joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9d0a0b
Capabilities:
Encode data using base64

Disassembly:
shr cl, 5
not dl
xor bl, dl
sub ecx, 0xfd1a3381
shr ax, 0xea
mov word [ecx + ebp - 0x2e4cc85], dx
lea edx, [ecx + eax*8 - 0x6d541a56]
movzx edx, byte [esi + eax - 0x3ff0034]
not eax
lea esi, [ecx + esi - 0x2e4cc75]
sar ecx, cl
xor dl, bl
dec eax
add dl, 0xa2
not ecx
rol dl, 1
neg dl
dec ecx
dec dl
bswap ecx
bt cx, ax
inc cl
not dl
jnp 0x9df4ff
xor bl, dl
bswap eax
mov word [ebp - 8], dx
sub cx, ax
sbb eax, 0x8d02b7bc
push eax
lea ebp, [eax + ebp - 0x34fc4948]
rol ecx, cl
pop edx
jbe fcn.00989a2c
inc ebp
add ch, ch
xor esi, 0x8707b63d
inc ecx
mov esp, 0x921dd527
bswap esi
dec esp
mov dword [esp + eax - 0x7f], ebp
neg esi
sub esi, 0xbdb6ce84
pop eax
inc cx
not ebp
dec eax
mov dword [esp + ebp - 0x21738], ebx
xor dword [esp + ebp - 0x21738], esi
pop ebx
cbw
dec eax
bt edx, 0x22
dec eax
arpl si, si
dec eax
adc edi, esi
call fcn.009cd40d
inc esi
jb 0x9d0a5f
sub ch, dl
add ah, byte [edx + 0x756d61c8]
cmp al, 0xe8
invalid
jns 0x9d0991
add dword [eax], eax
mov edx, 0xca363aa8
mov eax, dword [esi]
xor eax, ebx
movsx ecx, dx
not cl
inc eax
rol eax, 1
bt dx, cx
shl edx, cl
xor eax, 0x9f156bae
rol eax, 3
dec eax
xor eax, 0x2bb07120
xadd dx, cx
ror eax, 1
inc dx
shr edx, 0x68
xor ebx, eax
btr ecx, edx
mov dword [ebp + edx*8 - 0x2a001d4], eax
rol edx, 0x2a
mov eax, dword [esi + ecx*2 + 4]
sub dl, 0xbb
xor eax, ebx
xor eax, 0x8e9eef23
lea eax, [eax + ecx*8 + 0x7a0e43e]
neg eax
ror ecx, 0xa4
bswap eax
sbb cx, dx
dec eax
inc cx
neg eax
and dl, dh
dec eax
sal cx, 0x83
neg cx
xor ebx, eax
xchg dx, cx
add edi, eax
shr edx, 0x41
movzx edx, byte [esi + ecx*4 - 0x3a0f8]
xor dl, bl
movzx eax, cx
sar cx, 0x4d
neg dl
sar ax, 0x8b
sbb dl, cl
bswap ecx
ror dl, 1
rol eax, 0xaa
jae 0x9b2234
and ebx, 0xff
call fcn.009adb77
xor ebx, ecx
xchg dx, ax
and edx, edx
add eax, 0x24882699
add edi, ecx
push edx
xchg dword [esp + eax*2 - 0x2f764d52], edx
mov edx, dword [esi + eax*4 - 0x5eec9aa4]
bts ax, ax
mov cl, byte [esi + eax*2 - 0x2f764d4e]
ror eax, 0x6a
shr eax, 0x11
setbe al
lea esi, [esi + eax - 0x54fb]
sbb ax, word [esp + eax - 0x5500]
bts ax, ax
mov byte es:[edx + eax*8 - 0x521a0], cl
mov ecx, eax
shl ecx, cl
jbe 0xa3a6e1
mov dword [esp + eax - 0xa434], edi
ret

