joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8da081
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [eax + esi - 0x573d18a0]
mov dword [esp + eax - 0x573d189c], 0xfeb53303
sal dx, 5
lea esi, [eax + esi - 0x573d18a0]
ror dword [esp + eax - 0x573d189c], 0x33
btr edx, eax
xor ecx, ebx
dec edx
dec ecx
and dword [esp + eax - 0x573d189c], 0x111fb689
xor ecx, 0x6a313914
xadd byte [esp + eax - 0x573d189a], dh
bt eax, 0x1d
rol ecx, 1
sar ax, 9
shr dword [esp + eax - 0x573d000c], 0x9e
sbb ecx, 0xe31f9637
pop edx
xor ebx, ecx
bts ax, 0x93
sub edx, eax
add edi, ecx
inc eax
mov edx, dword [ebp + eax - 0x573d000d]
mov ecx, eax
mov eax, dword [ebp + ecx - 0x573d0009]
not ecx
not edx
push ecx
lea ecx, [ecx*8 - 0x414817ed]
pop ecx
not eax
and edx, eax
sal cx, 0x63
adc cx, cx
mov dword [ebp + 4], edx
movzx edx, cx
mov eax, dword [ebp + edx*4 - 0x3fc80]
mov ecx, dword [ebp + edx*8 - 0x7f900]
sal dx, 0x2e
imul edx, edx
add dx, dx
adc eax, ecx
bts edx, 0x29
setae dl
adc edx, edx
mov dword [ebp + edx*2 - 0x400007fc], eax
jns 0x7779b9
jmp 0x7338ed

Function at 0x8dad6d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x55b3f7aa
shr dword [esp], 0x27
and esi, 0xff
push 0xcb28dad
jmp 0x70e6f9

Function at 0x8ddb9b
Capabilities:
Encode data using xor

Disassembly:
mov edi, ebp
mov ebx, ecx
mov ebx, dword [esp + ecx - 0xdda8263]
mov ebp, dword [esp + ecx*2 - 0x1bb504c6]
mov dword [esp + ecx*2 - 0x1bb504c6], ecx
movsx eax, cx
mov esi, dword [esp + ecx*2 - 0x1bb504c2]
lea edx, [eax + eax*2 - 0x3fefa4f5]
mov ecx, dword [esi + ecx*4 - 0x376a099c]
add esi, 4
pop edx
cbw
xor ecx, ebx
pop edx
dec ax
xor ecx, 0xe81a578f
mov dword [esp + 4], 0x9406360f
pop edx
not edx
bswap ecx
inc ecx
lea eax, [edx - 0x1ef4ffe0]
bswap ecx
jmp 0x8ffe17
sub ecx, 0x2ba42835
mov dword [esp], eax
ror ecx, 1
shr dword [esp], 3
inc ecx
xor dl, 0x3f
dec edx
sbb eax, 0xcc06b19b
xor ebx, ecx
sal byte [esp + eax - 0x729cc1b], 0xc5
xadd byte [esp + eax*2 - 0xe539839], dl
jns 0x9a302a
adc ebp, ecx
movsx ecx, word [esp + eax*8 - 0x394e60e8]
mov dword [esp + eax - 0x729cc1d], ebp
ret

