joyce8/EMBER2024-capa huggingface dataset:
Function at 0xca949c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ecx, ebx
call fcn.009939bb
add eax, edx
call fcn.0094251f
div dword [edx + 0x27]
xchg esi, eax
lcall 0x9294, 0xf80438fc
cld
cmp byte [esp + esi*8], al
out dx, eax
salc
cld
cmp byte [eax + edi*4], al
push ebx
out 0xcb, eax
cmp eax, 0x23f713c4
pop ds
xchg esi, eax
test ch, dh
into
dec ebp
push esi
pop edx
cmc
dec ebp
rcl ch, 1
int 0x12
xor esi, ebp
cmp byte [ebx + 0xcfea987], 0x32
jmp 0xd9f767ba
and al, al
adc edi, 6
and ax, 0xd207
or eax, 0xe92b3717
mov byte ss:[ecx], dl
movzx ecx, al
mov edx, 0xac8d430f
add ecx, 0x5b8a0dbe
mov ecx, dword [ecx + esi - 0x5b8a0dd5]
or dl, 5
sbb edx, edx
lea esi, [esi + edx*8 + 4]
mul edx
jno 0x7f5764
shr eax, 4
sal edx, 2
lea eax, [eax + eax*8 + 0x349a8d3a]
mov eax, ebp
mov dword [esp], 0x408ff80b
dec dword [esp]
jp 0x8ff2ea
mov eax, 0xdc8ce521
mov ecx, dword [edi]
shl al, 3
mov dl, byte [edi + 4]
jne 0xa1ae63

Function at 0xca94d2
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not cl
sbb dl, dl
rol dx, 0x86
or al, cl
mov word [edi + edx*4 - 0x7ff5c], ax
call fcn.00a0bc21
jmp 0x99d6c0
mov edx, dword [ebp + ecx*4 - 0x1cf84f54]
lea eax, [ecx + 0x4a076900]
xor ax, bx
not ax
sal cl, 0x87
inc ax
sal dword [esp + edx - 0x76bc7f12], 0x94
rol ax, 1
xadd byte [esp + ecx*2 - 0xfdff], dh
not ax
dec dx
neg dx
add byte [esp + edx - 0x76bcffee], dl
inc ax
shr cl, 0xa5
neg ax
sar ecx, 0xd5
sal cx, 0x2e
sbb ax, 0x2ab5
xor bx, ax
lea edx, [ecx + edx*8 - 0x5deeedcb]
sub byte [esp + edx - 0x57f911ad], ch
sub byte [esp + ecx*8 + 1], 0x91
add cx, ax
mov ax, word [edi + edx - 0x57f911ad]
mov dword [esp + edx - 0x57f911ad], 0xf321d525
dec dword [esp + edx - 0x57f911ad]
not edx
not cx
push edx
not ax
or cx, ax
bt dx, 1
mov eax, dword [esp + 1]
mov word [edi + eax*2 - 0x49500ddc], cx
push eax
mov dword [esp + eax*2 - 0x49500ddc], ebp
ret 8
sub edi, 4
mov edx, 0x74165437
neg dx
lea eax, [edx*4 + 0x5935d0f]
mov edx, dword [edi + edx - 0x7416abc9]
push eax
xor edx, ebx
add dword [esp], 0x313007a2
sbb edx, 0xb1a27819
cbw
ror edx, 1
xor al, ah
mov ecx, dword [esp]
inc edx
not edx
xor ebx, edx
add esi, edx
btc ecx, ecx
jae 0x7dafac
shr ecx, 8
not dword [esp]
xor ecx, ebx
call fcn.009be9ac
inc dx
pop edx
add esi, ecx
not al
jmp esi
mov dword [esp + ecx - 0x7f24], 0x58bf6fb0
rol dl, 0x67
lea esi, [esi + edx - 0x76bc7f18]
jae 0x8a791c
mov eax, 0xb318b815
sub esi, 4
lea ecx, [eax + eax + 0x1b861a1e]
mov eax, dword [esi]
bts ecx, 0x39
movzx edx, cl
shl edx, cl
xor eax, ebx
lea edx, [edx + edx + 0x2cb54aa9]
bt edx, edx
xor eax, 0xc012970c
neg eax
sub ecx, 0x1d099f15
adc ecx, 0x412ff1a0
xchg edx, ecx
xor eax, 0x42b9ca33
bts ecx, ecx
rol ecx, cl
not eax
inc cl
xor ebx, eax
add ebp, eax
lea eax, [edx + ecx*2 - 0xed6ee60]
cdq
btc eax, ecx
movzx ax, byte [edx + edi]
