joyce8/EMBER2024-capa huggingface dataset:
Function at 0x899d56
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
ror edx, 0x48
xor ecx, ebx
mov dword [esp + edx - 0x9000000], 0x160bdeb6
bt edx, edx
sbb edx, 0x30fe10d
bswap ecx
rol edx, 0x9f
inc word [esp + 1]
cdq
neg ecx
cbw
lea ecx, [ecx + eax - 0x707ada5f]
push edx
xor ecx, 0x25be2381
pop edx
add edx, 0xc5211c0a
xor ebx, ecx
sal word [esp + 1], 0x2a
sal byte [esp + 1], 0xe1
sub dl, ah
adc esi, ecx
call fcn.00718fa3

Function at 0x89e692
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
rol dh, 1
inc eax
movsx ecx, dh
inc ecx
xor dh, 0xba
inc ecx
mov ecx, 0xebd159c
inc ebp
xor ah, dh
dec esp
add esi, esp
dec ebp
mov eax, dword [esi + ebp*2 - 0x33332e8]
dec eax
cdq
shl dx, 0x6a
dec ecx
mov esi, eax
inc ecx
sbb bh, 0xb2
not bl
sub bl, ah
mov cl, byte [edi + ebp*4 - 0x66665d0]
cwde
imul edx
inc esp
movzx esi, bp
dec eax
shr esi, cl
inc ecx
movzx ecx, bp
dec eax
mov dword [edi + ebp*4 - 0x66665d6], esi
dec eax
lea edi, [edi + edx - 6]
jmp fcn.008c5046
dec eax
add edi, 8
dec eax
mov dword [esp], 0xf503da89
dec ecx
sub edx, 1
inc esp
mov edi, dword [esp]
inc ecx
pop eax
inc edi
movzx ecx, byte [edx + eax*2 + 0x15f84aee]
inc ecx
push eax
inc ecx
movzx eax, ax
inc esp
movzx esi, al
inc ebp
xor cl, ah
inc edx
movsx edx, word [esp + eax + 0xafc257a]
inc ecx
xor cl, 0x86
inc ecx
ror cl, 1
inc ecx
xor cl, 0x9c
inc ecx
not cl
inc ecx
pop edi
inc ebp
xor ah, cl
not al
inc ecx
mov ebp, edi
dec esp
add ecx, esp
inc esp
mov ebp, eax
movsx ecx, dl
sar cl, 0x81
dec ebx
mov dword [edi + ecx + 0xafc2577], ebx
inc ecx
movsx ebx, bp
sal bl, 0x47
dec ecx
shr esi, 0x7a
dec edi
lea edx, [eax + edx + 0xafc2573]
jbe 0xcb898e
inc ebp
movzx esi, byte [edx + ebp*2 - 0x332cd1b]
inc ecx
dec ch
inc ecx
mov eax, ebp
dec ebp
lea edx, [edx + ebp*2 - 0x332cd1b]
not bp
cbw
inc ebp
xor dh, ah
dec eax
ror eax, 0xa0
shl eax, 0x2e
cdq
inc ecx
adc dh, 0x98
inc ecx
ror dh, 1
inc ecx
sub ebp, 0xdb05058f
inc esp
adc al, al
inc ecx
sbb dh, 0x21
dec edx
lea eax, [edi*4 - 0x52c10ef1]
sal edx, 0x31
inc ecx
not dh
inc ecx
inc dh
neg si
jle 0x7849aa
call fcn.0093f5ca
add esi, ecx
mov ecx, dword [eax + edi + 4]
and eax, eax
and dword [esp + eax*2 + 4], eax
adc eax, 0x8a86ff01
mov ax, word ss:[ecx]
mov edx, dword [esp + 6]
mov word [edi + 6], ax
adc edi, 6
sub dx, dx
pop edx
pop edx
pop ecx
add edx, esi
jmp edx

