joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9189d3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + 8], 0xe34c0ff1
int1
cmovl esp, ebx
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.008be373
add byte [eax], al
add byte [ebx + 0x6f], al
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2], 0x3ba724c0
in eax, 0x2e
mov esp, 0x75b64da8
xchg ecx, eax
add byte [ecx + edx*2 - 0x556e8a4a], 0xb0
and al, 0x1f
xchg ebx, eax
jno 0x918a8b
mov ah, 0x5d
inc esi
jno 0x9189f9
fidiv dword [0xd5729a5d]
aam 0xd
pop ebp
lcall 0x9a5d, 0x5e0bd72
jb 0x9189d7
enter 0xffffffffffffbfa6, 0xffffffffffffffd7
inc ecx
mov esi, 0x9a28b13d
inc ecx
push esi
inc ecx
movzx ebx, si
inc esp
mov eax, dword [edi + ebx*2 - 0x1627a]
neg byte [esp + ebx - 0xb13b]
inc esp
mov edi, dword [ebx + edi - 0xb139]
inc ecx
movsx eax, dh
inc ebp
movsx ecx, dh
mov cl, byte [ebx + edi - 0xb135]
inc ecx
push esi
dec eax
lea edi, [edi + ebx*4 - 0x2c4ee]
inc ebp
shld eax, edi, cl
inc ecx
pop ecx
xadd word [esp + ebx - 0xb138], bx
cdq
inc esp
mov dword [edi + ebx], eax
mov esi, dword [esp + ebx*4]
dec esi
lea edx, [ebx + edx - 4]
push esp
adc edi, esp
inc cx
sar ecx, 0x8b
inc ecx
dec esi
inc esi
mov ecx, dword [ebx + edx]
inc ebp
xor ecx, esp
dec eax
inc ebx
dec byte [esp + ebx*2 + 4]
inc ecx
ror ecx, 1
inc esp
add ecx, ebx
inc ecx
xor ecx, 0xdeaaea94
sal dx, 0xaa
inc ecx
sbb ecx, 0xd506840d
dec esp
mov dword [esp + ebx - 1], esp
dec eax
sub esi, ebx
inc eax
movsx ecx, dh
movsx ebp, al
inc esp
xor dword [esp + ebx*2 - 2], ecx
inc esp
mov ebp, edx
jmp 0xa23697

Function at 0x91c6b2
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ebp
xor eax, esp
movzx esi, ax
inc ecx
dec eax
inc al
cwd
inc ecx
neg eax
dec eax
cdq
inc ecx
rol cl, 0x61
not edx
inc esp
xor eax, edx
inc ebp
xadd esi, ebp
dec eax
mov dword [esp + ecx*4], ecx
inc ecx
xor eax, 0x61072d3d
inc ecx
sub eax, 0xab1184ad
xchg ah, dl
idiv ebx
inc ecx
not edi
dec esp
add dword [esp + eax*8 - 0x570440], esp
inc ecx
rol cl, 0x66
inc esp
xor dword [esp + eax*2 - 0x15c110], eax
inc edx
cwde
or dx, si
inc ecx
pop esp
inc esp
xor ecx, esi
dec ebp
xor edi, ecx
inc esp
mov dword [edi + ecx - 6], eax
dec esp
lea eax, [eax*8 - 0x4d54f654]
inc ecx
btc ecx, ecx
dec eax
lea edi, [ecx + edi - 6]
dec eax
rol esi, 0x18
dec ecx
bswap esi
jae fcn.008c5046

Function at 0x91e91e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc al
mov dword [esp], 0x7b1b6bbd
shr dl, 0xe2
sbb edx, edx
ror al, 1
xchg dword [esp + edx*2], edx
dec al
or edx, edx
or dword [esp + edx - 0x7b1b6bbd], edx
ror al, 1