mov cl, byte [edi + edx*2 + 2]
sub edx, 0xa81a969d
xchg dh, dl
lea edi, [edi + edx - 0x57e56367]
xor dl, 0x90
not al
sar edx, 0xee
jp 0x719267
Function at 0xca9af6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, 0xe70c9782
mov dword [edi + 8], ebx
pop ebx
mov dword [edi + ebx + 0x7b7e8d4c], ecx
lea ecx, [ebx + ebx + 0x31979b21]
mov dword [edi + ebx + 0x7b7e8d48], edx
mov ebx, dword [esp + ecx - 0x3a9a808d]
btr ecx, eax
lea edx, [eax + 0x123a7d30]
lea ebp, [ebp + ecx*2 - 0x75350126]
call fcn.008cb8e6
jmp 0x7f4420
inc ecx
mov eax, 0x71a010b4
inc ebp
movsx esi, ax
dec edi
lea edx, [edx + eax - 0x71a010b8]
inc ecx
mov ebp, eax
inc esp
sub eax, ebp
inc ebx
mov ebx, dword [eax + edx]
dec ecx
lea esi, [eax - 0x5ada64f8]
dec esp
xadd ebp, eax
inc ecx
xor ebx, esp
inc ecx
push esi
rol ebx, 1
inc cx
and esi, 0x41556fbf
lea ebx, [esi + ebx - 0x1029dc48]
dec esp
lea ebp, [ebp*8 + 0xea381b9]
dec esi
and dword [esp + eax - 0x71a010ac], eax
dec ecx
bts eax, 3
rol ebx, 3
dec ebx
lea eax, [ebp + esi*4 - 0x6dfed470]
dec ebp
add eax, esi
bswap ebx
inc ecx
push eax
xor ebx, 0x42b02039
bswap ebx
dec edx
shl dword [esp + esi - 0xa4], 0xe3
inc ecx
ror esi, 0x71
inc edx
lea ebx, [ebx + eax*2 - 0x7eb58c59]
inc edx
sar dword [esp + eax - 0x71a01163], 0xf9
xor ebx, 0x731010b
push eax
dec edx
mul dword [esp + esi*2 - 0xb3fffe]
rol al, 0xa7
neg ebx
inc edx
lea ebx, [ebx + eax - 0x1b1b71c6]
dec edx
sub dword [esp + esi*2 - 0xb40000], 0xd2a52510
inc ecx
setl ch
ror ebx, 1
dec esp
lea esi, [esi*8 - 0x4fdde261]
dec ecx
sar eax, 0xc2
inc edx
setp byte [esp + eax - 0x1c680446]
dec esi
mov dword [esp + eax*2 - 0x38d008a0], esp
inc dx
or dword [esp + eax - 0x1c68044b], 0xf742de1c
pushfd
add al, 0xa8
sti
xchg edi, eax
jecxz 0x7f455b
inc edx
xor dword [esp + eax - 0x1c68043c], ebx
dec esi
mov esp, dword [esp + eax - 0x1c68043c]
dec ecx
shr eax, 0x27
neg ax
dec eax
arpl bx, bx
btr ebp, 0x1c
dec esp
add ebx, ebx
inc edx
movzx ecx, byte [esp + eax*2 + 0x1a]
inc edx
mov edi, dword [edi + eax*2]
inc ecx
pop ebp
pop esi
pop ebx
inc ecx
pop edi
inc ecx
pop edi
jmp fcn.008c5046
inc esp
add al, 0xc
fisttp word [eax]
add byte [eax], al
add bh, dh
pop esp
and al, 0
push 0x848172b8
mov dword [edi + 0xc], eax
jne 0x7e21e7
mov al, byte [ecx + eax*2 - 0x40000010]
xchg dh, dl
lea edi, [edi + edx*2 - 0x2c40192]
not dx
mov word [edi + edx - 0x162ff37], ax
mov ecx, edx
jae fcn.00ca4448
mov esp, edi
mov edi, 0xfa209dbf
movsx eax, di
pop eax
movzx ebx, di
pop edi
pop ebx
mov ecx, 0xd40e5d15
pop esi
popfd
pop ebp
call fcn.008030e4
jb 0x8caaa9
outsb dx, byte [esi]
das
pop edi
ret
mov dword [esp], eax
pop edx
xor cl, 0x32
ror ax, 0xb
ror cl, 1
shl eax, 0xcb
sets al
btc ax, 0x13
xor bl, cl
add ecx, esp
ror edx, 0x47
jae 0x8caac0
ror edx, 1
ror eax, 0x45
shr ecx, cl
add eax, eax
not edx
xor ebx, edx
add edi, edx
btc ecx, eax
