joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9c49cc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jno 0x98efea
mov eax, 0xd8a7c215
inc esp
movsx eax, ax
inc ecx
movsx esi, al
dec eax
mov esi, dword [edi + esi - 0x15]
mov cl, byte [edi + 8]
inc ebp
mov ebp, eax
inc ecx
movzx ebp, bp
dec eax
sal esi, cl
inc ecx
mov esi, 0x7cb9f025
inc cx
sar eax, 0xc4
dec eax
mov dword [edi + ebp*2 - 0x18428], esi
dec esp
mov ecx, dword [edi + ebp*2 - 0x18428]
mov edx, eax
dec ecx
lea ecx, [esi + ebp + 0x621abf9f]
dec edx
mov ebp, dword [edi + esi - 0x7cb9f01b]
mul dl
inc esp
xadd dl, al
inc ecx
btc eax, 0xb5
dec esp
add ecx, ebp
dec eax
lea edx, [eax + 0x2926e81b]
movzx ebp, al
dec eax
rol ebp, cl
dec esi
mov dword [edi + esi - 0x7cb9f01b], ecx
dec edx
lea edi, [edi + esi - 0x7cb9f01b]
inc ecx
sub ebp, 0xe5a1e5ae
inc edi
mov ebp, dword [edx + ebp*2 - 0x34bbb8d2]
push edx
inc dx
sub dword [esp + esi - 0x7cb9f022], ecx
inc esp
movzx ecx, dl
dec edi
lea edx, [esi + edx - 0x7cb9f029]
inc ebp
xor ebp, esp
movsx ebx, dl
dec eax
cwde
dec bx
inc edi
lea ebp, [ebp + esi + 0x11030f86]
inc ecx
bswap ebp
inc cx
xchg eax, ebx
sar byte [esp + eax + 0x2758fe49], 0x82
dec eax
dec eax
inc ecx
xor ebp, 0xfc0bc319
dec ecx
and eax, esi
inc ecx
push eax
call fcn.009a77d1
dec eax
mov dword [esp], 0xbb314794
call fcn.0073fd82
cmovae ebp, ecx
dec eax
mov dword [edi + edx - 0x2c3000fd], esi
dec eax
lea ecx, [ecx + ecx*4 + 0x15ae7f00]
inc ebp
movzx esi, di
dec eax
lea edi, [edx + edi - 0x2c3000fd]
dec eax
cdq
inc cx
shr ecx, 0x81
inc ecx
sal ecx, 0x69
inc ebp
add esi, dword [edx + edx - 5]
bt cx, 0x3b
dec edi
lea edx, [edx + edi - 5]
inc esp
adc eax, ecx
inc ebp
xor esi, esp
dec ecx
bswap ecx
inc edi
lea esi, [esi + edi + 0x63865439]
inc ecx
shr bh, 0x83
jne 0x82b543
inc ecx
movzx esi, di
inc ecx
ror esi, 1
inc ebp
lea esi, [esi + edx*4 + 0x7905298e]
inc ecx
neg esi
inc ecx
push esp
dec esp
lea esp, [esi*8 + 0x2ea9bd02]
inc ecx
add bl, cl
inc ecx
shl ecx, cl
inc esp
xor dword [esp + edx*2], esi
cwde
dec bl
inc ecx
pop esp
dec eax
inc ebp
bts edx, edx
dec ebp
arpl si, si
push edx
inc esp
xadd dl, cl
shl cl, 0xc1
dec ebp
add ebx, esi
pop eax
jmp fcn.008c5046