Function at 0x92072b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
ror ch, 0x25
xor dword [esp + ecx - 0x558d454b], ebx
dec esp
mov dword [esp + ecx - 0x558d455b], esi
dec ebp
and edi, esi
dec esi
mov esp, dword [esp + edi - 0x907080]
dec eax
arpl bx, bx
not eax
inc sp
xadd esi, esi
push esi
dec esp
add ebx, ebx
pop esi
pop ecx
inc ecx
pop eax
pop edx
jmp fcn.008c5046
Function at 0x9212c5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
btr eax, edx
xor ebx, ecx
ror word [esp + 5], 0x49
and word [esp + 8], dx
adc edi, ecx
pop edx
movzx ax, byte [ebp]
push 0x92ebb05
pop ecx
xor dword [esp + ecx*8 - 0x4975d821], ecx
mov dl, byte [ebp + ecx - 0x92ebb03]

Function at 0x92199e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
mov dword [esp + 0x10], ebp
pop ebp
not word [esp + 5]
pop ebp
inc ecx
push edx
push ebx
call fcn.0097e2ad

Function at 0x924a8d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
btr edx, edx
not eax
mov dword [esp + edx*8], 0xaf9370b2
and ecx, eax
neg dword [esp + edx*2]
bts dx, dx
movzx eax, dx
mov dword [ebp + edx - 1], ecx
jae 0x7d91f8

Function at 0x924aaf
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push eax
dec ebx
call fcn.0093a170
call fcn.008032e9
and cl, ch
mov edx, dword [esi + 4]
mov cl, byte [esi + 8]
push 0xc538deb6
adc esi, 6
shrd eax, edx, cl
call fcn.009633f6
call fcn.007e53d0
neg word [esp + 2]
lea ecx, [ecx + eax - 0x4572f5b3]
xor eax, dword [esp]
bswap eax
neg ecx
dec byte [esp + eax - 0x5c60fc04]
inc dx
xadd eax, edx
xor ebx, ecx
add edi, ecx
xadd dl, ah
pop edx
jge fcn.0092c225
jmp 0x9b21ad
mov eax, 0x37019d91
mov eax, dword [ebp + eax - 0x37019d91]
jmp 0x8bf8a5
sub word [esp + 1], 0x9031
mov dword [ebp - 4], eax
neg dword [esp]
test ebx, ebx
jmp 0xa2518d
lea esp, [esp + 4]
je 0x93a184
mov eax, 0xba912021
mov eax, dword [ebp + ebx*4]
jmp 0x8b9e19

Function at 0x92f67d
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
sbb al, al
bswap edx
call fcn.009cfc53

Function at 0x930d53
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
mov edi, dword [ecx + edi - 0x788d1a0e]
inc ecx
pop eax
jmp fcn.008c5046

Function at 0x932d13
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc esp
mov ebp, eax
cdq
inc ebp
xor ecx, esp
dec eax
not edx
inc ecx
pop esi
inc ebp
lea ecx, [ecx + eax*2 + 0x5980b561]
jmp 0x9426ed
dec eax
mov dword [esp], 0x4172232
inc byte [esp + 4]
dec ecx
sub edx, 4
mov eax, 0x321cb69e
inc ebp
mov ecx, dword [edx + eax - 0x321cb69e]
jmp 0x8d4a24
inc ecx
rol ecx, 1
inc ebp
movsx eax, si
inc ecx
bswap ecx
movzx ebp, ax
mov ecx, 0xe137c584
dec eax
cwde
inc esp
xor ecx, edx
dec eax
mul ecx
xadd edx, eax
inc ecx
push esp
inc ecx
sbb al, 0x90
inc esp
xor dword [esp + eax*4], ecx
dec eax
btc edx, 0x21
inc ecx
pop esp
dec esp
lea edi, [ebp + eax*8 + 0x1c393e9f]
bt edx, edx
call fcn.0098633f
sbb esi, 3
mov dword [esp], edx
pop eax
mov ecx, dword [esi]
sal eax, 0x59
setp al
shr edx, 0xdf
xor ecx, ebx
bt eax, edx
not ecx
sar eax, 0x33
bts edx, edx
bswap ecx
add eax, 0x42b5f01
lea ecx, [eax + ecx - 0x573a8a37]
inc eax
rol ecx, 2
ror edx, 0xb9
add edx, eax
neg ecx
ror ax, 0xa9
xadd ax, dx
jno 0x9471cd
dec ecx
cdq
xor ebx, ecx
dec edx
add ebp, ecx
jmp ebp
Function at 0x932dc1
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
call fcn.00a4b171
mov edx, 0xc31b8b22
mov eax, ebp
call fcn.00a39f67
mov eax, 0x40268eb0
cdq
add edx, dword [edi + edx*8]
or eax, eax
movzx ecx, al
lea edi, [eax + edi - 0x40268eac]
xadd ecx, eax
jae 0x75c095
sysenter
push edx
pushfd
mov edx, 0xafa9ac83
mov edx, dword [esp + edx + 0x50565381]
mov dword [esp + 4], 0x45ebedda
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0074da8e
bts edx, edx
ror ecx, 1
lea eax, [edx + edx*2 - 0x76f24d49]
cwde
shl eax, 0xec
xor ecx, 0xd3dfd84
xor ebx, ecx
cwd
xchg dx, ax
imul ax
adc esi, ecx
call fcn.0081033a
sub esi, 4
mov ecx, 0x5b25e4a3
mov eax, dword [ecx + esi - 0x5b25e4a3]
xadd cl, ch
xor eax, ebx
movsx edx, cx
call fcn.009642ed
invalid
lea ebp, [ebp + eax*2 - 0x514f8e1e]
shr eax, 0xde
xor edx, ebx
dec ax
sub edx, 0xe6350b87
ror eax, 0x58
not edx
dec eax
jne 0xa2202c
setb byte [esp + eax*2 - 0x6ee30ac1]
lea esi, [esi + eax*2 - 0x6ee30abe]
movsx edx, al
push eax
movzx ecx, al
mov dword [esp + edx - 0x61], ebp
ret 4
lea edi, [ecx + edi - 0x1a7c02]
mov word [edx + edi - 0x2003], ax
call fcn.00999f2e
sub edx, edx
bswap eax
rol edx, 0xa1
je 0x947879
lea edi, [edi + edx*2 - 0x7ffffff8]
movsx eax, dx
call fcn.009815c5
mov eax, 0x3789fbb9
movzx ecx, al
lea esi, [esi + eax*2 - 0x6f13f774]
movzx edx, cl
movzx eax, word [eax + esi - 0x3789fbb9]
bt ecx, ecx
xor ax, bx
sar ecx, 0x6c
sar dx, 0xe6
neg cx
dec ax
ror ax, 1
xadd cl, dh
inc ax
sub cx, 0xe584
rol ecx, 0x28
xor ax, 0x7b30
btc edx, 0x2d
jb 0x7f2a29
inc edx
xor bx, ax
btr ecx, ecx
jae 0x8b186e
mov dword [esp], eax
push 0x417af1d
jae 0x7338dc
dec ebx
call fcn.0094068d
xor ebx, edx
add ebp, edx
movzx cx, byte [esi + eax*2 - 0x19a6]
movsx edx, ax
mov al, byte [esi + eax - 0xcd1]
btr dx, dx
and cl, al
push edx
movzx eax, byte [esp + edx*4 - 0x334c]
not cl
mov word [esi + edx*8 - 0x6696], cx
sal al, 0x22
inc byte [esp + edx - 0xcd1]
xchg byte [esp + edx - 0xcd3], al
mov edx, dword [esi + edx*8 - 0x6696]
rol ax, 0x62
jns 0x943c69
mov eax, 0x28a7c70d
jmp 0x77382c
mov cl, byte [esi + eax*2 - 0x692]
lea eax, [eax*8 - 0x377194ff]
sal edx, cl
neg ax
neg eax
mov dword [esi + eax*2 - 0x6ee30abe], edx
jno 0x7ae91a
add al, 0xe6
sub eax, 0xf2e6252d
inc edi
out dx, al
dec ebp
xchg ebp, eax
arpl si, bx
dec ebp
xchg ebp, eax
idiv byte [0xf3954db6]
bound edx, qword [ebp - 0xc6ab2fa]
mov esi, 0x954d66cb
out 0x43, al
salc
dec ebp
xchg ebp, eax
jp 0x943c77
dec ebp
xchg ebp, eax
add dword [edx + 0x57], ebx
mov dl, 0xa2
invalid
lea eax, [eax + ecx*2 - 0x5a9107b6]
xor ebx, edx
add esi, edx
movzx edx, cx
and eax, edx
xor eax, edx
mov edx, dword [edi + eax*2 - 0x16400]
or ecx, eax
cwde
mov ecx, dword [edi + 4]
not ax
sar al, 5
and edx, ecx
movzx ecx, al
not edx
mov eax, edx
movzx edx, cx
rol cx, 0xcd
setb cl
mov ecx, dword [edi + ecx - 0xdff9]
setb dl
ror edx, 0xe2
ror dl, 1
adc eax, ecx
mov dword [edi + edx*2 - 0x7ffffff8], eax
jmp 0x910ccc
ror edx, 2
neg eax
inc edx
not edx
sub eax, 0xdd0cb311
movsx ecx, al
ror edx, 3
or eax, eax
xor edx, 0xd01abb00
not edx
bswap ecx
sub cl, cl
jle 0x9884e6
Function at 0x933b74
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push esi
mov dword [esp], 0x71143bda
call fcn.0074da8e
xor dword [esp + 8], 0xcb009c00
xor eax, 0x91107fbf
and dword [esp + 8], 0xa49b74b5
xor dword [esp + 7], 0x53c8627
bswap eax
xor ebx, eax
add ebp, eax
lea esp, [esp + 0xc]
jmp 0x7e9d27

Function at 0x933be4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + edx - 0x219c0000], 0xec8214a5
pop edx
jle fcn.007194ad

Function at 0x933c08
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
mov dword [esp], 0xb8d1f637
call fcn.0073fd82
mov ecx, 0xdf3b171b
sub esi, 4
btr cx, cx
lea eax, [ecx + ecx*4 - 0x6aefc7c8]
mov edx, dword [esi]
shl al, 0x86
call fcn.0093ecee

Function at 0x936619
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jbe 0x965169
call fcn.00cb8c1a
dec ebp
arpl ax, ax
dec eax
mov dword [esp + ebx*2 - 0x4012eb54], 0xa73d57b7
dec ebp
adc ebx, eax
inc ecx
pop eax
pop esi
pop ebx
jmp fcn.008c5046

Function at 0x936ea8
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0x71143bda
call fcn.0074da8e
inc ecx
inc ecx
inc ecx
ror ecx, 1
inc esi
lea ecx, [ebx + ecx - 0x500d689d]
inc ecx
neg ecx
dec ecx
ror ebp, cl
dec esp
mov dword [esp + eax*8 - 0x30], esp
inc esp
xor dword [esp + eax*2 - 0xc], ecx
btr ebx, 0x36
inc ecx
pop esp
inc ecx
shl dh, 0x62
sar ecx, cl
dec eax
imul ecx, ecx
dec ebp
arpl cx, cx
dec ebp
adc ebx, ecx
inc cx
inc eax
jno fcn.008c5046
inc eax
mov eax, dword [esi + eax - 0x4d]
mov ecx, 0xf18a5ab8
seto cl
mov edx, 0x588710a9
lea esi, [esi + edx - 0x588710b1]
add dx, cx
xor eax, ebx
push edx
pop ecx
add ecx, 0xa8871703
lea eax, [eax + ecx*4 - 0x66c17949]
not eax
xor edx, 0x5612af15
xadd dl, dh
rol eax, 1
neg eax
sal dl, 0x61
ror eax, 1
xor ebx, eax
sub edx, edx
sub edx, ecx
mov dword [ecx + ebp - 0x10e81ae], eax
sal dx, 0xaa
lea ebp, [ebp + ecx - 0x10e81ae]
sal ecx, cl
shr ecx, 0x24
jne fcn.0098b9e9

Function at 0x93a170
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0xab10a6bb
push 0xcfad1d85
lea esp, [esp + 0xc]
jne 0xa25197
Function at 0x93b955
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push edx
mov dword [esp], 0x98aa51e8
call fcn.0092458a
inc ecx
mov eax, 0x3990cc2d
dec edi
lea edx, [edx + eax*2 - 0x7321985e]
inc ebx
mov esi, dword [edx + eax*2 - 0x7321985a]
inc ecx
xor esi, esp
inc ebp
mov edi, eax
inc ecx
movzx eax, ax
cbw
neg esi
dec eax
cdq
not esi
mov ecx, eax
dec eax
cdq
ror esi, 3
xor cl, dl
inc bp
btc edi, edi
bswap esi
inc ecx
bt eax, ecx
xor ecx, eax
dec ebx
lea ecx, [eax + eax*2 + 0x51031cb5]
inc ecx
push esp
dec eax
bswap edx
inc esp
movzx ebp, ax
inc ecx
setp ch
inc edx
xor dword [esp + edi*2 - 0x7321d85a], esi
inc ecx
pop esp
inc ecx
neg edi
dec eax
arpl si, si
inc sp
xchg ecx, eax
inc cx
sbb ecx, edi
dec esp
adc ebx, esi
inc ebp
add bh, ch
dec ecx
rol eax, 0x5a
dec esp
mov eax, edi
dec eax
lea edi, [eax + edi - 0x35]
dec esp
xor ebp, eax
dec esp
mov dword [edi + eax - 0x2d], eax
inc ecx
push ebp
inc eax
setb byte [esp + edx*2 + 2]
inc ecx
pop eax
jns fcn.008c5046
add ebp, eax
lea esp, [esp + 0x1c]
jmp 0xa023f9
jmp 0x753338
Function at 0x94251f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [ebp - 4], eax
jmp 0x72385e

Function at 0x942776
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [ebp + eax - 0x328b1402], edx
inc ecx
mov dword [esp + ecx - 0x1405], eax
mov ecx, dword [edi + eax - 0x328b1408]
movsx edx, word [esp + eax*2 - 0x65162808]
lea edi, [eax + edi - 0x328b1408]
sub al, byte [esp + eax*2 - 0x65162808]
dec dword [esp + eax - 0x328b1400]
call fcn.00952669

Function at 0x9427ae
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ebx, ecx
mov dword [esp], 0x1fa2e135
and word [esp + 7], ax
adc eax, eax
add edi, ecx
mov ebx, dword [ebp + ecx - 0x6da6af83]
sal bp, 0x61
mov dword [edi + ebp - 0x6da65f0a], ebx
mov ebx, 0x538e159f
sets bl
inc ecx
mov eax, dword [edx + ebp - 0x6da65f0a]
inc ebp
movzx ecx, bp
dec edi
lea edx, [edx + ebp*2 - 0x10a]
movzx ecx, bp
inc ecx
xor eax, esp
rol eax, 1
inc ecx
inc ecx
setge cl
inc eax
inc ebp
movzx esi, cx
inc ecx
dec ebp
inc eax
sar ch, 0x24
not eax
inc cx
or esi, 0xc041638f
loope 0x942877
dec eax
lea esi, [edx*2 + 0x7c34f8a5]
inc eax
inc ebp
mov edi, esi
inc ecx
push esp
inc ebp
movzx esp, ch
dec eax
shl edx, 0xfd
btc cx, bx
inc edx
xor dword [esp + ebp - 0x82], eax
dec eax
ror edx, 0x25
inc cx
sar esi, 0xa
inc ecx
sar esp, 0x49
inc ecx
pop esp
shr ebp, 0x13
dec eax
arpl ax, ax
dec esp
add ebx, eax
dec ecx
bt ecx, esi
movzx eax, dx
inc esp
mov eax, dword [edi + ebp - 0xdb8]
xor bp, si
or cl, byte [edi + ebp - 0xfa1f]
cwde
dec eax
mul ebp
inc ecx
sal eax, cl
inc esp
mov dword [edi + ebp*2 - 0x1f440], eax
dec eax
lea edi, [edi + ebp - 0xfa21]
jmp fcn.008c5046
invalid

Function at 0x94341b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not dword [esp + 4]
lea esp, [esp + 8]
je 0xcc2805

Function at 0x94528d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mul bx
pop esi
dec ecx
mov ebp, dword [eax + edi - 0x4d0b1b86]
movzx esi, cl
inc eax
jge 0x9825c4
inc esp
mov ecx, dword [edi + eax*4 + 4]
inc cx
not eax
inc ecx
sar eax, 0x78
inc ecx
dec al
dec ecx
lea edi, [eax + edi - 0x40]
inc ebp
mov dword [eax + ebp - 0x4c], ecx
dec eax
dec ecx
add eax, ebx
jmp eax

Function at 0x9452a4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ebx, ecx
call fcn.007acabb
not di
shl di, 0xa2

Function at 0x947b32
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 0x10]
jmp 0x96db6b
push ebp
call fcn.00a17906
Function at 0x950f4f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor edi, eax
jmp 0xca35f8
push 0x31a91292
and edi, 0xff
inc dword [esp]
push 0x4da47328
mov edi, dword [edi*4 + 0xc98ad4]
shr eax, 8
mov dword [esp + 8], 0xad1da838
call fcn.0099f298
sbb ecx, 0x970fae96
cwde
push eax
sal byte [esp + eax*2 + 1], 0xa4
xor ebx, ecx
neg edx
adc ebp, ecx
xor dl, byte [esi + eax]
call fcn.009b5882
rdtsc
mov ecx, 0xdf9c4c22
imul cx, cx
sbb esi, 7
sal cl, 0xc4
and cx, cx
mov dword [esi + 4], eax
mov dword [esi], edx
lea edx, [ecx*8 + 0x1c2e8e36]
mov eax, dword [edi + edx*2 - 0x3220606c]
lea edx, [ecx*4 + 0x58021324]
adc edi, 4
dec dl
imul cx, cx
ror ecx, 0x5d
xor eax, ebx
jmp 0x80d6bb

Function at 0x952fb3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
cwde
mov ecx, dword [edi + ecx - 0x7518a807]
dec ax
xor ecx, ebx
bswap ecx
sal al, 0x46
not ecx
ror ecx, 3
bswap ecx
lea edx, [eax + eax*4 + 0x531b55bf]
xor ebx, ecx
and ax, 0x6f28
adc esi, ecx
call fcn.0090f61d
jne 0x975aa6
adc ebp, 4
ror byte [esp + 0xa], 0xc5
jb 0x82f322
shrd dx, ax, cl
mov word [ebp], dx
pop edx
mov eax, 0x2b2e4918
mov dword [esp + eax*2 - 0x565c9230], edi
ret 4
xchg ecx, esi
dec ebp
xor edi, esp
or byte [esp + esi + 3], 0x91
inc ecx
add eax, 0x6229f1a7
movzx eax, byte [esp + esi*8 + 0xc]
dec ecx
inc edi
shl dl, 0x25
not edx
dec ecx
not edi
sar word [esp + esi + 9], 9
inc ecx
mov ebp, eax
dec ecx
neg edi
neg dword [esp + esi*2 + 6]
dec esp
adc edi, esi
dec ebp
xor esp, edi
dec eax
lea edi, [edi + esi - 8]
dec eax
rol edx, cl
inc cx
and eax, 0xf641f5b8
call 0x3ed3e43e
dec eax
xchg ebp, ebx
setno dl
xchg dword [esp + esi + 8], esi
inc ecx
pop eax
pop esi
jae fcn.008c5046
sysenter
push edx
mov edx, 0x61af2e2b
mov edx, dword [esp + edx - 0x61af2e2b]
mov dword [esp], 0x3845eb74
call fcn.009cb732

Function at 0x9565ed
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop edx
inc sp
xor esp, ecx
inc ecx
movsx edx, ch
cwd
dec eax
sub edi, ebx
dec eax
imul eax, ebx
mul si
inc dx
mov dword [edi + edi*4 - 0xb400], ecx
jo fcn.008c5046
invalid

Function at 0x95d1aa
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
neg bh
dec eax
bswap eax
inc ecx
dec bh
inc ecx
not bh
mov ebx, 0x7695793c
dec eax
cdq
inc ebp
xor ah, bh
inc dx
sar dword [esp + esi - 0x92dd285], 0xac
dec eax
inc dword [esp + eax]
dec esi
lea edi, [esp + edi + 8]
inc edi
mov dword [edi + esi*2 - 0x125ba50a], ecx
bswap eax
dec edx
lea eax, [edi + esi - 0x92dd281]
inc esp
movzx edi, bx
dec edx
mov dword [edi + esi - 0x92dd289], eax
inc esi
xadd byte [esp + esi - 0x92dd283], bh
inc esp
movzx ecx, ch
dec edx
lea edi, [edi + esi*8 - 0x496e942c]
dec eax
bt ebx, ebp
inc ecx
inc ebp
pop eax
jl fcn.008c5046
inc ebp
xor bh, ah
pop ebx
dec eax
mul edx
inc ecx
not bh
dec eax
cdq
inc ecx
sbb bh, 0x11
cwde
dec esp
xadd ecx, ebp
inc cx
neg ebp
inc ecx
ror bh, 1
dec edx
ror dword [esp + esi*2 - 0x125ba50a], 0x14
jae 0x8cca49
Function at 0x9642ed
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
ror ecx, cl
lea eax, [eax + ecx + 0x5587cde1]
xor eax, 0x68859d18
mov dword [esp + ecx - 0xeb64b47], ecx
xor edx, dword [esp + ecx*4 - 0x3ad92d1c]
rol ecx, 0xd3
bswap eax
xor dl, cl
not edx
add byte [esp + ecx - 0x5a3875b0], 0xa5
ror eax, 1
or edx, 0x513bc6aa
sal edx, cl
setp byte [esp + ecx - 0x5a3875b2]
bswap eax
xor ebx, eax
xadd dword [esp + ecx - 0x5a3875b2], edx
dec edx
jno 0xa4df08
adc edi, eax
dec edx
add ecx, 0x4eb01429
lea esi, [esi + edx - 0xe5b4b00]
movzx ecx, byte [esi + edx - 0xe5b4aff]
or byte [esp + edx - 0xe5b4aff], 0x88
xor cl, bl
movzx eax, dl
shl edx, 0x11
add edx, edx
adc cl, dl
neg cl
shr byte [esp + edx - 0x2bfbfffe], 7
xadd dl, dh
adc cl, 0xb7
neg cl
rol ax, 0x2f
mul dword [esp + edx - 0x2bfc0000]
not cl
div eax
sub cl, 0x8e
xor bl, cl
lea ecx, [esp + ecx + 4]
sar dword [esp + edx*4 - 0x36f51f3c], 0x79
pop edx
xor edx, eax
movzx ax, byte [ecx + edx - 0xf62e]
xor dx, dx
lea ebp, [ebp + edx - 2]
mov ecx, edx
and cx, dx
mov word [ebp + edx], ax
neg dx
add dl, 0x8d
jl fcn.0098b9e9

Function at 0x96537d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sub edx, ecx
call fcn.00a39c77
inc eax
imul ax, dx
ror ecx, 2
cwd
rol edx, 2
jmp 0x7dedab

