joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9a65c9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esi, [esi + ecx*2 + 4]
xor edx, ebx
cpuid
jae 0x90692e
lea edx, [eax*4 - 0x8d3a5ea]
adc edx, 0x768bf3b6
rol ecx, 1
xor ecx, 0x9d86919a
xor ebx, ecx
rol ax, 0x44
setae al
add esi, ecx
neg al
movzx ecx, dl
mov eax, dword [edi + ecx*4 - 0x334]
imul ecx, edx
or ecx, edx
mov cl, byte [edi + 4]
xor edx, 0xc22d1ba5
sal dx, 0x41
shr dx, 0x28
lea edi, [edx + edi - 0x13910002]
btr dx, 0xc
sar dl, 0x25
adc edx, 0xae1bbcb0
shl eax, cl
mov dword [edi], eax
sar dl, 0x61
btc edx, 2
jmp esi
call fcn.0099112b
syscall
push ecx
dec eax
mov ecx, 0xc786af9a
mov cl, dl
inc ecx
dec eax
mov ecx, dword [esp]
dec eax
mov dword [esp], 0xb7410ea3
call fcn.0073fd82
mov ecx, 0xf91f9315
movsx edx, cx
push edx
sub ebp, 4
not byte [esp + 3]
mov eax, dword [ebp]
add dl, byte [esp + 1]
xor eax, ebx
xadd dword [esp], ecx
je 0x830291
jae 0xca8342
mov edx, 0xd7395581
mov ecx, 0x3c147cb7
mov edx, dword [ecx + edi - 0x3c147cb7]
sar cx, 0xa9
lea eax, [ecx - 0x28db9800]
lea eax, [ecx*8 + 0x283a9f93]
mov eax, dword [eax + edi - 0x8daa17f]
adc cx, 0x930
jge 0x7cab7a
sal al, 0x23
inc cl
bswap eax
xchg word [esp + 1], ax
push eax
not cl
add al, 0x9d
rol al, 0xa5
rol al, 0x41
xor bl, cl
lea ecx, [esp + ecx + 0xc]
not ax
neg word [esp + 3]
sal ax, 0xeb
mov byte [ecx], dl
sbb dword [esp + 4], 0xbad8605
lea eax, [eax*2 - 0x537b3ed5]
mov dword [esp + eax - 0x6c8be12b], esi
ret 8
xor bl, dl
mov dword [esp + ecx - 0x57900000], ecx
lea edx, [esp + edx + 4]
mov word [edx + ecx - 0x57900000], ax
mov eax, dword [ebp + ecx - 0x57900005]
add ecx, 0xe7b470a8
lea ebp, [ecx + ebp - 0x3f4470ad]
jge 0x9cd7e8
aad 0x94
sub dword [esi + edx*8 - 0x7a], 0xffffffab
jmp 0xce988b98
movsx edx, cx
dec cx
xor eax, ebx
ror eax, 2
not edx
imul ecx, ecx
neg eax
shr byte [esp + ecx*2 - 0x789519e0], 0xe7
add word [esp + ecx*2 - 0x789519e0], dx
not eax
bt ecx, edx
dec eax
btr ecx, ecx
inc dword [esp + ecx*2 - 0x789119e2]
ror eax, 2
add ecx, 0xbf3dc437
push ecx
xchg dh, dl
not eax
xor ebx, eax
pop ecx
shl cx, cl
js 0x73f1d9
add esi, eax
shl dword [esp], 0xc6
lea ecx, [edi + 2]
js 0xa51435
xor eax, 0x7695d68f
push ecx
call fcn.00a260db
mov eax, 0xd1bc248d
sub byte [esp + 2], 0x96
mov dword [edi - 2], ecx
adc edi, 0xfffffffd
inc edx
push edx
push eax
pop ecx
pop eax
pop eax
jno fcn.00747049
push 0xbb87988e
mov eax, 0x2c23741d
mov eax, dword [edi + eax*2 - 0x5846e83a]
mov ecx, dword [edi + 4]
pop edx
btr edx, 0x36
push ebx
jae 0x75d260
adc edx, esp
mov dword [edx], eax
shl cl, 0x21
movsx eax, cl
jmp ebp
xor eax, 0x7695538e
sar dl, 0x64
mov word [esp + ecx - 0xff9314], dx
neg eax
push edx
neg edx
rol eax, 1
shl cl, 3
not eax
btc ecx, edx
xor ebx, eax
ror cx, 0x88
not ecx
add esi, eax
btc edx, 0x21
sar word [esp + edx - 0x6c02], 0x43
mov dx, word [edx + edi - 0x6c04]
adc dword [esp + 4], ecx
or dword [esp], ecx