Function at 0x8dfe2a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x7bb9e3a9
call fcn.0073675d
sub esi, 4
mov ecx, 0xc12b5a23
btr cx, 0xa5
mov ecx, dword [esi]
mov edx, 0xbfb8ee08
xor ecx, ebx
lea eax, [edx + edx*4 - 0x4bc545f8]
ror dl, 0xc1
dec ecx
rol edx, 0xcc
imul dx, ax
ror ecx, 3
neg dl
mul eax
not ecx
btc eax, eax
not dx
rol eax, 0xc2
inc ecx
dec ax
sub edx, 0x79a1f40d
neg ecx
shr eax, 0x55
shr eax, 0x52
bswap ecx
lea ecx, [edx + ecx - 0x714bbbd9]
bt edx, eax
xor ebx, ecx
push edx
or dword [esp + eax], 0x7706713e
jo 0x98f169
adc edi, ecx
mov ecx, dword [eax + ebp]
mov edx, dword [ebp + eax + 4]
and eax, 0x1690d386
lea ebp, [eax + ebp + 4]
adc ecx, edx
not dword [esp + eax*8]
xor eax, eax
mov dword [eax + ebp], ecx
lea edx, [eax + eax*2 - 0x9f0ba4d]
movsx ecx, dl
mov dword [esp + eax], edi
ret
Function at 0x8e03a9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop eax
pop edx
pop edx
jmp edi
jbe 0x76bf98
sal edx, 0x84
sbb ecx, 0xedbaa5b1
push eax
mov dword [esp + edx - 0x12246cd0], eax
xor ecx, 0xac0a9890
mov dword [esp + eax - 0x63a08713], eax
bswap ecx
mov dword [esp + edx*4 - 0x4891b338], edx
not ax
lea ecx, [ecx + eax*2 - 0x6b9c21af]
cdq
ror dl, 0x66
not ecx
bswap ecx
dec al
lea ecx, [ecx + edx*2 - 0x31919283]
not edx
xor ebx, ecx
add edi, ecx
mov edx, dword [esi + eax - 0x63a078e7]
mov cl, byte [eax + esi - 0x63a078e3]
neg word [esp + eax - 0x63a078dd]
lea esi, [esi + eax - 0x63a078e5]
setnp byte [esp + eax - 0x63a078e0]
shr edx, cl
mov dword [eax + esi - 0x63a078e7], edx
neg eax
jne 0x784640
not eax
call fcn.00a13ec5
mov ax, word [edi]
call fcn.00a289c6

Function at 0x8e759b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bswap edx
and cl, byte [esp + eax - 0x5cb0]
xor edx, 0x3e3b629c
mov dword [esp + ecx*4 - 0x17000], ecx
mov byte [esp + eax - 0x5cb6], 0x39
inc eax
dec edx
xor ebx, edx
btc cx, 0x90
adc ebp, edx
movsx edx, cx
mov di, word [edi + eax*2 - 0xb970]
pop ecx
pop ecx
jmp fcn.008360bb

Function at 0x8e92cc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea ecx, [edx*8 - 0x5a520075]
xor eax, ebx
btr ecx, edx
ror eax, cl
shl ecx, 0x3c
mov dword [esp + edx - 0x17d4ffff], ecx
imul ecx, ecx
adc eax, ecx
sal cx, 0x84
neg eax
dec eax
push edx
xor ebx, eax
inc dword [esp + ecx*4]
je 0x91e93f
neg dl
add esi, eax
shl dl, 0xe3
mov eax, 0x90282392
setbe al
mov ax, word [edx + edi - 0x17d4ff08]
rol dword [esp + ecx], 0x53
call fcn.0098b914
call fcn.00983840
mov ecx, 0x4d2409a1
sub cx, cx
lea esi, [esi + ecx - 0x4d240004]
mov ecx, dword [esi + ecx - 0x4d240000]
xor ecx, ebx
dec ecx
xor ecx, 0x333c2425
call fcn.00912d77
sar edx, 0xa5
rol edx, 0x1d
Function at 0x8e93c3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc esp
mov dword [ecx + edi - 0x71967bb6], esi
dec ebp
lea edi, [ecx + edx + 0x34940f96]
and dx, 0x540a
inc edi
mov ecx, dword [edx + ecx - 0x71927bb7]
inc ecx
movzx eax, ax
dec ecx
div eax
dec eax
sar eax, cl
dec ebp
lea edx, [edx + eax*8 - 0xcafd]
sar ax, 0xa3
inc ebp
xor ecx, esp
inc ecx
shr al, 0xa1
inc esp
movsx esi, cl
inc ecx
neg ecx
inc esp
movsx ebp, cx
inc ebp
add ebp, edi
inc ebp
lea ecx, [ecx + eax + 0x21b28d82]
movsx ebx, dx
inc ecx
neg ecx
inc bp
add esi, esi
call fcn.0075a5ae
mov esi, 0xd603f03c
mov ecx, 0xa3288208
xchg edx, eax
xchg ebp, eax
sub al, 0x82
sub byte [ebx - 0x7de75e3a], ah
sub byte [ebx + 0x3b5ea5ba], ah
push eax
mov dword [0x5968895c], eax
aam 0x6c
fnsave dword [edi]
sub al, 0x6f
adc ecx, ebx
hlt
dec esp
adc ebp, esp
inc esp
btc ecx, ecx
mov edx, 0x6502f381
inc esi
mov esi, dword [ecx + ebp - 0x71967bb2]
jae 0x70705c
inc ecx
sbb ch, 0x17
push ecx
inc ebp
movsx edi, ax
inc ecx
xor ch, 0x86
inc ecx
xor ecx, 0xf60d60a8
dec esi
xadd dword [esp + edi], ecx
inc ebp
xor ah, ch
inc dx
shr dword [esp + edi*2 + 6], 0xa2
inc ecx
pop esi
jp 0x75c027
dec eax
mov dword [esp + ebx], ebp
inc ecx
mov edx, eax
inc ebp
xor ah, dh
dec esi
lea esi, [esp + esi + 8]
bswap ecx
dec eax
ror esi, 0x22
inc si
movzx ecx, byte [ebx + esi]
inc bl
inc sp
cmovg ebp, edx
rol word [esp + ebx + 3], cl
dec eax
lea edi, [edi + ebx*2 - 4]
inc esp
movsx esi, byte [esp + ebx*8 - 5]
inc dword [esp + ebx + 1]
inc sp
mov dword [edi + ebx*8 - 8], ecx
not dx
inc cx
shl eax, 0xe6
pop ebx
jne fcn.008c5046
jmp 0xca6e7d
mov ecx, 0x71927bb2
inc ebp
movzx ebp, byte [edx + ecx - 0x71927bb3]
inc ebp
xor ch, ah
inc esp
movsx ecx, cl
inc ecx
xor ch, 0xa5
inc ebp
mov eax, ecx
inc ecx
ror ecx, cl
inc ecx
ror ch, 1
inc ecx
shl eax, cl
js 0x75d308
add edi, 6
mov eax, 0xa730d63d
mov byte es:[edx], cl
mov edx, eax
jmp esi