Function at 0x89e93b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
imul edx
dec ecx
and eax, 0x66a6253a
xor ebx, ecx
mov dword [esp + eax - 0x44040400], 0xb23350a5
or al, dh
dec al
adc esi, ecx
neg dword [esp + eax - 0x440404de]
call fcn.008b0d70
Function at 0x89e962
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, 0xde8c75a8
inc eax
shl ecx, 0x17
and edx, ecx
cmovg cx, dx
ror eax, 2
add dl, dh
and ecx, edx
xor ebx, eax
lea ecx, [ecx*2 - 0x14f9f949]
not edx
dec cl
add edi, eax
xor dx, 0x7025
jmp edi
inc ecx
sub bh, 0x92
push ecx
dec esi
mov dword [esp + esi - 0x1b1f], esi
inc ecx
xor bh, 0x84
inc ecx
add bh, 0x3e
dec eax
shl ecx, 0xe6
inc ebp
xor ah, bh
inc ecx
and bl, dh
inc cx
sal esi, 0xcf
dec esi
lea edi, [esp + edi + 0x20]
inc ecx
movsx esi, si
jnp 0xc9aab1
inc ecx
or ecx, dword [edi + ebx*2]
inc cx
sal ebp, 0xae
inc ecx
push esi
mov dword [edi + ebx*2 - 2], ecx
rol dword [esp + ebx + 8], 0x68
inc edx
not byte [esp + eax - 0x5c051b28]
dec edx
xchg dword [esp + eax - 0x5c051b20], ebx
dec edx
lea edi, [edi + esi*4 - 0x20002]
dec eax
shl dword [esp + ebx - 0x1b5aac3a], 0xa7
pop ebp
pop eax
pop ebx
inc ecx
pop ecx
pop eax
je fcn.008c5046
mov edx, 0xabbd4fa2
mov ecx, 0xba09a304
sub ebp, 4
dec ecx
shl ecx, cl
sar ecx, cl
mov ecx, dword [ebp]
ror dl, 0xc6
movzx eax, dl
xor ecx, ebx
imul ax
rol ecx, 2
xadd eax, edx
cwde
or dl, 0x81
neg ecx
neg ax
cwd
ror ecx, 1
mul eax
neg ecx
sal dx, 0x4a
and dx, dx
cbw
xor ebx, ecx
cbw
push edx
not eax
add edi, ecx
not dword [esp + eax - 0x7f2affef]
cwd
lea ebp, [ebp + edx*2 - 0x1ffff]
movzx edx, byte [edx + ebp - 0xffff]
sub eax, eax
ror eax, 0x49
cwde
xor dl, bl
mov ecx, eax
not dl
shl eax, 0x3c
dec dl
imul ecx, dword [esp + eax]
not dl
call fcn.009a06d5
mov edx, dword [ecx + edi - 0x4e080d0f]
xor edx, ebx
lea eax, [ecx - 0x66622c52]
xor cx, ax
sar cx, 0x47
not edx
cwde
add ax, cx
call fcn.00946a38
jo 0x9091fd
lea esi, [eax + esi - 4]
or eax, dword [eax + esi]
mov edx, 0xa03a3127
xor eax, ebx
rol eax, 1
movzx ecx, dx
or edx, ecx
jae 0x74e4dd
xchg dh, dl
add esi, eax
mov dword [esp + edx - 0x50057], esi
ret 0xc
inc si
mov dword [esp + esi*4 - 0x23a], esi
inc edi
mov edi, dword [edx + ebp*2 - 0x120]
inc edx
shl dword [esp + esi*8 - 0x480], 0x6e
inc cx
sal eax, 0x8f
inc esi
or byte [esp + esi*2 - 0x120], ch
inc ebp
xor edi, esp
cbw
dec edx
lea esi, [eax*2 - 0xd6c45e8]
inc edx
xor byte [esp + eax - 0x6ab1ffff], al
inc ecx
inc edi
dec edx
sar dword [esp + eax - 0x6ab20000], 0x3a
inc edx
and dword [esp + ebp*2 - 0x11c], 0xbba44a3e
inc ecx
bswap edi
dec ecx
not ebp
inc ecx
movzx ebx, al
inc ecx
neg edi
inc edx
movsx ebp, word [esp + eax - 0x6ab1fffe]
dec ecx
inc esi
inc ecx
xor edi, 0x1d92b5b3
inc ecx
shl dh, 0xc5
sal bp, 0xed
inc ecx
dec edi
dec esi
xor dword [esp + esi - 0x20], esp
inc eax
movsx edx, dh
inc esi
xor dword [esp + eax - 0x6ab20000], edi
inc ecx
pop esp
cdq
or ebp, 0xe80a661c
dec ebp
arpl di, di
dec edx
lea ecx, [ebp*2 - 0x117378e4]
dec ebp
adc ebx, edi
inc cx
add ecx, ebp
dec ecx
xor ebx, ebx
jmp ebx
Function at 0x8a5bbc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg dl
mov dword [esp], 0xe023631d
pop ecx
ror dl, 1
xor ecx, eax
neg dl
add ecx, eax
or al, 0x9e
ror eax, 0x3e
xor bl, dl
rol eax, 0xc5
add edx, esp
push ecx
mov eax, dword [eax + edx - 0x1ddffff7]
xadd byte [esp + 2], cl
sbb edi, 3
not dword [esp]
movzx edx, word [esp]
jmp 0x92202e
mov dword [edi + edx*2 - 0xc63c], eax
not dword [esp + edx - 0x631e]
sal dx, 0x24
movzx eax, cl
pop ecx
ja fcn.00ca4448
ror cx, 1
add cx, 0x30b7
neg cx
add dl, byte [esp + edx*4 + 9]
sbb cx, 0x46a2
and dx, dx
movsx eax, dx
xor bx, cx
add dx, word [esp + edx - 0x42]
sub word [esp + edx - 0x4ad9], ax
lea esi, [esi + edx - 0x4ae2]
push edx
mov word [edx + esi - 0x4ae0], cx
adc edx, edx
pop edx
pop ecx
pop edx
pop ecx
jno fcn.007194ad
lea edx, [eax + edx + 0x2123eeb6]
bswap edx
xchg al, cl
dec edx
lea eax, [eax*2 - 0x69625a51]
not cl
ror edx, 3
bswap edx
rol edx, 2
lea eax, [ecx + ecx - 0x71d8014c]
xor ebx, edx
neg ax
dec cx
rol cx, 0xa3
add esi, edx
call fcn.00a42280