lea edx, [ecx*8 - 0x1cea4b66]
jmp edi
Function at 0xca9d66
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not eax
btr dx, cx
pop ecx
shl edx, 0x48
xor ebx, eax
lea ecx, [edx + 0x7286bc1e]
rol dword [esp + edx - 0x788f0efc], cl
adc ebp, eax
movzx eax, word [esp + edx - 0x788f0efd]
lea ecx, [eax*8 + 0x7d04e48a]
dec ecx
mov dword [esp + edx - 0x788f0f00], ebp
ret 4
mov edx, 0x3e37a433
movsx ecx, dx
lea edi, [edi + edx - 0x3e37a42f]
mov dword [esp + edx*2 - 0x7c6f4866], 0x6c9c1e11
bt ecx, ecx
sbb edx, 0xe6bf14a3
xor eax, ebx
ror eax, 3
bts edx, 0xb5
adc ecx, ecx
bswap eax
push edx
xor eax, 0x22057587
and cx, dx
push ecx
ja 0xa1e28b
mov eax, 0x2a3f0816
call fcn.009cd6c7
Function at 0xcac005
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.00a1a0b0
adc ebp, eax
mov eax, 0x14bf4111
neg edx
btr cx, 0x22
mov eax, dword [edi + edx*2]
mov ecx, dword [edx + edi + 4]
sal dl, 0x22
inc dl
push ebx
setne dl
movsx ebx, dl
bts ebx, edx
cpuid
jae 0x7084d2
lea ecx, [eax*4 - 0x2ac0d5db]
dec edx
and cx, 0x8eb3
bswap eax
add ax, cx
ror edx, 2
shr eax, 0xff
lea eax, [ecx - 0x56f98f77]
xor ebx, edx
lea ecx, [eax + ecx*4 + 0x500a3e26]
neg al
add esi, edx
jmp esi
dec eax
mov dword [esp + 8], 0xb81126f1
dec eax
lea esp, [esp + 8]
call fcn.0073fd82
mov ecx, 0xb3986b15
sal ecx, 0x4b
mov eax, dword [esi]
adc esi, 4
sub ecx, 0xa6993c32
xor eax, ebx
movzx edx, cl
xchg dx, cx
add ecx, ecx
bswap eax
xadd edx, ecx
neg eax
dec dx
sub edx, 0x94bb473d
inc eax
bswap eax
lea ecx, [edx + ecx*2 + 0xcba008f]
lea edx, [ecx*2 + 0x151d8c90]
xor ebx, eax
xor edx, edx
sar cl, 0x44
ja 0x7c64df
mov edx, 0x8536f71d
mov ecx, 0x81212110
sub edi, 4
imul edx, edx
rol edx, 0x6f
mov eax, dword [edi + edx - 0x7ca4a862]
sal ecx, cl
add byte [edi], cl
scasd eax, dword es:[edi]
rol cl, cl
ret 0x8b6f
push edi
pop ebx
adc ebx, 0xfffffff1
push ecx
sar cx, 0xe5
xor eax, ebx
xor eax, 0x948cca16
rol dx, 1
call fcn.007283cd
jne 0xcac0e0
inc edi
jnp 0xcac076
sal dl, 0xe4
mov ecx, 0xf3b3bf00
mov eax, 0xb3bfa83b
and byte [ebp - 0x18], dl
mov edi, 0x4d58f3b3
clc
mov edi, 0x33f4f3b3
mov eax, 0xa8f3b3bf
das
mov al, 0xbf
mov bl, 0xf3
sbb al, 0x63
sar byte [edi - 0x57000c4d], 1
jno 0xcac081
mov byte [0x88a29976], al
mov word [ecx - 0xcb4960], cs
dec dword [edi]
jecxz 0xcac0db
pavgw mm7, mm5
fiadd word [ecx - 0x24]
arpl di, di
fsub qword [ebx - 1]
pand mm5, qword [edx]
sahf
add byte [ebx + 0x2e80b007], cl
jmp ebx
Function at 0xcaccc5
Capabilities:
Encode data using base64
Execute syscall

Disassembly:
mov edx, dword [edx + ebp - 0x324]
mov eax, ecx
not cl
btc cx, 0x3f
xor edx, ebx
call fcn.00a26a9f
mov eax, 0x47b4e13b
mov cx, word [ebp + eax - 0x47b4e13b]
lea eax, [eax*8 - 0x54ffc47d]
movsx edx, al
lea ebp, [edx + ebp - 0x59]
jmp 0x7644b4
inc al
or cl, dl
mov word [edi], cx
pop edx
jmp esi
lea eax, [eax + edx*2 + 0x3dfb10]
mov dword [esp + edx*2 - 0x3fff8000], edx
