba
rol eax, 0xd3
ror edx, 3
btc ecx, 0x9f
sub edx, eax
sal cl, cl
jg 0x9d0601
sub ebp, 1
movzx eax, byte [ebp]
mov ecx, 0x2828912
xor al, bl
bts cx, 0xb6
sbb al, 0x29
rol cx, 3
rol al, 1
jmp 0x8d7382
mov dword [esp + 4], 0x5921961d
jmp 0x976494
movzx edi, byte [edx]
push 0x23b8d430
xor edi, eax
and edi, 0xff
jmp 0x8c896f
rol byte [esp], 0xe5
mov edi, dword [edi*4 + 0x964b28]
jae 0x8c919d
sub ebp, 4
mov ecx, 0x6cb37296
mov edx, ecx
mov edx, dword [ecx + ebp - 0x6cb37296]
neg ecx
xor edx, ebx
sub cl, 0x13
setne cl
ror edx, 3
jmp 0x753621
shr eax, 8
neg byte [esp + 1]
call fcn.00ca420d
jmp 0xcc0496
lea esp, [esp + 0xc]
jne 0x7e7243
mov edx, 0x4a0a4434
mov edi, edx
pop edi
mov ecx, 0x1290da37
not eax
sal cx, 0x6a
ja 0x7252b8
xor edx, 0x96b5d597
shr ecx, cl
xor ebx, edx
or eax, ecx
adc esi, edx
mov edx, dword [ecx + edi - 0x4d32340]
lea ecx, [eax + ecx*8 + 0x3baccd0a]
lea edi, [edi + ecx - 0x6245e705]
shr ecx, cl
not ecx
cwde
push edx
popfd
shl ax, 0xc7
lea edx, [eax*8 - 0x31def542]
xadd eax, ecx
jmp esi
btr ecx, 0xb2
bswap edx
push eax
neg edx
cbw
push eax
rol edx, 2
dec ecx
shl ecx, 0x11
xor ebx, edx
add ebp, edx
mov dword [esp + eax*4 - 0x3fffc], ebp
ret 0xc
movzx edx, cx
neg al
xor al, 0xad
bts edx, ecx
call fcn.00a35e63
invalid
Function at 0x7afa3b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov cl, byte [edi + ecx - 0x7dd2]
call fcn.009244b0
mov cx, word [esi]
mov eax, 0x1a898ea4
cwde
mov ax, word [esi + 2]
add esi, 2
mov edx, 0xaebdef2b
xor dl, 8
adc cx, ax
mov word [esi], cx
inc dl
sub ebp, 4
lea eax, [edx + edx*4 + 0x54b30c88]
mov ecx, dword [ebp]
xor ecx, ebx
bswap eax
rol ax, 0xcd
jb 0x8bab2a
mov eax, 0xef33043e
sub edi, 4
movsx edx, ax
movsx ecx, ax
dec cx
mov edx, dword [edi + edx - 0x43e]
or ecx, 0x8e33de1a
adc ax, ax
sbb ecx, ecx
xor edx, ebx
cwde
not edx
shl al, 0x41
call fcn.00829895
mov edx, 0xa9287c3a
rdtsc
mov ecx, 0xcc9c9738
sub edi, 8
xadd cl, ch
mov dword [edi + 4], eax
shl ecx, cl
mov dword [edi + ecx*4 - 0x719e0000], edx
mov edx, dword [ecx + esi - 0x1c678000]
lea ecx, [ecx + ecx*4 - 0x37ed8c5c]
or cl, 0xa4
lea esi, [ecx + esi - 0x5617f3a0]
movzx eax, cl
sub ax, ax
and ax, ax
xor edx, ebx
inc edx
dec al
xor edx, 0x401b6e3e
btr eax, ecx
cbw
idiv cl
bswap edx
btc ecx, eax
jb 0x7f606a
sbb edx, 0xa197cd1e
and ecx, 0x56acb599
inc cl
bswap edx
dec edx
shr ecx, 0xcf
and ecx, 0x5a8f2aac
push eax
rol edx, 2
xor ebx, edx
lea ecx, [eax + eax + 0x6598a920]
ror dword [esp + eax*4 - 0x3bc00], 0x9b
jb 0x89ef6f
adc ebp, edx
rol byte [esp + eax - 0xeeff], 0x22
pop eax
jb fcn.008360bb
xadd ax, cx
btr ax, ax
xor ebx, edx
and al, cl
sbb ax, ax
adc esi, edx
sal cx, 0xd
or eax, dword [edi + ecx]
movzx edx, cx
rol edx, 0x91
adc dx, word [edi + ecx + 4]
and cx, cx
lea edi, [edi + ecx*4 + 6]
sar cx, 0x83
mov word [eax + ecx*8], dx
movsx eax, cl
sal ecx, 0x39
xor ecx, esi
jmp ecx
adc ebp, edx
cdq
pop ecx
pop eax
pop edx
pop edx
jmp fcn.008ca50c
rol ecx, 2
and al, 0x2c
jl 0x9157d7
dec ecx
cdq
neg ax
or dx, ax
not ecx
sar edx, 0x37
and eax, edx
shl edx, 0x21
xor ecx, 0xd721e735
mul al
call fcn.00821436