Function at 0x9d1ebc
Capabilities:
Encode data using base64

Disassembly:
inc esp
xor dword [esp + edx + 0x14], eax
dec eax
mov ebx, dword [esp + edx*2 + 8]
cdq
cbw
dec ebp
arpl ax, ax
dec esi
lea ebx, [edi*2 - 0x316a0b75]
dec eax
mov dword [esp + edx + 0x20], 0x3781a03a
inc ecx
push esp
dec ecx
add edi, eax
sar edx, 0xf3
dec ebp
mov edi, ecx
dec ebp
lea ecx, [ecx + edx - 4]
dec eax
inc dword [esp + edx + 0x19]
inc ebp
mov dword [ecx + edx*2], edi
inc eax
sete dh
inc ecx
pop eax
pop edx
pop esi
pop ecx
pop eax
pop ebp
jle fcn.00987526
dec eax
lea esp, [esp + 8]
ja 0xeb03b2
inc ecx
mov edi, 0x10991a19
dec ecx
lea esi, [edi + 0x683f3b37]
dec esp
mov esi, esp
lea ecx, [esi - 0x78d85478]
dec edi
lea edi, [ecx + edi*4 - 0x426468e4]
inc si
jns 0xa5b7d9
dec ecx
and edi, 0xfffffff0
inc si
dec esp
sub edi, ecx
not si
call fcn.00992692
Function at 0x9d2683
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + edx - 0x6c2], 0x2382ca13
inc ebp
lea esp, [esp + ecx*2 - 0x7577415a]
imul edx, esi
jno 0xa935db
mov edx, dword [ebp + eax - 0x1dfb]
jb 0xa83824
adc ecx, edx
mov dword [ebp + eax*4 - 0x7804], ecx
movzx ecx, word [esp + eax - 0x1e03]
push ecx
movzx edx, word [esp + eax - 0x1dff]
lea ebp, [eax + ebp - 0x1dfb]
dec word [esp + eax - 0x1dff]
push ecx
mov dword [esp + eax - 0x1e03], edi
ret 8
not eax
lea esi, [esi + eax - 0x5ea5154]
sbb al, al
imul eax, eax
mov dword [esp + 4], eax
mov byte [edx], cl
cdq
dec dl
mov dword [esp], 0xfac5c05
sbb ebp, 3
mov edx, dword [ebp]
xadd dword [esp + 4], eax
mov ecx, eax
xor edx, ebx
bts ax, 0xa8
dec edx
dec eax
neg edx
sub edx, 0x4f8c8329
rol edx, cl
bswap edx
ror dword [esp + 4], 0x83
jb 0xa73910
shl ecx, 0x96
xor ebx, edx
add dword [esp + ecx*4 - 0x1000000], eax
inc ecx
bswap esp
inc ecx
neg esp
btc edx, ebp
dec esp
lea esi, [ecx + esi*2 + 0x26231d1a]
inc ecx
bswap esp
xadd esi, ecx
inc esp
movzx edi, si
dec eax
mov dword [esp + ecx - 0x6c2], ebx
inc esp
movzx ebx, bp
inc esp
xor dword [esp + ecx - 0x6c2], esp
dec ebp
lea ebp, [ebx + ecx*2 + 0x44b083af]
pop ebx
dec ebp
arpl sp, sp
dec ebx
lea ebp, [ebx + eax*2 - 0x48d63d49]
or edx, ecx
inc esp
adc bl, dl
dec ecx
add edi, esp
call fcn.00a53895
stc

Function at 0x9d41bb
Capabilities:
Encode data using base64

Disassembly:
inc ebp
movsx ebx, sp
inc sp
xor ebx, ecx
inc ecx
movzx edx, ah
call fcn.00a06086
mov edx, 0x68972437
call fcn.00ea3a3a

Function at 0x9d41d6
Capabilities:
Encode data using base64

Disassembly:
dec eax
cwde
inc eax
not dh
dec eax
mov dword [esp + edx*2 - 0x3c00000], 0xaabbd487
inc eax
sub dh, al
dec eax
and edx, ebp
inc cx
shl eax, 0x41
dec eax
neg dword [esp + edx + 3]
inc eax
xor bl, dh
dec eax
lea esi, [esp + esi + 0x10]
dec ebx
lea edx, [edi + esi*2 - 0x31d5e4d7]
dec edx
rol dword [esp + 0x6e7760c5], cl
inc cx
not esp
dec esi
mov ebp, dword [esi + esi + 0x224f4b2d]
dec edi
mov dword [ecx + 0x6e779f38], ebp
dec esi
lea ecx, [ecx + ecx - 0x27]
inc esi
mov ebp, dword [esp + 0x6e779f45]
inc ecx
shr ebp, cl
cwde
inc ecx
pop esi
inc ecx
pop ebp
jp fcn.00987526
dec esi
outsd dx, dword [esi]
inc edi
das
in al, 0x17
test al, 0xe9
imul esp, dword [esi + 0x51], 0x3c
neg ax
not ax
pop edx
neg cl
dec ax
xor cx, cx
ror ax, 1
or dl, ch
xor bx, ax
sal ecx, 0x2b
Function at 0x9d9907
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0xfd85315f
lea esp, [esp + 4]
call fcn.00b78955
dec ecx
sub ecx, 8
inc ecx
mov ebp, 0xcebfc6a9
dec ecx
mov dword [ecx], esi
movzx ecx, word [esp + 2]
shl byte [esp + ecx - 0x4000], 0xe5
ror word [esp + ecx - 0x3ffe], 0xc5
dec ebp
lea edx, [edx + ecx*4 - 0x10004]
inc ecx
push ebp
dec esp
xadd dword [esp + ecx - 0x3ffe], ebp
inc ecx
mov ebp, dword [edx + ecx*2 - 0x8000]
xor ebp, ebx
shr byte [esp + ecx - 0x3ffb], 0x82
call fcn.00a358a7
mov eax, 0x2607026e
xchg esi, eax
dec eax
outsd dx, dword [esi]
xchg ebx, eax
mov eax, 0x6f08a69e
xchg ebx, eax
mov eax, 0x6f18f27a
xchg ebx, eax
mov eax, 0x6f48a666
xchg ebx, eax
mov eax, 0x6f28fe16
xchg ebx, eax
mov eax, 0x6f10ca3e
xchg ebx, eax
mov eax, 0x6f0092da
xchg ebx, eax
mov eax, 0x6f689612
xchg ebx, eax
mov eax, 0x504cc692
enter 0xffffffffffff8727, 0x56
push ebx
in eax, dx
xchg edi, eax
outsb dx, byte [esi]
div dword [ebx - 0x7238e442]
in eax, dx
cmpsd dword [esi], dword es:[edi]
std
push ss
pop es
enter 0xffffffffffffe471, 0x24
push ebp
xor byte [edi - 0x5eff2504], dh
jge 0x9d99a7
mov bl, 0xa6
pop dword [eax]
retf 0xbbc2