sub edx, 0x36113b1c
ror eax, 1
add dword [esp + ecx*4 - 0x20a4964], 0xce2c94b1
or word [esp + ecx - 0x829259], dx
xor eax, 0xae2e6d9f
xadd dword [esp + ecx*2 - 0x10524b2], edx
xor ebx, eax
add esi, eax
movzx cx, byte [edi + ecx - 0x82925b]
xadd word [esp + 1], dx
mov dl, byte [edi]
neg dword [esp]
mov eax, 0xbd2ce807
not cl
sbb ax, 0x5780
setl al
jb 0xa08a2b
not dl
lea eax, [eax*4 - 0xa429046]
ja 0x8a9bb6
mov eax, 0x1d33e6ab
mov ecx, dword [eax + esi - 0x1d33e6ab]
add ax, ax
inc eax
btr ax, ax
mov eax, dword [esi + eax*2 - 0x3a679aaa]
mul ecx
mov dword [esi], edx
mov edx, 0x3249132
lea ecx, [edx + edx*4 + 0x6b2bed3e]
mov dword [edx + esi - 0x324912e], eax
lea ebp, [edx + ebp - 0x3249136]
imul dx, cx
sar edx, 0xf0
jne 0x7c93e8
xor dx, dx
xor edx, dword [eax + ebp - 0x211608bb]
xor al, al
lea ebp, [ebp + eax*2 - 0x422c0ffc]
push eax
or dword [esp + eax - 0x211607fd], eax
bswap eax
adc ecx, edx
mov dword [ebp + eax*4 - 0x205884], ecx
dec eax
mov edx, dword [esp + eax*2 - 0x102c40]
cmovne edx, eax
mov dword [esp + eax - 0x81620], edi
ret 4

Function at 0xcacec5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec edx
add dword [esp + esi*4 - 0x294], 0x78f25a6
inc sp
xor esp, ebp
sub cl, 0x38
dec edx
mov dword [esp + edi - 0x16000], ecx
inc edx
sal byte [esp + esi*2 - 0x148], 0x65
dec edx
lea edi, [edi + esi*2 - 0x150]
inc dx
mov dword [edi + esi - 0xa7], ebp
inc si
sbb edi, dword [esp + esi - 0x9b]
inc ecx
mov ebp, 0xb6b7598d
pop edx
pop edx
jb fcn.008c5046
jmp 0x921448

Function at 0xcad339
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ecx, dword [edx + ebp - 0x1ffff0f]
inc eax
xor ecx, ebx
lea eax, [edx*8 + 0x4595fe9b]
inc dx
dec dl
bswap ecx
add al, dl
sbb ecx, 0xafb40e18
mov dword [esp + 4], ecx
push dword [esp + 4]
popfd
lea ecx, [eax*2 + 0x6d9d68bb]
or ax, dx
jg 0x73feb9
mov dword [esp + ecx - 0x5cee13db], ebp
ret 4

Function at 0xcad89c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [ecx + esi - 0x5409150c], eax
mov dword [esi + ecx - 0x54091510], edx
movzx eax, cl
mov edx, dword [edi + eax*2 - 0x20]
shl cx, 0x8a
bt cx, ax
mov dword [esp + eax*2 - 0x20], eax
lea edi, [ecx + edi - 0x54093ffc]
adc dword [esp + ecx - 0x54094000], ecx
setae al
inc ecx
xor edx, ebx
xor edx, 0x48b8cfb1
mov byte [esp + eax - 1], 0x1b
call fcn.00a47b13
bswap ecx
ror ecx, 3
jmp 0x924ad1
Function at 0xcafa7b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add ebp, ecx
call fcn.0070886e
movzx dx, byte [edi]
mov ecx, 0xd82fabb0
movsx eax, cx
xadd eax, ecx
mov cl, byte [edi + 2]
or dl, cl
not dl
lea ecx, [eax*8 + 0x2637bb3b]
call fcn.007e75cc
add dword [esp + eax - 0x25fff83], eax
xor ebx, edx
add ebp, edx
lea edx, [eax + eax - 0x60de7c58]
jmp fcn.007c545b
adc esi, edx
lea edx, [ecx*2 + 0x1e054436]
movzx ax, byte [edi + ecx - 0x1fa5062]
shr dword [esp + ecx - 0x1fa5062], cl