Function at 0x8a7840
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add eax, edx
mov dword [ebp - 4], eax
mov dword [esp], 0xde9fc206
jmp 0x9a657c
call fcn.007aa814
lea eax, [ecx + edx*8 + 0x318ca43a]
xadd eax, edx
lea ebp, [ebp + edx - 0x63c68ccf]
mov eax, dword [ebp + edx - 0x63c68ccb]
inc ecx
xor eax, ebx
bt edx, ecx
not dl
inc eax
rol eax, 1
bswap eax
bswap edx
shr dl, 0x65
xchg ecx, edx
neg eax
call fcn.009cc432
mov edx, 0xf89f518d
sub edi, 4
mov edx, dword [edi]
xor edx, ebx
call fcn.00a4fd28

Function at 0x8a8507
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bts edx, ecx
dec eax
ror eax, 2
dec eax
shr dl, cl
jp 0x834e32
shr ecx, 0xf1
bswap eax
xor ebx, eax
dec edx
inc dl
bswap ecx
add edi, eax
movsx eax, cl
mov edx, dword [esi + ecx - 0x566b0000]
neg cx
add ax, cx
mov ecx, dword [esi + eax*2 + 4]
adc eax, 0xa936da1a
adc esi, 8
jmp 0x970ddd
inc eax
dec byte [esp + 6]
jne 0x782ba2
mov ecx, 0xd6ad4a07
movzx eax, cx
lea ebp, [eax + ebp - 0x4a0b]
mov edx, eax
mov eax, dword [ebp + eax*8 - 0x25038]
add cx, 0x983d
xor eax, ebx
jmp 0x718a88
rol dword [esp + 4], 0xcd
xor edx, 0x16098a3d
dec ecx
lea esp, [esp + 8]
jne 0xa4057c
call fcn.008df446
sub ebp, 4
mov eax, 0x250f1636
lea ecx, [eax + eax*8 - 0x51ebf553]
mov eax, dword [ebp + eax*2 - 0x4a1e2c6c]
bswap ecx
lea ecx, [ecx + ecx*4 - 0x16482bf9]
xor eax, ebx
neg cl
inc eax
sub ecx, ecx
xor ecx, 0xefb4891d
not eax
bts cx, cx
ror eax, 2
xor eax, 0x623cab2d
inc ecx
ror ecx, cl
jp 0x908608
jmp 0x734cba
xor ebx, eax
rol cx, 0x82
sub ecx, ecx
adc esi, eax
xor ecx, dword [edi + ecx*8]
mov eax, 0x41b20f9a
btr eax, 0x85
mov eax, dword [edi + eax - 0x41b20f96]
jae 0x7d91f3
bt eax, 0x29
mov dword fs:[edx], ecx
rol eax, 0x1b
lea edx, [eax + eax*2 - 0x7b41594c]
adc dl, 0xa3
jmp edi
movzx edi, byte [eax]
xor edi, edx
jmp 0x7e9860
Function at 0x8a8e38
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec ebp
arpl di, di
dec eax
mov dword [esp + ecx - 0x743a], 0xeba14ab3
dec eax
not dword [esp + ecx - 0x743a]
dec ebp
add ebx, edi
inc ecx
pop edi
inc ecx
not bh
inc esp
mov edi, dword [edi + ecx*4 - 0x1d0e8]
jmp 0x95bee9
call fcn.007acab1
mov cx, word [eax + edx - 0x676404ff]
shl edx, 0x78
sbb edi, 2
mov eax, edx
mov word [edi], cx
mul al
movzx ecx, al
lea eax, [ecx - 0x20c9ccf7]
jno fcn.008360bb

