joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70886e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
btc edx, eax
btc dx, ax
pop edx
jae fcn.008360bb

Function at 0x70d7c5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc eax
movzx eax, ch
inc eax
dec dh
ror ecx, 2
xor ecx, 0x72312728
push eax
push eax
dec esp
mov dword [esp + esi - 0xb], esp
inc esp
mov esp, esi
dec esp
lea esi, [ebp*2 - 0x4c5cbe59]
xor dword [esp + eax - 0xc], ecx
dec esp
mov esp, dword [esp + esi*2 - 0x26]
imul ax
dec eax
arpl cx, cx
mul si
inc esp
movsx ebp, dl
and dl, byte [esp + esi*2 - 0x2d]
dec esp
adc ebx, ecx
inc ebp
movzx eax, byte [edx + eax*2 - 0xa565]
inc ecx
bswap ebp
inc ebp
xor al, ah
dec eax
mov dword [esp + esi*2 - 0x26], ebp
inc eax
mov byte [esp + esi - 0x17], ch
inc ecx
mov ebx, ebp
inc ecx
dec al
dec eax
sar edx, 4
inc ecx
rol al, 1
dec eax
ror dword [esp + edx*4 - 0x2a2abff0], 0x9a
imul edx
inc ecx
not al
dec ebp
sub esi, ecx
dec ebp
xchg ebp, esi
inc ecx
rol al, 1
inc ebp
xor ah, al
inc cx
btc esi, 0x14
cbw
inc eax
sub byte [esp + edx - 0x35b], ch
dec esi
lea eax, [esp + eax + 0x18]
dec ebp
mov edi, dword [eax + edx*4 - 0xd9c]
dec esp
mov dword [edi + edx - 0x36f], edi
inc esi
movzx edi, byte [edx + edx - 0x36d]
mov ecx, dword [esp + edx*2 - 0x6be]
sub bl, byte [esp + edx - 0x360]
dec ebp
lea edx, [edx + edx*2 - 0x6d4]
dec esp
lea eax, [ebx - 0x6f6ebedb]
inc cx
xadd eax, ebp
inc ecx
setns dh
inc ebp
xor bh, ah
inc ecx
xor bh, 0x23
dec eax
bt ebx, 0x21
not ax
call fcn.007f585d
mov dx, word [edi]
mov ecx, 0xa7ab189d
mov eax, 0x503d9db9
xchg ecx, eax
mov ax, word [edi + ecx - 0x503d9db7]
bts ecx, ecx
push ecx
mov cl, byte [edi + ecx - 0x523d9db5]
adc edi, 4
neg byte [esp + 1]
jno 0x7f5329
ror dword [esp], 0x99
shld dx, ax, cl
mov word [edi], dx
jmp 0x921a1d

Function at 0x70da9c
Capabilities:
Execute syscall

Disassembly:
mov dword [esp + ecx - 0x4f0a85c], 0xb996b78f
mov ecx, dword [esi + ecx - 0x4f0a85c]
xor ecx, ebx
dec ecx
pop edx
neg ecx
dec ecx
or edx, 0x2f8ce481
jae 0x8ebb3d
mov ecx, 0xfa85bc1f
push ecx
call fcn.00a4a664
sysenter
call fcn.007c9806
rol ecx, 1
sub dx, dx
movsx eax, dx
sub edx, 0xce22458b
xor ebx, ecx
imul eax, eax
or ax, dx
neg ax
add ebp, ecx
jmp 0xa1a3b2
jmp ebp

Function at 0x70e015
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
ror al, 1
neg al
inc al
neg al
mov dword [esp + edx*2 - 0x76], ecx
jmp 0xa4660f
xor bl, al
xchg byte [esp + edx - 0x3b], cl
or dword [esp + edx - 0x3b], edx
lea eax, [esp + eax + 4]
inc dword [esp + edx*2 - 0x76]
pop ecx
jne 0x73c269

Function at 0x70fbe0
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sal word [esp + 6], cl
mov dword [esp + 8], edx
xor ebx, eax
xadd ecx, edx
sar cx, 0xe6
mov dword [esp], 0xb88fe296
add edi, eax
pop ecx
pop edx
pop ecx
pop eax
jmp fcn.0092c225
Function at 0x712028
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0xcf89862b
xor edi, edx
and edi, 0xff
mov dword [esp + 8], 0xea3fb091
push 0xd62616be