dec dword [esp + ecx*2 - 0x3f4a0c4]
mov cl, byte [edi + ecx - 0x1fa5060]
bt edx, edx
lea edi, [edx + edi - 0x21f9e4f8]
setae dl
pop edx
shl dx, 0x8c
or al, cl
sar dl, 0x45
not al
mov word [edi + edx*4 - 0x30834000], ax
jmp esi
bts ax, dx
xor cx, bx
or eax, 0x7b190a96
dec dx
xor cx, 0xb332
add cx, 0xf69e
sal ax, 0xa9
push eax
bswap edx
xor cx, 0xad3d
xor edx, 0xa7243d87
ror cx, 1
xadd dword [esp], eax
dec cx
pop edx
btc dx, ax
xor bx, cx
rol dl, 0xa3
not dx
sbb edi, 2
cbw
xchg edx, eax
mov word [edi], cx
mov ecx, dword [esi]
btc edx, eax
cwde
adc esi, 3
xor ecx, ebx
mul dl
bswap edx
inc ecx
mul edx
adc al, 0x24
ror ecx, 1
cwde
neg ecx
xor ecx, 0x74ac338a
bts ax, ax
cdq
xor ebx, ecx
neg ax
jb 0x71ba78
mov ecx, 0x26a404a5
lea eax, [ecx + ecx*2 - 0x1ce8bc6a]
imul ecx
mov eax, dword [ecx + esi - 0x26a404a5]
sbb dl, dl
push edx
call fcn.007692c1
xor edx, ebx
rol ecx, cl
cwde
lea edx, [edx + ecx*4 - 0x2609f214]
ror edx, 1
xadd ecx, eax
not edx
btr ax, 0xbe
bswap eax
mov dword [esp + ecx*4 - 0x7e94188], 0x6f9b7c1a
neg edx
xor ebx, edx
rol dword [esp + ecx - 0x1fa5062], 0x39
and word [esp + ecx*4 - 0x7e94186], 0x72a0
jne 0x8fb227
push 0xfa3abe36
pop ecx
lea edx, [ecx - 0x137ae759]
movzx ecx, word [esi + ecx + 0x5c541ca]
shl dl, 0x26
mov eax, edx
adc esi, 1
bt edx, eax
jae 0x9a9d1f

Function at 0xcb255c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call 0x7cd9c4
sub esi, 4
mov edx, 0x4e9c8624
and edx, 0xe831eab
mov edx, dword [esi + edx*2 - 0x1d000c40]
jnp 0xa4e2aa
inc dl
movzx ecx, word [esp + eax*2 - 0x627c0194]
bt ecx, ecx
rol dl, 1
bts ax, cx
xor dl, 0x89
ror dl, 1
xchg cl, al
shl word [esp + eax - 0x313e008c], 0x61
xor bl, dl
inc dword [esp + ecx - 0xe6]
push eax
mov word [edi + eax - 0x313e0097], dx
mov dword [esp + eax - 0x313e0091], ecx
movzx eax, byte [ebp + eax*2 - 0x627c0130]
movsx edx, cl
dec ecx
lea ebp, [ebp + ecx*8 - 0x76e]
shl cl, 0xa3
sbb dl, 0
xor al, bl
jmp 0x9719bb

Function at 0xcb5010
Capabilities:
Encode data using xor

Disassembly:
bt ecx, ecx
rol ax, 1
dec cx
xor bx, ax
mov dword [esp + ecx - 0xf60842c], ecx
inc dword [esp + ecx - 0xf60842c]
lea ebp, [ebp + ecx - 0xf60842e]
sub dx, cx
mov word [ebp + ecx*2 - 0x1ec10858], ax
dec cl
mov eax, 0x6609870b
neg ecx
pop eax
pop ecx
jb fcn.0098b9e9
Function at 0xcb5835
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esp
mov dword [esp + edx], edi
dec esp
btr edx, edi
dec eax
lea edi, [edi + edx + 0xc]
dec esp
sub dword [esp + edx], edi
dec eax
neg dword [esp + edx]
inc esp
movsx ecx, byte [esp + edx]
mov dword [esi + edx], eax
dec eax
shr edx, 0x38
ror byte [esp + edx*4 + 6], 0xc1
jnp 0x82abf2
dec esp
or dword [esp + edx], ebx
ret

Function at 0xcb5daa
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
ja 0x72644a
add cl, 0x20
test al, al
jmp 0x8a0237
lea esp, [esp + 4]
call eax
mov ecx, 0x808b801
