joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8fecab
Capabilities:
Encode data using xor

Disassembly:
dec ecx
sar ebx, 0x2c
inc ebp
movsx esp, bl
inc ecx
xor eax, esi
inc esp
mov eax, edx
dec edx
mov dword [esp + ebx], 0xa0102eb7
lea eax, [eax + edx - 0x4f94f898]
bswap eax
inc cx
ror eax, 1
sbb eax, 0xba8733b1
dec edx
not dword [esp + ebx*2]
inc si
sub eax, dword [esp + ebx + 5]
not eax
dec esi
mov dword [esp + ebx + 8], esi
inc esi
and bl, byte [esp + ebx + 7]
inc edx
xor dword [esp + ebx + 8], eax
inc ecx
movsx ecx, al
dec ebx
lea edx, [esp + 0x22dea4]
dec esp
mov esi, dword [esp + edx - 0x22de9c]
dec eax
arpl ax, ax
add dl, byte [esp + edx*2 - 0x45bd41]
movzx ebp, word [esp + edx - 0x22dea1]
dec eax
mov dword [esp + edx*2 - 0x45bd40], 0x960e5a17
dec esp
adc edi, eax
dec eax
lea esi, [esi + edx - 0x22dea5]
inc esp
movzx ecx, byte [edx + esi - 0x22dea4]
dec esp
or dword [esp + edx - 0x22dea0], esp
inc esp
movzx ebp, dx
dec ecx
btr ebp, 0x88
inc ebp
xor cl, dh
inc ecx
dec cl
not word [esp + edx - 0x22de9c]
xchg dword [esp + edx - 0x22dea3], edx
inc ecx
shl ebx, 0x74
inc ecx
ror cl, 1
dec eax
inc ecx
call fcn.00d71d1e
sal byte [ecx], 0xd5
invalid
das
inc edi
add al, al
xor ebp, edx
pop ds
sar ebx, 1
inc ebp
jo 0x8fed66
adc al, 0xd1
shr byte [ebx - 0x36], 0xda
jle 0x8fed12
mov dh, 0
jns 0x8fed85
cmp eax, 0xdbcebb18
into
lodsd eax, dword [esi]
arpl word [edx - 0x4124b3dd], si
out dx, al
outsd dx, dword [esi]
mov ebx, dword [0x7adb58fe]
dec eax
push ebx
dec esp
insb byte es:[edi], dx
ret 0x6feb

Function at 0x90306e
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [ebp + ecx*4]
xor ecx, ebx
mov eax, dword [esp + 4]
call fcn.00d4d5ab
mov cl, byte [esi]
enter 0x6ec1, 0x2f
sub dword [edi], eax
xchg ebx, eax
pop eax
sbb al, 0x8a
insd dword es:[edi], dx
out dx, al
outsd dx, dword [esi]
fist dword gs:[esp + ebp*2 + 0x4a]
push esp
invalid

Function at 0x9098ea
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0xfd22a16b
lea esp, [esp + 4]
call int.009d20d7

Function at 0x91e206
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp 0xd8f184
push edi
mov dword [esp], 0xbf174ce7
call fcn.008f466e
Function at 0x924112
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xd0634a
ret
add dword [ecx], eax
jmp 0x924145
add ecx, dword [ebp + 0x10]
cmp bx, 0x7f3d
test cx, ax
cmp al, 3
jne 0x947fd3
mov edx, dword [ebp + 8]
add dword [ecx], edx
jmp 0x7cc852
cmp al, 2
jmp 0x7cc83c
mov dword [ebp - 4], eax
jmp 0x72f3a3
jne 0x7cc852
mov dx, word [ebp + 8]
cmc
test si, 0xcea8
add word [ecx], dx
cmp ax, si
lea edi, [edi + 2]
clc
sub dword [ebp - 4], 1
jmp 0xd17bdb
jmp 0x7cc852
jne 0x79872e
mov eax, dword [ebp + 8]
sar eax, 0x10
cmp bp, 0xf2ad
add word [ecx], ax
jmp 0x980ab1
mov esp, ebp
pop ebp
jmp 0x73f433
cmp al, 1
jmp 0x804a2d
inc eax
call fcn.00cfd8fe
sub ebp, 4
mov edx, 0x7d0ecf34
mov edx, dword [ebp + edx - 0x7d0ecf34]
mov ecx, 0x3d26ebba
movzx eax, cl
inc ecx
xor edx, ebx
ror eax, cl
sub ecx, 0x3da54fa8
rol edx, 2
call fcn.007b77c3
adc dword [ecx + 4], edx
jmp 0x7d5514
cmp al, 0xa
jmp 0xd004e4
jmp 0x7cc852
mov eax, dword [ebx + esi + 4]
clc
cmc
cmp eax, 8
jb 0xd17bf8
add eax, 0xfffffff8
cmp edi, ecx
test cx, si
stc
shr eax, 1
je 0xd17be1
lea edi, [ebx + esi + 8]
jmp 0x7a2124
jne 0x88589f
mov eax, dword [ebp + 8]
bt dx, 0x3a
cdq
cmc
jmp 0x7471b7
movzx eax, word [edi]
movzx ecx, ax
test edi, esp
cmp bh, dh
shr ecx, 4
add ecx, dword [ebx + esi]
and al, 0xf
clc
jmp 0x766699
jne 0xd0634a
lea eax, [ebx + esi + 4]
add esi, dword [eax]
cmp eax, 0xf3084c2f
cmp bx, di
cmp esi, dword [ebp + 0xc]
jb 0xa091fc
pop edi
movzx ebx, bx
pop ebx
pop esi
jmp 0x873b03