dec dword [esp + 3]
mov edi, dword [edi*4 + 0x738048]
inc byte [esp + 5]
call fcn.00748df8
mov ecx, 0xf225393d
mov edx, ecx
lea ecx, [ecx + edx + 0x3f20621f]
mov eax, dword [ecx + esi - 0x236ad499]
lea edx, [edx + ecx*4 - 0x660b755]
lea esi, [esi + ecx*2 - 0x46d5a92e]
not ecx
xor eax, ebx
ror eax, 2
xadd cl, dl
dec edx
sbb eax, 0xefbbbab1
sar ecx, 0xe3
dec dl
bswap eax
sar edx, 0xdd
not eax
bswap edx
xor ebx, eax
add ecx, ecx
add ebp, eax
dec dx
sar edx, 0x7a
xor edx, edi
bts cx, 0x3d
sbb edi, 2
lea eax, [ecx*2 + 0x60a09223]
mov word [edi + eax - 0x4eeb67fb], dx
sal ecx, cl
jae fcn.008360bb
push edx
xchg byte [esp + edx*4 + 5], dh
ror al, 1
lea ecx, [edx + edx*4 + 0x1e04bb9b]
neg al
dec dword [esp + edx - 0x51fd]
cmove ecx, edx
ror al, 1
call fcn.007f5e0a
mov ecx, 0x41859817
xor ecx, ecx
lea edx, [ecx + ecx*8 - 0x35d0da4d]
mov ax, word [edi + ecx*8]
inc dx
add dx, 0x2da0
movzx edx, byte [ecx + ebp - 1]
xor dl, bl
rol dl, 1
and cl, cl
neg dl
rol dl, 1
dec dl
xor ecx, 0x57909c8c
sbb cx, cx
call fcn.009a65c9
Function at 0x713e2c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, dword [edi + eax - 0x4399cf37]
mov ecx, 0x8d2d2611
mov dword [esp], ecx
xor eax, ebx
add dword [esp], ecx
shr dword [esp], cl
rol dword [esp], 0xf
not eax
and ecx, ecx
movzx edx, cx
xadd ecx, edx
ror eax, 1
btc cx, 0xa8
lea eax, [eax + edx - 0x2e0628eb]
pop ecx
jae 0xa189ef
bts dx, 0x27
xor eax, 0x44b71c21
xor ebx, eax
bt cx, dx
shl ecx, 0xab
adc esi, eax
mov edx, dword [ebp]
movsx eax, cx
shr ax, 0x2a
mov ecx, dword [ebp + eax + 4]
sal eax, 0xc
or edx, ecx
call fcn.00899b83

Function at 0x714c57
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
adc edi, 3
call fcn.0089b7e0
mov ecx, 0x7435c5af
jmp 0xcb9ef6
mov edx, dword [esi + ecx - 0x7435c5af]
lea esi, [esi + ecx - 0x7435c5ab]
mov eax, ecx
shr al, 0x65
push ecx
xor edx, ebx
shl word [esp + eax - 0x7435c504], 0x4f
btr ax, cx
xor edx, 0x1d25250e
neg cl
sbb edx, 0x809cd686
rol edx, 3
bts cx, ax
xor edx, 0xf387c00c

Function at 0x717c5e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc edx
movzx edx, byte [ebp + edx - 0x10b5]
dec eax
mov dword [esp + ebp - 0x10b5], ebx
inc esp
movzx esi, bl
inc ecx
or al, dh
inc ecx
xor dl, ah
xadd ebp, eax
inc dl
not dl
btc bp, bp
ror bp, 0x4f
inc eax
div ch
inc ecx
xor dl, cl
xadd bl, ah
add byte [esp + eax*2 - 0x15c25], ah
inc ebp
movzx ebp, al
adc dl, 0x17
inc esp
xor ah, dl
movsx esi, word [esp + eax*8 - 0x570a8]
dec ecx
rol ecx, cl
dec eax
lea edx, [esp + edx + 8]
sar dword [esp + eax*2 - 0x15c26], cl
inc ebp
mov ecx, dword [edx + eax - 0xae15]
dec eax
dec dword [esp + eax*2 - 0x15c2a]
bts bx, si
dec eax
lea edi, [edi + eax*2 - 0x15c2e]
mov dword [edi + eax*2 - 0x15c2a], ecx
shr dword [esp + eax - 0xae15], 0xbf
inc ecx
pop eax
jb fcn.008c5046
mov edx, 0xc088b23b
movzx ecx, dx
mov eax, edx
mov eax, dword [edi + ecx - 0xb23b]
btc edx, edx
sal dl, 0x41
lea edi, [ecx + edi - 0xb237]
rol dl, 0x21
add ecx, ecx
bt ecx, 0x98
xor eax, ebx
bts dx, dx