Function at 0x9db980
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp + ecx - 0x1bf33133], eax
lea ebp, [ebp + ecx - 0x1bf33133]
movsx eax, cx
xor ecx, eax
push eax
pop ecx
pop eax
ja fcn.00989a2c

Function at 0x9db9a4
Capabilities:
Encode data using base64

Disassembly:
inc edx
xchg byte [esp + esi - 0x7fe1], cl
inc edx
sbb dword [esp + esi - 0x7fec], ebp
inc esp
xor ch, bl
dec eax
xor eax, ebp
dec eax
sar ebp, cl
inc esi
adc esp, dword [esp + esi - 0x7fe0]
inc ecx
rol ch, 1
inc ebp
add ch, bl
inc esp
bts esi, esp
pop esi
jae 0x9be7bf
mov edx, 0x8824e49d
push edx
mov eax, dword [esi]
movsx ecx, dl
neg edx
lea esi, [esi + edx - 0x77db1b5f]
btr cx, 0x1a
add word [esp + edx - 0x77db1b63], 0x5926
btr edx, 0xb9
xor eax, ebx
imul edx, edx
sar edx, 0x72
dec edx
rol eax, 3
xor dx, cx
pop ecx
dec eax
xor ecx, edx
shl ecx, cl
rol eax, 1
imul cx, dx
dec eax
ror eax, 2
sal dx, 0xc
or cx, 0xd7a7
seta cl
xor ebx, eax
not dx
not cx
add edi, eax
movzx edx, byte [esi + edx - 0x1fff]
or ecx, ecx
neg cl
adc esi, 0
lea ecx, [ecx - 0x97948d6]
movzx eax, cx
or eax, eax
xor dl, bl
sub eax, 0xa237d52a
bts eax, 0x3a
add ecx, eax
not dl
ror ax, cl
lea ecx, [eax*4 - 0x2858f7f0]
sar cl, 0xa1
inc dl
neg eax
shl ax, 0x4d
dec cl
neg dl
bswap eax
ror eax, cl
neg ecx
not dl
sub ecx, 0x1f1d4a3c
not eax
add al, 0xaa
xor bl, dl
add edx, esp
sar cl, 0x87
bt eax, ecx
adc ecx, 0x4e90860c
mov eax, dword [edx]
lea edx, [ecx*8 - 0x234ad643]
sbb ebp, 4
call fcn.00a21654

Function at 0x9de8a0
Capabilities:
Encode data using base64

Disassembly:
neg ecx
imul eax, edx
shr edx, 0x74
inc ecx
ror ecx, 2
mov dword [esp + eax - 0x60000000], edx
or eax, edx
or edx, dword [esp + edx*2 - 0xb10]
inc ecx
xor ax, word [esp + edx - 0x588]
sal eax, 0xe2
pop edx
xor ebx, ecx
dec eax
add edi, ecx
call fcn.00a8fd61
Function at 0x9e348b
Capabilities:
Encode data using base64

Disassembly:
call fcn.00abc452
not ecx
lea edx, [ecx*2 - 0x32537d50]
neg al
lea edx, [ecx + 0x7d83588a]
ror al, 1
mov dword [esp + edx - 0x61ee26f3], 0xc9030fa9
dec al
shr ecx, cl
not edx
neg al
lea edx, [edx + edx*8 + 0x3f206697]
btc dx, dx
inc al
xchg ecx, edx
call fcn.00ab17ed

Function at 0x9e358d
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
add edi, edx
mov dx, word [ecx + esi + 1]
mov cl, byte [ebp + eax*4 - 0x1f979]
xor cl, bl
push eax
dec cl
xor cl, 0x82
sub ax, ax
shr dword [esp + eax*8], 0x28
jne 0xaa4f58
rol ecx, 0xf4
rol edx, 2
shl cx, 0xa7
setp cl
not edx
mov dword [esp + ecx*8 - 8], 0x9c8546a5
push ecx
jp 0x9ab1fc
Function at 0x9f78c1
Capabilities:
Encode data using base64