Function at 0x8f0bf5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe9b0b6a9
not dl
push eax
neg byte [esp]
movsx ecx, al
mov word [ebp + 2], dx
mov edx, 0x15318f13
jb 0xa2363b
mov edx, dword [edi]
mov ecx, 0x353e1c95
xor cl, cl
mov eax, dword [edi + ecx*2 - 0x6a7c37fc]
rol ecx, 0x1f
bts cx, cx
mov cl, byte [ecx + edi - 0x1a9f0df9]
jae 0x778201
push ss
div dword [eax + edi]
adc al, 0xfd
mov edi, 0x8e7c6bd8
push edi
ror byte [ebx + 0x7c], 1
invalid
mov edx, dword [ebp + edx - 0x15318f11]
adc eax, eax
mov cl, byte [ebp + 6]
call fcn.0097a065

Function at 0x8f34da
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + eax - 1], edx
rdtsc
mov ecx, 0xa03e6a20
mov byte [esp + 3], cl
sbb ebp, 8
mov dword [ebp + 4], eax
add word [esp + 6], 0xe103
setne byte [esp + 7]
mov dword [ebp], edx
pop eax
pop edx
jp fcn.0089b138
mov ecx, dword [ebp]
mov edx, 0xe4b3bc1a
dec dl
mov dx, word ss:[ecx]
mov eax, 0x6723661d
jg 0x7fa16b
Function at 0x8f4069
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], ebp
push ebx
push edi
lea ebp, [esi*4 - 0x4ae7187d]
pushfd
pop edi
mov dword [esp], edi
mov ebx, 0
neg ebp
mov dword [esp + ebp - 0x62ecf4c5], ebx
lea edi, [esi + ebp - 0x5dc1e247]
mov edi, dword [esp + ebp - 0x62ecf4bd]
bts si, si
lea ecx, [esi*4 - 0x17d928c7]
neg edi
xor edi, 0x969d22a2
and ebp, ebp
rol edi, 2
add cx, si
bts ecx, 0x27
not edi
lea edi, [edi + ebp - 0x3c2f6048]
xchg cx, si
ror ebp, cl
neg ecx
ror edi, 1
shl esi, 0x2f
sub esi, 0xf4a8359a
bswap ecx
add edi, ebx
sar esi, 0xd2
rol ecx, cl
mov dword [esp + esi - 0x13d2], edx
ror si, 9
add ebp, ecx
mov dword [esp + esi - 0xf6e9], eax
jbe 0xcb2a93
clc
Function at 0x8fa61f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bts edx, edx
jae 0x974bd0
ror ecx, 3
movzx eax, dl
rol ax, 0x8f
bswap ecx
lea ecx, [ecx + eax - 0x2fb90391]
neg dword [esp + eax*2 - 0x100a8]
sbb dword [esp + eax - 0x804e], edx
mov dword [esp + eax - 0x8056], edx
xor ebx, ecx
shr dword [esp + eax*8 - 0x402ab], 0x9a
add edi, ecx
mov dword [esp + eax*2 - 0x100ac], edi
ret 8