Function at 0x9c80bd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + eax - 0xfe], eax
or cx, 0x3711
ror edx, 1
call fcn.00946a5c
Function at 0x9cc336
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec byte [esp + esi*2 - 0x130]
bswap eax
dec esp
lea ecx, [edx*4 + 0x9a2d2ac]
neg eax
dec esp
mov dword [esp + esi - 0x97], esp
dec esp
xor eax, dword [esp + esi*2 - 0x13e]
inc edx
xor dword [esp + eax - 0xd60a43d], eax
dec esi
lea esi, [ecx*2 + 0x40919992]
dec edx
or dword [esp + eax*2 - 0x1ac1488a], 0xe8a36d21
dec edx
neg dword [esp + eax - 0xd60a445]
dec esi
mov esp, dword [esp + eax*2 - 0x1ac14882]
dec eax
arpl ax, ax
jno 0xa27349
inc ecx
inc ecx
dec edx
mov dword [esp + eax*8], ecx
ror dl, 1
dec edx
sub dword [esp + esi - 0x6eaa0617], 0xb42a273c
neg dl
inc cx
sar esi, 2
inc ecx
pop edi
inc ecx
sbb dl, al
inc ecx
ror ecx, cl
inc sp
xadd ecx, esi
xor dl, 0x11
inc ebp
movzx ebp, cx
inc cx
bt ebp, 0xb8
movzx ebp, bl
inc esp
xor ah, dl
dec eax
lea ebx, [ebp + ecx*2 - 0x17e2eb56]
dec eax
add edx, esp
inc ecx
mov byte [eax + edx], dh
bswap ebx
dec edi
lea edx, [eax + edx - 4]
dec eax
shl ebx, cl
inc ebx
mov ebx, dword [edx + eax]
inc eax
movzx esi, ch
dec edx
lea eax, [ebp*8 + 0x5ca2a49a]
inc ecx
xor ebx, esp
dec ecx
lea eax, [edi - 0x4154cc4f]
inc ecx
ror bh, 0xc6
xor ebx, 0xb06ceaa
dec edx
lea edx, [esi*8 + 0x678457a7]
xchg dx, ax
dec ebp
sub esi, eax
inc ecx
lea ebx, [esi + ebx - 0x3b182803]
neg ebx
dec eax
dec edx
dec edx
lea ebp, [edi*2 + 0x4340238]
dec ecx
lea esi, [esi - 0x1fd698ff]
inc ebx
dec ecx
sal esi, 0x58
inc ecx
push esp
sal bp, 0xe1
dec ebp
lea ecx, [esi - 0x44679a5b]
dec eax
inc eax
inc edx
xor dword [esp + eax], ebx
dec ecx
xadd eax, eax
dec ecx
rol eax, cl
inc ecx
pop esp
inc ecx
setns dh
inc ebp
btc esi, ebp
dec eax
arpl bx, bx
jae 0x99b65b
inc ecx
sub ebp, edi
dec esp
adc ebx, ebx
inc ecx
inc bh
sal dx, 0xc1
dec ebp
lea eax, [ebp + 0x2809909b]
dec ecx
xor eax, ebx
jmp eax
dec esp
add ebx, eax
dec edx
sar dword [esp + eax*2 - 0x1ac1488a], 0x34
inc ecx
pop ecx
dec ebp
or ecx, dword [ecx + edi]
add dx, 0x7bb2
dec ecx
shl esi, 0x6e
dec edx
mov edx, dword [edi + eax*2 - 0x1ac14882]
movzx eax, bl
dec eax
mov dword [esp + esi - 0x9f], 0x6899b1b9
dec ecx
sar esi, 0xb4
dec edx
lea edi, [edi + eax*2 - 0x1ac1487a]
inc esi
movzx edi, word [esp + eax*8 - 0x6b052226]
dec ebx
mov dword [eax + ecx - 0xd60a445], edx
inc ecx
movsx ecx, di
dec esi
mov dword [esp + eax*2 - 0x1ac1488a], ebx
ret
Function at 0x9ce036
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec al
jmp 0x8f3db5
xor bl, al
lea eax, [esp + eax + 0xc]
or cl, byte [esp + ecx*2 + 5]
mov cx, word [eax + ecx - 0xa2]
lea edi, [edi + edx - 0x62ee4002]
mov eax, edx
mov word [edi + eax - 0x62ee4000], cx
not byte [esp + edx - 0x62ee3ff7]
xchg dword [esp + eax - 0x62ee3ff8], edx
mul byte [esp + edx*2 - 0x383fe]
pop edx
pop ecx
pop eax
jno fcn.008360bb
mov word [eax + edi - 0xff], dx
mov ecx, eax
ror cl, 0x67
mul dword [esp + eax*2 - 0x1fe]
pop edx
jno fcn.00cad447
push edx
bswap eax
adc ecx, 0x1f31ce2d
neg eax
xor ebx, eax
sal dl, 0x82
xchg ecx, edx
sar cl, 1
adc ebp, eax
jmp 0x98d131
pop ecx
jmp ebp
dec ebp
arpl si, si
bswap ecx
dec ebp
add ebx, esi
dec ebp
lea edx, [edx + edx*8 - 0x7f9]
inc si
xchg dword [esp + edi*2 - 0x127ec], edi
not bx
inc ebx
movzx ebp, byte [edx + edi*2]
inc ecx
xor ch, ah
dec esp
mov dword [esp + edx*8 - 0x7e8], ecx
inc eax
rol ch, 1
inc eax
sub ch, dl
inc si
inc eax
ror ch, 1
inc ebp
btc ebp, ebp
inc eax
sbb ch, 0x9b
inc eax
neg ch
cwd
inc esp
xor ah, ch
inc ecx
pop ebp
inc cx
sub ebx, edi
dec edx
lea edi, [edi + edi*2 - 2]
inc edx
xor dword [esp + edi*2 + 1], 0x70a7c91
dec eax
cdq
call fcn.007c232b
setb byte [esp + ecx + 8]
dec al
neg al
bswap ecx
jmp 0x732266
Function at 0x9cfd2e
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
xor edx, 0xe6ae9cbf
pop eax
lea eax, [ecx + ecx*4 + 0x6ba92708]
rol edx, 1
push eax
xor ebx, edx
or byte [esp + eax - 0x40de3357], ah
sar cl, 0x47
lea edi, [edi + eax - 0x40de3360]
mov dword [edi + eax - 0x40de335c], edx
mov ecx, dword [eax + esi - 0x40de335c]
lea esi, [esi + eax - 0x40de3358]
xor ecx, ebx
movzx edx, byte [esp + eax - 0x40de3358]
xor ecx, 0x1d25250e
sub ecx, 0x809cd687
rol ecx, 3
add edx, 0xbf3691b4
xor ecx, 0xf387c00c
xor ebx, ecx
mul edx
push eax
add ebp, ecx
lea ecx, [edx + eax*8 + 0x4029ca86]
rol byte [esp + eax - 0x2173bd5], 0x61
pop edx
pop eax
pop ecx
jb fcn.008360bb