Function at 0x8a9392
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
mov edx, 0xfc0bd91
stosd dword es:[edi], eax
ror byte [edi], cl
rol edx, 0x41
div al
call fcn.008cbdde
push 0x31a4ffae
adc ebp, 3
movsb byte es:[edi], byte [esi]
xor dword [ecx + 0x3d5], eax
add byte [eax + 0x11], ch
pop ss
scasb al, byte es:[edi]
mov bh, 0x68
mov cl, 0xe4
sbb ebp, esi
add byte [eax], al
push 0xb7ae1711
push 0xee1be4b1
shld dx, ax, cl
mov word [ebp], dx
not dword [esp + 6]
call fcn.007fa988
in al, 0xb
fdivp st(1)
or esi, dword [edi + 0xc]
inc edi
mov cl, 0x3a
add dword [ecx + 0x24], esp
js 0x7c76c5
std
sbb byte [ecx + 0x38], bh
js 0x7c76cb
std
cmp byte [edi + edi*4], dh
fisubr dword [edx - 0x50]
add edx, dword [ebx]
jle 0x7c76b0
mov edi, 0x3b06ada
adc edi, dword [esi - 0x59]
enter 0xffffffffffffc7b1, 0x6e
loopne 0x7c7701
adc byte [ecx - 0xd2781e5], dh
adc byte [ecx - 0xd0ba5dd], dh
adc byte [ecx + 0x57a9230f], dh
inc ecx
mov ecx, 0x2fae2006
lea ebp, [ebp + ecx - 0x2fae2007]
mov eax, 0xaa80d97
xor eax, 0x2725a72a
movzx eax, byte [ecx + ebp - 0x2fae2006]
dec cx
bt ecx, ecx
xor al, bl
bts ecx, 0xd
dec al
xor cx, cx
mov edx, 0xf0b4bad
not al
dec al
xor al, 0xb3
neg al
call fcn.00915bf2
jb 0x7c76c2
lea ecx, [edx*4 + 0x20ca904]
not dx
xor eax, ebx
not dl
mov dword [esp + edx - 0x55bb82c4], ecx
ror eax, 2
call fcn.00770b9c

Function at 0x8a93b5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc dword [esp]
jp 0x9bc3a4
mov eax, 0x3202217
lea esi, [esi + eax*4 - 0xc808860]
shr eax, 0xc7
mov ecx, dword [eax + esi - 0x64044]
xor ecx, ebx
movzx edx, al
mul al
and eax, 0x7e8d5216
ror ecx, 1
xor ax, ax
not ecx
not eax
rol ecx, 3
xor eax, 0x45887333
not al
dec dx
xor ecx, 0xff14a8a1
jmp 0xa0341e
sub esi, 4
mov eax, dword [esi]
mov dword [esp], 0x5820c786
mov edx, 0x2a2da896
xor eax, ebx
add dword [esp + edx - 0x2a2da896], edx
lea eax, [eax + edx*8 - 0x6a6d1c7b]
mov ecx, edx
ror dword [esp + edx - 0x2a2da896], cl
not ecx
not eax
neg edx
xor eax, 0x73b4b387
sub cx, 0x7e9d
inc ecx
adc eax, 0x70418a9
jmp 0x7a85cc
sar edx, 0x2e
xor ebx, ecx
not dl
btr edx, 0xbc
adc ebp, ecx
or dl, 0xb4
push edx
movzx ecx, ax
mov eax, dword [edi + edx - 0xff]
sbb dl, dl
push ecx
mov cx, word ss:[eax + edx*2]
lea eax, [edx*8 - 0x7e668ad0]
lea edi, [edi + edx*2 + 2]
xchg word [esp + edx*2 + 5], ax
sal dword [esp + edx*2 + 3], 0xcd
mov word [edi + edx*2], cx
mov ecx, edx
mov dword [esp + edx], ebp
ret 4

Function at 0x8af3e9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ecx, 0xee3497a5
mov esi, dword [esp + 8]
lea esp, [esp + 0xc]
Function at 0x8b0d89
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add eax, edx
jmp 0x9a209f
lea esp, [esp + 8]
jne 0x9d416d
mov eax, dword [ebp]
push 0x9db036a2
jmp 0x97d88c
jmp 0x803523
sub edi, 1
push 0x76bea907
movzx ecx, byte [edi]
xor cl, bl
mov eax, 0xd70f4f2c
add cl, 0x96
mov dword [esp + 4], 0xd4a522b3
xor cl, 0x26
sub byte [esp + 1], 0xa9
movzx edx, ax
xadd eax, edx
inc cl
rol cl, 1
inc ax
pop edx
cwd
xor bl, cl
xchg edx, eax
mov dword [esp + eax - 0x76beffff], edi
sal ax, 0x29
push esi
push ebx
movzx ebx, ax
mov ebx, ecx
shr eax, 0x37
mov edx, ebx
xor eax, eax
sal edx, 2
add eax, ebp
push 0xcb90a33c
jmp 0xa008fc
lea esp, [esp + 4]
call eax
mov edi, 0xae1a80aa
bswap edi
movzx esi, di
mov ebp, dword [ebp + esi*2 - 0x3560]
push esi
mov dword [esi + ebp - 0x1aae], eax
mov ebx, dword [esp + esi*8 - 0xd56c]
mov esi, dword [esp + esi*2 - 0x3554]
bts di, di
mov edi, dword [esp + 0xc]
sbb edi, 4
mov edx, dword [edi]
mov ecx, dword [esp]
mov dword [esp + ecx - 0x1aa6], 0xc28a6a35
push ecx
xor edx, ebx
bswap edx
bts ecx, 0x38
xor cl, ch
mov eax, ecx
rol edx, 2
shr ecx, 0xdb
neg edx
bt eax, eax
xadd dword [esp + ecx], eax
not edx
jb 0x9ade41
rol eax, 0xb3
ja 0xcb669f
jmp 0x9d414d
mov dword [ebp - 4], eax
mov word [esp], 0x3795
dec byte [esp + 1]
not word [esp + 2]
test ebx, ebx
lea esp, [esp + 4]
je 0x80352d
mov eax, dword [ebp + ebx*4]
push 0xaabf92f
not dword [esp]
mov dword [esp], eax
push 0x929d9a0f
push 0x883200a6
dec ebx
jmp 0xa5060d
jmp 0x79967c
jmp 0x82fae4
ror edx, 1
xor ebx, edx
add esi, edx
mov dword [esp + ecx*2 + 8], eax
not word [esp + ecx + 0xe]
mov dword [esp + ecx], esi
ret 0x10

Function at 0x8b1d78
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
bts ecx, ecx
xor ebx, eax
mov dword [esp + ecx - 0x4c37ed01], ecx
add ebp, eax
movsx eax, word [esp + ecx - 0x4c37ed01]
ror eax, cl
shr eax, 0x14
mov di, word [ecx + edi - 0x4c37ed01]
add eax, eax
pop eax
jnp fcn.008360bb
mov edx, edi
mov eax, 0xd1ad2fb7
sub edi, 4
call fcn.00a01c52

Function at 0x8b25f6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
or ax, dx
neg eax
mov dword [esp + edx - 0xfffb], ebp
call fcn.00923554