Disassembly:
inc si
and dword [esp - 0x1254a], ebp
inc dx
ror dword [esp - 0x929c], 0x2d
dec edi
lea edx, [esp + edx - 0x92b5]
cdq
inc ecx
adc ah, 0x84
xor si, bx
rol si, 1
inc ebp
and esi, esp
neg si
not si
dec si
dec edx
mov dword [esp - 0x9233], eax
neg si
inc ebp
and dh, bh
inc ecx
setb dh
sbb si, 0x849d
inc ecx
neg bl
and dl, 0x1b
inc dx
sal dword [esp - 0x248bd], 0x84
rol si, 1
inc si
inc sp
xadd edx, esp
jp 0xa4c610
push esp
movsb byte es:[edi], byte [esi]
invalid
dec ebp
add edi, ebp
inc bx
mov dword [esp + ecx + 8], esi
dec edi
lea ecx, [esp + ecx + 8]
inc ecx
dec dh
dec edx
mov dword [esp], edi
ret 0x10
neg si
inc esi
movsx eax, byte [esp + 0xd]
xchg edx, eax
xadd eax, edx
xor bx, si
mul dl
jb 0xa32888

Function at 0x9fe917
Capabilities:
Encode data using base64

Disassembly:
add edi, ecx
xor word [esp + 1], dx
movzx cx, byte [ebp + 2]
mov al, byte [ebp + 4]
sar edx, 0x4b
and dl, dh
adc cl, al
rol dword [esp], 6
pop edx
mov word [ebp + 4], cx
lea eax, [edx - 0x5df626cc]
jb 0x95d8ae
cbw
sbb ebp, 0xfffffffc
jmp edi
ror edx, 0xbe
not al
and cl, al
inc edx
mov dword [esp + edx - 0x71d480c5], edx
mov word [ebp + edx - 0x71d480c3], cx
ror edx, 0xfc
pop edx
mov ecx, dword [edx + esi - 0x71d480c5]
lea esi, [esi + edx - 0x71d480c1]
xor ecx, ebx
mov eax, 0x11ac6ebc
ror eax, 0x5a
imul dx, dx
dec ecx
bswap edx
push eax
xor ecx, 0x539c7abb
sal dx, 0x2e
not ecx
neg ecx
neg dx
jo 0x954284
jge 0xe99282
xor ebx, ecx
shr dl, 0x41
ror eax, 0x30
jp 0x9ed3d9
Function at 0xa00a80
Capabilities:
Encode data using base64

Disassembly:
inc ebp
lea edi, [edi + ebp*2 - 0x2115540b]
inc ecx
not edi
pop ecx
movsx edx, word [esp + ebp*2 + 0x20]
inc ecx
neg edi
inc ecx
inc edi
inc cx
add ebp, 0xf41a80d
mov bh, 0xc3
inc sp
or esi, dword [esp + ebp + 0xc]
inc ecx
xor edi, 0xe6bae69f
inc ecx
pop esi
inc sp
btr edx, esp
inc ecx
not edi
dec eax
mov dword [esp + ebp + 0x18], ebx
jae 0xeadc97
movsx esi, byte [esp + ebp*2 + 0x11]
inc esp
xor dword [esp + ebp + 0x18], edi
dec eax
neg dword [esp + ebp]
sbb ax, word [esp + ebp*2 + 3]
dec eax
mov ebx, dword [esp + ebp*8 + 0x18]
movzx ecx, byte [esp + ebp + 0x11]
cwde
call fcn.009bb7d4

Function at 0xa021d8
Capabilities:
Encode data using base64

Disassembly:
sub ecx, 0x4f0aee9d
or ax, dx
setg al
xor ebx, ecx
push eax
rol dx, 0x6a
add edi, ecx
dec eax
dec ax
inc ax
pop eax
pop edx
jl fcn.00989a2c
xor eax, ebx
inc ecx
or edi, 0x2990f624
inc ebp
mov ebx, edi
ror eax, 1
dec ebx
lea edx, [edi + edi*4 - 0x2e7f1a50]
xor eax, 0x50fcc0e
inc ecx
rol edi, 0x6c
bswap eax
dec edi
lea esp, [edi + edi*2 - 0x32415972]
inc ebp
mov esi, ebx
rol eax, 1
bswap eax
not eax
mov ebp, 0xc21b43ae
inc ebp
mov eax, edi
call fcn.00b6c7af
Function at 0xa02bde
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp]
mov dword [esp], 0xbbb8d094
push 0x140ed10c
jmp 0xa37ec8
lea esp, [esp + 0xc]
call eax
mov edi, 0x81ae258a
movzx ecx, di
call fcn.009ee90f