Function at 0x93b15c
Capabilities:
Encode data using base64

Disassembly:
lea esi, [esi + eax - 0x6fc58409]
jmp 0xcf85d9
dec dword [esp + edx*2 - 0x2038]
ror ecx, 2
lea ecx, [ecx + edx - 0x611b203d]
xor al, 0x10
bswap ecx
xor ecx, 0xa585c8bd
add dword [esp + edx - 0x101a], edx
neg ecx
ror ecx, 3
cwd
xor ebx, ecx
pop edx
pop eax
add edi, ecx
lea eax, [eax + eax + 0x6e8afd8b]
movzx ecx, ax
jmp 0x7e9119
lea edx, [eax + ecx*8 + 0x11aa26ab]
cwd
mov eax, dword [ecx + esi - 0x8405]
xadd ecx, edx
sbb edx, 0x98e5618
bswap edx
xor eax, ebx
btc edx, ecx
push edx
not eax
rol ecx, 0xe7
ror eax, 1
sar byte [esp + 1], 0x25
add word [esp + 2], dx
inc eax
bts dx, 1
jb 0xd8cb36

Function at 0x93badd
Capabilities:
Encode data using base64

Disassembly:
shr edx, 8
xor edx, esi
shr dword [esp + 4], 0xf
push 0x5112f5b9
and word [esp + 2], 0x9600
inc ecx
sar word [esp + 0xa], 0xc5
call fcn.008c79e8