Function at 0x8fde61
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
adc edx, 0xbbb769b8
btc ax, ax
ror edx, 1
cwde
sal cx, cl
dec edx
bswap edx
cbw
xadd ecx, eax
xor ebx, edx
jmp 0xc97b10
sal ecx, cl
not dx
pop ecx
xor bx, dx
lea edi, [eax + edi - 0x57abc002]
movsx ecx, ax
mov word [edi + eax - 0x57abc000], dx
shl ecx, 0xb1
mov dword [esp + ecx - 0x80000000], eax
lea ebp, [ebp + eax - 0x57abc004]
movzx edx, byte [esp + eax - 0x57abbfff]
mov ecx, dword [edx + ebp - 0xc0]
xor ecx, ebx
sub ecx, 0xed03781b
shl edx, 0x72
bswap ecx
btc edx, 0x12
jb 0x731a8a
rol ecx, 1
pop edx
call fcn.008d787e
sub ecx, eax
neg ax
add esi, edx
rdtsc
shr ecx, 0x32
rol cl, 5
lea edi, [edi + ecx - 8]
add ecx, ecx
btr ecx, ecx
xor ecx, ecx
mov dword [ecx + edi + 4], eax
imul ecx, ecx
adc ecx, 0xb43bbe33
mov dword [edi], edx
mov edx, ecx
jl fcn.00747049
cmp esp, 0x2fb87cb9

Function at 0x902b63
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
xchg esi, eax
dec esp
add ebx, ebp
inc esp
mov byte [esp + edx - 0x1a], ch
dec eax
mov edx, dword [edi + edx - 0x28]
mov ebp, ebx
inc edx
neg byte [esp + edi - 0x30]
dec eax
cwde
inc dx
mov esi, dword [edx + edi*2 - 0x6e]
inc dx
not dword [esp + edi - 0x24]
cmove ax, bx
inc cx
mov dword [edi + edi - 0x39], esi
dec ecx
lea edi, [edi + edi - 0x39]
dec edx
mov dword [esp + edi*2 - 0x5a], 0x2298e405
pop edx
inc ecx
pop ebp
inc ecx
pop ecx
pop ebx
inc ecx
pop ecx
jno fcn.008c5046
jmp 0xa00a7d
xor ebp, 0xd3b262b6
sar edx, 0xe1
xadd byte [esp + esi - 0x24], ch
dec eax
mul eax
lea ebp, [ebp + edx - 0x4eb8ee19]
dec eax
sal dword [esp + edx + 0x20], 0x74
dec esp
mov dword [esp + edx*4 + 0x20], esp
inc esp
xchg dl, cl
xor dword [esp + edx*4 - 0x60], ebp
movsx ebx, byte [esp + edx - 7]
dec esp
mov dword [esp + edx - 0x20], esi
dec esp
mov esp, dword [esp + edx*2 - 0x20]
dec eax
arpl bp, bp
jmp 0x8df05c
mov eax, 0x7db2d8ae
call fcn.008de65b
mov dl, 0x6c
push ss
sub ecx, ebx
fiadd dword [eax - 0x4e]
fsub dword [ebx + 0x5d]
adc al, byte [eax]
fidivr dword [eax + 0x125d0f]
adc bh, byte [ebp + 0x54782cad]
minps xmm2, xmmword [edx]
add byte [edx], dl
mov ebp, 0x54782cad
jmp 0xa00a96
Function at 0x902ba4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Parse pe header