Function at 0x8b2607
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc byte [esp + 6]
shrd eax, edx, cl
inc word [esp + 6]
mov ecx, dword [esp + 4]
mov dword [ebp + ecx*2 - 0x37745c04], eax
lea edx, [ecx*8 - 0x1b52c7f7]
call fcn.007cd0f1
Function at 0x8b262a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ebp
xor bh, ah
inc ecx
neg bh
inc ecx
inc bh
inc eax
movzx edx, ch
inc ecx
movsx ebx, dh
inc ebp
movsx eax, dh
inc ecx
rol bh, 1
dec ecx
xor esi, 0x1fa0e415
inc ecx
adc bh, 0xa9
dec ebx
lea ebp, [eax + ecx*8 + 0x21a11bb6]
inc ecx
ror bh, 1
inc ebp
xor ah, bh
dec esp
add edi, esp
inc bp
mov ebp, dword [edi + edx - 0xa4]
inc ecx
xadd esi, ebp
jp 0x71bad6
inc sp
mov dword [edi + edx*2 - 0x14a], ebp
inc ebx
mov ebp, dword [edx + esi - 0x27041c30]
movzx ecx, dl
inc ecx
xor ebp, esp
inc ecx
rol esi, cl
lea ebp, [ebp + edx*2 - 0x308367e2]
jae 0x7e716d
mov dword [esp], eax
jmp 0x7a27d1
mov eax, 0xc0321004
sub eax, eax
or ax, ax
xor eax, dword [ebp + ebx*4]
call 0x71bafd
call fcn.008fa3c7
mov edx, dword [edi]
mov eax, 0xa897cb1f
mov cl, byte [edi + 4]
or eax, eax
sar al, 0x82
shr edx, cl
mov dword [edi + 2], edx
movzx ecx, al
call fcn.009294d6
xchg byte [edi + 0x3a], al
adc byte [esp + eax], dl
wait
cld
dec ebx
jl 0x760c1b
rcr edx, cl
jnp 0x760c25
ja 0x760b9e
or ebp, eax
arpl word [edi + esi*2 - 0xd], di
outsd dx, dword [esi]
scasb al, byte es:[edi]
jmp 0x760c31
pop edi
adc edx, dword [ecx]
invalid
bnd js 0x760c8d
int3
jl 0x760c9e
hlt
jl 0x760caa
cmp byte [0xf3777ca4], bl
mov word [ecx - 0x3c], ss
jl 0x760cb6
or byte [0xf3777c9c], dh
mov bl, 0x6b
mov ch, 0xb2
out dx, al
or al, 0xed
popal
dec esp
mov word [ebp - 0x778423], es
test ebp, ebx
jnp 0x760bdc
fisubr dword [ebp + 0x4d]
xchg edx, eax
push dword [edi - 0x6db2da9e]
jmp edi
xlatb
adc dword [eax], esp
imul dword [ebp - 0x44]
loop 0x760c76
int 0xc7
std
invalid
invalid
jmp 0x760c50
or ah, 0x88
int3
push 0xd1a99b0d
push 0x94aa1211
dec ebx
lea esp, [esp + 8]
jne 0x75ff86
mov eax, 0xfb3067a3
call fcn.0077ed52
mov esi, 0x5a5fa34d
dec ebx
in al, dx
push 0x28
cmpsb byte [esi], byte es:[edi]
pop edi
and bl, byte [edi - 0x5f839df1]
and al, 0x81
pop ss
bound edi, qword [eax + 0x7e]
bound edi, qword [si - 0x60]
lodsb al, byte [esi]
mov dword [0xf0f2a051], eax
mov cl, ch
pushal
push eax
mov al, byte [0xe0c1c1c7]
sbb dword [ecx], edi
mov word [ebx + 0x19d885d6], gs
mov byte [ecx], cl
and al, 0x96
push edx
ret
xor ebp, 0xd909149c
dec esp
xor ecx, ecx
bswap ebp
call fcn.007ae650
call fcn.00804672
push 0xb0048d86
xor edx, 0x333c2425
rol dword [esp], 0xeb
sal dword [esp + 8], 0xdc
ror edx, 3
shr dword [esp + 8], 0xbe
jbe 0x760b75
inc ecx
mov ecx, 0x84a07ca4
inc ebp
movzx edi, cx
inc edi
movzx edi, byte [edx + edi - 0x7ca5]
inc ecx
movsx ebp, cx
inc esp
movsx esi, ch
jmp 0x714c10
Function at 0x8b679a
Capabilities:
Authenticate hmac

Disassembly:
call fcn.0070f5d8
xor bl, dl
bts cx, 0x36
xor eax, eax
lea edx, [esp + edx + 4]
xor ax, word [edx + eax*4]
lea edx, [ecx + ecx - 0x5cf7d858]
add cx, 0x3913
lea esi, [edx + esi - 0x25ac282a]
adc edx, edx
mov word [esi + edx - 0x4b585050], ax
xchg dword [esp + edx - 0x4b585050], ecx
lea eax, [edx*4 - 0x2fc94ec6]
pop eax
jp fcn.007194ad
dec eax
imul dx, cx
sub ecx, 0x50ac1392
rol dx, 0xc1
rol eax, 1
sal dx, 0x2f
neg edx
bswap edx
inc eax
rol edx, 0x5c
ror dl, 0x21
adc dx, dx
xor ebx, eax
shl ecx, 0x10
adc edi, eax
movsx eax, cx
ror cx, 9
mov edx, dword [eax + ebp + 2]
jae 0xa4f58a
bswap ecx
inc ecx
sar ax, 0xc9
xor ecx, 0x2846906
add dl, byte [esp + eax - 0xd]
ror dx, 0xa7
neg ecx
mul dl
xadd dword [esp + eax - 0x2d0], edx
sub dword [esp + eax*2 - 0x5a2], edx
xor ebx, ecx
imul edx
sal ax, 0xe2
not eax
add esi, ecx
or eax, 0xea0367b2
mov edx, edi
call fcn.00a2321c
jmp 0x7875ee
mov eax, dword [esp + edx - 0xf80]
mov dword [esp + edx - 0xf80], ebp
ret
add ebp, 4
call fcn.0082ae75
pushfd
pop esi
mov dword [esp], esi
mov esi, 0
jmp 0x765ed5
btc ecx, ecx
mov cl, byte [ebp + eax*2 + 6]
shl edx, cl
inc eax
call fcn.009319b3
jmp 0x80801d

Function at 0x8b6d63
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
rol edx, 0x8b
shr word [esp], 0x8c
adc edi, eax
shr byte [esp + 1], 0xc6
xor ecx, 0xbb0841a2
push edx
mov dword [esp + ecx - 0x4c0e6a9a], edi
ret 4
mov dword [esp], 0x96a71438
xor edx, ebx
pop eax
rol cl, 0x23
call fcn.007c840a
mov ecx, 0x5e9f4101
mov edx, dword [esi + ecx - 0x5e9f4101]
mov eax, ecx
imul cx, ax
rol ecx, 0xeb
mov ecx, dword fs:[edx + eax - 0x5e9f4101]
and al, ah
btr ax, ax
setae al
mov dword [eax + esi - 0x5e9f4101], ecx
setae al
mov edx, eax
shl eax, 0xe5
lea ebp, [ebp + edx - 0x5e9f4105]
imul dx
movsx ecx, dl
setae dl
mov eax, dword [ebp + ecx*2 - 0x50]
xor eax, ebx
ror eax, 2
lea ecx, [edx*4 + 0x7c8a0b38]
lea eax, [edx + eax - 0x3675f556]
rol eax, 2
push edx
sal edx, cl
setbe dl
bswap eax
xchg dword [esp + edx*4 - 4], edx
not eax
setp dl
je 0x7e07b3
mov ecx, 0xad8e639e
call fcn.009cec6a
dec eax
in eax, 0xe6
fidiv word [esi - 7]
and dword [eax*4 - 0x760c75e2], esp
and dword [eax*4 - 0x760c75e2], esp
mov dh, bl
mov eax, edi
clc
dec ebp
push ds
mov dh, bl
and dword [ebp + edx*8 + 0x1e], edi
mov dh, bl
xor eax, 0x8a1e7de2
leave
jo 0x8b6dfd
push ds
mov dh, bl
popal
mov al, byte [0xf38a1e3d]
inc ebp
jo 0x8b6e01
push ds
mov dh, bl
or dword [eax - 0x4e], ecx
scasd eax, dword es:[edi]
dec ebp
lodsb al, byte [esi]
add esi, dword [ecx + 0x1964b18c]
jne 0x8b6e35
Function at 0x8b724d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec ecx
div eax
dec eax
lea edi, [edi + ebx - 0x200975b4]
bt ax, 0x8b
or eax, eax
js 0x824416
mov word [edi + ebp - 0x75b2], si
dec ebp
lea edx, [edx + ebx*2 - 0x4012eb68]
inc esi
mov eax, dword [ebp + edx - 0x75b2]
mov ecx, 0xcc1a0a04
movzx esi, bl
shr dx, cl
inc ebp
xor eax, esp
bts esi, 0x98
inc ecx
bswap eax
inc ecx
inc eax
inc ecx
ror eax, 1
dec esp
mov dword [esp + ebx - 0x200975b2], esi
inc cx
not esi
inc ebp
lea eax, [eax + ebp - 0x500dde4f]
inc ebp
movsx edi, bp
dec eax
div dword [esp + ebp*4 - 0x1d6c4]
inc ecx
neg eax
dec esp
mov dword [esp + ebx - 0x200975aa], esp
add esi, dword [esp + ebx - 0x200975b1]
inc esp
xor dword [esp + ebp - 0x75aa], eax
add dword [esp + ebx - 0x200975b1], ecx
dec esp
mov esp, dword [esp + ebx - 0x200975aa]
xor si, si
call fcn.00936619
push 0xe7042f06
mov edx, dword [edi]
mov ecx, 0x6e933e8a
movsx eax, cl
xor cx, 0x7bd
lea edi, [ecx + edi - 0x6e933933]
and byte [esp + ecx - 0x6e933937], 2
xor edx, ebx
shr cl, 0x44
xor cl, byte [esp + ecx - 0x6e933901]
or eax, ecx
neg edx
ror ecx, cl
bswap edx
xor cl, ch
adc eax, 0xe8b877ab
mov dword [esp + ecx*8 - 0x76e932a0], ecx
not edx
sar ecx, 0x95
sbb eax, ecx
sub dword [esp + ecx - 0x76], eax
bswap edx
setb byte [esp + ecx*4 - 0x1d8]
xor edx, 0x3aa1f89a
lea edx, [edx + eax - 0x81c0533]
call fcn.0071aa89

Function at 0x8b7528
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x9cd1f5
push 0xcd8382a9
cld
rep movsb byte es:[edi], byte [esi]
call fcn.007e1bce
mov esp, edx
jmp 0xcad9eb
push edi
push esi
pushfd
mov esi, 0xa88dc7a7
lea edi, [esi + 0x98604b7]
imul edi, edi
mov esi, eax
or edi, 0x4f305728
sub di, di
mov edi, edx
jge 0x97597e

Function at 0x8b7f3d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.00ca1729
setnp byte [esp + 4]
push 0x1a92130
adc eax, edx
jmp 0xa45cd4
mov dword [ebp - 4], eax
jmp 0x7f1c7a

Function at 0x8b8206
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ecx, dword [esp + 6]
mov cl, byte [ebp + 4]
mov edx, dword [esp + 4]
ror byte [esp + edx*8 - 0x79857c21], 0xe7
lea ebp, [ebp + edx*2 - 0x1e615f04]
adc edx, edx
mov byte es:[eax + edx*4 - 0x79857c28], cl
pop ecx
call fcn.009f728a
shr ecx, 0xc5
lea edi, [ecx + edi - 0x5f16a2e]
neg cx
xor dl, bl
call fcn.007fa7a8
mov edx, 0xa72922b3
mov eax, dword [esi]
mov ecx, edx
btr cx, cx
adc esi, 4
jmp 0x999c7e
xor eax, ebx
sar edx, cl
sbb eax, 0x558d06b4
push ecx
shl cl, 0x44
dec edx
not eax
rol eax, 1
sar edx, cl
add cl, cl
lea eax, [edx + eax - 0x7b72d2ec]
ror eax, 2
rol byte [esp + 2], 0x86
add ecx, edx
xor ebx, eax
ror ecx, cl
adc ebp, eax
mov edx, edi
lea edi, [edi + ecx - 0x4e5244c3]
movzx eax, cl
sal eax, 0xfd
mov dword [edi + ecx - 0x4e5244bf], edx
pop ecx
js fcn.008360bb
inc ecx
mov edi, 0x48161b1
inc ebp
movzx ecx, di
dec edx
lea eax, [edi*2 - 0x1efd60f9]
inc dx
mov edx, dword [edi + edi*2 - 0x902c362]
inc ecx
movsx ebp, bh
dec eax
lea edi, [eax + edi + 0x15fa9d99]
call fcn.009f644d
Function at 0x8b9673
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [ebp + ecx - 0x68009a5a]
mov edx, dword [ebp + edx*2 - 0x533a381e]
mov dword [esp + ecx - 0x68009a5a], ecx
sub ecx, 0xcd0ff50b
mov cl, byte [ebp + 8]
push 0x10890f27
adc ebp, 5
call fcn.00ca24f8
mov eax, 0x63117b33
mov edx, dword [edi + eax - 0x63117b33]
movzx ecx, al
lea edi, [edi + eax - 0x63117b2f]
mov ebp, 0x748b35ab
mov ebp, edx
and al, al
ja 0x825def
mov edx, 0xebae138a
movsx ecx, dx
mov ecx, dword [ecx + esi - 0x138a]
movsx eax, dl
sar ax, 0x4e
xor ecx, ebx
div eax
sub dx, ax
rol edx, 0xfb
bswap ecx
sar edx, 0xc6
not eax
dec ecx
xor ecx, 0xb13a4517
or ax, 0x7fba
bt dx, dx
bswap ecx
btr ax, ax
inc edx
xor ax, 0x79b8
dec ecx
jmp 0x9a9625
jmp 0x701d03

Function at 0x8b9a8e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop edx
inc ecx
sbb esi, 0xfb35ea9f
inc edx
movzx edx, word [esp + ebp - 0x38197ef4]
dec eax
inc ecx
ror esi, 3
dec ecx
neg eax
inc esp
sbb esi, ebp
inc edx
not dword [esp + ebp - 0x38197efe]
inc cx
shl eax, 0x81
cwd
inc ecx
ror esi, 1
dec esi
mov dword [esp + ebp - 0x38197ef8], esp
inc esi
xor dword [esp + ecx - 0x80e0], esi
inc cx
shl ebp, 0x81
sub cl, 0x88
dec esi
mov esp, dword [esp + ebp - 0x3819fe00]
dec ebp
arpl si, si
inc ecx
idiv ebp
sar bp, 0xcb
inc ecx
pop eax
dec ebp
adc ebx, esi
inc ebp
mov esi, eax
dec eax
cwde
pop ebx
inc ecx
pop ecx
jmp fcn.008c5046