movzx edx, cl
btr dx, dx
mov ebp, dword [ebp + ecx - 0x808b805]
lea esi, [edx + edx*4 - 0x1554ca68]
mov dword [ebp + ecx - 0x808b801], eax
sar dx, cl
adc dl, 0x87
jno 0x7f3007
mov cl, byte [edi]
setbe bh
cmovae bx, sp
xchg al, al
mov al, byte [esi]
cmovnp ebx, esi
movzx bx, bh
mov byte [ebp - 1], cl
dec ebx
mov cl, dl
movsx bx, dl
movsx ebx, cx
inc esi
bswap ebx
inc edi
bswap bx
mov ebx, 0xe89b08be
rol ebx, cl
setg cl
add bl, dl
test bh, 0x15
ror cl, 0x8c
xor al, bl
mov cl, al
sub cl, 0x41
jmp 0x74fd02
inc edx
jmp 0x7e5a7a
pop esi
adc ebx, 0xf8ad5f88
add bx, dx
pop ebx
cmp cl, al
jmp 0xa196e0
sbb eax, eax
cmp ch, 0xac
neg eax
jmp 0x9a1be4
cmp cl, 0x19
ja 0x7e5a85
add al, 0x20
mov cl, byte [ebp - 1]
xor bl, 0x3c
mov bl, cl
sub bl, 0x41
clc
cmp bl, 0x19
jmp 0x726441
mov esi, ebp
pop ebx
call fcn.00a0c9f1
mov ebx, 0xa99fb6
dec ebp
lea edx, [edx + ebx - 0xa99fba]
dec eax
lea edx, [ebx*4 - 0xac7b5c2]
je 0xa30ece
cmp al, cl
jmp 0xa30ec8
mov eax, 0xf5b715b9
mov eax, dword [ebp]
push 0xd53077a6
jmp 0x73702f
mov esp, ebp
pop ebp
jmp 0x7089a7
jbe 0x7e5491
or eax, 0xffffffff
jmp 0xa3c931
je 0x737062
pop edi
jmp 0x7b8b3f
lea esp, [esp + 0x14]
je 0x8e12fa
mov eax, 0x6a0f8f90
lea eax, [eax + eax - 0x36c2dfca]
mov eax, dword [ebp + ebx*4]
call fcn.00735c6e

Function at 0xcb8c26
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
pushfd
dec eax
add dword [esp + 8], 0xff350d48
dec eax
mov dword [esp + 8], 0xb9b11e0c
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.0073fd82
Function at 0xcc095f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
imul ecx, ecx
lea esi, [esi + edx - 0x77b5ffec]
adc cl, dl
xor dl, ch
bts cx, cx
xor eax, ebx
and edx, 0x2a97625
ror eax, 2
sal dx, 0xa5
dec eax
xchg ecx, edx
push edx
rol eax, 1
push edx
xor word [esp + edx - 0x2c], dx
jge 0x8f42be
movzx ecx, word [edi]
mov edx, 0x579ee61e
lea eax, [edx*8 + 0x3106b5a7]
or dl, 0x34
lea edi, [edx + edi - 0x579ee63c]
or ax, ax
xor cx, bx
cwd
sub cx, dx
jmp 0xa2ec9b
call fcn.009f9f52
mov edx, 0x2e8b6f32
mov dx, word [edi + edx*2 - 0x5d16de64]
mov eax, 0x80205534
lea ecx, [eax + eax*2 + 0x52a69f8e]
sub ecx, 0x34118030
mov cl, byte [edi + 2]
or ax, 0xe231
adc al, ah
add ax, ax
adc edi, 1
shr dx, cl
mov word [edi], dx
movsx ecx, al
btr ecx, 0x80
lea edx, [ecx + eax*8 + 0x370df720]
lea esi, [esi + ecx*2 - 0xb4]
shr edx, cl
and edx, 0xd53e363c
mov eax, dword [esi + ecx - 0x58]
imul cx, cx
call fcn.007ac7d3
neg eax
sub cl, 0x8a
ror dword [esp + edx*4 - 0xc0], 0x71
jne 0x980947
mov eax, 0x91b706ae
movzx ecx, al
mov cx, word [ecx + edi - 0xae]
jmp 0x7fa13b
bswap eax
xor ebx, eax
sar dword [esp + edx - 0x30], 0xfc
inc ecx
adc edi, eax
dec edx
lea eax, [ecx + ecx*4 + 0x35b53ea2]
xor cx, 0x53a6
mov dword [esp + edx - 0x30], edi
ret 4
mov edx, 0x9600f30e
bt dx, 0x2a
adc ebp, 2
or edx, 0x75b5ee01
or dl, dh
xor cl, dl
xor al, dl