Function at 0x7b002a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sal ecx, cl
xor edx, 0x57114c88
pop ecx
mov ecx, eax
add edx, 0xac8b4e28
cbw
sar ecx, cl
btc ecx, 0x20
xor edx, 0x2b1ec02b
xadd byte [esp + eax - 0x10001], ch
neg cl
rol word [esp + eax - 0x10002], 0xcb
xor ebx, edx
add esi, edx
shr word [esp + eax - 0x10003], 0x6b
movzx edx, byte [ebp + eax*8 - 0x80025]
sar cx, 0x24
lea ebp, [ebp + eax*4 - 0x40015]
and ecx, 0xb1950134
xor dl, bl
lea eax, [ecx*4 + 0x1a3c1e1f]
add dl, 0x17
xor dl, 0x36
sub cl, 6
dec dl
not word [esp + eax - 0x1a3c1eae]
call fcn.0097a4c2
mov ecx, dword [edi + edx - 0x144eec46]
cwde
ror eax, 0x77
shl al, 0x86
lea edi, [edi + edx - 0x144eec42]
xor edx, edx
xor ecx, ebx
and dl, dl
not ax
dec ecx
idiv ax
bswap ecx
bswap eax
xchg dl, al
sar edx, 1
neg ecx
div eax
bswap ecx
cdq
xor ebx, ecx
add ebp, ecx
sal dl, 4
jp fcn.007194ad
Function at 0x7b1cf4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
dec dl
shr dword [esp + eax], cl
ja 0x782d1b
shr al, 0x65
not dl
xor bl, dl
lea edx, [esp + edx + 4]
call fcn.00cc2490
lea ecx, [esp + ecx + 4]
cmovbe edx, esi
ror esi, 0xa4
xadd esi, edx
mov eax, dword [ecx + edx*2 - 0x1dbc0]
jo 0x787479
movzx ecx, si
mov dword [esp + edx - 0xede0], 0x36aaa214
mov dword [ebp + edx - 0xede4], eax
jle 0x7bae71
pop ecx
shr ecx, 0x89
mov eax, dword [ebp + edx*8 - 0x76f04]
sub ecx, edx
xchg ebp, eax
btc si, 0x96
xchg edx, ecx
mov esi, eax
movsx eax, dl
or cl, 0xa5
jl 0xcc501e
shl al, 0x63
xor ebx, ecx
add al, 0x21
mul eax
adc esi, ecx
cwd
rol al, 0x27
ror dx, 0xc6
mov ecx, dword [ebp + edx*2]
div eax
xor edx, dword [edx + ebp + 4]
xor eax, eax
shl eax, 0xa7
lea ebp, [ebp + eax*4 + 4]
adc ecx, edx
mov dword [ebp + eax*2], ecx
push eax
movsx ecx, al
xor dword [esp + eax], esi
ret

Function at 0x7b42ff
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push edx
mov cx, word [edi + edx - 8]
mov dword [esp + eax - 0xf781eb8], 0x8c9db686
jmp 0x8a287b
push edx
lea edi, [edi + edx - 6]
shl dl, 0xa7
rol eax, 0xcb
lea ebp, [edx + ebp - 1]
sets byte [esp + edx + 8]
bt eax, 0x3c
adc dl, byte [edx + ebp]
not ax
xor dword [esp + 0xa], eax
jno 0x932101
xor dl, bl
rol dword [esp + 1], 0x68
bt eax, 0x81
neg dl
inc dl
sar eax, 0x5d
jnp 0xcadb3b
btr ax, ax
not dl
bts eax, 0x28
xor ax, word [esp + 0xe]
dec eax
rol dl, 1
not eax
inc dl
and ax, word [esp + eax - 0x2ff7]
adc word [esp + eax*8 - 0x18009], 0x69f
ror dl, 1
add ax, ax
inc byte [esp + eax - 0x6002]
not dl

Function at 0x7b7244
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
push 0x304e0f
call fcn.0092199e

Function at 0x7b724e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
btr eax, eax
sbb ebp, 3
sub ecx, eax
inc ecx
mov dword [ebp + eax - 0x7fffffff], edx
dec cl
lea edx, [ecx + eax*4 - 0x8e167e4]
jno fcn.0098b9e9
ror edx, 0x4e
adc edi, eax
movzx eax, dx
lea esi, [esi + edx - 4]
bswap ecx
shl al, 0xa2
mov dword [esp + eax], eax
xor edx, dword [esi + edx]
shr al, 6
shr cx, cl
or ecx, 0x2a59e21
xor edx, ebx
dec ecx
rol edx, 1
dec cl
pop eax
sub edx, 0xc3351f35
neg edx
dec edx
ror al, 0x21
cbw
dec eax
neg edx
xor ebx, edx
sar eax, 0x4b
jb 0x789d47
xor ebx, edx
push 0xcf2b008d
ror dword [esp], 0x13
jae 0x9744ed
add esi, 4
call fcn.008c14fb
bswap eax
shr dx, 0xee
call fcn.009d56da
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x97a5ec]
neg dword [esp]
shr edx, 8
inc dword [esp]
call fcn.00770c3f
Function at 0x7b7f60
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
call fcn.00a0b6e6
test ebx, ebx
jmp 0x97ef2d
call fcn.0094341b

Function at 0x7bb7a5
Capabilities:
Encode data using xor

Disassembly:
call fcn.00929473
call fcn.0079c424
call [esi + 0x9a01101]
leave
fcom qword [esi]
add al, ch
jne 0x7bb7b9
invalid
cmp ch, byte [ecx]
lcall 0x1a83, 0x4af37ac8
enter 0xfffffffffffff37a, 0xffffffffffffffce
enter 0xfffffffffffff37a, 0x4a
dec edx
sbb dword [edx], 0xffffffc8
jp 0x7bb7b5
into
xor dword [edx], 0xffffffc8
jp 0x7bb7bb
fidiv dword [ebx]
mov byte [0x6ef37ac8], al
rep outsb dx, byte [esi]
jnp 0x7bb7ab
enter 0xfffffffffffff37a, 0x6a
rcr dword [edx - 0x38], cl
jp 0x7bb7cd
push 0xffffffffffffffd3
pop edx
enter 0xfffffffffffff37a, 0xfffffffffffffff6
fbstp tbyte [edx - 0x38]
neg bh
jb 0x7bb7a6
jp 0x7bb7d3
pop ebp
fistp qword [eax - 0x4ed0d4e]
aad 0x41
invalid
Function at 0x7bd9c1
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
pushfd
mov ebp, 0x37812b21
push ecx
mov ebp, dword [esp + ebp*2 - 0x6f02563a]
mov dword [esp + 8], 0x38acd2e6
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.0092458a
mov edx, 0xbd13d037
dec eax
lea eax, [edx + edx*8 - 0x15f8d5d]
inc esp
mov eax, dword [edi]
dec esp
lea ebp, [eax*4 + 0x5981d0b9]
inc esp
movzx edi, al
movsx esi, dx
inc ecx
mov ebp, dword [edi + edi - 0x8e]
inc ecx
movzx ecx, ch
inc ebp
movsx esi, di
dec ecx
lea edi, [edi + edi - 0x8e]
mov ebx, edx
inc esp
or eax, ebp
inc ecx
neg ebp
inc cx
xchg ebp, ecx
inc ecx
not eax
inc ebp
mov dword [edi + edi - 0x92], eax
dec edi
lea edx, [edx + ebp*4 - 0x54cc0008]
dec edx
inc edi
mov esi, dword [edx + ebp - 0x15330001]
inc sp
sub ebp, edx
or bx, 0xa703
inc ebp
xor esi, esp
movsx ebp, dx
inc ecx
xadd bh, dh
inc ecx
dec esi
inc ecx
not esi
call fcn.0089e76a
ja 0x789975
call 0xf2831afb
xor eax, 0x79e98d2a
xor eax, 0x79e9853e
sbb dword [ebp + ebx*8 - 0x17], ebp
jns 0x78991a
mov cl, 0x28
mov ch, 0xe9
jns 0x789920
add eax, 0x79e95dca
mov ecx, 0x79e9f56c
jne 0x7898df
xor eax, 0x1af379e9
invalid
ficomp dword [eax + ebx*8]
pushfd
inc dword [edi - 0x7d]
fcomp dword fs:[edi + edi*8 - 0x274b1cf1]
pushfd
jmp [edi]
neg dword [esp + 8]
xor edx, 0x333c2425
mov dword [esp], 0x32361338
shl dword [esp], 0xe1
ror edx, 3
sar byte [esp], 0xa2
jnp 0x9aa8f2
nop
mov cx, ss
mov ss, cx
jmp 0x78986a
jne 0x785710
adc ebp, 0xfffffff7
sal edx, 0x71
xor eax, ebx
not eax
movzx ecx, dl
dec eax
rol dl, 0xc6
push edx
call fcn.00794a79
adc al, 0x2e
neg al
or ecx, ecx
bts cx, 0x1b
lea edx, [edx*8 - 0x5ce3fec6]
not al
sar edx, 0x33
adc al, 0x15
push ecx
rol edx, 0xc3
dec dx
xor al, 0xbe
add al, 0x89
rol word [esp + ecx - 0x87e], 0x61
neg dx
xor bl, al
sub byte [esp + ecx - 0x880], dl
mov word [ebp + ecx*4 - 0x2204], ax
xchg dword [esp + ecx - 0x880], ecx
lea ebp, [ebp + ecx - 0x8e2]
rol cl, 0x85
sbb dword [esp + ecx*8 - 0x46d8], edx
sal dword [esp + ecx - 0x8db], 0x96
pop eax
jns fcn.0098b9e9
sal ecx, 0x61
rol eax, 0xa5
ror edx, 1
bswap ecx
lea edx, [edx + eax - 0x6234cc3c]
sar cx, 0xf
xor ebx, edx
add ebp, edx
movzx edx, ax
mov edi, dword [ecx + edi - 0x10730000]
imul ecx, ecx
shl ecx, 0x6e
je fcn.008360bb
mov ecx, 0xb1b00388
neg ecx
movzx ecx, byte [ecx + esi - 0x4e4ffc78]
xor cl, bl
mov ebp, 0x9036b112
mov edx, ebp
imul ebp, edx
rol cl, 1
xchg dx, bp
push edx
inc cl
movzx eax, dl
dec dword [esp + ebp - 0x6e11b112]
btc ebp, 0xaa
xor cl, 0xaa
not ebp
add word [esp + eax - 0x44], 0x5f13
not ax
rol cl, 1
xadd dx, bp
push ebp
mul ebp
xor bl, cl
or ebp, dword [esp + edx*2 - 0x1238e]
lea ecx, [esp + ecx + 8]
call fcn.008b5347
Function at 0x7c1eb6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
neg eax
inc ecx
shr cl, 7
inc esp
or dword [esp + edx - 0x12], ebp
dec eax
inc eax
dec eax
not ebp
dec dx
dec esp
xor esp, eax
xadd cx, si
inc ecx
setbe al
dec eax
lea edi, [edx + edi - 0x21]
dec eax
mov dword [esp + edx - 0x19], 0x630f1687
dec eax
mov dword [edi + edx*2 - 0x32], eax
shl dword [esp + ecx*4 - 0xc1c4], cl
pop ecx
pop edx
jbe fcn.008c5046

Function at 0x7c1ef8
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [ecx + esi - 0x6437e48a], eax
mov edx, dword [edi + ecx - 0x6437e48a]
call fcn.007be383
jmp 0x8f0afa
jmp 0x8d5bab
push 0x75ba38b5
lea esp, [esp + 0x1c]
jne 0x896fef
pop esi
mov edx, 0x6437e489
inc edx
not eax
mov ecx, edx
jnp 0x72646b
mov ecx, 0x87bdffb4
jmp 0xca944c
mov esi, 0x61844899
movzx esi, byte [ecx + esi - 0x61844899]
push 0x2b931189
dec dword [esp]
xor esi, eax
jmp 0x985293
mov esi, dword [esi*4 + 0xa31cc0]
call fcn.00ca8532
pop edx
pop ecx
pop ecx
jmp ebp
dec edx
lea esp, [esp + 0xc]
jne 0xc9fba5
mov edx, 0xa42f4e0c
pop ebx
mov eax, 0x233bf99f
shr al, 0x63
not ecx
mov dword [eax + edi - 0x233bf913], ecx
lea edx, [eax*2 - 0x1dc25e57]
movsx ecx, ax
rol eax, 0x4f
jmp ebp
and ebx, 0xff
push 0xee0c06a4
shr dword [esp + 4], 0x4a
shr dword [esp + 4], 0x92
mov ebx, dword [ebx*4 + 0x93b0ec]
shr ecx, 8
xor ecx, ebx
ror byte [esp + 1], 0xa2
or word [esp + 4], 0x1bad
inc eax
push 0xca2eb58d
xor ecx, 0xa732efa8
jmp 0x765994
push 0x7b06432b
and esi, 0xff
jmp 0x8ceb4f
movzx ebx, byte [eax]
push 0x57063704
sal word [esp + 2], 0xf
xor ebx, ecx
jmp 0x72647e
mov eax, dword [edi]
call fcn.00a12370
mov edx, 0xc71ef826
sal edx, 0xfa
mov cx, word [edi]
adc edi, 2
xor edx, edx
mov eax, edx
not dx
lea ebp, [ebp + edx*8 - 0x7fff9]
cbw
movzx edx, byte [eax + ebp]
xor dl, bl
sar eax, 0x82
adc eax, eax
add eax, 0x2c011b36
rol dl, 1
div al
sal eax, 0x99
neg dl
sar ax, 0xe7
rol dl, 1
dec dl
call fcn.0074a554

Function at 0x7c232b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov word [edi + edx], bp
cbw
inc ecx
pop ecx
inc ecx
pop ebp
pop esi
jno fcn.008c5046

Function at 0x7c4b61
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add al, 0xbc
mov ecx, dword [edi + eax*4 - 0x22926340]
xor edx, eax
mov cx, word [ebp + 2]
not eax
cwde
or eax, eax
lea ebp, [ebp + eax - 0x195c]
sal ax, 0xd
mov dword [esp + eax - 0xc000], eax
not dx
mov word [esp + eax - 0xbffe], ax
jnp 0x7738c5
shl eax, 0xe1
not cx
or dx, cx
mov word [ebp + eax*4 - 0x60000], dx
call fcn.009d1c89
Function at 0x7c9731
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
inc bh
dec eax
mov dword [esp + eax - 0x5524001f], 0x428146a0
inc esp
mov ebp, eax
inc ecx
neg bh
inc ecx
sub bh, 0xa1
inc sp
add dword [esp + edx + 0xe], esi
inc ecx
xor bh, 0x34
inc ecx
div esi
dec eax
mov dword [esp + eax*2 + 0x10], ebp
inc ecx
inc bh
mov ebx, dword [esp + eax*2 + 2]
inc ecx
rol bh, 1
or ax, word [esp + eax + 0xb]
inc ebp
xor ah, bh
dec bp
inc ebp
movsx ecx, si
ror ebp, 0x55
dec esi
lea edi, [esp + edi + 0x18]
mov dword [esp + eax + 1], 0x57bf9d11
inc edx
mov dword [eax + edi], esi
dec eax
inc dword [esp + eax + 1]
dec ebp
lea edx, [edx + eax - 4]
shl word [esp + eax*8 + 0x15], 0xc1
inc ebp
mov edi, dword [edx + eax]
setb byte [esp + eax*2 + 8]
inc ebp
xor edi, esp
inc cx
mul ecx
mov byte [esp + eax*4 + 7], 0x1d
inc ecx
ror edi, 3
dec eax
sal edx, 0xea
div dword [esp + eax*2 + 9]
ror eax, 0xdb
inc ecx
dec edi
dec bl
jle 0xa5408c
mov ecx, 0xbb86ea87
mov eax, dword [ebp - 4]
movzx edx, cl
dec edx
bt cx, cx
lea ebp, [edx + ebp - 0x8a]
shl ecx, 0x6a
bswap ecx
xor eax, ebx
dec ecx
xor eax, 0xdd0199ba
imul ecx, edx
lea eax, [eax + ecx - 0x48b7ce39]
add edx, ecx
neg cl
shr cx, 0xa9
not eax
call fcn.009ad52f
inc ecx
movzx esi, dh
inc ecx
neg edi
sar esi, 0xe1
call fcn.008fe5cd
movzx cx, byte [ebp]
mov al, byte [ebp + 2]
mov edx, 0x54bbda97
and cl, al
not cl
lea eax, [edx*8 - 0x77e28a47]
mov word [edx + ebp - 0x54bbda95], cx
mul eax
shl edx, 0x4b
dec al
mov ecx, dword [esi + edx - 0x15567000]
lea eax, [edx + 0x3a97e34]
xor ecx, ebx
shr eax, 0x7a
dec edx
bswap ecx
bts edx, 0x99
push eax
mov dword [esp + edx - 0x17566fff], eax
neg ecx
sal byte [esp + eax - 5], 0xc1
not ecx
call fcn.00840789

Function at 0x7cab2b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
dec eax
mov edi, dword [esp + esi - 0x5fffbfd0]
inc esp
movsx edx, dh
push dword [esp + 0x38]
popfd
inc ecx
not dl
dec eax
lea ebx, [esi*8 + 0xc13e612]
dec edx
mov ebx, dword [esp + edx*8 - 0x7b8]
dec esp
mov edx, dword [esp + esi - 0x5fffbfb8]
xchg esi, ebp
dec eax
mov ebp, dword [esp + ebp - 0x5fffbfb0]
dec eax
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x50], 0x4696f53a
call fcn.00c96d0b

Function at 0x7cac33
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop ebp
call fcn.00901c7a
sub edi, 1
mov dword [esp], 0x5827eb1e
movzx ecx, byte [edi]
pop edx
xor cl, bl
dec cl
not dx
movsx eax, dl
ror eax, 0xee
rol cl, 1
xor cl, al
xor eax, eax
sbb dx, 0x69a7
bt dx, dx
rol cl, 1
lea eax, [eax + edx*2 + 0x610f963c]
xchg edx, eax
shl eax, 0xb2
neg cl
not cl
cwde
rol cl, 1
jmp 0x804f8b
sub cl, 0x81
xor bl, cl
add ecx, esp
jmp 0x98c551
imul ax
or ax, word [ecx + edx*2 - 0x22bc0000]
movzx ecx, dl
lea ebp, [ecx + ebp - 2]
mov word [ebp + edx*2 - 0x22bc0000], ax
mov eax, ecx
xor dx, 0x43b9
lea edi, [edi + ecx*2 - 4]
btc ax, 0xa5
jae 0x8256a9
jmp 0x712b76