Function at 0xa02d49
Capabilities:
Check http status code
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
mov dword [esp], edx
neg dx
adc esi, 5
movzx ecx, byte [ebp - 5]
inc dx
jns 0xa16ce9
jmp 0xaa1b6b
add ebp, 0xfffffffb
imul edx, edx
not edx
pop edx
xor cl, bl
push edx
add edx, edx
jbe 0xa47f85

Function at 0xa1a0c2
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x2431469e
inc edi
mov edi, dword [ecx + edi*4]
jmp 0xa6accd
neg dword [esp + 0xa]
adc byte [esp + 0xe], 0x39
shr ebp, 8
inc ecx
xor ebp, edi
inc byte [esp + 0xe]
dec ecx
inc esi
push 0x161bfba6
call fcn.009fe2ae

Function at 0xa1b281
Capabilities:
Encode data using base64

Disassembly:
cbw
sbb ecx, 0xd03ca192
div ax
not ax
mul dx
not ecx
btr edx, edx
inc edx
xor ebx, ecx
mul dx
add edi, ecx
lea ecx, [eax + 0x68aedc2d]
jmp fcn.00989a2c
inc esi
mov ebp, dword [edx + edx - 0x1c8a812d]
dec ebp
lea edi, [esp + edx*8 - 0x19eb2af9]
inc esp
xor ebp, ebx
inc ecx
sub ebp, 0xaab3bf92
inc ecx
rol ebp, 1
inc ecx
xor ebp, 0xd8923f87
inc ecx
pop eax
inc ebp
movsx eax, sp
call fcn.00abf80a
lea ecx, [ecx + eax + 0x4897b30d]
xchg edx, eax
not ecx
dec ecx
or eax, 0x7fb76ca7
inc eax
xor ecx, 0x289a01b4
or dx, 0x2c31
jae 0xa0283c
Function at 0xa29f82
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp + 7], 0x24
mov edx, dword [esp + 2]
adc ebp, 2
bt edx, 0xa8
jb 0xb63d1b
bts edx, edx
sal eax, cl
bts dx, dx
mov ecx, dword [esp + 4]
mov dword [ebp + ecx - 0x2434e47b], eax
pop eax
shr edx, 0xfb
mov dword [esp + edx*2 - 0x38], edx
mov dword [esp + edx*2 - 0x38], edi
ret
dec cx
lea edx, [ecx + edx - 0x384636]
xor ebx, edx
xor cl, ah
and dword [esp + ecx - 0x12e2b158], ecx
rol ax, 0xc1
add edi, edx
mov dword [esp + ecx - 0x12e2b15c], 0x1c89f194
mov byte [esp + ecx - 0x12e2b158], ch
sub dword [esp + ecx*4 - 0x4b8ac56c], 0x52dcd36
mov eax, dword [ebp + ecx*4 - 0x4b8ac570]
mov cl, byte [ecx + ebp - 0x12e2b158]
jge 0x9e12bf
sar cl, 0xc6
mov dword [eax + esi - 0x7f80], edx
call fcn.00a6f109
not ecx
bswap ecx
not al
call fcn.00964b9f
cwde
add edx, dword [esi + eax - 0x7fff]
mov ecx, dword [eax + esi - 0x7ffb]
lea esi, [eax + esi - 0x7ffb]
div al
or edx, ecx
mov ecx, eax
not edx
jmp 0xa4bdcb

Function at 0xa29fce
Capabilities:
Encode data using base64

Disassembly:
dec ebp
arpl di, di
dec eax
mov dword [esp + edx - 0x31df1f], edx
mov word [esp + edx - 0x31df1a], 0xcfbb
dec eax
idiv esi
dec ecx
add edi, edi
inc ecx
inc eax
inc ebp
btr eax, ebx
inc ecx
pop ebp
inc ecx
pop edi
jae fcn.00987526
inc ecx
xadd ebx, ebp
call fcn.00a745de
cdq
inc ecx
sub edi, 0xfd9cb5ba
dec eax
mov dword [esp + eax - 0x63be4f07], ebx
dec eax
mov dword [esp + edx*2], ecx
cwd
inc esp
xor dword [esp + edx*2 + 8], edi
dec esp
btc ecx, eax
dec eax
mul ecx
dec eax
mov ebx, dword [esp + edx*4 - 0xc77c94]
jb 0x961e71