Function at 0x9d1143
Capabilities:
Encode data using xor

Disassembly:
jbe 0x734de5
mov ecx, 0x34175096
and ecx, 0x4ab4e3ab
shr ecx, 0x5a
lea ebp, [ebp + ecx - 4]
adc ecx, dword [ebp + ecx]
call fcn.009737bd
ljmp 0xf2ef

Function at 0x9d239b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea ebp, [ebp + eax - 0x760b0845]
rol eax, 0xdf
btc eax, eax
btr eax, 0
shl dl, cl
cbw
ror ax, 0xe5
mov word [ebp], dx
movzx ecx, al
dec cl
mov edx, dword [esi + ecx]
lea esi, [ecx + esi + 4]
or cx, cx
cwde
xor edx, ebx
neg eax
adc cx, ax
sbb edx, 0xa53ff213
ror eax, 0x24
bswap edx
or al, ah
btr cx, cx
lea edx, [edx + ecx*4 + 0x200f488a]
setae cl
imul ax, ax
bts eax, ecx
neg edx
not edx
push ecx
rol cx, cl
rol eax, cl
xor edx, 0x3da18b0d
and ecx, dword [esp + ecx - 0x6003]
dec edx
and word [esp + ecx - 0x2001], 0x5a0a
xor ebx, edx
and cx, word [esp + ecx - 0x2000]
sal eax, 0x32
add edi, edx
mov dword [esp + ecx], edi
ret
push 0xb6156932
lea esp, [esp + 4]
jne 0x93e154
xor eax, 0x91107fbf
not byte [esp]
bswap eax
call fcn.007a0357
mov dword [esp], 0xceaa40b2
push 0xa2af7718
adc esi, 3
dec word [esp + 4]
jp 0xa12035
mov dword [esp], 0x633bc9b9
sub dword [esp], 0xdbadc137
mov dword [esp], eax
dec ebx
jmp 0x7ffad1
xor eax, ebx
ror eax, 1
inc dword [esp + 4]
setg byte [esp + 1]
dec eax
sar dword [esp + 4], 0xdb
jb 0x8ce74f
xor bl, al
not dx
neg dx
call fcn.007b4d99
jae 0x9ce099
mov edx, 0x8cb1e516
movzx ecx, dl
neg ecx
movzx dx, byte [ebp]
or ecx, ecx
mov cl, byte [ebp + 2]
mov eax, 0x760b08b9
neg al
jbe 0x7b8db6

Function at 0x9d2ea6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
adc edi, 5
call 0xa3a4e3

Function at 0x9d36ee
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
or word [esp + 9], 0xa81b
call fcn.009582d7