Disassembly:
movzx ecx, byte [esi + ecx*2 - 0x7c218b45]
mov dword [esp], edi
sub esi, 1
movsx eax, di
xor cl, bl
not cl
jmp 0xcaf207
dec cl
or eax, dword [esp]
neg cl
xadd dword [esp], eax
ror eax, 0xc9
xadd dword [esp], eax
rol cl, 1
inc eax
dec cl
imul dword [esp]
sub edx, edi
xor bl, cl
lea eax, [edi*8 - 0x50562050]
sar eax, 0x99
lea ecx, [esp + ecx + 4]
btr edi, 0x9b
lea edi, [edx + edx*2 - 0x245ad250]
mov eax, dword [ecx + edx - 0x7f]
lea edx, [edx*8 + 0x14335789]
adc dword [esp + edx*2 - 0x2866b702], 0x8b9acf38
mov dword [edx + ebp - 0x14335b85], eax
mov ecx, dword [ebp + edx*2 - 0x2866b706]
mov edi, ecx
movsx ecx, dx
shl dx, 0x29
pop edx
jp 0x74f13b
Function at 0x904918
Capabilities:
Encode data using xor

Disassembly:
push 0xe106a7a4
jmp 0x7cec64
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0x8d1b9c04
lea esp, [esp + 8]
je 0x9093d1
mov eax, dword [ebp + ebx*4]
call fcn.00a047ca
xor dl, bl
mov dword [esp + eax - 0xa060000], eax
sar al, 0x45
pop eax
rol dl, 1
xadd al, ah
dec ax
dec eax
dec dl
cbw
ror eax, 0xe1
neg dl
ror eax, 0x10
sar eax, 0xa8
sbb dl, 0x8c
cwde
xor bl, dl
push esi
shr al, 0xa6
lea eax, [eax + eax*4 - 0x7cf1f350]
shl ax, 0x63
push ebp
idiv al
bts ax, ax
lea ebp, [eax*4 - 0x4f51a273]
push ebx
mov ebp, edi
add al, 5
movsx ebx, al
lea eax, [eax + ebx + 0x70b26235]
mov ebx, edx
lea edx, [eax + eax*4 + 0x431834b7]
mov edx, ebx
jno 0xa1aeb6
mov eax, 0x3e2aab05
cwde
mov eax, dword [ebp]
call fcn.00a15798
adc eax, eax
sal edx, 2
mov eax, ebp
jmp 0x73eda3