setae cl
dec eax
inc cx
sar edx, cl
not eax
and cx, dx
neg eax
inc ecx
lea ecx, [edx*2 - 0x49d241c3]
lea eax, [eax + ecx - 0x7178e37f]
dec edx
dec edx
shl edx, 0x9a
xor ebx, eax
add ebp, eax
jmp 0xa1b5ca
xor ecx, ebx
sar eax, 0x6a
xor ecx, 0x3e03512e
jmp 0x9d10d2
movzx eax, dl
add eax, dword [esi + eax*8]
lea ecx, [edx + edx*2 + 0x2593d81c]
mov edx, dword [esi + 4]
add esi, 4
lea ecx, [ecx + ecx*8 - 0xe5fedc8]
shr cx, 0xcf
and ecx, ecx
not eax
sal ecx, cl
call fcn.009b2c08
sub esi, 4
mov edx, 0x5cb55609
movzx eax, dx
btc edx, 0x98
mov ecx, dword [eax + esi - 0x5609]
jae 0x754548
Function at 0x717e16
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
and dl, dh
rol al, 1
mov dword [esp + ecx - 0x53c4], ecx
bswap ecx
sub al, 0x81
not dword [esp + edx + 5]
xor bl, al
ror ecx, 0x21
sub dl, dh
rol ecx, 0xa6
lea eax, [esp + eax + 0xc]
push edx
shl cl, 0xc3
or cx, dx
mov cx, word [eax + edx*8]
lea ebp, [ebp + edx*2 - 2]
movsx eax, dl
add eax, 0xd8b2bc38
sar dword [esp + edx + 4], 0x76
mov word [edx + ebp], cx
jns 0x9743ee
jmp 0x91077a
mov ecx, dword [ebp]
push 0xf93d87b5
mov edx, 0x9a925e95
mov al, byte [ebp + 4]
add dx, dx
sbb edx, dword [esp]
not dx
adc ebp, 5
pop edx
div word [esp + edx + 7]
sal dword [esp + edx*2 - 0x2869], 0xdc
pop ecx
pop edx
pop ecx
pop edx
jp fcn.0089b138
mov esi, 0x512ff231
dec esp
mov edi, edi
inc eax
movzx ecx, dh
movzx edx, si
dec eax
lea edi, [edi + ecx - 0x35]
inc esp
mov dword [esi + edi - 0x512ff231], edi
inc esp
mov eax, edx
dec esi
lea edx, [ecx + edx - 0x35]
inc ecx
mov esi, dword [edx + esi - 0x512ff231]
inc ebp
movsx edi, al
ror cl, 0xe7
inc ecx
movsx ebx, ax
inc ecx
xor esi, esp
inc esp
xor bh, cl
movzx ebp, dl
not esi
inc ebp
or al, bh
and ebx, 0x4e82278c
inc ecx
sbb bl, bh
sbb esi, 0xbc381a37
inc eax
xadd cl, ch
dec eax
btr ecx, ebp
xor esi, 0x1db49336
dec eax
and edx, edx
dec ecx
shl edi, 0x3e
ror esi, 3
inc ecx
movzx eax, ax
inc ebp
movzx esi, ax
inc esp
mov ebp, ebp
lea esi, [esi + ebx*2 - 0xf041f30]
and bx, 0xe538
neg esi
inc ecx
push esp
xor dword [esp + ecx - 0x93], esi
inc ecx
pop esp
inc ecx
sal ebp, cl
cdq
inc esp
movsx ecx, cx
dec eax
arpl si, si
dec esp
adc ebx, esi
jmp fcn.008c5046
Function at 0x717f37
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov word [edx + eax*4 - 0x400], cx
movsx ecx, al
or al, cl
lea esi, [esi + eax*2 - 0x204]
xor ecx, dword [esi + eax*4 - 0x400]
xor ecx, ebx
neg ecx
bswap eax
lea edx, [eax - 0x50f1df55]
call fcn.009b821f
neg edx
rol al, 0x63
xor edx, 0xd00bb029
pop eax
xor eax, ecx
xor ebx, edx
imul cx, ax
and cx, cx
lea eax, [eax + eax - 0x4ff8f968]
adc ebp, edx
push ecx
imul ecx, dword [esp]
rdtsc
and dword [esp], ecx
sbb edi, 8
pop ecx
inc cx
mov dword [edi + 4], eax
mov dword [edi], edx
or cl, cl
movzx eax, cx
jp 0x7838ca
jae fcn.008ca50c
mov ecx, 0x1c8d3d81
lea edx, [ecx + ecx*4 + 0xa330600]
movzx ecx, word [ecx + edi - 0x1c8d3d83]
shr dx, 0x4d
mov eax, edx
xor cx, bx
neg edx
add cx, dx
bts ax, 0xa
ror al, 4
inc edx
not cx