Function at 0x9f5d9a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esp
adc ebx, edx
inc ecx
pop ecx
pop eax
inc ecx
pop eax
inc ecx
pop ebp
inc ecx
pop ecx
jmp fcn.008c5046
Function at 0x9f7162
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add eax, edx
push 0xcf81871a
mov dword [ebp - 4], eax
mov dword [esp], 0xd1b824a1
shl dword [esp], 0x88
call fcn.00ca52b7
pop eax
or cl, dl
mov edx, 0x58072b9d
mov word [edi + eax - 0x10040], cx
movzx ecx, ax
xchg cx, dx
movzx eax, byte [ebp + eax*2 - 0x20089]
jmp 0x8f0946
lea ebp, [edx + ebp - 0x58070047]
xchg dl, cl
xor al, bl
lea ecx, [edx + edx + 0x4787a3ab]
not al
btc ecx, ecx
call fcn.007bf972
call fcn.007a7a05
lea ecx, [ecx*4 + 0x3b071b30]
setb al
xor dl, bl
xor ecx, 0x9ab36123
cwde
setp cl
adc dl, 0xa0
rol dl, cl
btc ecx, eax
adc cl, al
lea ecx, [ecx*4 - 0x54d1b7f3]
not dl
btr eax, 0xa9
ror cx, 0x4c
sbb dl, al
sal ecx, cl
adc edi, edx
pop edx
ror ecx, 0x42
add dword [esp + ecx - 0x74ffffc], eax
lea esi, [esi + ecx*2 - 0xea00001]
jno 0xa443f2
push 0xd5b95fbe
shl edx, 2
shr dword [esp + 4], 0x1b
mov eax, ebp
add eax, edx
sar byte [esp + 6], 0xe6
mov dword [esp + 1], 0x39b67b18
mov dword [ebp - 4], eax
shr dword [esp + 2], 0xaf
test ebx, ebx
call fcn.0076f17e
movzx ecx, byte [ecx + esi - 0x7500000]
movzx edx, ax
not ax
mov dword [esp + edx - 0xffef], eax
xor cl, bl
inc cl
shr ax, 0x85
rol cl, 1
or edx, dword [esp + edx - 0xffee]
btr edx, edx
sbb cl, 0x87
neg cl
xchg dword [esp + edx - 0x2cff7fef], edx
xor cl, 0x31
xor bl, cl
lea ecx, [esp + ecx + 8]
xor eax, edx
mov eax, dword [ecx + eax - 0x10]
and dx, dx
bswap edx
lea ebp, [edx + ebp - 0x10010003]
neg dl
mov dword [ebp + edx*2 - 0x2001fe02], eax
not word [esp + edx - 0x1000ff00]
bts dx, 0xbf
pop edx
pop ecx
jb fcn.0098b9e9
shl edx, 2
add ax, ax
mov eax, ebp
jle 0x7a80f1

Function at 0x9f98fb
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0xed8d8585
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [ebp + 8], ebx
imul eax, eax
mov dword [ebp + 4], ecx
mov dword [ebp], edx
mov ebx, dword [esp + 0xc]
mov edx, eax
movzx ecx, dl
pop eax
pop ecx
pop eax
pop eax
jb fcn.0098b9e9

Function at 0x9fc750
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + 4], 0xaedc97
mov dword [esp], 0xce969f17
xor dl, 0x2f
mov dword [esp + 3], ecx
push ecx
rol dl, 1
sal cx, 0x88
lea ecx, [ecx*2 - 0x10e309d6]
ror dword [esp + ecx - 0x34e36822], 0x63
xor dl, 0xa7
rol cx, cl
neg dl
sub ecx, dword [esp + ecx*2 - 0x69c75338]
ror dl, 1
not ecx
not byte [esp + ecx*2 - 0x56616578]
xor bl, dl
lea edx, [esp + edx + 0xc]
mov dword [edx + ecx*2 - 0x56616580], eax
mov edx, dword [ebp + ecx*2 - 0x56616585]
sal ecx, 0x1f
dec ecx
movzx eax, cl
xor edx, ebx
or cl, ch
adc edx, ecx
bswap edx
xadd al, ch
sal dword [esp + eax - 0xfe], 0x51
rol edx, 1
lea edx, [ecx + edx - 0x11defb63]
call fcn.009c80bd
Function at 0xa075a4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop eax
pop edx
jp fcn.008360bb
movzx eax, byte [esi]
xor al, bl
mov ecx, 0x56a6160f
xor cl, 5
sar cx, cl
ror al, 1
sub cx, cx
xor al, 0x86
dec al
xor al, 0x20
jmp 0xca781c
bswap eax
neg edx
mov dword [esp], 0xf4931486
ror eax, 1
bswap ecx
not eax
or cl, cl
shl ecx, cl
lea eax, [eax + ecx - 0x3991d4ef]
xor eax, 0xb2bf099c
xchg word [esp + 1], cx
push ecx
xor ebx, eax
add ebp, eax
not byte [esp + 5]
sub edx, edx
mov eax, 0x28b6861d
lea eax, [edx + edi + 2]
js 0xa02c6e
and dword [esp + edx*2 + 2], ecx
adc dx, cx
mov dword [edi + edx - 0x9316], eax
adc dl, cl
lea edi, [edi + edx*4 - 0x24ca2]
jp 0x75c9fe
push ecx
sub al, 0xb7
lea edx, [ecx + ecx*2 - 0x74fed97f]
shr edx, 3
rol al, 1
add dword [esp + ecx - 0x56a60000], ecx
xor bl, al
call fcn.00792626