Function at 0x940f80
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop eax
pop edx
pop ecx
pop edx
jge fcn.009f2e39
Function at 0x94a36a
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
ror dx, 0xc2
xor ax, bx
push ecx
xor ax, 0xb5a0
rol ax, 1
call fcn.009b94ad
test edx, edx
lea esp, [esp + 0xc]
je 0xd1bb20
jmp 0x79ea2b
push ebx
mov ebx, 0x8380fa2e
rol ebx, 0x97
movzx ebx, byte [eax + ebx*4 - 0x5d0701f4]
jb 0x8307e9
rol edx, 0xc1
mov ecx, dword [ecx + ebp - 0x433478a0]
inc dx
lea eax, [edx + edx*8 + 0x248744ad]
xor ecx, ebx
not ecx
cwde
lea ecx, [ecx + eax - 0x7d435bcb]
xor ecx, 0x1e3a1583
shr ax, 0xac
or edx, 0xf12be82
ror al, 0xa7
neg ecx
xor ebx, ecx
dec ax
sar eax, 0x24
sbb esi, 3
xor dword [esp], eax
sets byte [esp]
not eax
mov dword [esi + eax*4 - 0x3ffc], ecx
ror dword [esp + eax*2 - 0x1ffe], 0x2d
cwd
movzx ecx, ax
pop eax
jne fcn.008ba6aa
call fcn.00da4de3
bswap eax
dec cx
setl byte [esp + ecx*2 - 0x16b0e]
inc eax
pop edx
xor ebx, eax
inc ecx
and ecx, 0x9c8e5939
jno 0x92d049
inc dword [esp + ecx - 0xc2]
bswap eax
not cx
rol eax, 2
rol byte [esp + ecx - 0xff3d], 1
xor ebx, eax
ror dword [esp + ecx - 0xff3d], cl
neg edx
add edi, eax
neg dx
and cx, 0x3e90
sets cl
mov dx, word [edx + ebp - 0x36ee4122]
ror word [esp + ecx*2 - 0x7bfe], 0x2e
jns 0xd4f246
not edx
bt ecx, eax
neg cx
lea edx, [ecx + edx - 0x5cd7e488]
adc cl, 0x83
lea ecx, [ecx + ecx*8 - 0x54c5f1c9]
cwde
rol edx, 1
cwde
sal cl, 0x46
xor ecx, eax
neg edx
cwde
add ecx, eax
shr al, 0x82
rol edx, 1
not al
and ecx, 0x582a4b35
bswap eax
xor ebx, edx
add ebp, edx
mov edx, dword [esi + ecx - 0x48024334]
push eax
neg dword [esp + ecx - 0x48024334]
mov ecx, dword [esi + ecx - 0x48024330]
adc esi, 7
mov dword ss:[edx], ecx
pop ecx
jmp ebp
adc edi, eax
movsx eax, cl
rol cx, cl
inc al
lea esi, [ecx + esi - 0x813]
rol cx, 0xa1
xor dx, cx
mov ax, word [esi + ecx - 0x1022]
jl 0x74ed1b
mov ecx, dword [esi]
cwde
setb al
mov eax, dword [eax + esi - 0xbfc]
call fcn.0074e151
ror dl, 1
bswap ecx
dec dword [esp + 3]
neg dl
mov byte [esp + 8], ch
call fcn.00db2927
call fcn.009ffffa
pop ecx
mov edx, 0xef2c9ea0
sub ebp, 4
lea eax, [edx + edx + 0x59b3e392]
mov eax, dword [ebp + eax*2 - 0x701a41a4]
add edx, 0x5407e902
xor eax, ebx
neg edx
not dl
sbb eax, 0x1a051b2a
neg dx
bswap eax
mov ecx, edx
dec eax
push ecx
rol ecx, 0x43
adc cx, 0xed20
ror eax, 2
lea ecx, [ecx + ecx*4 + 0x22b307b3]
add ecx, ecx
xor ebx, eax
sal ecx, 0x68
sar dl, 0x45
bts ecx, 0x20
adc edi, eax
not dword [esp]
xchg dword [esp], edx
xchg ecx, edx
lea ebp, [ebp + ecx - 0x433478a4]
jmp 0x7d2510
mov dword [esp + ecx - 0xb588], ecx
jmp 0x894090
inc eax
btr edx, 0xac
rol eax, 1
dec dx
neg eax
ror eax, 1
bswap eax
not dx
dec edx
setne dl
ror eax, 1
neg edx
xor ebx, eax
shr ecx, 0xe8
add ebp, eax
jmp ebp
adc ebp, 4
call fcn.0088eb31
not ecx
mov eax, 0x11871018
movzx edx, al
mov dword [edi + eax*4 - 0x461c4060], ecx
xchg dh, al
movzx ecx, dx
or dl, cl
lea esi, [esi + eax - 0x11871004]
mov eax, dword [esi + eax - 0x11871000]
neg dx
xor dl, cl
jg 0x9ede84
xor eax, ebx
inc ecx
xchg cx, dx
ror eax, 3
inc edx
sal dl, 1
jge 0x97e5ab
mov al, 0xfe
stosb byte es:[edi], al
ret
mov ax, word [ebp + ecx*8 - 0x1effe]
xor ecx, 0xe0a87492
mov cl, byte [ebp + 4]
inc byte [esp + 1]
jl 0x9c0b4e
Function at 0x95613c
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x32c], eax
not dword [esp + eax*2 - 0x658]
mov byte [edx + eax*2 - 0x658], cl
lea esi, [esi + eax - 0x330]
sbb ax, 0xc584
mov eax, dword [esi + eax*8 - 0x1ed40]
xor eax, ebx
shl byte [esp], 0x85
shl byte [esp + 2], 0xc7
mov ecx, 0xe6232298
ror eax, 3
sub word [esp], 0xffa6
ror ecx, 0x28
movsx edx, word [esp]
inc eax
not eax
btr ecx, edx
neg eax
or ecx, edx
ror edx, cl
lea eax, [eax + ecx - 0x72c909fb]
sar dx, 0x6a
jne 0x965d9b
xor ebx, eax
xchg edx, ecx
xadd edx, ecx
btr dx, 0x9c
add edi, eax
push edx
inc cx
pop edx
pop ecx
jmp edi