inc cx
inc ax
not cx
jno 0x968027
mov ebx, 0x1df43184
cld
stosd dword es:[edi], eax
dec ebp
jp 0x717fc5
xor eax, 0xaa610cb7
cmp eax, 0xd50cb735
mov ah, 0xd
xor eax, 0xa8190cb7
xor eax, 0xad0cb735
movsb byte es:[edi], byte [esi]
add eax, 0x810cb735
out 0x55, al
xor eax, 0x227a0cb7
jne 0x71806a
xor ecx, dword [ecx]
imul edi, edi, 0x77001db5
fld xword [ecx + eax*8]
xchg ebp, eax
push dword [edi - 0x6a3e33a5]
invalid
mov dword [esp], 0x9d804f3f
mov edx, 0xfdb78531
sub ebp, 4
bt edx, 0x90
mov edx, dword [ebp]
mov eax, dword [esp]
mov word [esp + 2], ax
xor edx, ebx
pop eax
lea ecx, [eax*4 + 0x74981f06]
inc edx
push ecx
xor eax, ecx
ror edx, cl
pop ecx
lea eax, [ecx*8 - 0x674fd3fd]
dec ax
inc edx
add ecx, ecx
ror edx, 2
sub ecx, ecx
shr eax, 0xcf
call fcn.008ea9f0
mov edx, 0x802a40b3
sub esi, 1
movzx ecx, byte [esi]
movzx eax, dx
sar al, 0xa7
xor dx, 0xa27
xor cl, bl
ror dl, 0x66
sbb cl, al
jmp 0x763619
xor cl, al
shl eax, 0xdf
cdq
shl ax, 0xe1
xor cl, 0x3e
mul al
inc al
xor dl, dl
adc cl, al
shl eax, 0xfd
xor bl, cl
xor ax, dx
adc ecx, esp
and edx, 0xe187fe9e
dec ax
cdq
mov eax, dword [edx + ecx]
movsx ecx, dl
ja 0x9732fd
push edx
lea edi, [edi + edx*2 - 4]
sar ecx, 0x6d
mov dword [edi + edx*2], eax
xor byte [esp + ecx*2], dl
sete byte [esp + edx*2]
ror byte [esp + edx + 1], 3
lea esi, [esi + edx - 4]
shl word [esp + edx + 2], 0xc6
or edx, dword [esi + ecx]
mov eax, 0x488292a8
xor edx, ebx
ror edx, 1
call fcn.007042f0

Function at 0x7185ab
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp + esi*2 - 2], ebx
dec eax
sar dword [esp + esi + 0x15], 0x69
mov eax, dword [edi + esi*4]
Function at 0x71bdbc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
jno 0x9037d6
mov eax, 0x640a71a8
shr al, 0x47
movsx ecx, ax
lea ebp, [ebp + ecx - 0x7105]
movzx edx, cl
imul eax, ecx
cwde
mov ecx, dword [ebp + ecx*2 - 0xe202]
xadd edx, eax
cwde
lea edx, [eax*4 - 0x737cdfda]
xor ecx, ebx
sub ax, 0x8c08
not eax
lea ecx, [edx + ecx - 0x1c6c8ba3]
inc eax
sub al, dl
and al, dh
ror ecx, 1
rol edx, 0xb7
lea ecx, [ecx + edx - 0x49d913ca]
imul eax
not dx
ror ecx, 1
cbw
mul al
imul edx
xor ecx, 0x34820424
and edx, 0xd9166a81
lea edx, [eax + edx - 0x244975ef]
jbe 0x81eb6f
lea ecx, [eax + ecx + 0x2cab46a8]
btr eax, edx
shl eax, 0xe
sal dx, 0x23
xor ebx, ecx
inc eax
add esi, ecx
bt edx, eax
rol edx, 0x11
mov dx, word [edi + eax*4 - 4]
mov ax, word [edi + eax + 1]
mov ecx, 0x68862222
not cx
mov cl, byte [ecx + edi - 0x6886ddd9]
adc edi, 4
shrd dx, ax, cl
mov eax, 0xee36c7bf
lea ecx, [eax + eax - 0x215fb04f]
sub al, ch
mov word [edi], dx
jmp esi
dec dword [esp + eax*4 - 0x18c]
xor bl, cl
mov dword [esp + eax*2 - 0xc8], eax
sal al, 0xa5
lea ecx, [esp + ecx + 8]
dec word [esp + eax - 0x7d]
je 0x96f880
jl 0x706ca8
mov byte [ecx + eax - 0x80], dl
sbb al, byte [esp + eax - 0x80]
mov eax, dword [esi + eax*4 - 0x79]
pop edx
setbe dl
sbb esi, 9
pop edx
xor eax, ebx
add edx, edx
movsx ecx, dl
call fcn.008aa5bf
movzx dx, byte ss:[eax + ecx*2 - 0x71047a18]