Function at 0xa07887
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 8]
je 0x824d2b
push 0x7dabb628
mov dword [esp], ebx
jmp 0x905acb
Function at 0xa0cad1
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
ror esi, 0x26
inc edi
lea ecx, [ecx + ebp + 0x12b8529e]
dec esi
mov dword [esp + ebp*4 + 0x10], esp
inc esi
xor dword [esp + ebp*2 + 0x10], ecx
dec esi
mov esp, dword [esp + ebp + 0x10]
inc si
xchg dword [esp + ebp*4 + 0xd], ebp
dec ebp
arpl cx, cx
dec esi
mov dword [esp + ebp*4 + 0x10], ebp
dec ebp
add ebx, ecx
dec edx
or dword [esp + eax + 0xf], 0xc7880815
dec ebx
lea ecx, [ebp + ebp*4 - 0x7cc84aeb]
inc dx
mov edi, dword [edi + ebp]
dec eax
and ebx, 0xda3e9834
inc ecx
pop ecx
pop ebp
inc ecx
pop esi
jge fcn.008c5046
movzx eax, byte [ebp - 1]
xor al, bl
mov ecx, 0xba7f002
movsx edx, cl
xor al, 0x13
add al, 0x22
neg al
xor al, 0x3c
sub edx, 0x3c8fe9b0
jle 0x9860fb
mov ecx, dword [ebp]
mov edx, 0xff2ce729
mov eax, dword fs:[ecx]
movzx ecx, dl
lea ecx, [edx + edx*8 - 0x567960e7]
mov dword [ebp], eax
lea eax, [edx + ecx*2 + 0xe2f5721]
lea esi, [esi + eax - 0x5191bd62]
mov ecx, dword [esi + eax - 0x5191bd5e]
ror edx, 0x1c
sub dx, ax
sub dl, dl
xor ecx, ebx
neg ecx
dec ecx
bt eax, edx
inc dl
bswap ecx
neg ecx
xor ebx, ecx
imul eax, edx
cwde
add edi, ecx
add eax, eax
jmp edi