Function at 0xa29ffe
Capabilities:
Encode data using base64

Disassembly:
dec edx
lea ebp, [edx + 0x4ca03e2b]
inc ecx
not al
and edx, edx
dec eax
mov dword [esp + edx - 0x33b3351c], 0x6ba5bc85
dec ecx
bts esp, edx
inc ecx
rol al, 1
dec eax
shr dword [esp + edx*2 - 0x67666a38], 0xa4
inc ecx
dec al
inc ecx
ror al, 1
jmp 0xa79015
inc ecx
xor bl, al
inc ebp
sub ah, ah
dec esi
lea eax, [esp + eax + 8]
dec esp
or esi, ebp
dec ecx
ror esi, 0x1e
dec ebp
mov dword [eax + edx*2 - 0x67666a38], edi
shl cx, 0xad
xor byte [esp + edx*2 - 0x67666a36], dh
dec eax
xadd dword [esp + edx*2 - 0x67666a38], ecx
dec esi
lea edx, [edx + edx - 0x33b33520]
xor ecx, 0xe3853a0e
dec eax
not dword [esp + edx - 0x33b3351c]
inc esp
movsx ebp, byte [esp + edx - 0x33b33519]
inc ebp
mov eax, dword [edx + edx*2 - 0x67666a38]
dec eax
add ecx, dword [esp + edx*2 - 0x67666a38]
ror byte [esp + edx - 0x33b3351c], 0x62
call fcn.00b86d2a
Function at 0xa301aa
Capabilities:
Encode data using xor

Disassembly:
inc ecx
add bl, 0x8e
dec esi
mov dword [esp + edi*4 - 0x70], eax
nop
inc ecx
ror bl, 1
mov edx, esi
inc ecx
not bl
inc ecx
dec bl
inc esp
add ebp, eax
inc ecx
not bl
inc dx
mul dword [esp + edi - 0x18]
inc cx
and edi, 0x8f0fc80c
add eax, 0xa9fff0f0
fcomp qword [esi - 1]
and dword [edi - 0x66], esp
scasb al, byte es:[edi]
lodsb al, byte [esi]
pushfd
push ecx
lcall 0x9a67, 0x5574ecae
scasb al, byte es:[edi]
rcl byte [ebp + edi*2 + 0x3a], cl
mov byte [0x2b339fbf], al
add bl, byte [esi + 0x1e]
out 0x36, eax
xor bl, bh
xor eax, edx
pop es
jg 0xa301b2
jmp 0xa30209
push esi
in eax, dx
mov ecx, ebp
insb byte es:[edi], dx
daa
and byte [ecx - 0xa], 0x77
push es
xchg edi, eax
ror dh, 1
inc esi
mov esi, 0x461e260c
ret

Function at 0xa359b5
Capabilities:
Encode data using base64

Disassembly:
dec edi
lea ecx, [ecx + ebx - 0x86]
inc esi
adc byte [esp + ebx - 0x82], bh
inc ecx
sal esp, cl
inc bx
mov dword [ecx + ebx*2 - 0x108], edx
dec edi
lea edx, [edx + ebx - 0x88]
inc edi
mov esi, dword [edx + ebx*4 - 0x210]
inc esi
xadd byte [esp + ebx*2 - 0x100], bl
inc ecx
not ah
inc esp
xor esi, ebx
inc si
add dword [esp + ebx*4 + 0xa], eax
dec edx
lea edx, [edi*2 + 0x3587d584]
call fcn.009bd6b2
xor ebx, edx
add edi, edx
sub ecx, 0xdabab41b
sub al, 0x3f
adc cl, 0xa9
jmp edi
cld
call fcn.009a00b7
ror dword [esp + edx - 0x579abd7a], 0xbe
movzx eax, byte [esi + edx - 0x579abd7e]
lea esi, [esi + edx - 0x579abd7d]
sub dl, 0xa4
xor al, bl
rol al, 1
add al, 0xb9
add dx, dx
or word [esp + edx - 0x579a7bb0], dx
ror al, 1
ror dl, 0xe4
jb 0x9c2c55
not al
rol dx, 0x6b
dec byte [esp + edx - 0x579a5bd8]
ror dx, 0x44
dec al
or edx, 0x7c3bd233
not al
sbb al, 0x19
push edx
call fcn.009ef6b9
inc ecx
neg ch
inc ecx
sub ch, 0x3b
inc ecx
pop eax
inc edx
mov esi, dword [esp + esi*2 - 0xfff2]
inc edx
and byte [esp + esi - 0x7fec], cl
inc ebp
xor ch, bl
inc ecx
neg edi
inc ecx
ror eax, 0xa3
inc dx
adc ecx, dword [esp + esi - 0x7fed]
inc ebp
sbb ch, bl
inc cx
add ebx, 0xc6ffc299
inc esp
btr esi, esp
inc ecx
neg ch
inc edx
shl dword [esp + esi - 0x7ff6], 0xd0
inc edx
sbb cl, byte [esp + esi - 0x7ff2]
inc eax
rol dh, 0xa1
inc ecx
xor bl, ch
push eax
inc edx
mov dword [esp + esi - 0x7ffa], ecx
inc di
mov dword [esi + ecx - 0x800c], ebp
dec edi
lea ecx, [esi + ecx - 0x800c]
jmp 0xa449b5
cbw
not edx
sub cx, cx
bswap eax
jle 0xa6349b
mov dword [esp], 0x86bf2c2f
jg 0x9be760
not dl
inc edx
mov ecx, dword [esp + ebx - 0x79]
xor bl, dl
dec eax
sar esi, 0x72
inc cx
xadd edi, ecx
jne 0x946c29
call fcn.00b7835f
dec ecx
idiv esp
inc ebp
xor esi, esp
pop ebp
pop eax
pop esi
pop esi
jne fcn.00987526
inc edi
js 0xa44a17
aas
not dword [eax]
mov ch, 0xf9
popal
arpl word [si], di
inc dword [ecx - 0x7b62d40f]
fld qword [esi + esi]
rol edx, 1
neg edx
ror edx, 3
dec eax
or cl, ch
not edx
neg ecx
lea edx, [ecx + edx + 0x40294b23]
add ecx, eax
sar ecx, cl
jne 0x95af9e
mov eax, 0xb057c09
call fcn.00ea1ae7
adc dword [esp + edx - 0x4e9f25fb], edx
lea ebp, [ebp + eax*2 - 0x22dbffd2]
mov word [ebp + edx - 0x4e9f25ff], cx
pop edx
pop edx
js fcn.00989a2c
Function at 0xa3851b
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
dec ecx
ror edx, 1
shl cx, cl
not cx
lea edx, [edx + eax - 0x2adf5a67]
sar al, 0xa4
xor ax, 0xbd
xor ebx, edx
call fcn.009a2e92
ror eax, 1
pop edx
xor ebx, eax
sub dx, 0x5834
sbb dl, cl
add edi, eax
bt ecx, ecx
sal cl, 0x43
ror cl, 0x45
mov dx, word [ebp + ecx - 0x1205]
mov dword [esp + ecx*4 - 0x4818], 0x6f21871d
movzx eax, cx
mov ax, word [ecx + ebp - 0x1203]
imul ecx, ecx
and dx, ax
jmp 0xa6e1b1
push edx
mov eax, dword [ebp + edx*2 - 0x553aad5c]
movzx ecx, byte [esp + edx*2 - 0x553aad5c]
bts ecx, ecx
sar ecx, 0xc4
mov dx, word ss:[eax + ecx*2 - 0x814]
shr word [esp + ecx - 0x408], 0x49
mov word [ebp + ecx - 0x408], dx
mov dword [esp + ecx*2 - 0x810], 0x34129e9b
mov eax, dword [esi + ecx*2 - 0x814]
jns 0xa5341c
inc ecx
mov esp, 0xce99babb
inc bp
movzx esi, byte [ecx]
inc ebp
mov al, byte [ecx + 2]
inc ebp
or dh, al
inc ecx
movsx ebp, ah
call fcn.00a2c049
add cl, 0x20
sub dl, 0x1e
sbb edx, 0xc2386eaa
not cl
mov dword [esp + edx - 0x3a0d9f74], edx
bswap edx
sal edx, 0xde
rol cl, 1
xor bl, cl
shl dl, 0xc5
sar dl, 0x47
js 0xa2465a
lea ecx, [esp + ecx + 8]
or byte [esp + edx - 0x7ffffffc], dl
jl 0xa5d879
sar edx, 0xc3
mov dword [ecx], eax
pop edx
pop ecx
jmp edi
movzx edx, cl
lea esi, [ecx + esi - 0x406]
neg cl
xor eax, ebx
rol cl, 0x23
lea eax, [ecx + eax - 0x16b37d45]
not eax
sbb edx, edx
xor eax, 0xf5355c9e
rol ecx, 0x42
push edx
jae 0xa29f2f
inc ecx
mov ebx, 0x8b234619
inc ecx
movsx eax, bx
inc si
mov eax, dword [eax + ecx - 0x4619]
mov edx, eax
inc cx
mov eax, dword [ecx + eax*2 - 0x8c30]
inc esp
movzx ebp, dl
inc ecx
shr bl, 0x61
inc sp
and eax, eax
inc ecx
inc ebx
inc ecx
push ebp
inc cx
not eax
inc bp
mov dword [ecx + edx - 0x4617], eax
call fcn.009f1587
not dx
call fcn.009446da
xor edx, 0x99b63f9f
sar al, 0xc1
ror eax, cl
lea edx, [eax + edx + 0x310e2109]
jnp 0x9d1a0c
stosd dword es:[edi], eax
push edx
invalid

Function at 0xa436cb
Capabilities:
Encode data using base64

Disassembly:
neg eax
push ecx
bswap eax
imul ecx, dword [esp + edx - 0x18]
call fcn.00abf6fd
Function at 0xa4f59a
Capabilities:
Encode data using base64

Disassembly:
inc ecx
clc
cmp edi, 5
jmp 0xa03343
or word [esp + eax + 1], dx
lea esi, [esi + eax + 0xc]
neg edx
ror edx, 0x19
pop eax
xor ecx, ebx
xor ecx, 0x7218fe1d
pop eax
inc ecx
shr al, 7
neg ecx
inc ecx
xor ebx, ecx
not eax
xchg ah, dl
ror edx, 0xf6
mov dword [ebp + edx - 0x3fe0a], ecx
lea ecx, [edx + edx*4 + 0x703aeeb2]
lea ebp, [ebp + edx*2 - 0x7fc0c]
add eax, 0xd414c782
jbe fcn.00989a2c
mov dword [ebp + 0xc], eax
mov eax, 0x1a80feaf
mov dword [esp + eax - 0x1a80feaf], 0x1c0f3a0b
mov dword [eax + ebp - 0x1a80fea7], ebx
xor ax, word [esp + eax - 0x1a80fead]
bts eax, eax
mov dword [ebp + eax*2 - 0x3501c53e], ecx
mov dword [eax + ebp - 0x1a80e2a1], edx
mov ebx, 0x42371834
neg word [esp + eax - 0x1a80e2a0]
mov ebx, dword [esp + eax*4 - 0x6a038a80]
mov dword [esp + eax - 0x1a80e29d], eax
mov edx, dword [eax + esi - 0x1a80e2a1]
add ax, word [esp + eax - 0x1a80e29b]
lea esi, [eax + esi - 0x1a80fd1d]
xor edx, ebx
push eax
lea ecx, [eax + eax*8 - 0x1fabdfd]
inc al
dec edx
cbw
xchg word [esp + eax - 0x1a800018], cx
not edx
sal dword [esp + eax*4 - 0x6a000087], 0xbb
lea edx, [edx + eax*4 - 0x21684d7b]
inc dword [esp + eax*4 - 0x6a000084]
not edx
dec edx
pop eax
xadd word [esp + 6], cx
xor edx, 0x289a01b4
cwde
dec eax
and ax, cx
sbb edx, 0xd03ca192
not cl
neg word [esp + 5]
jp 0x9b9419
cmp si, 0x6520
not edx
dec al
sar dword [esp + 4], 0xb
or eax, 0x1804ba36
xor ebx, edx
rol ecx, 0x43
ror eax, cl
adc edi, edx
movsx edx, cx
pop edx
pop ecx
jmp fcn.00989a2c
jl 0xa4f60b
mov dword [ebp - 8], ecx
neg cx
btc dx, 0xa1
rcl cx, cl
lea esp, [esp]
bswap dx
xor cl, ah
rol cl, 0xa2
neg eax
dec cx
add dl, byte [esp + ecx*4 - 0x2e9]
xor eax, 0xe1a134ae
sal dl, 0x24
lea eax, [eax + ecx*2 - 0x4f0af015]
shl cx, 0xae
xor ebx, eax
add edi, eax
xchg dword [esp + ecx*2 + 4], ecx
mov eax, dword [esp + ecx - 0xb9]
mov dword [esp + ecx - 0xbd], 0xd8a096bd
mov ecx, dword [esi + ecx*4 - 0x2ec]
sal byte [esp + eax*2 + 6], 6
jp 0x9a856f
adc ecx, ecx
rep stosw word es:[edi], ax
cmp si, 0x2a3b
shr al, 0x15
mov ecx, dword [ebp + 8]
shl al, 0x29
lea eax, [ecx - 1]
mov dword [ebp - 0x40], eax
sub esi, esi
test ch, 0xaa
clc
or eax, 0xffffffff
stc
sub edi, edi
cmc
cmp ecx, dword [ebp - 0x40]
je 0x9e3408
movzx edx, byte [ecx]
shl esi, 8
inc edi
or esi, edx
jmp 0x9880cb

Function at 0xa4fa6d
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
inc edx
shl dword [esp + ebp*8 - 0x7cccd], cl
dec eax
ror ecx, cl
inc ecx
neg ebx
inc cx
and edx, ebp
call fcn.009955b4
push esi
call fcn.00a7037a
mov edx, 0x8895f99a
dec ecx
sub edx, 4
push edx
inc ebp
mov ebx, dword [edx]
inc esp
movzx ebp, dx
push edx
inc esp
xor ebx, ebx
inc esi
movzx esi, word [esp + ebp - 0xf991]
inc esi
movzx eax, word [esp + ebp*4 - 0x3e65e]
inc ecx
ror ebx, 1
dec esi
lea edi, [eax*2 - 0x6240c2ee]
inc ecx
bt eax, 0xa7
inc edi
lea ebx, [ebx + ebp - 0x22b730c9]
dec esi
xor dword [esp + ebp - 0xf992], edi
inc ecx
mov ecx, eax
dec esp
bt ecx, eax
inc ecx
bswap ebx
inc ecx
rol ebx, 3
inc edi
lea ebx, [ebx + edi*2 + 0x27a4b6f]
push ecx
inc ecx
ror ebx, 2
jmp 0xa10230