ror ecx, cl
adc edi, 1
shr ecx, 0xb2
adc cl, 0x2c
jbe 0x70aea3
mov word [edi + ecx - 0x345d], dx
mov edx, 0x984403d
not edx
xchg cx, dx
lea ebp, [ecx + ebp - 0xbfc6]
neg cl
movsx eax, dl
mov edx, dword [ecx + ebp - 0xbf3e]
adc eax, 0xa134381f
setle al
sbb ax, cx
xor edx, ebx
lea edx, [edx + eax + 0x6e2d2ec]
dec ecx
xor edx, 0x1225798
jmp 0x7935f2
xchg ch, cl
lea edx, [edx + eax - 0x1589719e]
neg edx
bswap edx
bt ecx, 0xa8
shr ecx, 0x22
push ecx
xor ebx, edx
sar ax, cl
dec ecx
add esi, edx
mov dword [esp + ecx*2 - 0x1edc], esi
ret
not eax
mov ecx, dword [esi + edx*2]
or al, 0x31
sar eax, 0x82
xor ecx, ebx
lea ecx, [ecx + eax - 0x69ce404b]
xor ecx, eax
dec eax
lea ecx, [eax + ecx - 0x2fcabe4a]
bswap ecx
xor ebx, ecx
sub eax, eax
adc ebp, ecx
lea eax, [eax*8 - 0x1362f8d4]
add edx, ebp
jmp edx
Function at 0x71e79b
Capabilities:
Execute syscall

Disassembly:
dec eax
mov dword [esp + esi - 0xc6], 0xb79da625
dec esp
mov dword [esp + esi - 0xbe], esp
jae 0x8394eb
xor dword [esp + esi - 0xc5], esi
xor dword [esp + esi - 0xbe], eax
jmp 0x8d3cb9
dec esp
adc ebx, eax
or bx, 0xe420
dec esp
mov dword [esp + edx*2 - 0x1e41eaf4], ebx
ret 8
movsx ebx, byte [esp + esi - 0xc3]
dec esp
mov esp, dword [esp + esi*8 - 0x628]
inc ebp
movzx ebp, cx
inc ecx
shl ebp, 0xa5
jne 0xa41194
push 0x463e652f
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ecx
mov dword [esp + 4], 0x359f24a0
mov ecx, dword [esp + 4]
mov ebx, ecx
mov dword [ebp + ebx - 0x359f24a0], edx
sub ebx, 0x17b38f01
lea edx, [ecx - 0x347fa5d8]
mov ebx, dword [esp + ecx*2 - 0x6b3e4938]
movzx eax, word [esp + ecx - 0x359f249e]
and dword [esp + edx*4 - 0x47dfb1c], ecx
pop ecx
pop eax
pop edx
jge fcn.0089b138
sysenter
push ecx
pushfd
mov ecx, 0xad2c48b8
mov ecx, dword [esp + ecx + 0x52d3b74c]
mov dword [esp + 4], 0x60173770
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00809b07
dec eax
lea edi, [edi + ebx*8 - 0x19a]
inc eax
movzx eax, ch
mov word [edx + edi - 0x55f0b000], si
inc cx
adc esi, 0x34d7f8c
ret
dec eax
arpl ax, ax
ja 0x83c805
mov edx, 0x4611a184
lea eax, [edx + edx*2 + 0x74052e81]
ror dl, 0x47
mov ax, word [edi + edx - 0x4611a109]
shr dx, 0x64
mov cx, word [edi + edx - 0x46110a0e]
btc edx, edx
lea edi, [edi + edx - 0x46100a0e]
neg dx
not ax
and dl, dl
not cx
or ax, cx
push edx
mov word [edi + edx - 0x4610f5f0], ax
dec word [esp + edx - 0x4610f5ee]
lea ebp, [ebp + edx - 0x4610f5f4]
mov ecx, 0xac3f192e
neg byte [esp + edx - 0x4610f5f0]
mov eax, dword [ebp + edx - 0x4610f5f0]
jle 0xa21e47
adc dl, byte [esp + edx - 0x4610f5ed]
xor eax, ebx
btc dx, 5
call fcn.00807f9b
fidivr dword [edi - 0x4c]
add al, 0x62
add byte [ebp - 0x58], 0xba
fidiv word [eax - 0x455f964e]
fidiv word [eax + 0x215bcf50]
mov word [edi + 7], ds
push ecx
push es
xor dh, byte [edi + 0x3f]
mov esi, 0x152d9ace
insb byte es:[edi], dx
mov byte [0x152dbef4], al
insb byte es:[edi], dx
xchg al, bl
mov gs, word [0x96436c15]
xchg edi, eax
adc al, 0xc0
dec esp
and al, 3
adc edi, 5
call fcn.008a78ff