Function at 0xa11f5a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea ebp, [ebp + eax*2 - 2]
mov edx, eax
mov word [ebp + eax*4], cx
mov dword [esp + eax*4], edx
call fcn.0071f7ac
Function at 0xa13ec5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ecx, ebx
rol ecx, 2
xor ecx, 0x7dba658c
sar dx, 4
push eax
inc al
neg ecx
and edx, dword [esp + 1]
jne 0x896ca8
neg al
mov edx, 0xd208440a
dec al
or ecx, esi
add dx, dx
bts cx, cx
neg al
imul esi, edx
imul ecx, ecx
not edx
not al
shr dx, 0x83
push ecx
call fcn.00897c61
shl eax, 0x56
rol ecx, 2
sar ax, 0xc4
ror ax, 0x6c
xor ebx, ecx
call fcn.0074fcc9
pop esp
cmp ebp, dword [esi + ecx*4 - 0x425f7666]
push ds
mov al, bh
xchg dword [eax - 0x3815894d], esp
xchg dword [eax - 0x38799927], esp
xchg dword [eax - 0x5f55f9b3], esp
sbb esi, dword [ebp + 0x53]
add ch, al
stosd dword es:[edi], eax
mov al, byte [0xe03a642e]
invalid
dec eax
rol ecx, cl
xor ebx, eax
add ebp, eax
mov dword [esp + edx], ebp
ret 4
not cx
cwde
xor edx, ebx
pop eax
cbw
sar eax, cl
lea edx, [edx + eax - 0x40cfb272]
bswap edx
bt ecx, ecx
neg cl
neg edx
add edx, 0x1387d096
call fcn.0092332b
mov edx, 0xa70e029e
push edx
xadd dword [esp], edx
mov ecx, dword [esi]
lea eax, [edx + edx*4 + 0x54b76620]
shr al, 0x46
adc esi, 3
rol byte [esp + 1], 0x86
shl dword [esp], 0xf5
jae 0x7a8f5e
push 0x4b1ffd9d
mov edx, 0x84bbb126
rol edx, 0x16
lea esi, [esi + edx - 0x49a12ef0]
mov edx, dword [esi + edx - 0x49a12eec]
mov eax, 0xedb2388f
shl dword [esp], 0xb4
xor edx, ebx
movzx ecx, al
xadd dword [esp + ecx*2 - 0x11e], eax
add cl, cl
dec edx
rol edx, 1
xadd ecx, eax
not dword [esp + eax - 0x1e]
xor eax, eax
bswap edx
not edx
xor ebx, edx
neg ecx
idiv cl
add edi, edx
pop ecx
mov ecx, ebp
and al, ah
call fcn.00a11f5a
mov edx, 0xfc00d928
sub esi, 4
movzx eax, dl
sal edx, 1
jle 0x9cdfc5
jmp 0x970db1
mov ecx, 0x4faacdaf
movzx eax, byte [ebp + ecx - 0x4faacdb0]
rol ecx, cl
xor al, bl
movzx esi, cl
jmp 0x80c79b
mov edx, dword [esi + eax*2 - 0x50]
mov ecx, 0x8116bc29
sar ax, 0x27
xor edx, ebx
lea edx, [edx + eax*2 - 0x1391ecb4]
rol edx, 3
inc edx
push ecx
neg edx
bswap ecx
dec edx
push eax
xor ebx, edx
add ecx, eax
dec dword [esp + eax*2]
sar ecx, 0x94
add edi, edx
rol word [esp + eax + 2], 0x4b
mov edx, dword [ebp + eax*2]
ror byte [esp + eax*2 + 1], 0x21
push eax
setb cl
or eax, dword [ebp + eax + 4]
lea ecx, [ecx*4 - 0x2fd316e7]
dec dword [esp + 8]
je 0x7aec31
mov cl, byte [ebp + 8]
rol dword [esp], 0xcc
adc ebp, 6
shrd edx, eax, cl
call fcn.00a13d9d
sar byte [esp + ecx*2 - 0x353e3fa0], 0x21
jae 0x937b3c
call fcn.00a2ade3
mov ecx, 0xd33fc98e
push ecx
movsx eax, cx
sub edi, 4
lea edx, [eax + eax*8 - 0x1d70b0dd]
mov edx, dword [edi]
jmp 0x9595bf
Function at 0xa15798
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
sbb ebp, 4
movsx eax, dl
mov edx, dword [ebp + eax*2]
lea ecx, [eax + eax*2 + 0x3725958a]
xor edx, ebx
lea edx, [edx + ecx*2 + 0x3371d213]
not eax
sar cl, 2
not eax
not edx
adc edx, eax
bts ecx, ecx
or eax, ecx
ror cl, 0xa6
neg edx
xor al, 0x86
rol edx, 3
neg al
xor ebx, edx
add esi, edx
bt ecx, 0x82
mov edx, eax
ror ecx, cl
mov edi, dword [eax + edi - 0x372595a0]
or cx, cx
jne fcn.00747049
call fcn.007531ac
inc ecx
lea eax, [edi + eax - 0x6fae32a6]
dec ecx
lea ebx, [ecx - 0x43621fc2]
dec ecx
inc ecx
dec esi
mov dword [esp + edi*2 - 0x143ba002], eax
xor eax, 0x2b9c5d0a
inc eax
movzx edx, word [esp + ebp - 0x331017af]
dec ebp
xchg ecx, ebp
inc eax
and dl, ch
neg eax
push edx
inc esp
xor eax, ebp
push esi
rol eax, 3
inc cx
ror edi, 0xed
inc cx
not ebp
dec esp
mov dword [esp + ebp - 0x33101797], esp
inc cx
xchg eax, esi
inc edx
adc byte [esp + edi*2 - 0x143b0059], 0x36
inc esp
movsx esp, dx
xor dword [esp + ebp*2 - 0x66202f46], eax
shr dword [esp + ebp*2 - 0x66202f4b], 0x7b
dec esp
mov esp, dword [esp + ebp*2 - 0x66202f46]
dec eax
arpl ax, ax
inc si
dec eax
mov dword [esp + ebp*2 - 0x66202f46], 0xc0aeaab0
dec esp
adc ebx, eax
push ebp
inc ecx
shr eax, 0x3d
call fcn.00829674
call fcn.008bfe95
mov edx, 0x838df71b
xor dx, dx
jle 0x932d6c

Function at 0xa15d5f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sbb al, cl
lea ecx, [ecx + edx*4 + 0x5abff23]
sub cl, ch
shl dx, 9
ror al, 1
sal cl, 0x81
call fcn.00a3340c
xor al, bl
sar cl, 6
not al
adc edx, edx
inc cx
jg 0x78248a
push 0xe188bd24
call fcn.0076426f
mov eax, 0xba400a6
movzx eax, byte [edi + eax*4 - 0x2e900298]
mov edx, 0x5c203296
movzx ecx, dl
jmp 0x8404a1

Function at 0xa164f9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec ebx
push 0xcb3d46b5
lea esp, [esp + 4]
jne 0x98a92c
push 0x713c888
pop eax
not ax
mov eax, dword [ebp + eax - 0x7133777]
push 0x4ba65981
call fcn.007c3705
ror word [esp + 8], 0xe
test ebx, ebx
push 0xdca1091f
lea esp, [esp + 0x10]
je 0x97e1e4
mov eax, 0x54143733
add eax, 0x8831ff14
mov eax, dword [ebp + ebx*4]
ja 0x9b50ee
push eax
jle 0x97e1d4
mov ecx, dword [ebp]
mov edx, 0x43b2dd23
call fcn.009c80d0
mov eax, 0xb703b19e
movzx ax, byte [edi]
mov ecx, 0xe9b8e78f
mov cl, byte [edi + 2]
mov edx, 0xe0777b4
btc edx, edx
xor edx, edx
lea edi, [edi + edx + 2]
adc edx, 0x7705a520
adc al, cl
jmp 0x7833d0
mov dword [ebp - 4], eax
jne 0x98a915
mov edx, 0x76818111
push edx
lea esi, [esi + edx - 0x76818115]
mov edx, dword [esi + edx - 0x76818111]
mov ecx, 0x5c90ac16
xor cl, byte [esp + ecx - 0x5c90ac14]

Function at 0xa165c5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x7f21373a
xor eax, eax
test edx, edx
lea esp, [esp + 8]
je 0x7797e5
jmp 0x9bec89
Function at 0xa17ba6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov esp, esi
movsx eax, di
call fcn.00ca6f77
inc edx
movzx ebx, byte [esi + edx - 0x5c04b406]
dec eax
mov dword [esp + esi - 0x5c04b400], eax
dec eax
cdq
inc eax
and ch, 0xbd
dec ebp
lea edx, [edx + edx - 6]
inc ecx
btc edi, ebp
call fcn.00a43fa7
inc ecx
ror ch, 0xc3
jnp 0x965184
mov edi, 0x25811923
jmp 0x758485

Function at 0xa18207
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc edx
mov edx, dword [edx + edi - 0x168fbc35]
call fcn.00763475
mov eax, 0x860ea03d
bt ax, ax
mov eax, dword [esi]
call fcn.009d239b
mov ecx, 0xd136ce97
mov eax, 0x51334091
jmp 0x7e2510
lea ebp, [ebp + eax - 0x51334095]
mov ecx, dword [eax + ebp - 0x51334091]
and eax, eax
dec eax
xor ecx, ebx
movsx edx, ax
lea ecx, [edx + ecx - 0x58125d41]
call fcn.0090606c
pop ebx
pop ecx
pop edx
inc ecx
pop ebp
pop esi
jmp fcn.008c5046
mov dword [esp], eax
jle 0x8b9505
mov ecx, 0x168fbc38
mov edx, ecx
mov ecx, dword [ecx + edi - 0x168fbc38]
movsx eax, dx
jmp 0x787fdc

Function at 0xa1bdfc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add esi, 4
call fcn.00cc27e9
movsx ecx, al
je 0x92c49e
movzx dx, dl
mov al, byte [esi + eax - 0xa52802d]
inc ecx
not dl
add ecx, ecx
ror cx, 0x6b
xchg dword [esp + ecx*8 - 0x63f8], ecx
not al
setne cl
or dl, al
push ecx
mov word [esi + ecx*2 - 0x70f9a3fe], dx
movzx edx, word [esp + ecx*2 - 0x70f9a3f6]
xchg dword [esp + 4], ecx
add ecx, 0x673d7
jmp ecx