Function at 0x908646
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc eax
xor dx, 0x6c80
xor eax, eax
not dx
shr ax, 0x89
lea ecx, [eax + eax*2 - 0x15d38f80]
sbb dx, 0x7d0b
dec eax
neg dx
push eax
push eax
rol dx, 1
call fcn.0074a6e6
add dword [esp + edx - 0x63a9f929], 0xa3a44f92
dec eax
and dx, cx
sbb ecx, ecx
or dword [esp + ecx*2], 0x2020e993
bswap eax
not ecx
push edx
pop edx
neg eax
imul edx, ecx
shl dword [esp], 0xef
xor ebx, eax
sub cl, 0xd
adc edi, eax
sal dword [esp], cl
lea eax, [edx - 0x3efd2d4c]
mov ax, word [ebp + eax - 0x5d5981ab]
not byte [esp + 3]
rol ecx, cl
sal edx, cl
lea ebp, [edx + ebp - 0x7ffffffe]
movzx ecx, byte [edx + esi - 0x80000000]
jns 0x76966d
lea esi, [esi + edx - 0x7fffffff]
dec edx
xor cl, bl
inc dl
ror dx, 0xcf
sbb cl, 0x3c
and dword [esp + edx - 0x7ffffe01], 0x17277284
call fcn.00937d80
invalid
mov ebx, dword [esp + ebx - 0x6d7104c8]
lea ebp, [ebp + eax*2 - 0x1fa]
inc cx
and byte [esp + ecx - 0x4ae95b2c], 0x95
mov eax, dword [ebp + eax*8 - 0x7d8]
shr ecx, cl
neg dword [esp + ecx - 0x12b4]
movsx edx, word [esp + ecx*8 - 0x95cf]
xor eax, ebx
push ecx
xchg dword [esp + ecx*8 - 0x95c4], edx
xor edx, 0xf03f3587
rol eax, 1
sar byte [esp + ecx - 0x12ac], 0xc4
bswap eax
sub cl, byte [esp + ecx*8 - 0x95c2]
call fcn.008a38a3
mov dword [esp], 0xa027928f
sbb esi, 8
push 0xfb2b4a8c
dec byte [esp + 4]
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebx
mov ebx, dword [esp + 2]
inc byte [esp + 5]
movzx eax, byte [esp + 3]
mov dword [eax + esi - 0xf7], ecx
push ebx
neg ebx
mov dword [ebx + esi - 0x6d7104d5], edx
dec ebx
lea ecx, [eax + ebx*2 + 0x7007508e]
jns 0x8d0c64
mov ecx, 0xfa0e511b
mov eax, dword [esi]
add esi, 4
lea edx, [ecx*2 - 0x68561d6e]
btr ecx, ecx
xor eax, ebx
push edx
neg dl
adc dl, cl
bswap eax
sub edx, 0x281c8b2b
jae 0x8cb940
sub esi, 2
mov ecx, 0xa62148a5
shl cl, cl
movzx edx, word [esi]
movsx eax, cx
ror ecx, 0x2c
xor dx, bx
inc eax
jns 0x71ca44
Function at 0x9086dd
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
cwde
lea edx, [edx + eax*4 - 0x6b189e28]
lea eax, [eax*8 - 0x1cf3ff6e]
sar al, cl
bswap edx
not edx
adc ecx, 0x31ab5f91
not al
ror edx, 2
add ax, cx
and al, cl
lea ecx, [ecx + eax*2 + 0x573b5c9e]
xor ebx, edx
mov dword [esp + ecx - 0x4f0214d9], 0x4e13b2b2
mov dword [esi + ecx - 0x4f0214dd], edx
imul dword [esp + ecx - 0x4f0214d9]
sar dl, 0x27
mov edx, dword [edi + ecx - 0x4f0214d5]
add word [esp + ecx - 0x4f0214d8], cx
shr dword [esp + ecx - 0x4f0214d9], 0x54
pop ecx
lea edi, [ecx + edi - 0x4da]
setnp al
setb al
and ax, cx
xor edx, ebx
not ax
sub edx, 0xbeb09bbd
btr eax, eax
lea eax, [ecx + eax*8 + 0x75361b9d]
not edx
add al, ch
dec cx
sar eax, 0xeb
dec edx
xor edx, 0x9f96bd99
lea ecx, [ecx + eax + 0x20beaa8a]
xor ebx, edx
shr al, 0x24
not ecx
and ecx, eax
adc ebp, edx
call fcn.0098b8fb

Function at 0x9091ba
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ecx, esi
inc edx
neg byte [esp + 0xb]
mov dword [esp + 0xc], 0x9ca6a32c
xor ecx, 0x120b93e
dec eax
call fcn.009b2222
shr ecx, 8
mov dword [esp], 0x7f35e582
jmp 0x810169