mov eax, 0x46b2fc91
lea edi, [edi + eax - 0x46b2fc95]
or eax, eax
add eax, 0xe6a85aa0
setp al
mov eax, dword [edi + eax*2 - 0x5ab6ae00]
push 0x9909780b
jg 0x8e9adf
call fcn.007ce035
add edi, 2
mov dword [esp + 4], 0x6ea16d8b
ror word [esp + 1], 0x48
ror dword [esp + 4], 1
shl dl, cl
mov eax, 0x578547a9
mov word [edi + eax - 0x578547a9], dx
mov dword [esp + eax - 0x578547a9], esi
ret 4
Function at 0x71fe99
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esi, [edx + esi - 4]
lea eax, [ecx + ecx*8 - 0x4075164c]
mov eax, dword [esi + edx*2]
or dword [esp + edx + 8], 0xc2c0f95
sub byte [esp + edx + 0xb], dh
rol byte [esp + edx*2 + 4], 0x87
xor eax, ebx
neg eax
pop edx
shr ecx, 0x8a
movsx edx, cx
lea eax, [eax + ecx*4 - 0x3c3d2aa9]
imul edx, edx
jo 0x704ad6
neg eax
shl cl, 0xe4
rol eax, 2
shr dx, 0x41
add byte [esp + ecx + 7], dl
adc eax, 0xbd1b438c
sub dword [esp + ecx + 1], ecx
xor ebx, eax
imul dx, dx
shr dx, 0xac
bswap edx
adc edi, eax
pop ecx
pop edx
jmp fcn.0098b9e9
Function at 0x729193
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ecx, dword [esp + ecx - 0x9a4b]
mov dword [esp + ebx - 0x381b6598], ebx
call fcn.00cbc757

Function at 0x72da4b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shr ebp, 0xae
dec eax
mov dword [esp + ebp - 0x400], ebp
dec eax
lea edi, [ebx + edi + 0x45627ba1]
or word [esp + ebp*2 - 0x7f6], 0x84
inc ecx
ror ebp, 0xbe
dec ecx
and ebp, 0xb0a23099
pop ebx
pop ebp
jae fcn.008c5046
not ecx
inc ecx
movsx edx, ax
movzx ebp, dx
inc esp
movzx ebp, bl
sub ecx, 0xbc381a38
dec eax
shl ebx, 0xc2
mov esi, 0xc533173d
call fcn.008e6612
mov edx, 0x8990e906
mov dx, word [ebp]
mov ecx, 0x1886fdb2
movzx eax, cl
push eax
mov ax, word [ebp + ecx - 0x1886fdb0]
xadd byte [esp + ecx*2 - 0x310dfb63], ch
setg cl
lea ecx, [ecx*2 + 0x599c3698]
mov cl, byte [ebp + 4]
adc ebp, 4
sal dword [esp], 0x7b
not byte [esp + 2]
call fcn.008c3c84
inc edx
mov ecx, dword [edi + esi - 0x6a920398]
dec ebx
lea esi, [eax + esi - 0x634946c2]
call fcn.0082d19d
push 0x539ea419
mov edx, dword [esp]
or dword [esp + edx - 0x539ea419], edx
mov dx, word [ebp + edx - 0x539ea419]
rol byte [esp + 2], 0x66
mov eax, 0x3f965a10
lea ebp, [ebp + eax - 0x3f965a0e]
lea edi, [edi + eax*2 - 0x7f2cb421]
movzx eax, byte [edi + eax*2 - 0x7f2cb420]
mov ecx, dword [esp]
sal ecx, cl
xor al, bl
ror ecx, 0x1f
sub cl, ch
dec ecx
adc al, 0x2e
rol al, 1
xchg dword [esp + ecx - 0x63ffffff], ecx
xadd word [esp + ecx - 0x53a7a417], cx
neg al
neg ecx
add al, cl
and cl, ch
shl ecx, 0x26
xor bl, al
not ecx
dec cx
lea eax, [esp + eax + 4]
mov word [eax], dx
and ecx, ecx
xor dword [esp], ecx
call fcn.0092b371
sal dword [esp + eax - 0x4a2f9e40], 0xac
adc edi, ecx
cwd
sar eax, 0x14
movzx ax, byte [esi + eax*4 - 0x1288]
lea ecx, [edx + edx*4 + 0x2e8051a3]
sub edx, edx
adc dl, byte [esi + edx + 2]
xchg dword [esp], ecx
sar cx, 0xae
lea esi, [esi + ecx - 0xc37fffd]
not dword [esp + ecx - 0xc37ffff]
and ecx, dword [esp + ecx - 0xc37ffff]