btr edx, edx
sal dl, 0x83
and cl, al
mov eax, edx
mov word [eax + ebp - 0x77b5fff8], cx
movsx ecx, al
mov eax, dword [esi + eax - 0x77b5fff8]
add dl, cl
jp 0x7e7bb9
pop edx
add esi, eax
sal ecx, 0xbd
bts ecx, 0x98
lea edx, [ecx*2 - 0x4d6708c6]
mov ecx, dword [edi + edx - 0x7498f73a]
dec dl
bt edx, 0x82
mov edx, dword [edi + edx - 0x7498f735]
jae 0x8d97fb
movzx cx, byte [ebp]
mov al, byte [ebp + 2]
jmp 0xa36ef0

Function at 0xcc0ec7
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dx, word [edi + 2]
call fcn.0098cb98
Function at 0xcc27fb
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, 0x371768b8
or al, ah
jle 0x98ba9e
lea esp, [esp + 0xc]
jne 0x943429
call fcn.007839da

Function at 0xcc2843
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
cwde
not si
add si, 0xaa1e
rol cl, 0x25
not si
dec esp
lea eax, [ecx*8 - 0x74e4e5f6]
dec ecx
shl eax, 0x29
inc ecx
xadd ecx, eax
inc sp
xor esp, esi
inc cx
mov dword [ebp + edi + 0x1b684850], esi
dec edx
lea edi, [edi + ebp*2 + 0x36d090aa]
inc ecx
pop edi
dec edx
mov dword [esp + ebp + 0x1b68485a], 0x9a81769a
pop edx
pop ecx
inc ecx
pop edi
pop ecx
pop eax
jmp fcn.008c5046
Function at 0x8ec058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8ec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8ec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8ec06a
add dl, dl
jne 0x8ec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8ec0dc
xor eax, eax
add dl, dl
jne 0x8ec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8ec17d
add dl, dl
jne 0x8ec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8ec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8ec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8ec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8ec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8ec075
mov eax, 1
add dl, dl
jne 0x8ec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8ec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8ec0e1
sub eax, ebx
mov ebx, 1
jne 0x8ec128
mov ecx, 1
add dl, dl
jne 0x8ec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8ec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8ec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8ec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8ec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8ec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8ec136
cmp eax, 0x7d00
jae 0x8ec16d
cmp eax, 0x500
jb 0x8ec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8ec075
cmp eax, 0x7f
ja 0x8ec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8ec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8ec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8ec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45e008], 0x8088405
inc edx
mov dword [ebx + 0x45e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret