joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa47d64
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
xor ecx, esp
dec ecx
lea ebp, [ebp + eax*4 - 0x15498b5f]
inc ecx
not ch
dec eax
mov dword [esp + eax - 0x6c0d8310], 0xb73d991f
neg ecx
not ecx
ror ecx, 3
dec eax
mov dword [esp + eax - 0x6c0d8308], 0xe11869a7
movsx ebx, bp
inc esp
movzx edi, ch
bswap ecx
dec ecx
not ebp
inc esp
movzx eax, ax
inc bp
bt eax, ebp
dec esp
mov dword [esp + ebx*2 - 0xcb34], esp
xor dword [esp + ebx*8 - 0x32ce8], ecx
dec eax
rol dword [esp + ebx*4 - 0x19678], 0xdf
cdq
dec esp
mov esp, dword [esp + eax - 0x6c0d8308]
inc cx
btr ebp, 0x27
dec eax
inc ebx
dec eax
arpl cx, cx
inc ecx
push ebp
dec esp
add ebx, ecx
inc ecx
movzx ecx, di
xchg word [esp + eax - 0x6c0d8302], ax
pop esi
pop ecx
pop edx
jmp fcn.008c5046

Function at 0xa47e34
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + eax - 0x60aaae9b], eax
lea edi, [edi + eax - 0x60aaae9f]
movsx ecx, ax
mov edx, dword [edi + eax - 0x60aaae9b]
xor ecx, dword [esp + eax - 0x60aaae9b]
xor edx, ebx
xor cl, cl
shr dword [esp + eax - 0x60aaae9b], 0xcf
bswap eax
xor edx, 0xc6058cb9
bswap ecx
dec dword [esp + ecx - 0x559f]
ror edx, 1
and ecx, ecx
xor edx, 0xdf1c6aa0
call fcn.00794558

Function at 0xa4949f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x833002a1
mov dword [esp + 4], esi
lea esp, [esp + 4]
lea esp, [esp + 0xc]
je 0x9f4850
push 0x4fbcc43c
jmp 0x9fc9c1

Function at 0xa4bbd4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
bswap ebx
dec eax
ror esi, cl
inc edx
sar byte [esp + ecx - 0x5aef], cl
inc dx
mov dword [edi + ecx*4 - 0x16c20], edx
dec edx
inc dword [esp + ecx*8 - 0x2d831]
dec esi
mov dword [esp + ecx*2 - 0xb610], ebx
ret 0x20
mov dword [esp + eax], eax
xor ecx, 0xd09ad73a
xchg dword [esp + eax + 8], eax
not ecx
bswap ecx
xadd byte [esp + 2], ah
cdq
jae 0x8b1dfa
dec eax
mov ecx, dword [edi + edx - 0x1cbfecbe]
dec esp
mov esi, dword [edx + edi - 0x1cbfecb6]
dec eax
lea edi, [edi + edx*4 - 0x72ffb2f0]
movsx eax, dl
dec esp
lea ebp, [eax + eax*8 - 0x4c56fe2]
dec esp
lea ecx, [edx*2 - 0x535f1b4e]
dec eax
not ecx
dec ebp
lea eax, [ebp + eax*2 + 0x519e1a9b]
dec ecx
not esi
dec ecx
rol ebp, 0xbb
inc ecx
sbb ch, 0xba
dec ecx
or ecx, esi
dec eax
mov dword [edi + edx*2 - 0x397fd97c], ecx
inc ecx
div ebp
dec ebp
lea edx, [edx + edx*2 - 0x30ad8230]
mov ebx, eax
inc edx
mov ebx, dword [eax + edx - 0x666eec92]
inc ecx
xor ebx, esp
inc ecx
movzx ebp, cx
rol ebx, 1
movsx esi, dx
dec ebx
shr edx, 0x87
xor ebx, 0x79138f3b
dec ecx
or ebp, 0x6fba9c15
dec esp
lea esi, [eax*8 - 0xfdee2fa]
add dl, 0xa8
bswap ebx
inc ecx
sal cl, 0x45
inc cx
neg esi
dec esp
lea edi, [ebp*4 + 0x1a1eaea9]
lea ebx, [ebx + edx*4 + 0x297b22ec]
inc ecx
push esp
xor dword [esp + edx - 0x30ad2a], ebx
inc ecx
pop esp
dec ebp
and ebp, ecx
inc ecx
bts ebp, 0x89
inc eax
rol ch, 0xa5
dec eax
arpl bx, bx
dec ebp
xor ebp, eax
jbe 0x8e4e05
dec esp
adc ebx, ebx
inc ecx
sar bh, 0x86
inc bp
adc ebp, ecx
inc ecx
jmp ebx
Function at 0xa50525
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg edx
inc eax
sar ch, 0x46
inc edx
lea edx, [edx + esi - 0x63857835]
dec esp
mov dword [esp + eax - 0x49130fa2], esp
xor ax, 0x2b3d
inc ecx
pop edi
xor dword [esp + ecx - 0x5696e099], edx
inc ecx
pop esp
jmp 0x9d2eb1
dec eax
not ecx
dec eax
arpl dx, dx
dec esp
lea eax, [esi*8 + 0x44002108]
dec esp
lea ecx, [ecx + 0x27068baa]
dec esp
add ebx, edx
dec eax
sal ebp, 0x75
dec eax
mov edi, dword [edi + eax - 0x49132497]
inc eax
shl dh, cl
and ax, bp
jbe fcn.008c5046
mov ecx, dword [edi]
call fcn.00a18086
mov edx, 0x133e04a9
lea esi, [edx + esi - 0x133e04ad]
call fcn.008fe649
adc dl, byte [eax]
push ebx
aaa
out dx, eax
repne lodsb al, byte [esi]
cmp esi, dword [eax - 0x6b0c63a1]
mov eax, dword [0xf39c5f18]
and al, 0xe9
pushal
pop edi
pushfd
jo 0x9d2f27
mov eax, 0x38f39c5f
popfd
or byte [edi - 0x64], bl
add al, 0xbd
and byte [edi - 0x64], bl
hlt
pop edi
pushfd
repe cmpsd dword [esi], dword es:[edi]
dec eax
pop esi
mov dl, 0x82
cwde
sbb dword [edx - 0x59], eax
mov word [ecx + esi*8 + 0x58], fs
arpl di, di
dec esp
mov dword [esp + ebp - 0x4913fca4], edi
jmp 0x81fb1a

Function at 0xa519ed
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, ebx
rol cl, 7
xor eax, 0x29a097b2
lea eax, [eax + ecx - 0x2904fcf9]
neg eax
inc eax
bt edx, 0x8b
jb 0x95f018
bswap eax
xor ebx, eax
xor byte [esp + edx + 2], ch
xchg dword [esp + edx*8 + 5], edx
pop edx
adc esi, eax
call fcn.00786573
call fcn.00c9b417
movzx ecx, ax
add byte [esp + edx*4 - 0x1eb], al
lea edi, [edx + edi - 0x81]
or dx, ax
mov dword [esp + edx - 0x537d], 0x24371a03
mov eax, dword [edi + edx - 0x537d]
xor ecx, 0xdb98ab37
xor edx, edx
jno 0x8098b2
sal edx, 0x22
adc cl, 0xa0
rol cl, 1
not cl
imul edx, edx
lea eax, [edx*2 + 0x47998e89]
dec cl
div eax
shr edx, 0xca
adc al, dl
neg cl
dec cl
shl eax, 0xf2
xor eax, edx
xor bl, cl
add ecx, esp
mov dx, word [edx + ecx - 0x1859b9]
mov ecx, eax
sub eax, 0xb710c4bd
or eax, eax
lea edi, [ecx + edi - 0x5db059bb]
sal ecx, 0xfe
neg al
bswap eax
mov word [ecx + edi - 0x40000000], dx
movzx edx, cx
bt eax, ecx
neg cx
adc edx, dword [eax + esi - 0x4949fa6]
lea esi, [eax + esi - 0x4949fa2]
not eax
cbw
imul eax, ecx
xor edx, ebx
lea ecx, [ecx*4 + 0x4181cb02]
btr eax, eax
not edx
neg al
and cx, cx
inc edx
ror ecx, 0xc3
shl cx, 0x22
not edx
bswap edx
sar ax, 0xcf
btc ax, cx
inc ecx
xor ebx, edx
add ebp, edx
lea edx, [eax + eax*8 - 0x58f542cb]
jmp fcn.008360bb
Function at 0xa52d7e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
btr ecx, ecx
ror al, 0xc2
cwde
xor edx, ebx
and dword [esp + eax - 0x1d73], eax
bswap edx
xor cl, ah
dec word [esp + eax - 0x1d7b]
sete cl
sbb edx, 0xafb40e18
shl ecx, 0x96
push eax
ror edx, 1
inc edx
mov dword [esp + ecx + 0x14], ecx
ror edx, 1
and ax, ax
xor ebx, edx
dec ecx
xchg word [esp + eax - 0x1d6a], ax
add esi, edx
pop edx
pop ecx
pop edx
pop edx
pop ecx
pop ecx
jmp fcn.00ca4448
lea ebp, [ebp + eax*2 - 0x359a537a]
pop eax
mov edx, dword [ebp]
imul cx, cx
xor edx, ebx
bswap edx
lea eax, [ecx + ecx*4 - 0x4e03bec]
bt ecx, ecx
jb 0x9b1d51
sbb edx, 0xafb40e18
add cx, ax
ror edx, 1
lea ecx, [ecx*8 + 0x40214e81]
inc edx
not ecx
jmp 0x796c4f

Function at 0xc969e1
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
aaa
test dword [ecx], esi
mov cl, 0xa1
mov ch, 0x36
invalid
movsx edx, ax
bt dx, ax
ror ecx, 3
cwd
bswap ecx
and ax, 0xce07
mul dword [esp + eax*2 - 0x28051008]
not ecx
xadd byte [esp + edx - 0x29938d9], dh
adc eax, eax
je 0xa16582
sbb ecx, 0xedb38b1e
xor ecx, 0xc3149da9
cwde
xor dword [esp + edx - 0x29902d7], eax
xor ebx, ecx
add ax, 0xa408
jb 0xc9a62a
push cs
push 0x8b1b96
ljmp 0x33
adc esi, ecx
mov dword [esp + edx - 0x8876], esi
ret
mov dword [esp + edx - 0x8876], eax
xor ebx, ecx
add dword [esp + edx - 0x8876], eax
dec ax
jns 0x97e838
mov eax, dword [esp]
xchg byte [esp + 1], al
adc esi, 5
not ax
lea eax, [eax*8 - 0x4ffdb9d8]
lea eax, [eax + eax*4 + 0x753acf81]
mov byte [ecx + eax*4 - 0x49dc7c84], dl
btc eax, 6
ror byte [esp + eax - 0x12771f5f], 0xc4
movsx ecx, byte [esp + eax - 0x12771f61]
lea ebp, [ebp + eax*4 - 0x49dc7d88]
adc eax, 0x18b5992
mul cl
mov ecx, dword [eax + ebp - 0x140299c6]
push eax
xor ecx, ebx
add word [esp + eax - 0x140299c0], ax
lea ecx, [ecx + eax - 0x773989e0]
jbe 0x8ec358

Function at 0xc99ac2
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + 4], 0x7e8d5a00
dec ebx
push 0x33ab7c22
jmp 0xcc245a

Function at 0xc9b1b6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg edx
not eax
shl eax, 0x22
dec edx
dec eax
bswap edx
inc edx
xor edx, 0x1e85ee28
rol edx, 1
mov dword [esp + eax - 0x172a73a7], ecx
shl cx, 0x61
push eax
neg edx
xor edx, 0xe6ae9cbf
ror eax, 0x2f
btc ax, 0xb3
adc ax, ax
rol edx, 1
neg eax
xor ebx, edx
sub byte [esp + eax - 0x18b1a343], ch
sal byte [esp + eax*2 - 0x3163468f], 0x62
lea edi, [edi + eax - 0x18b1a34c]
sbb byte [esp + eax - 0x18b1a343], al
push eax
sbb al, ch
mov dword [eax + edi - 0x18b1a3c2], edx
setg cl
pop edx
pop eax
pop ecx
jge fcn.008360bb
sub edi, 4
mov ecx, 0xfdb4bcb7
mov edx, dword [edi]
mov eax, ecx
call fcn.008b6d63
mov ecx, dword [esp]
lea edi, [edi + ecx - 0x7b300011]
btc ecx, ecx
btc ecx, ecx
add al, dl
sal cl, 0xc1
movzx edx, cl
mov word [edi + ecx - 0x7b300026], ax
dec dword [esp + ecx - 0x7b300026]
mov dword [esp + edx*2 - 0x4c], ebp
ret
Function at 0xc9c088
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
and dword [esp + 0xc], 0xde3f8484
rol edx, 2
push 0x1d0d598e
not dword [esp + 1]
neg edx
mov dword [esp + 8], 0x2c267b2e
and word [esp + 6], 0xa1b9
inc edx
xor ebx, edx
mov dword [esp + 0xc], 0x75b90d15
add edi, edx
lea esp, [esp + 0x18]
jmp 0x93f5ff
ror edx, 1
inc byte [esp + ecx - 0x6d86720d]
not ecx
shl cl, 0x47
xor ebx, edx
add esi, edx
movzx eax, cl
movzx edx, ax
bts cx, ax
mov dword [esp + edx], esi
ret 4
inc edx
push 0x5137a03
mov dword [esp + 0x10], 0x89842a26
call fcn.00753976
ror dword [esp + 8], 0x5f
bswap edx
push 0xc18a7bb7
jb 0x9a6e4d
mov edi, dword [edi + ecx*8]
movsx eax, word [esp + ecx + 0x11]
pop esi
pop edx
pop ebx
jmp fcn.008c5046
push esi
mov dword [esp], 0xc7c179fd
call fcn.0082a379
mov eax, 0xbeaabf09
lea edx, [eax + eax*2 + 0x5f0dac08]
mov edx, dword [esi]
push eax
add esi, 4
jmp fcn.00cb28f2
sbb edx, 0x3a9a828e
jmp 0x791282
jb 0x95b92b
mov edx, 0xb3206a11
lea ecx, [ecx + edx + 0xa7e81a9]
call fcn.00925cc9
lea esi, [esi + edx*2 - 4]
inc word [esp + edx + 2]
neg byte [esp + edx*8]
xor edx, dword [esi + edx]
xor edx, ebx
sal word [esp], 0x4f
lea eax, [ecx + ecx*2 - 0x65e052e0]
seta al
sbb edx, 0x713a2b14
xadd byte [esp + eax - 0x34376bff], ah
je 0x7984d7
ror edx, 2
shl eax, cl
rol dword [esp], cl
dec edx
not al
rol cx, cl
not ecx
rol edx, 3
call fcn.0089a366
shr eax, 8
xor eax, esi
jmp 0x8cd53b

Function at 0xc9c7d6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0x3fb4110b
dec ecx
xor ecx, 0xcbb0cf1b
neg ecx
mov edx, 0xa384f325
movsx eax, dx
sub ecx, 0xa4867815
not ecx
sal al, 0xa2
jb 0xca258f
xor ebx, ecx
add edi, ecx
mov ecx, dword [esi]
btr edx, 0x34
mov edx, dword [esi + 4]
adc al, 0xa4
sal al, 0xa4
adc esi, 7
mov dword ss:[ecx], edx
pop ecx
pop ecx
jmp edi
xadd ax, cx
push ecx
Function at 0xc9f7ff
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
rol dl, 7
adc edi, 8
mov dword [eax], ecx
sar dword [esp], 0xaf
mov ecx, edx
sbb ebp, 3
sal dl, 0xe6
js 0x96cfe8
mov eax, 0x99b318ab
movsx edx, al
mov edx, dword [esi]
movzx ecx, ax
jmp 0xca5646
mov edx, 0x653e5a17
lea eax, [edx + edx*4 - 0x4156be45]
neg edx
not ecx
add edx, eax
cmovle ax, dx
btr edx, 0xae
mov dword [edi + edx - 0x53a2aa17], ecx
sar edx, 0x51
push eax
and byte [esp + edx*8 - 0x14e88], ah
lea ebp, [ebp + edx*8 - 0x14e8c]
mov edx, dword [ebp + edx*2 - 0x53a2]
movzx ecx, ax
xor edx, ebx
sar ecx, cl
rol edx, 1
bswap ecx
rol byte [esp + ecx + 3], 0x65
neg edx
rol cl, 0xc7
bt eax, 0x25
not edx
dec ax
lea edx, [edx + ecx - 0x109610ab]
add word [esp + ecx + 2], cx
and word [esp + ecx*8], ax
not edx
btc ax, cx
xor ebx, edx
add esi, edx
pop ecx
xadd ecx, eax
jmp esi
call fcn.0076eb6e
not dword [esp + 4]
lea esp, [esp + 8]
je 0x7e5270
push ebx
mov ebx, 0x8a88e4a3
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
call fcn.007e507d
mov dword [esp], 0x98aa51e8
call fcn.0092458a
push 0xdb0a6dbc
mov edx, 0x8616c9a9
dec byte [esp + 3]
mov eax, dword [edi]
xchg word [esp], dx
movzx ecx, dx
mov ecx, dword [edi + ecx - 0x6db8]
jnp 0x74edb9
sub esi, 4
mov edx, 0x38536b0
movzx eax, dl
neg al
mov ecx, dword [edx + esi - 0x38536b0]
xor edx, edx
neg al
inc edx
xor ecx, ebx
rol ecx, 2
not ecx
lea ecx, [edx + ecx + 0x4eb71b29]
xor ecx, 0x51761a0
cdq
bswap eax
sub eax, edx
xor ebx, ecx
add ebp, ecx
lea ecx, [edx + eax*8 + 0x4a96e84]
mov cx, word [edi + edx*2]
push eax
xor dx, word [edi + edx*4 + 2]
not dword [esp]
add edi, 2
add ax, word [esp + 1]
cwde
sal al, 0xe1
or cx, dx
xchg byte [esp + 2], ah
movzx edx, al
not cx
sar dl, 0x84
call fcn.008f4123
xor ebx, edx
not ecx
add esi, edx
call fcn.009b077e
jmp fcn.008014b9
Function at 0xca0ea8
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ebp
lea ebp, [ebp + eax - 0x47d6f105]
inc ecx
push esp
dec esp
lea eax, [eax + 0x71202524]
inc esp
xor dword [esp + eax - 0x47a7af78], ebp
dec edx
lea ebp, [eax + eax*2 - 0x3b40d9ce]
inc esp
movsx ecx, dx
call fcn.0079ca99
mov ecx, 0xa736e20d
sub ebp, 4
mov ecx, dword [ebp]
mov edx, 0x6f1eff30
ror dl, 0x61
movsx eax, dx
xor ecx, ebx
cwde
jmp 0xa34533
mov word [edi], dx
mov ecx, 0xf096d61a
jmp esi
and dx, cx
dec eax
xadd ecx, edx
bswap eax
sar edx, cl
sbb eax, edx
not al
lea ecx, [ecx*8 + 0x4c09803a]
or cx, cx
and cx, 0xaba
and dl, al
mov word [esi], dx
and ecx, 0x620f1b9e
lea ebp, [ebp + ecx*2 - 0x20028]
movsx eax, cx
bts ecx, eax
sar eax, cl
add eax, dword [ebp + ecx - 0x50012]
lea edx, [ecx + ecx*8 + 0x1e36fe89]
xor eax, ebx
inc dx
jne 0x82e157
bswap ecx
xor eax, edx
inc ax
rol ecx, 1
dec ecx
cdq
cbw
xadd eax, edx
rol ecx, 1
cwde
xor ebx, ecx
btc dx, ax
sal ax, 0x6d
adc esi, ecx
xor dx, word [eax + edi]
lea eax, [eax - 0x16736848]
rol eax, 0x4c
jb 0x8ebbad
mov cl, byte [edi + 2]
bts eax, eax
adc al, al
adc edi, 1
imul eax, eax
add al, ah
and eax, eax
sal dx, cl
jmp 0x7da0bf
inc ecx
rol bh, 0x41
inc ecx
xor ebp, 0x5c094226
dec edx
mov dword [esp + eax + 0x2ae88000], ebx
inc edx
or byte [esp + eax*2 + 0x55d10005], dh
inc ecx
dec ebp
dec esi
mov dword [esp + eax*2 + 0x55d10008], esp
inc dx
xor esi, dword [esp + eax*2 + 0x55d10003]
cdq
jle 0x76b9b5
inc esp
xor dword [esp + ebx*2 - 0x70], ebp
inc ecx
pop edi
inc ecx
pop esp
inc ecx
push eax
inc ecx
pop eax
dec ebp
arpl bp, bp
dec ebp
add ebx, ebp
inc ecx
mov dh, byte [edx + ebx*8 - 0x1e6]
dec ebp
lea edx, [edx + ebx*8 - 0x1e6]
dec ebp
imul edi, edi
call fcn.00812816

Function at 0xca0f0a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sub ecx, 0x3dc385
xor eax, dword [esp + eax - 0x146989f0]
adc esi, edx
cdq
cwd
mul dword [esp + eax*2 - 0xba55da6]
mov dword [esp + edx - 0x3165628], esi
ret 4
add ecx, eax
not dl
not ax
setb byte [esp + eax - 0x9bf7]
cbw
ror dl, 1
mov dword [esp + eax*8 - 0x7fff8], 0x689d7908
sub dl, 0xaa
xchg ecx, eax
xor bl, dl
lea edx, [esp + edx + 0x10]
mov ecx, dword [edx + ecx*4 - 0x3fffc]
mov dword [esi], ecx
movzx ecx, ax
mov ecx, dword [edi + ecx*4 - 0x1e6fe]
sub ax, word [esp + 0xc]
ror byte [esp + 0xd], 0x26
movzx edx, ax
lea edi, [edx + edi - 0x79ba]
sal byte [esp + edx*2 - 0xf377], 0xe3
cwde
xor ecx, ebx
btc edx, 0x2e
xchg word [esp + eax*4 - 0x1e700], dx
not ecx
sar al, 0xe2
lea ecx, [ecx + eax*4 - 0x64118af3]
call fcn.008c695b
neg edx
jne fcn.008360bb
mov word [esp + eax - 0x1520373d], 0xa11
rol edx, 3
btc eax, ecx
neg edx
lea eax, [eax*2 + 0x661bfb94]
dec edx
add eax, 0x840d21a8
sal al, 0x62
xor ebx, edx
jmp 0x8da72d
Function at 0xca1729
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x94916703
lea esp, [esp + 4]
jmp 0x8f0af5
pop ebx
pop ebp
pop esi
bswap edx
lea esi, [esi + edx - 0x2eb36b7e]
mov ecx, dword [esi + edx*2 - 0x5d66d6f4]
dec eax
not edx
lea eax, [edx + edx*2 - 0x78f05ced]
xor ecx, ebx
mul dx
adc ecx, 0x39a1af2a
rol ecx, 1
lea edx, [edx - 0x725982e6]
shl dl, 0xc6
dec edx
neg ecx
bt edx, edx
inc ax
bt edx, 0xa
lea ecx, [ecx + edx - 0x454a4829]
shl al, 0x41
not ecx
sbb ecx, 0x70009702
add al, 0xad
rol dl, 0x61
xor ebx, ecx
sal dl, 7
add ebp, ecx
lea ecx, [eax + edx + 0x11bc5629]
shr dx, 0x2b
jmp ebp
add esi, ecx
lea esp, [esp + 0x14]
jmp 0x7a975d
call fcn.009afcb4
test ebx, ebx
lea esp, [esp + 0x14]
je 0xcc2464
mov eax, 0x5b8204ac
imul eax, eax
sal ax, 0xed
mov eax, dword [ebp + ebx*4]
call fcn.0094c683
dec byte [esp + 0xc]
xor ebx, ecx
push 0x28b55786
jmp 0x7f66bd
mov eax, dword [ebp]
call eax
mov ebp, dword [ebp - 4]
mov edx, 0x2eb36b86
btr edx, edx
mov dword [ebp + edx*2 - 0x5d66d70c], eax
neg dl
bswap edx
lea eax, [edx*8 - 0x254660ea]
mov edi, ebp
jne 0x7dcdba

Function at 0xca2426
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec ecx
sar esi, 0x7b
xor cx, 0x79a5
jp fcn.008c5046
mov dword [esp], 0x3bb8ce34
inc dword [esp]
add ecx, 0x93b7be00
dec byte [esp + 3]
rol byte [esp + 3], 4
rol ecx, 1
neg ecx
push 0x1abed3b4
shl dword [esp + 4], 0xec
dec ecx
push 0x1010b14
push 0x6aa2013c
xor ebx, ecx
sal dword [esp + 9], 0xe9
neg dword [esp + 0xb]
add edi, ecx
jmp 0x801cfb
call fcn.00a21355
neg eax
dec eax
mov dword [esp + ecx*2 - 0x3e6a685a], ebp
inc edx
lea eax, [eax + edi - 0x1b4602f4]
dec esp
mov dword [esp + ecx*2 - 0x3e6a685a], esp
dec ecx
sub edi, 0xe94b738
dec eax
shl ebx, cl
inc edx
xor dword [esp + edi + 0x47e6e3ce], eax
inc ecx
mov esp, 0x5190a1b
dec ebp
bts esi, esi
inc ecx
pop esp
dec eax
arpl ax, ax
ror cx, cl
sal bl, 0xc1
dec esp
adc ebx, eax
jmp 0x75d560
Function at 0xca31be
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
ror al, 0xe5
not dl
neg dl
dec eax
inc dl
neg ax
ror eax, 0x19
rol dl, 1
dec ax
jnp 0xa287db
mov dword [esp + eax - 0x2c3b0520], ebp
ret 4
sub cl, cl
not eax
shl cx, 0xc8
not edx
sar edx, 0x30
dec eax
xor eax, 0x4703d61e
rol cl, 0x81
xor ebx, eax
rol cx, 0xc2
adc ebp, eax
movzx eax, dx
mul dl
jmp ebp
xor byte [esp + 0xa], al
adc esi, 6
pop eax
mov word [eax + edx - 0x2c3b0520], cx
add byte [esp + eax*2 - 0x58760a40], ah
mov edx, dword [esp + eax - 0x2c3b051c]
jae 0x8187bd
dec cl
xor ebx, edx
add esi, edx
sal ax, cl
dec cl
mov eax, dword [edi]
sub cx, cx
movsx edx, cx
cmovl ecx, edx
or edx, dword [edi + edx*2 + 4]
sal cl, 0xa1
setb cl
adc cl, byte [edi + 8]
call fcn.00927893
mov eax, 0xb7b6fe9a
movzx edx, ax
movsx ecx, dx
mov cx, word [edi + edx - 0xfe9a]
add al, al
div eax
lea edi, [edi + eax*2 - 0x2c58e]
cbw
jmp 0x960fee
btc dx, dx
movzx edx, byte [esi + eax*4 - 0x7ff20]
sal eax, 0xf4
imul eax, eax
lea eax, [eax + 0x6e37b79d]
lea esi, [esi + eax - 0x6e37b79c]
sub ax, ax
shr eax, 0x7d
xor dl, bl
inc ax
jg 0x7e3c86
neg dl
dec al
rol ax, 0x23
bswap eax
sbb dl, 0x92
xor bl, dl
and al, ah
bt eax, eax
add eax, eax
add edx, esp
rol al, 0x41
sal eax, 0xa1
mov byte [edx], cl
mov eax, dword [esi]
mov ecx, 0xa41d0ab2
mov edx, ecx
adc esi, 3
xor eax, ebx
ror dx, 0x6e
cmovb ecx, edx
inc eax
btr edx, edx
bswap eax
rol edx, 0xdd
jb 0x89afa0
mov ecx, 0x7aafd85
mov ecx, dword [esi + ecx - 0x7aafd85]
mov edx, 0xd620f737
add esi, 4
bswap edx
btc dx, dx
xor ecx, ebx
movsx eax, dx
shl edx, 0x78
sbb ecx, 0x999721b7
sar edx, 0x2e
rol ecx, 1
not ecx
cdq
push edx
dec ecx
pop eax
ror eax, 0xa4
xor edx, edx
xor ecx, 0xa001ea2f
mul dx
xor ebx, ecx
ror eax, 0x87
not edx
adc edi, ecx
movsx ecx, ax
lea eax, [ecx + edx*8 + 0x178a150d]
bts edx, ecx
add cl, byte [esi + eax - 0x178a1505]
xadd ax, dx
lea esi, [eax + esi - 0x178a1503]
xor cl, bl
btr edx, eax
neg al
bt eax, eax
sbb cl, 0xb3
call fcn.0079efec
call fcn.00cadd67
add ecx, 0xf49a810c
rol dl, 1
inc dl
shl dword [esp + ecx*2 - 0x69350204], cl
mov dword [esp + ecx*2 - 0x69350210], ecx
ror dl, 1
not dl
ror ecx, 0x79
jb 0x957f57
shl ecx, 0x2e
ror dl, 1
xadd dword [esp + ecx - 0x21467ffa], ecx
inc cl
shr dword [esp + 4], 0x6a
xor bl, dl
xadd byte [esp + 0xf], cl
lea edx, [esp + edx + 0x14]
or ecx, ecx
mov word [edx], ax
call fcn.007be862

Function at 0xca6db5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add ebp, eax
mov ecx, dword [esi + ecx - 0x6487678d]
mov eax, edx
neg dl
adc esi, 5
movzx eax, byte [edi + 4]
imul edx, edx
rol edx, 0xa1
sal edx, 0xd2
sbb edi, 0xfffffffa
push edx
xor al, bl
pop edx
shr edx, 0xae
adc al, 0x99
xor al, 0x20
sal dl, 0xc6
mov dword [esp + edx - 0x27dfc], edx
or edx, edx
sbb al, 0x1a
xor word [esp + edx*2 - 0x4fbfb], dx
sar word [esp + edx*2 - 0x4fbfc], 0xad
bt edx, edx
rol al, 1
sub dx, dx
call fcn.0099e2ed
Function at 0xca6f0a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shr ecx, 8
and byte [esp + 0xb], 0x9e
xor ecx, ebx
push 0x8a2b35ba
push 0x55941c91
call fcn.007799c4
mov ecx, 0x1b23f097
mov edx, ecx
mov eax, edx
lea ebp, [ebp + ecx - 0x1b23f09b]
mov eax, dword [ebp + eax*4 - 0x6c8fc25c]
xor eax, ebx
neg edx
ror eax, 2
call fcn.009c527a

Function at 0xca6f46
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
btc dx, 0x22
xor eax, ebx
mov word [esp + 2], cx
xchg dh, cl
dec eax
add cl, 0x13
ror eax, 1
lea eax, [eax + ecx - 0x29ee8c89]
neg word [esp]
cmovne cx, word [esp + 2]
and cx, word [esp]
neg eax
call fcn.009a06e6
bts edx, ecx
xor eax, 0x44b71c21
bts edx, edx
xor ebx, eax
dec dl
or dl, dl
shl edx, cl
adc esi, eax
imul edx, ecx
jmp esi
xor ecx, edx
xor ebx, eax
pop edx
sub edx, edx
xor ecx, 0xbe0bed24
adc edi, eax
dec cl
call fcn.0076f8dc
adc dl, 0x80
rol ecx, cl
pop ecx
rol dl, 1
xor cl, cl
neg cl
not dl
jg 0x8b6075
btc ecx, ecx
setae cl
neg dl
sub ecx, ecx
shl ecx, 0xc6
rol ecx, 0x8a
xor bl, dl
lea ecx, [ecx + ecx + 0x3bad439a]
add edx, esp
lea ecx, [ecx*2 + 0x379a4ba6]
xor cl, cl
push ecx
mov dword [edx], eax
mov dword [esp], ecx
mov edx, 0xad8b0f10
sbb ebp, 4
xor word [esp + 1], cx
setle byte [esp]
mov eax, dword [ebp]
ja 0x732863
int 0x2e
call fcn.009025d5
not cl
not dl
bt ax, ax
jb 0x921e82
or cl, dl
mov word [eax + edi - 0x9285498], cx
movzx edx, ax
jmp ebp
mov dword [esp], ecx
xor dl, bl
inc cl
add cx, word [esp + 1]
jnp 0xa3573d
dec ebx
lea ebp, [ecx + eax + 0x5957c0f]
dec edx
lea edi, [edi + ebp*8 - 2]
dec ecx
and ebp, ebp
inc dx
mov dword [edi + ebp*2], edx
inc ecx
not eax
jge fcn.008c5046

Function at 0xca8528
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop ecx
pop eax
pop ecx
pop eax
jo fcn.007194ad

Function at 0xca8532
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, esi
push 0xa7942696
neg byte [esp + 0xc]
sal byte [esp + 0xc], 5
inc ecx
xor eax, 0x832ec796
or byte [esp + 0xc], 0x34
jge 0xcc0954
shr eax, 8
shl word [esp + 0xa], 0xc8
jbe 0x798962
dec edx
push 0x8e84cf2f
call fcn.007c1ef8

Function at 0xca943c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add dword [esp], 0xc4b4843b
push 0xc61b6fad
test edx, edx
call fcn.00984450
mov edx, 0x52195114
mov dword [esp + edx - 0x52195114], edi
ret
xor eax, eax
jmp 0x8bfd00
push 0x219c5239
call fcn.00942f59
jb 0xa4b4f0