Function at 0x970f41
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shl edx, 0x10
stc
test esp, esp
or eax, edx
test edi, 0xdebd6830
shr ecx, 1
jmp 0x7be276
jl 0x895fe0
mov dword [ebp - 8], ecx
sal dl, cl
btc dx, si
adc edx, 0x64151a05
lea esp, [esp]
cwd
clc
shl esi, 8
inc edi
or esi, edx
jmp 0x9a9dc0
rep stosd dword es:[edi], eax
jmp 0x7bf8be
adc ecx, ecx
jmp fcn.00895fb8
mov dword [ebp - 0x24], edi
jmp 0xcaeb78
mov ecx, dword [ebp + 8]
rcl ah, 0x36
btc eax, 0xe
cwde
lea eax, [ecx - 1]
cmc
mov dword [ebp - 0x40], eax
stc
xor esi, esi
or eax, 0xffffffff
clc
xor edi, edi
test dx, 0x7d9d
cmp bp, bp
cmp ecx, dword [ebp - 0x40]
je 0x8aba62
movzx edx, byte [ecx]
cmc
jmp 0x7a2f37
xor ebx, edx
call fcn.0082fb20
mov dword [ebp - 0x28], edi
jmp 0x7cab23
inc ecx
stc
test cx, 0x6724
cmp edi, 5
jmp 0x776798
mov dword [ebp - 0x2c], edi
je 0x895fbd
mov ecx, eax
mov eax, 0x400
mov edi, ebp
mov edi, edx
sar dl, 0x9b
sub dh, 0x1d
btr edx, esi
movzx edx, ax
sar eax, cl
inc eax
lahf
mov eax, edx
jmp 0x7692a7
Function at 0x971c20
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
mov ecx, eax
mov cl, byte [edi + 4]
mov dword [esp + edx - 0x4067f828], edx
cdq
xor cx, dx
shr dx, 0x41
rol eax, 0x85
imul ax
ror cx, 1
and dx, ax
jae 0xa223c8
lodsb al, byte [esi]
in eax, 0xed
pop ds
mov ebx, 0xb77c092
push ds
invalid
test byte [eax + ebx*8], dl
pop es
cwde
mov edi, 0x3ed98166
jmp 0x8fa795
add byte [esp + 0xa], 0xb7
not eax
dec byte [esp + 7]
bswap eax
not eax
jae 0x7039d7
setle byte [esp + 5]
xor ebx, eax
push 0x8f872f33
call fcn.00741474
jbe 0x971c10
test dword [edi + 0x58f24618], edi
fst qword [eax + esi*2 + 0x35]
clc
pop edi
aam 0x70
xor eax, 0xc4753cf3
jo 0x971c93
aam 0xfd
inc esp
jo 0x971c99
dec eax
cmp edx, dword [eax + esi*2 + 0x53ccf335]
int3
add bh, ah
add ah, byte [ebx*2 - 0x1401008d]
sub al, 0x5d
jae 0x971c9f
invalid
dec dword [esi]
push cs
ret 0x5db4
not cx
or dword [esp], eax
and ax, 0xc2bb
adc cx, 0xcb34
bts dx, dx
shr dword [esp], 0xed
xor cx, 0x8988
xor bx, cx
push edx
shl eax, 0x4d
mov word [ebp - 6], cx
setne byte [esp + 2]
cwde
cdq
lea ebp, [ebp + edx - 6]
pop edx
mov ecx, eax
pop eax
jp fcn.0089b138
fist dword [eax - 0x64]
pop esp
frstor dword [eax + 0x3ca547e6]
adc dword [edi - 0x38], ebx
in eax, 0x3c
adc dword [edi - 0x32], ebx
jne 0xa223fd
cmp al, 0x11
pop edi
mov byte [ebx], bl
lea edi, [ecx + edx]
pop edi
sti
js 0xa2246b
push 0xfffffffffffffff5
mov al, 0xd1
push eax
xchg ebp, eax
pop eax
dec esi
sbb dword [ebx], edi
pop edi
in al, 0xc2
or byte [ecx - 0x7a1d097d], ch
xlatb
dec eax
inc ebp
and dword [ecx], esi
pop esp
mov dh, dl
mov bh, 0xf6
bound edx, qword [ebp + 0x2c]
and al, 0x85
mov al, byte [0x52cab8d8]
inc ebx
jle 0xa2245b
rcl byte [esi], cl
iretd
iretd

Function at 0x973f52
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
push 0xc18dc60f
mov edx, dword [esp]
sub edi, 4
lea ecx, [edx + edx*4 - 0x116677ff]
mov edx, dword [edi]
push ecx
xor edx, ebx
push ecx
jmp 0xa52e60
shr dl, 0x41
xor cl, byte [eax + ecx*4]
push edx
mov word [esi + edx*4 - 4], cx
lea esi, [esi + edx*2 - 4]
sub dl, 0x21
movsx eax, byte [esp + edx - 0xcc]
ror dword [esp + edx*2 - 0x1b4], 0x66
pop edx
pop ecx
pop ecx
pop eax
pop eax
pop ecx
ja fcn.0073c645
jmp 0x815cca
imul cx, cx
bswap edx
sal dword [esp + 8], 0xb1
mov eax, 0xcbada613
xor edx, 0x4d3e0d25
lea ecx, [ecx + eax*4 + 0x2fbe3dad]
lea eax, [ecx + ecx*4 + 0x5031750c]
neg al
neg edx
xchg cx, ax
mov dword [esp + ecx - 0x14d3e345], 0xbc043d29
inc edx
dec eax
xor ebx, edx
sal word [esp + ecx*4 - 0x534f8d18], cl
shr ecx, 0x7b
xor ecx, ecx
adc esi, edx
movsx edx, al
call fcn.009074d2
sub esi, 1
mov ecx, 0xc11d9f8c
movzx edx, cl
inc dx
movzx eax, byte [edx + esi - 0x8d]
xor edx, 0x409cda21
shl edx, 0x68
xor al, bl
btr ecx, ecx
xor al, 0x16
sub dx, cx
lea edx, [edx*2 - 0x63d312c4]
sub dx, 0xeb3
neg al
shl edx, 0xc2
dec dl
or dl, cl
dec al
jmp 0xa4553a