Function at 0x90ec7c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
mov ebp, edi
dec esi
mov dword [esp + edi - 0x6334a3b8], edi
inc ebx
mov ebp, dword [edi + edx - 0x6334a3b8]
inc ebp
mov ecx, edi
inc ecx
xor ebp, esp
inc ecx
mov eax, 0x5e809884
inc dx
add dword [esp + edi - 0x6334a3b7], ecx
inc ecx
movsx eax, bh
ror ebp, cl
dec eax
cdq
inc ecx
movsx esi, bh
bswap ebp
ror ebp, 2
xor ebp, 0x72312728
add dl, byte [esp + edx + 4]
dec esp
mov dword [esp + edx], esp
inc ecx
xchg bh, dl
inc edx
xor dword [esp + edi - 0x6334a300], ebp
inc ecx
pop esp
dec edi
lea ebp, [ecx + eax*4 + 0x3399450c]
inc esp
btc ecx, ebp
dec eax
arpl bp, bp
dec ecx
mul ecx
inc ecx
movzx ebx, ch
dec esp
adc ebx, ebp
dec cl
dec edi
lea edx, [edx + edi - 0x6334a301]
mul ecx
inc ecx
ror bh, 7
inc ebx
movzx eax, byte [edx + edi - 0x6334a300]
dec esp
lea ecx, [esi*4 - 0x4c5768fd]
inc ecx
xor al, ah
inc ecx
push ecx
inc ebp
movsx esi, cl
inc ecx
push ecx
dec al
rol al, 1
inc ecx
neg eax
not al
rol al, 1
inc esp
xor ah, al
dec eax
lea eax, [esp + eax + 0x10]
inc dx
inc dword [esp + edi - 0x6334a2f6]
inc ecx
or bl, ch
dec esp
mov esi, dword [eax + edx*2 - 0x1c34f51a]
not cl
ja 0x8a0096
mov eax, 0xed0f79b4
call fcn.007e1c11
Function at 0x9124aa
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov esi, 0xd413ed03
movzx esi, byte [eax]
xor esi, edx
jmp 0x72d203
push 0x2006c0ba
and esi, 0xff
sub word [esp], 0x2d29
setnp byte [esp]
call fcn.0094b43e
jmp 0x7593ec
not byte [esp + 6]
lea esp, [esp + 0xc]
jne 0x72ca8b
mov esi, 0x318e9400
mov ecx, esi
and ecx, esi
pop esi
call fcn.00a12488
mov edx, 0x1a34c9ba
lea ebp, [ebp + edx - 0x1a34c9be]
movsx ecx, dl
bts edx, 0x32
sub edx, 0xea907ea3
mov eax, dword [ebp + edx*2 - 0x5f48962e]
imul ecx, ecx
bts cx, dx
sub dl, cl
xor eax, ebx
neg eax
ror eax, 1
inc eax
lea ecx, [ecx + edx*2 - 0x7fe4ee6]
ror ecx, 0x71
push ecx
neg eax
xor ebx, eax
add esi, eax
mov eax, edx
add dx, 0x3636
inc dx
mov edi, dword [edi + edx*2 - 0x5f490354]
rol word [esp + edx*2 - 0x5f490352], cl
jbe 0x712c44
inc byte [esp + 7]
inc eax
not dword [esp + 8]
mov dword [esp], 0x81353026
xor edx, 0xa5b1b216
shr word [esp + 9], 0x61
dec ecx
jmp 0x740e03

Function at 0x912d77
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sal dword [esp], 0x26
adc ecx, 0xcf2d5788
jmp 0x9b5995
mov edx, 0x8bbf4d04
shl dl, 0x25
adc edi, 6
neg dx
shl dl, 0xe6
dec dl
mov byte [eax], cl
lea eax, [edx + edx*2 - 0x9e64fea]
movzx ecx, dx
xchg ecx, eax
lea esi, [esi + eax*8 - 0x597fc]
cwde
jle 0x8df02f
shr edx, cl
mov edx, dword [esi + edx*2 - 0x22ee]
bts eax, eax
btc cx, 0xbf
bswap ecx
xor edx, ebx
rol edx, 1
sub eax, ecx
lea eax, [eax*2 - 0x65cff7d9]
xor eax, ecx
inc edx
sar ecx, cl
rol cx, cl
call fcn.00cb25eb
mov dword [esp], 0x3c3a5100
ror ecx, 3
jmp 0x773609
sar word [esp + 1], 0xaa
xor dword [esp], 0xcc11248e
xor ebx, ecx
mov word [esp], 0xde99
push 0xe5210083
call fcn.008f6ca4
sysenter
call fcn.009c5f35
mov eax, 0x1bae802b
bts eax, eax
xor ax, 0x5db9
mov eax, dword [ebp + eax*4 - 0x6ebb5648]
mov dx, word [ebp + 4]
mov ecx, 0x6ab352a2
lea ebp, [ebp + ecx - 0x6ab3529c]
sal cl, 0xa4
sar cl, 0x85
mov word ss:[eax + ecx - 0x6ab35201], dx
mov edx, 0x97882030
lea edi, [edi + ecx - 0x6ab35205]
btr cx, dx
btr edx, edx
mov eax, dword [ecx + edi - 0x6ab35200]
call fcn.008e0fb3
mov ecx, 0x65810005
shr cx, cl
mov eax, dword [edi + ecx - 0x65810000]
or cl, byte [edi + ecx - 0x6580fffc]
jmp 0x8ca1e0