Function at 0x965aac
Capabilities:
Parse pe header

Disassembly:
sbb ecx, 0xd9002733
sub edx, edx
ror ecx, 3
lea ecx, [edx + ecx + 0x531fea21]
btc eax, eax
lea edx, [edx - 0x294e1af4]
sub edx, 0xd4342ea9
xor ebx, ecx
lea edx, [edx + edx*2 + 0xa2f6c0b]
add eax, 0xf625a08e
inc edx
add ebp, ecx
jmp ebp
inc edx
movzx eax, byte [esi + eax*2 - 0x3a1b0256]
dec esi
and ebp, dword [esp + eax*4 - 0x743604a4]
inc ecx
xor al, dh
add bl, 0xab
and edx, ebx
not al
inc ecx
neg ecx
inc edx
shl byte [esp + ebp - 0xf2], 5
adc al, 0xb9
dec edx
mov dword [esp + ebp - 0xf0], 0x393d359b
inc sp
add eax, ebx
ror al, 1
inc dx
inc dword [esp + ebp*2 - 0x1eb]
add al, 0xf
inc edx
not dword [esp + ebp*2 - 0x1ec]
inc ebp
xor ecx, ebp
dec edx
inc dword [esp + eax - 0x1d0d82e6]
not al
bts dx, dx
dec edx
mov dword [esp + ebp*8 - 0x800], ebx
sbb al, 0xb5
not al
dec edx
sub dword [esp + eax*2 - 0x3a1b05e4], 0xfd138e3f
inc ecx
shl ebp, 0x13
inc esi
sbb byte [esp + ebp - 0x8000000], cl
inc ecx
adc al, ch
neg al
inc cx
inc ebx
inc dx
sal dword [esp + ebp - 0x7fffff2], 0x86
inc esp
xor dh, al
inc ebp
add ecx, esp
inc esi
movsx edx, byte [esp + ebp*4 - 0x1ffffff0]
pop edx
dec eax
lea eax, [esp + eax + 0x10]
call fcn.0075e580
mov ecx, dword [esi]
mov eax, 0xe713d5af
mov eax, dword [esi + 4]
mul ecx
mov ecx, 0x91cdb98
lea ecx, [ecx + 0x443eaf84]
mov dword [esi + ecx - 0x4d5b8b1c], edx
add cl, cl
mov dword [esi + ecx - 0x4d5b8b34], eax
movsx edx, cx
movzx eax, cl
sar al, 0xa5
mov ecx, dword [ecx + edi - 0x4d5b8b38]
rol edx, 0x50
ja 0x785425
lea edi, [edi + eax*8 - 4]
sets dl
xadd eax, edx
xor ecx, ebx
rol dl, 0x27
btr eax, edx
xadd edx, eax
neg ecx
lea ecx, [ecx + eax*4 + 0x70b45834]
add edx, eax
or eax, edx
ror ecx, 1
neg edx
jp 0x958baf
Function at 0x96e404
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push esi
bts edx, edx
ror edx, 0x5c
push edi
jae 0x818b92
xor esi, eax
and esi, 0xff
call fcn.009828f4
mov eax, 0x391185a0
lea edx, [eax*8 + 0xfb5c831]
shr dl, 4
lea ebp, [eax + ebp - 0x391185a4]
mov ecx, dword [ebp + eax - 0x391185a0]
sbb dx, 0xf8c
call fcn.00d65935
mov eax, 0x9178b81
cwde
bswap eax
sub esi, 1
lea eax, [eax + eax*2 - 0x33772e6e]
movzx eax, byte [esi + eax - 0x512cd18f]
mov edx, 0x6d83b69a
neg dl
xor al, bl
rol al, 1
neg edx
neg edx
adc al, 0xbe
not edx
neg edx
ror al, 1
xor al, 0xe
bt dx, 0x99
sub edx, edx
shr dl, 0xa1
xor bl, al
sar edx, 0xc3
bt edx, edx
jae 0x747052
invalid