ror dword [esp + ecx - 0x422ae61], cl
or al, dl
movzx edx, word [esp + ecx - 0x422ae61]
not byte [esp + ecx*8 - 0x21157308]
not al
mov word [esi + ecx - 0x422ae61], ax
add cl, ch
mov dword [esp + ecx*8 - 0x21157078], edi
ret

Function at 0x72f701
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
rol eax, 1
inc esi
movsx esi, byte [esp + ecx - 0xef]
inc ecx
sub eax, 0xbb29c319
dec esp
lea ebp, [ecx - 0x4ddafcd2]
inc ecx
xor eax, 0x5c094226
inc esp
sub eax, ebp
btr edx, 0xb2
inc ecx
bt ebp, edx
dec esp
mov dword [esp + ebx - 0x7fffffe8], esp
jae 0x8e6649
inc edx
rol dword [esp + ecx*2 - 0x1f0], cl
not bp
inc esi
xor dword [esp + ecx*2 - 0x1e4], eax
dec esp
mov esp, dword [esp + ebx - 0x7fffffe8]
inc ecx
shr dh, 7
dec ebp
arpl ax, ax
dec eax
mov dword [esp + ebx - 0x7fffffe8], ebx
inc ebp
xor dh, cl
dec ebp
adc ebx, eax
inc ecx
movzx esi, cx
inc ecx
rol esi, 0x4e
pop ebx
pop ebx
pop eax
pop ebx
jae fcn.008c5046
pop ax
mov esp, dword [eax]
cmp dword [ecx - 0x5a], edx
lodsb al, byte [esi]
inc ebp
dec esi
outsb dx, byte [esi]
hlt
Function at 0x734899
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov edx, 0xef93ed28
lea edx, [edx + edx*4 + 0x1184a88c]
pop eax
mov al, byte [ebp + eax - 0x66840d82]
add ebp, 2
xor dl, dl
inc dl
push edx
not cl
cmovnp dx, word [esp]
not al
dec dword [esp]
neg byte [esp + 3]
and cl, al
push edx
rol dword [esp], 6
bts edx, edx
mov word [ebp], cx
sbb edi, 4
dec edx
ror dword [esp + 3], 9
pop ecx
mov eax, dword [edi]
xor eax, ebx
sal edx, 0x5b
inc dx
lea eax, [eax + edx*8 + 0x790b6485]
push edx
pop ecx
ror eax, cl
dec eax
btr ecx, ecx
or ecx, edx
not eax
sbb dx, dx
xor ebx, eax
add esi, eax
sal byte [esp + edx*4 - 0x3ffffffd], 2
mov dword [esp + edx*2 - 0x20000000], esi
ret
pop ecx
jno fcn.008ca50c
push 0xe39e3502
adc esi, 4
shld dx, ax, cl
sal word [esp + 1], 0x81
mov word [esi], dx
jae 0x9d5af1
mov eax, dword [edi]
shr dword [esp], 0x83
mov edx, 0xf1ac826
lea edi, [edi + edx*2 - 0x1e359048]
mov dword [esp + edx - 0xf1ac826], edx
xor eax, ebx
lea ecx, [edx + edx*8 - 0x22c51f52]
bswap eax
dec eax
and cx, 0xcc19
xor eax, 0xf71c02af
inc dword [esp + edx - 0xf1ac826]
jo 0x7066f9
call fcn.007e9233
not eax
setg cl
sal cx, 0xa
lea eax, [eax + ecx + 0x6f20742a]
not eax
ja 0xa0bbb0
jbe 0x7e4b9a
xor ebx, eax
push edx
sub word [esp + edx*8 - 0x5ed], 0xd8b4
jg 0xa06f72
sub eax, 0x9903b900
setge al
ror ecx, 1
idiv eax
add dx, ax
sbb ecx, edx
bswap ecx
sar edx, 0x79
xor ebx, ecx
rol eax, 0xfd
shl eax, 0x99
adc edi, ecx
add edx, edi
jmp edx
xor ebx, eax
imul ecx, dword [esp + ecx]
jo 0x831a32
rol dword [esp + ecx], 0x15
adc ebp, eax
pop ecx
lea eax, [ecx + edx + 0x45271193]
mov ecx, dword [edi + ecx - 0x1fffde]
btr edx, edx
and dx, ax
lea edi, [edi + eax*2 - 0x4999aae0]
movzx eax, byte [esi + eax*2 - 0x4999aae2]
sub edx, edx
lea esi, [edx + esi + 5]
lea edx, [edx + 0x1a125b4]
xor al, bl
rol dx, 0xac
ror al, 1
lea edx, [edx*8 - 0x447366c3]
add dx, 0x5083
adc dl, dl
xor al, 0x23
and dl, dh
shl edx, 0xc1
neg al