Function at 0x914472
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jmp fcn.008c5046
inc ebp
mov ecx, dword [edx]
inc ecx
movsx eax, bh
dec ecx
ror ebp, 0x66
dec ebp
btc edi, edi
inc ebp
xor ecx, esp
dec esp
mov dword [esp + eax - 0x7c], edi
dec eax
cdq
inc ecx
dec ecx
sar word [esp + eax*2 - 0xf2], 0xaf
inc ecx
bswap ecx
sar ax, 5
inc ecx
xor ecx, 0xa1bc0c93
inc ecx
inc ecx
dec dword [esp + eax + 1]
inc ecx
neg ecx
inc ecx
xor ecx, 0x40329221
inc esp
movzx esi, word [esp + eax - 2]
movsx ecx, ax
inc ecx
neg ecx
inc ebp
lea ecx, [ecx + eax*8 - 0x638568a3]
dec esp
mov dword [esp + eax - 3], esp
inc esp
xadd eax, edi
dec eax
lea esi, [edx + 0x7eaa9535]
inc esi
xor dword [esp + edi - 3], ecx
inc ecx
pop esp
sub si, dx
inc ecx
movsx ebx, bh
dec ebp
arpl cx, cx
inc ecx
mov ebp, esi
dec ebp
adc ebx, ecx
dec edx
mov edi, dword [edi + edi*8 - 0x18]
jmp 0x7e3e40
Function at 0x914b32
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.009b68e3
sub ebp, 4
mov ecx, 0x11363c26
movsx edx, cl
mov edx, dword [ebp + ecx - 0x11363c26]
add cx, cx
sub ecx, ecx
shr ecx, 0xad
xor edx, ebx
movsx eax, cl
xadd eax, ecx
cwde
rol edx, 1
sar cl, 0x87
and cl, ah
call fcn.0075a6ce
mov edx, dword [esi]
add esi, 4
mov eax, 0xd8830cba
btc eax, 0x87
lea ecx, [eax + eax*2 - 0x20706461]
xor edx, ebx
shl cl, 0x47
adc ecx, eax
dec edx
sub al, ah
not edx
xadd ecx, eax
cwde
ror ecx, cl
xor edx, 0xe9e680b
add eax, 0xe69b0ab9
rol cx, 0xc4
xor ecx, eax
ror edx, 3
and al, 0x35
lea edx, [edx + ecx*2 - 0x42270173]
xadd eax, ecx
shl cx, 3
rol edx, 1
bts ecx, eax
bt ax, ax
lea eax, [eax + eax + 0x192b8621]
lea edx, [edx + ecx - 0x486c2af1]
jae 0x9aa977

Function at 0x915b10
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.0097140e
inc ecx
not ecx
not dx
ror ecx, 3
push edx
xor ecx, 0xd01abb00
not ecx
call fcn.00cc440c
bswap edx
ror dword [esp + 0xd], 0x18
xor ebx, edx
push 0x50011f8e
add esi, edx
lea esp, [esp + 0x18]
jmp 0x7ac92e

Function at 0x917f97
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc cx
sal ebp, 0x25
rol ebp, 1
sub ebp, 0xbb29c319
xor ebp, 0x5c094226
dec ebp
dec esp
mov dword [esp + eax - 0x68d7a659], esp
dec edx
mov dword [esp + ebp], eax
inc ecx
push ebp
xor dword [esp + eax - 0x68d7a651], ebp
dec esi
mov esp, dword [esp + ebp*2 + 0x10]
dec eax
arpl bp, bp
dec edx
mov dword [esp + ebp + 0x10], 0x3685ea28
dec esp
add ebx, ebp
cbw
inc edx
xchg byte [esp + ebp + 0x12], al
movsx ebp, ax
pop ebp
pop ebp
inc ecx
pop ecx
jmp fcn.008c5046