Function at 0x975847
Capabilities:
Encode data using base64

Disassembly:
not edx
not ecx
not eax
xor edx, 0x3d0b7b18
ror edx, 2
not cl
call fcn.009f69e0
jb 0x964623
inc ecx
movzx ebx, cx
inc ecx
xor eax, esi
inc esp
movzx edx, bl
jmp 0x88fae4
xor edx, ebx
not al
sub eax, 0xaea1281c
jp 0x75868d
mov eax, 0x101b088b
movsx edx, ax
movzx ecx, al
mov eax, dword [esi + eax - 0x101b088b]
dec edx
mov ecx, dword [edx + esi - 0x886]
and edx, 0x44a49094
push ebx
cpuid
push 0xe7195d92
sbb byte [esp + 1], 0x85
sbb esi, 7
push 0xfe9adaae
call int.00d86cbe
xor ebx, edx
lea eax, [eax*2 - 0x3966724c]
xadd ecx, eax
adc ecx, eax
adc edi, edx
cwde
mov dx, word [esi]
cwde
xchg dword [esp], eax
mov ax, word [esi + 2]
add esi, 2
ror word [esp + 1], 0x6c
add dx, ax
lea eax, [ecx*4 + 0x3784679f]
bt ecx, ecx
jb 0x9a37a9
btr dx, dx
sbb ebp, 4
movzx ecx, dl
lea ecx, [edx + 0x6683c536]
lea eax, [ecx + ecx*4 + 0x5901fe83]
mov edx, dword [ebp + eax - 0x4d9e9496]
bswap ecx
bt ecx, 0x95
jae 0x9196f8
push 0x3a281f0d
jmp 0x9ac361
adc eax, ecx
ror edx, 2
mov dword [esp + eax - 0x5947f42e], eax
not edx
sar dword [esp + eax - 0x5947f42e], cl
rol edx, 1
sub ecx, ecx
neg dword [esp + ecx*4]
and dword [esp + ecx], 0x8a92b218
dec edx
inc al
xor ebx, edx
bts cx, 0x95
not word [esp + ecx*4 - 0x7e]
jb fcn.0099e9b0
adc edi, edx
dec cl
ror eax, cl
push eax
mov bp, word [ecx + ebp - 0x1f]
sbb ecx, 0x638b6520
sal dword [esp + 4], 0xa
pop eax
pop eax
jne fcn.009fc29f
mov edx, 0xeea072b2
movzx eax, dl
lea ebp, [ebp + eax*8 - 0x594]
mov ecx, edx
not eax
add al, 0x8d
mov edx, dword [ebp]
xor edx, ebx
not ax
rol edx, 3
dec al
sar al, 0xc5
dec edx
push ecx
sar ecx, 0xe8
shl cx, 0x64
not edx
sub ecx, dword [esp]
sbb ecx, 0xaf3daa31
lea edx, [edx + ecx + 0x91c9f02]
jno 0x89c36a
mov word [esi + eax - 0x6261f063], dx
mov dword [esp + eax - 0x6261f063], edi
ret

Function at 0x97a25b
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
jne 0x795bc6
pop esi

Function at 0x97b0c6
Capabilities:
Encode data using base64

Disassembly:
call 0xd75eb3
mov eax, ebp
push 0x7019620d
neg byte [esp + 1]
sete byte [esp + 1]
add eax, edx
neg word [esp + 1]
push 0x5d9a6718
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x75de16
Function at 0x9905d3
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov edx, 0xd734e91c
cpuid
push 0x90a84b39
sar dword [esp + 4], 0xfd
sbb esi, 7
call fcn.00861cfd
mov edx, 0xb99cd59a
movsx ecx, dx
mov edx, dword [esi]
xor cl, cl
jno 0x8748ed
sub ebp, 1
mov edx, 0x9b907e06
movzx eax, byte [ebp]
xor al, bl
not dx
add al, 0x89
xor dx, dx
rol al, 1
neg dx
neg edx
and edx, 0xa72119a5
xor al, 9
sal edx, 0x4a
jnp 0x8f465b
inc al
ror dl, 0xc4
ror edx, 1
xor bl, al
push ebp
lea ebp, [edx*2 - 0x20c0a975]
bswap ebp
call fcn.009916b1
adc esi, 4
mov eax, ecx
xor edx, ebx
neg eax
neg ecx
cbw
sbb edx, eax
sal cx, 0xce
xadd eax, ecx
bswap edx
not edx
call fcn.00d00412
mov edx, 0x241b4a38
lea eax, [edx + edx - 0x7a5a11e3]
lea ecx, [eax + eax + 0xb0a5b9f]
lea ebp, [edx + ebp - 0x241b4a3c]
add eax, ecx
sar eax, 2
or cx, 0xdda5
mov eax, dword [ebp + edx - 0x241b4a38]
sub dl, 0xb7
bt ecx, edx
sar ecx, 0xc9
xor eax, ebx
lea ecx, [edx + 0x22aa8f8f]
bts ecx, ecx
shr cl, 3
dec eax
neg eax
bt edx, 0x9c
shr dl, cl
adc cl, cl
bswap eax
je 0x9c8cc7
rol ecx, 0x6b
inc eax
call fcn.008e141c
shl dl, 0x61
bswap eax
sbb word [esp + ecx*4 + 4], cx
xor ebx, eax
dec dl
call fcn.0082c53e
push 0xaabd039d
mov eax, dword [esi]
sal dword [esp], 0xbc
mov ecx, dword [esi + 4]
mov dword [esp + 4], ebx
jne 0x87475b
xchg ecx, eax
jmp 0x990649
or bh, al
adc al, 0x3e
dec ecx
adc dl, byte [ecx - 0x3e]
movsd dword es:[edi], dword [esi]
dec eax
dec edx
shr dword [0x8c9002d6], 1
out dx, al
int1
inc esp
jne 0x99064d
loope 0x990637
inc edx
push ss
or ebx, dword [edx]
inc ecx
bnd jbe 0x990680
and dword [eax + 0x30], 0x886e7ccd
scasd eax, dword es:[edi]
add eax, 0x8cf319f0
sbb byte [ecx + 0x12], 0xea
mov ecx, 0xdb591783
inc esp
and al, 0x2b
stosb byte es:[edi], al
outsb dx, byte [esi]
pushfd
inc edx
inc edi
invalid
mov ecx, 0x8a885b7
add dword [ebx + edx*8], edx
std
pop es
sal ch, 0xc9
cli
stosd dword es:[edi], eax
das
idiv ch
mov eax, dword [0xeb3e8c03]
invalid
shl eax, 0x95
sal dl, 3
xor ebx, ecx
push eax
rol word [esp + edx - 0x4e6e206f], 0xad
xor eax, 0x8e8fa4a5
adc edi, ecx
rol word [esp + edx - 0x4e6e206f], 0xa9
mov ecx, 0xef949a9b
pop edx
mov eax, dword [ebp + edx*2 - 0xe004000]
push edx
mov dx, word [ebp + edx*8 - 0x3800fffc]
xchg dword [esp], ecx
lea ebp, [ebp + ecx*2 - 0xe003ffa]
sbb dword [esp + ecx - 0x7002000], ecx
lea ecx, [ecx + ecx*8 - 0x3c58a277]
mov word [eax + ecx*2 - 0x550fb12], dx
mov dword [esp + ecx - 0x2a87d89], edi
ret

Function at 0x990afa
Capabilities:
Encode data using xor

Disassembly:
adc ebp, 4
dec word [esp + 4]
dec dword [esp + 4]
shrd ax, dx, cl
mov word [ebp], ax
mov eax, 0x4b023b39
mov edx, dword [esi + eax - 0x4b023b39]
pop ecx
xor dword [esp + eax - 0x4b023b39], eax
pop eax
lea esi, [esi + eax*4 + 0x593136c]
sar eax, 0x71
movzx ecx, al
add ecx, 0x7eba3c9e
xor edx, ebx
not cx
neg cx
neg edx
and ax, 0x2993
shr ecx, cl
inc edx
bswap edx
not eax
sar ax, cl
not ax
xor edx, 0xafa29dab
lea eax, [eax + 0x6e35dd34]
dec ecx
Function at 0x991521
Capabilities:
Encode data using base64

Disassembly:
rol edx, 3
sal cx, 0x42
jae 0x8f5514
adc cx, cx
sbb edx, 0xae225d9b
add al, ah
ror edx, 1
bt cx, cx
sbb edx, 0xd73a118c
ror edx, 3
shr ax, 0xe6
lea edx, [ecx + edx - 0x433af82e]
bswap edx
call fcn.009494ed
movzx cx, byte [ebp]
mov al, byte [ebp + 2]
mov edx, 0x91896737
xor dl, byte [esp + 6]
bts edx, 0xaa
adc ebp, 1
not cl
bt edx, edx
mov dword [esp], edx
not al
inc edx
shr dl, 0x84
dec dword [esp + 3]
and cl, al
mov word [ebp], cx
lea ecx, [edx*8 - 0xce7e8d8]
push edx
ror ecx, 0x3a
sbb esi, 3
jmp 0xd70d22
neg cl
ror edx, 3
dec edx
jmp 0x75dc16
mov esi, 0xc2b70fca
neg cl
lea esi, [eax + esi - 0xe701]
sub ecx, ecx
shr cx, 0xe6
not edx
mov edx, dword [esi + edx - 0x1902]
xor edx, ebx
sar al, 0x23
ror edx, 1
lea edx, [edx + ecx*2 - 0x73b9248e]
neg edx
add al, 0xa9
jle 0xd43fdc
shl dx, 0xe6
mov eax, dword [esi]
call fcn.00d6e2e7
xchg esp, eax
test dh, bh
sub byte [ebp + 7], ch
adc byte [esi], cl
xchg ecx, eax
xchg ecx, edi
fdivr qword [edi]
dec esp
xchg ecx, eax
xchg ebp, eax
or esp, esp
insb byte es:[edi], dx
loopne 0xd70ced
and al, 0x4f
or eax, 0xb7f9cb90
xchg ebx, eax
invalid

Function at 0x99d3f9
Capabilities:
Encode data using xor

Disassembly:
btr cx, ax
xor bx, dx
mov dword [esp + ecx - 0x1988e88c], ecx
lea ebp, [ebp + ecx - 0x1988e88e]
mov word [ebp + ecx*2 - 0x3311d118], dx
sar dword [esp + ecx - 0x1988e88c], 0x14
bts eax, 0x14
xadd dword [esp + ecx*2 - 0x3311d118], ecx
pop ecx
jno fcn.0081f8e9
invalid
Function at 0x9a0c7d
Capabilities:
Encode data using xor