not al
rol dx, 0x81
push edx
rol word [esp + 1], 0xa
dec al
xor al, 0xa1
call fcn.00a15b59
sal edx, 0xde
neg cl
btr eax, eax
xor ax, dx
xor cl, 0x80
xor dx, dx
shr eax, 0x91
cwd
adc cl, 0x8f
not dl
ror cl, 1
sar al, 0x47
sbb dl, 0x26
xor bl, cl
cdq
bts eax, edx
lea esi, [esi + edx - 2]
bts dx, 0x99
mov word [esi + edx*2 - 0x400], cx
movsx ecx, al
jae fcn.007194ad
push 0xc37d723
mov dword [esp + 8], 0x8ea45b30
dec ecx
call fcn.007fb860
adc edi, eax
call fcn.009bb971
mov edx, 0x81b03e0b
mov ecx, dword [ebp]
mov ax, word [ebp + 4]
add dx, dx
or dl, 0x8d
sar edx, 0xc
adc ebp, 5
mov word ss:[ecx], ax
movzx eax, dl
shr eax, 0x14
sbb edx, 0x2c2c0e2e
mov ecx, dword [esi + eax]
lea esi, [eax + esi + 4]
xor ecx, ebx
cwde
and al, ah
inc ecx
dec edx
imul eax
bt dx, dx
neg ecx
jmp 0x760f6a
btc dx, dx
add al, ah
neg ecx
call fcn.009cc468
Function at 0x734931
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ecx, 0xb59a3c16
mov edi, dword [esp + 4]
lea esp, [esp + 8]
call fcn.008379fc
add edi, 4
lea ecx, [eax + eax*4 - 0x8673254]
bts eax, eax
xor edx, ebx
xchg al, cl
sal cx, 0x28
xor edx, 0xd808428d
dec edx
shr ecx, 0xec
bts ax, cx
xor cl, al
xor edx, 0xf8a82d05
sar ax, 7
jnp 0x748441
mov edx, 0x1a00f2f
lea ecx, [edx + edx - 0x5ed7d461]
mov ecx, dword [edi + edx*2 - 0x3401e5e]
lea edi, [edi + edx*4 - 0x6803cb8]
btc edx, 0x9b
lea eax, [edx + edx*2 + 0x6d06e015]
xor ecx, ebx
inc ecx
not dx
inc eax
bswap ecx
ror al, 0xa4
not ecx
dec eax
sbb al, 0x38
add eax, 0x4ea02eb6
dec ecx
dec dl
sete dl
and dx, dx
xor ebx, ecx
add ebp, ecx
mov eax, dword [esi + edx - 0x9a0f000]
movzx ecx, dl
sar cx, 0xa1
mov edx, dword [esi + edx*2 - 0x1341dffc]
call fcn.0078759e
dec edx
idiv al
neg cl
sbb cx, ax
xor ebx, edx
add ebp, edx
lea ecx, [eax*2 - 0x7d6bdd71]
mov dx, word [esi + ecx - 0x5ade2291]
bswap eax
imul ax, cx
mov ax, word [esi + eax - 0x100d2aa]
call fcn.009899c8

Function at 0x7349dd
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg esi
cwd
bswap esi
dec eax
mov dword [esp + ebx*2 - 0x7715d168], 0x70102296
inc ebp
movsx esi, ch
inc esi
dec esi
mov dword [esp + ebp*2 - 0x178aeb68], ebp
dec esi
mov dword [esp + ebp - 0xbc575b0], esp
inc edx
xor dword [esp + ebp - 0xbc575b0], esi
dec esi
mov esp, dword [esp + ebp*2 - 0x178aeb68]
inc esp
xchg dl, al
sar cx, 0xa4
dec eax
arpl si, si
cwd
inc cx
idiv ecx
inc ecx
push ebp
dec esp
add ebx, esi
inc cx
xchg esi, ebp
pop ebp
inc ecx
pop esi
pop edx
jmp fcn.008c5046

Function at 0x734c9e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ax, word [eax + ebp - 0x258fe]
shr dword [esp + ecx*2 - 0x1cd2], cl
lea ebp, [ecx + ebp - 0xe6b]
jb 0x744dee
not dx
or cl, byte [esp + ecx*2 - 0x1cd1]
mov dword [esp + ecx - 0xe69], ecx
ror dword [esp + ecx - 0xe65], cl
not ax
sets cl
mov dword [esp + ecx - 0xe00], 0x3c21d22d
and ecx, 0xb288be14
or dx, ax
sub cx, word [esp + ecx - 0xdf6]
mov word [ebp + ecx*4 - 0x35c0], dx
xchg byte [esp + ecx*2 - 0x1ad8], cl
mov dword [esp + ecx*4 - 0x3400], edi
ret 8