Function at 0xa1fa4f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sub ebp, 4
mov eax, 0x253c61bc
mov ecx, dword [ebp + eax*2 - 0x4a78c378]
xor ecx, ebx
cwde
movzx edx, ax
dec ecx
not ecx
neg ecx
btr eax, 0x27
xor ecx, 0x158c22bf
add eax, eax
ror edx, 0x87
bswap ecx
not ecx
cmovae edx, eax
neg eax
xor dx, ax
ror ecx, 1
btc edx, edx
xor ecx, 0x80890004
cbw
xor ebx, ecx
or eax, edx
jle 0x70df30
call fcn.008cc786
jmp 0x7f3b7c

Function at 0xa20706
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 0xc]
jmp 0x841f7f
Function at 0xa21c54
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea eax, [ecx - 0x197ef84f]
not dx
mov word [ebp + ecx*2], dx
or ecx, esi
jmp ecx
add ecx, esp
or eax, edx
mov edx, dword [ecx]
sbb ebp, 4
push eax
movzx ecx, al
mov dword [ebp + ecx*4 - 0x3fc], edx
sar dword [esp + ecx*2 - 0x1fe], 0x17
pop eax
jne fcn.0098b9e9
sar dword [esp], 0x76
xor bl, al
pop edx
add eax, esp
inc edx
and dl, dh
mov dword [eax + edx - 0x101], ecx
mov edx, dword [ebp + edx - 0x106]
mov eax, 0x2e2bbdb8
lea ecx, [eax*8 - 0xc551d52]
lea ebp, [ebp + eax*2 - 0x5c577b75]
call fcn.0091b9ff
neg word [esp + ecx - 0x5c90ac95]
xor edx, ebx
lea edx, [ecx + edx + 0x67c83a2]
ror edx, 1
dec edx
lea eax, [ecx*4 - 0x48c4c065]
shr word [esp + eax - 0x297df1f5], 0x29
xor edx, 0x9ae5a9d
pop eax
xor al, ch
neg edx
add cx, cx
add ecx, 0xe29c48b1
lea ecx, [eax*4 + 0x6bb52814]
bswap edx
ror cl, 0x44
xadd cl, al
xor ebx, edx
add edi, edx
imul cx, ax
cwde
lea esi, [ecx + esi - 0x6cc75b81]
movzx ecx, byte [esi + ecx - 0x6cc75b80]
add eax, eax
xor cl, bl
btr ax, ax
ror al, 0xc5
shr ax, 0x8d
inc cl
mov edx, 0xc3828510
rol cl, 1
or edx, edx
sbb cl, 0x88
cdq
bts eax, eax
rol al, 0xe6
neg cl
not al
xor cl, 0x31
btr dx, 0x1a
xor bl, cl
add al, dh
jb 0x80622b
div cl
btr cx, 0x25
add edi, edx
mov dword [esp + eax - 0x600], ecx
add ecx, dword [esp + eax*2 - 0xbfc]
mov cx, word [esi + eax*4 - 0x1800]
lea edx, [eax - 0x5af3a259]
sal dl, 6
and dl, 0xe
lea esi, [esi + eax*2 - 0xbfe]
adc dword [esp + eax*2 - 0xbfc], 0xed117230
pop eax
lea ebp, [ebp + eax - 0x7f3fbf9d]
sbb dl, al
add dl, 0x26
movzx eax, byte [eax + ebp - 0x7f3fbf9c]
sub edx, dword [esp]
dec dx
bswap edx
xor al, bl
sub dl, byte [esp + edx - 0x78f3fcbb]
inc al
inc edx
or byte [esp + edx - 0x78f3fcad], dh
sar dl, 0x66
neg al
sub al, 0x36
xor dx, 0x7e37
not dword [esp + edx - 0x78f382c9]
rol al, 1
dec al
add word [esp + edx - 0x78f382c8], 0xc302
rol al, 1
push edx
xor edx, 0x299bf08f
xor bl, al
call fcn.00994864
movzx eax, cl
mov ax, word [ebp + eax - 0xd3]
imul ecx, ecx
sub ecx, 0x242358be
jo 0xa16523
adc ebp, 2
and dx, ax
xor ecx, ecx
jle 0x7b4d42

Function at 0xa21d1e
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax + ecx*8 + 0x39a1af2b]
pop ecx
call fcn.007578ee