Disassembly:
neg cx
neg edx
push eax
ror dword [esp + ecx*2 - 0x3fe0002], cl
rol edx, 2
ror word [esp + ecx - 0x1feffff], 0x8f
push eax
setae al
xor edx, 0x693a533b
dec edx
neg byte [esp + ecx*2 - 0x3fe0000]
xor ebx, edx
shl word [esp + ecx - 0x1ff0000], cl
cwde
adc edi, edx
mov eax, dword [esi + ecx*2 - 0x3fe0002]
movzx edx, cl
not dl
mov edx, dword [esi + ecx - 0x1fefffd]
lea esi, [esi + ecx*4 - 0x7fbfffc]
mov dword ss:[ecx + eax - 0x1ff0001], edx
movzx edx, cl
call fcn.0090caf9
sub cl, byte [ebx - 0x5d]
mov edi, 0x220ac96c
mov byte [0xbaf3d35a], al
mov byte [0xfe674558], al
push edx
and eax, 0x82c1913d
push edi
in al, dx
inc ebp
inc esp
movsd dword es:[edi], dword [esi]
arpl word [edi], cx
sbb edx, dword [ecx]
mov bh, byte [edx - 0x24]
movsd dword es:[edi], dword [esi]
popfd
lcall 0x656d, 0xa6a09d35
fninit
idiv byte [edi]
wait
add al, 0xed
adc al, 0x6d
idiv byte [edx - 5]
cmp eax, 0xa4c50b7b
stc
loop 0x7832ba
mov eax, 0x9ae59f45
inc ebp
lahf
in eax, 0x9a
inc ebx
mov bh, 0x9a
loop 0x78327e
inc ebp
inc edi
mov esi, 0x2585251e
push ecx
xchg ecx, eax
cmp eax, 0xebd07f91
sbb dl, byte [ecx]
bound eax, qword [edx - 2]
invalid
invalid
out dx, al
adc esp, eax
pop edx
mov byte [0x251527c3], al
and al, 0x82
int 0xda
mov dword [edx + 2], ecx
and eax, 0x7b756f8f
adc esp, dword [ebp + 0x25186deb]
jle 0x783317
pop esi
sbb ch, dl
or eax, 0xbe9b3349
mov dh, 0xda
popfd
adc byte [ebp - 0x2c47dfa6], dl
jge 0x783261
pop edx
dec ebx
mov esp, dword [ebx]
das
and ebp, dword [edi]
movsd dword es:[edi], dword [esi]
cmp dh, al
push ss
movsd dword es:[edi], dword [esi]
mov ch, 0x73
jg 0x783286
mov al, byte [edi]
salc
xor dword [0xcc5af6ac], 0xa2c73b83
invalid
bswap eax
lea eax, [edx + eax - 0x3b49e73f]
ror edx, 0x4a
xor ebx, eax
add edi, eax
pop eax
mov ecx, dword [ebp + edx*4 - 0x2d2288]
cdq
btc eax, edx
shl al, 0x27
or edx, dword [ebp + eax - 0x5a3fc]
not ax
lea ebp, [ebp + eax*2 - 0xab7f6]
shr ax, 0x63
mov dword [ecx + eax - 0x50b7f], edx
sbb ax, ax
lea eax, [eax*8 - 0x1b5a907c]
movzx ecx, al
jmp edi
xor edx, esi
push 0x7b82003f
push 0xbea1d617
push 0xb120b09e
inc ecx
call fcn.009a2e4e
mov edx, 0xbb351ea0
movsx eax, dx
cbw
lea ebp, [eax + ebp - 0xffa4]
movsx ecx, ax
mov edx, dword [eax + ebp - 0xffa0]
xor edx, ebx
xor eax, eax
dec eax
shr ecx, 0x87
rol edx, 1
jmp 0x7831bc

Function at 0x9b2e41
Capabilities:
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov dword [esp + edx - 0x3b8ca586], edx
mov dword [esp + edx - 0x3b8ca586], edi
or dl, 1
jb 0x98eec6
push ebx
mov ebx, eax
lea eax, [edx*8 + 0x54316b86]
mov edx, ebx
sal edx, 2
xadd al, ah
rol al, 0xc4
mov eax, ebp
add eax, edx
jmp 0xa0e447
Function at 0x9b32ed
Capabilities:
Encode data using base64

Disassembly:
adc eax, 0xc2800799
xor edx, 0xa585c8bd
neg edx
ror eax, cl
setae cl
xchg word [esp + 1], ax
ror edx, 3
xor ebx, edx
inc eax
lea ecx, [eax + ecx*4 + 0x5da63303]
or byte [esp + ecx - 0x79b7df0a], 0x1e
adc edi, edx
movsx edx, cx
rol edx, cl
lea esi, [esi + ecx - 0x79b7df10]
mov edx, dword [esi + ecx - 0x79b7df0c]
jae 0xd1f80b
xor edx, ebx
neg ecx
call fcn.0073a9e0
mov dword [esp], eax
xor edx, ebx
movzx ecx, al
lea edx, [edx + ecx*4 - 0x2338fa57]
inc ecx
cwde
not eax
not edx
xor edx, 0x4204e024
xor byte [esp + eax - 0x5a52], cl
btc ax, 0xb2
dec edx
xor edx, 0x4f90f19f
add cx, ax
shl eax, 7
rol word [esp + eax - 0x2d2b7e], 0x2c
ror edx, 2
sub eax, 0x641d2b3d
ror ecx, 0xe2
lea edx, [edx + ecx*8 - 0x611bc627]
neg ecx
adc ecx, eax
bswap edx
jne 0x9938f1

Function at 0x9ba8ef
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
shl dx, 0x68
xor ecx, 0xbc38e09b
neg edx
push edx
dec ecx
dec dword [esp + eax*2 - 0x1b8d7f3a]
or dx, dx
not ecx
bswap ecx
sbb edx, 0xd7131c1e
dec ecx
btr edx, edx
call fcn.00a0d9e2
inc ecx
mov eax, 0x6c31ac13
dec edx
mov ebp, dword [edi + eax - 0x6c31ac13]
xor byte [0x13b84100], al
lodsb al, byte [esi]
xor dword [edx + ecx*2 - 0x75], ebp
lodsb al, byte [esi]
pop es
in eax, dx
push ebx
into
xchg ebx, eax
dec edx
lea edi, [edi + eax - 0x6c31ac0b]
dec edx
lea esi, [esi + eax - 0x6c31ac15]
inc esi
movzx ebp, word [esi + eax - 0x6c31ac13]
inc cx
not eax
inc ecx
rol eax, 0xb
inc ecx
mov eax, eax
inc bp
xor ebp, esi
dec esi
lea ebx, [eax + eax*8 - 0x7374426f]
inc cx
add ebp, 0x8041cf30
loopne 0x9ba914
inc ebp
bts ebx, eax
inc cx
xor ebp, 0xff4844b5
shl byte [esi + 0x41], 0xf7
aad 0xbb
scasd eax, dword es:[edi]
jbe 0x9ba919
salc
inc cx
dec ebp
inc cx
xor ebp, 0xf444989
mov esi, 0xf3c166d3
sub eax, 0xd5814166
das
mov ah, byte [esi + 0x45]
xor edx, ebx
inc cx
ror ebp, 1
inc bp
xor esi, ebp
dec ecx
or edx, 0x1a2b9b32
call fcn.00cf2396
mov eax, 0xc11097b7
lea edx, [eax + eax*2 - 0x6467ee7c]
sub esi, 4
lea eax, [eax*2 + 0x34bcaa11]
shl edx, 0xfa
movzx ecx, ax
mov ecx, dword [esi + ecx*8 - 0x6cbf8]
ror dx, 0xc9
xadd ax, dx
sar dx, 0x41
xor ecx, ebx
jmp 0x80bb4e

Function at 0x9ca7ed
Capabilities:
Parse pe header

Disassembly:
sub esi, 2
mov eax, 0x9dbb14a0
movzx edx, ax
not al
mov dword [esp], edx
shr dl, 0x25
add al, dl
sub word [esp], 0x191a
sbb edx, dword [esp]
not al
setne dl
neg dx
sal dword [esp + edx*2 - 0x1cffe], 0x81
xor bl, al
lea edx, [edx + edx*8 + 0x79bea13b]
lea eax, [esp + eax + 4]
sar edx, 0xfd
jbe 0xd18bd4
dec edx
mov byte [eax + edx*2 - 4], cl
jg 0x91f12a
mov ecx, 0x433a478b
mov ecx, esi
jmp 0x91530d

Function at 0x9d1a02
Capabilities:
Encode data using xor

Disassembly:
adc edi, eax
rol cl, 0x47
movzx eax, word [esp + edx - 0xb67d]
mov dword [esp + edx - 0xb680], edi
ret 4
mov dword [esp], 0x132a1ea6
mov eax, dword [ebp]
not word [esp + 1]
jmp 0xd7691c
push edx
xor eax, ebx
rol eax, 1
lea ecx, [edx*2 + 0x6628edbb]
sar byte [esp + 2], 0xa2
neg eax
rol eax, 2
neg edx
shr edx, 0x8f
or byte [esp + edx*8 - 0x5b5e8], 0x8d
xor eax, 0x693a533b
dec eax
xor ebx, eax
shl dl, 0x87
jae 0x7f0a68