adc edi, 2
sub ebp, 1
movzx eax, byte [esp + 3]
movzx ecx, byte [ebp + eax*8 - 0x7f8]
add eax, eax
jle 0x7b44e6
xor cl, bl
bts eax, eax
cwde
adc eax, eax
dec cl
not dword [esp + eax - 0x3f8]
rol cl, 1
jmp 0x983926
Function at 0x9a77d1
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
bswap ebp
dec esp
mov dword [esp + eax - 0x58a10010], esp
inc esp
xor dword [esp + eax - 0x58a10010], ebp
inc ecx
mov esp, 0x318c523e
dec eax
mov dword [esp + eax - 0x58a10020], ecx
dec esp
mov esp, dword [esp + eax - 0x58a10010]
call fcn.00809660

Function at 0x9acad6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esi
mov dword [esp + ebp - 0x1933d30b], esp
inc ebp
bt ebp, ebp
jb 0x73e64a
inc esi
xor dword [esp + ebp*4 - 0x64cf4c2c], esi
inc ebp
movsx esp, ch
inc ebp
mov ecx, eax
dec ecx
lea ebp, [ebp + ecx*4 - 0x44d9ad69]
inc ecx
pop esp
sal ecx, cl
dec eax
lea edx, [esi + 0x72229d9a]
shl ebp, 0x52
dec ebp
arpl si, si
inc sp
btr edx, edi
dec ebp
adc ebx, esi
inc ecx
sal eax, 0xc7
inc ebp
sub cl, cl
inc ecx
jmp ebx
dec edx
lea esi, [ebp*2 - 0x1867dcf0]
inc edi
mov esi, dword [edx + ebp*2 - 0x3267a616]
inc ebp
xor esi, esp
inc ecx
inc esi
inc ecx
neg esi
dec esi
mov dword [esp + ebp - 0x1933d30b], eax
inc ecx
not esi
inc esi
movsx edi, word [esp + eax + 0x490d8312]
inc ecx
ror al, 0x24
inc ecx
inc esi
movzx ecx, si
jmp 0x8aba72

Function at 0x9afcb4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.00c9f0c8
not edx
mov eax, 0x38873e26
not ecx
btc eax, eax
rol eax, 0xf5
btr eax, eax
or edx, ecx
call fcn.00926736
dec esp
mov dword [edi + ecx + 0x7e44ddf6], ebp
dec eax
lea edi, [esi + edi - 0x4a]
dec eax
shl ebx, 0x74
jne fcn.008c5046
sub esi, 4
mov ecx, 0x912d8f35
movsx eax, cx
mov eax, dword [esi]
xor cx, 0xe621
imul ecx, ecx
movzx edx, cl
xor eax, ebx
ror ecx, 0xf9
bswap eax
rol eax, cl
lea eax, [eax + ecx*2 + 0xb3e94c0]
bts edx, ecx
rol eax, cl
xor ebx, eax
sub dl, dl
adc edi, eax
movsx eax, dl
cwde
mov bp, word [ecx + ebp - 0x14b4c862]
jmp fcn.0098b9e9
Function at 0x9b0799
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov ebx, 0x48cd3d0
adc eax, 0x59ffff01
jb fcn.00747049
mov eax, 0x6106f6a9
movsx edx, al
sub ax, 0xfa33
lea ebp, [ebp + eax - 0x6106fc7a]
lea eax, [edx + eax*2 + 0x75bd79a8]
mov edx, dword [ebp + eax*2 - 0x6f96e47a]
xor edx, ebx
sal eax, 0x53
xor edx, 0x5d0f9310
call fcn.00760f2a
xchg byte [ebx], bl
imul edx, dword [eax - 0xf3e2ccd], 0x10f28153
xchg ebx, eax
minps xmm5, xmm0
sahf
sar al, 0xff
call fcn.00949b1d
ror byte [esi - 0x7f], 1
and dword [esi - 0x3b], 0x1aabbef2
push cs
mov dh, 0xf3
jbe 0x7d4e93
add dword [ecx - 0x410d3a9a], 0xb60e1aab
jbe 0x7d4e93
bound ecx, qword [esi]
mov dh, 0xf3
into
mov bh, 0xa
push cs
mov dh, 0xf3
fsubrp st(7)
push edx
push cs
mov dh, 0xf3
loop 0x7d4e4b
sub cl, byte [esi]
mov dh, 0xf3
div dword ds:[edx - 0x5d0c49f2]
push edx
push cs
mov dh, 0xf3
jge 0x7d4edd
je 0x7d4e78
dec esp
dec edx
mov bl, 0x13
lea ecx, [esi + ebp*4 - 0x7cc7bf]
jmp [ebx - 0x64]
sub dword [eax], eax
jb 0x7d4f1f
dec ecx
push cs
cdq
invalid
mov esp, 0xb82b00a7
or al, 0x6c
xchg ecx, eax
sbb byte [ebx], ch
mov eax, 0xf0510c0c
sub edi, dword [eax - 0x37a077f4]
sub edi, dword [eax - 0x3fac1ff4]
sub edi, dword [eax - 0x4fe2eff4]
sub edi, dword [eax + 0x3d1fa30c]
call eax
mov edx, 0x9219ff21
sar dword [ebp + 0x6d3eedfe], 0xc6
invalid
pop ebp
jae fcn.008c5046
mov ecx, 0x88aa94bc
movzx eax, cx
mov eax, dword [eax + edi - 0x94bc]
add edi, 4
and ecx, 0x73b59b0d
ror ecx, cl
not ecx
xor eax, ebx
neg cl
not eax
adc eax, 0x548b280a
bt ecx, ecx
and ecx, ecx
inc ecx
not eax
sbb eax, 0x3ca06381
btr ecx, 4
neg eax
xor ebx, eax
lea ecx, [ecx*4 + 0x2495781f]
bts ecx, ecx
setb cl
add ebp, eax
bts ecx, ecx
mov ecx, dword [ecx + esi - 0x21954c03]
mov eax, dword [esi + 4]
push 0x4c9e7585
jae 0x7d4e8c
Function at 0x9b2c3c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.00cb7297
inc ebx
mov ecx, dword [edx + edi - 0x6d0823af]
inc ecx
movsx edx, bh
inc ecx
xor ecx, esp
inc edx
lea ecx, [ecx + edi - 0x6f34f340]
inc ecx
movsx eax, bh
inc ebp
movsx esi, di
inc ecx
mov esi, esi
rol ecx, 1
movzx ebx, dl
inc ebp
bts esi, esi
inc esp
mov ebp, eax
xor ecx, 0x3f2ac60e
rol ecx, 1
sal bx, 0xac
js 0x9d24b6

Function at 0x9b2c81
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec ecx
bswap eax
jg 0x91baae
not ecx
not eax
not cl
xor ebx, eax
bt edx, 0x95
imul ecx, edx
add esi, eax
xadd ecx, edx
movsx eax, dx
bt ecx, eax
mov eax, dword [ecx + edi - 0x3180000]
call fcn.00729b7f
inc ecx
mov edi, 0x1f024716
dec esi
mov eax, dword [edi + edi - 0x1f024716]
inc ecx
movsx esi, bh
inc esp
mov esi, esi
dec ecx
bts edi, 0x31
dec eax
mov ebp, dword [esi + edi - 0xe]
inc ecx
movsx ecx, bh
dec eax
lea edi, [edi + esi - 6]
dec edx
mov dword [esi + eax - 0x16], ebp
inc ebp
movzx ebp, di
inc bp
imul ebp, ebp
dec ebp
lea edx, [edx + ecx*2 - 0x30]
dec edx
lea ebp, [edi*4 + 0x67b6a03d]
dec esp
lea ecx, [ecx*2 + 0xdb5de9a]
inc ecx
mov ecx, dword [edx + esi*2 - 0x2c]
inc ecx
or ch, dh
push esi
inc ecx
xor ecx, esp
inc ecx
push esi
neg ecx
sar word [esp + esi*8 - 0xa5], 0x21
ror ecx, 2
bswap ecx
inc ecx
push edi
inc ecx
inc ecx
neg ecx
inc dword [esp + esi - 4]
dec esp
mov dword [esp + esi - 6], esp
inc ecx
neg bh
xor dword [esp + esi*2 - 0x1c], ecx
inc ebp
movsx eax, cx
mov edx, dword [esp + esi - 0xa]
dec esp
mov esp, dword [esp + esi*4 - 0x48]
call fcn.0096aefb
shl cl, 7
xor eax, 0xa30f8113
sal ecx, 0x50
rol eax, 2
and cl, dl
jbe 0x740f4b
dec eax
mul eax
xor ecx, 0xd01abb00
shr ax, 0x2d
not ecx
add edx, edx
call fcn.009223c6
jmp 0xa52360
mov edx, 0x2d23e685
lea ebp, [edx + ebp - 0x2d23e689]
sal dl, 0xe7
shl dl, 0x67
mov ecx, edx
mov eax, dword [ebp + edx - 0x2d23e600]
sbb edx, 0xce0fec09
neg cx
xor eax, ebx
sub eax, 0xc3a81f0a
and edx, ecx
jp 0x922c07
movsx ecx, dx
mov word [esi], ax
pop edx
pop eax
pop eax
jmp fcn.007194ad
Function at 0x9b334b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ebp
xor cl, ah
dec eax
xor dword [esp + ecx - 0x71180ef6], edx
inc ecx
not cl
call fcn.007d50aa
mov edx, 0xd899af30
xor edx, edx
mov eax, edx
xor dl, byte [edi + edx*2]
mov ecx, eax
and ecx, 0x75376836
or al, byte [edi + eax*8 + 2]
add ecx, 0xfd28723f
adc edi, 2
imul dl
or ecx, ecx
lea edx, [ecx + ecx*4 - 0x26f7bede]
rol ecx, cl
mov word [edi], ax
sbb ebp, 3
call fcn.009cb30f
mov eax, 0x9d0518b4
cwde
movzx edx, al
mov ecx, dword [edi + eax*4 - 0x62d0]
shr eax, 0xf1
bts dx, 0x2f
rol edx, 0x7b
mov dl, byte [edi + eax*4 + 4]
cwde
and al, 0x2a
lea edi, [edi + eax + 6]
cbw
bt ax, ax
call int.00973b4a
inc esp
mov ecx, dword [edi]
inc ecx
mov eax, 0x43334127
inc ecx
movzx ecx, al
inc ecx
mov esi, eax
inc ecx
mov eax, dword [eax + edi - 0x43334123]
dec ecx
lea edi, [eax + edi - 0x43334123]
mov ebp, ecx
inc esp
add ecx, eax
inc esi
mov dword [edi + eax - 0x43334127], ecx
dec eax
shr esi, 0x17
mov eax, 0x1e13d12b
movsx ebx, al
dec ebp
lea edx, [edx + esi - 0x8a]
inc esp
mov esi, esi
inc ecx
bswap eax
inc ecx
mov edi, 0xe1ea517
inc ebp
mov eax, dword [edx + ecx - 0x27]
inc ecx
sub edi, 0xa2b43183
inc ecx
sar dh, cl
inc ebp
xor eax, esp
inc ecx
imul esi, edi
dec ecx
xor ebp, edi
inc ebp
lea eax, [eax + ecx*2 + 0x7b8a80cf]
bt bp, bp
inc esp
movzx ebp, bx
dec eax
inc eax
inc ecx
ror eax, 1
dec eax
shr esi, 0x39
inc bp
inc ecx
bswap eax
sbb al, 0x20
call fcn.00a00b36

Function at 0x9b35e4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
ror ch, 0xa3
xor dword [esp + ebx*2 - 0x14a413a0], ebp
inc ebp
movzx esi, bp
dec ecx
dec ebp
inc ecx
pop esp
ror dx, cl
dec eax
arpl bp, bp
inc ecx
sal ebp, cl
inc cx
xchg ebp, edx
dec esp
add ebx, ebp
dec esp
xor ebp, esi
dec eax
mov edi, dword [ebx + edi - 0xa5209d0]
rol ebx, cl
jne fcn.008c5046
mov ecx, 0x13b379b4
call fcn.008b9990
mov ecx, 0xe610ee3d
call fcn.00a1e3d9
movsx eax, word [esp + 3]
mov dword [esp + eax*2 - 0x230e], edx
neg ecx
dec ecx
xor ebx, ecx
xchg dword [esp + 8], edx
add edx, 0xfffaed29
jmp edx
mov eax, 0x9e1ca6bf
xor ecx, ebx
call fcn.008a68a9
not eax
lea edx, [ecx + ecx*2 + 0x4c278caa]
inc dl
btr edx, edx
xor ebx, eax
shr edx, 0xfd
adc ebp, eax
shr ecx, 0x27
mov edx, dword [edi + ecx*2]
xor cl, cl
or ecx, dword [edi + ecx + 4]
mov eax, 0x71a337b3
lea eax, [eax + eax*4 + 0x403e30b5]
dec eax
lea edi, [eax + edi - 0x786e472b]
mov dword fs:[eax + edx - 0x786e4733], ecx
movzx edx, ax
btr ax, dx
jmp ebp
neg ebp
inc ecx
neg eax
xor ebp, 0x40329221
dec eax
shr esi, 0x2d
inc esp
movzx ebp, si
neg ebp
dec esp
mov dword [esp + ebx*2 - 0x14a413a0], ebp
sub dword [esp + ebx - 0xa5209cc], 0xa11a5817
dec esp
sub dword [esp + esi*2], ecx
lea ebp, [ebx + ebp - 0x6dd7725b]
dec cl
dec esp
mov dword [esp + ebx - 0xa5209d0], esp
inc cx
and esi, ecx
jae 0x8bbad4
xor al, 0x95
sub al, 0x2b
ror edx, 0xe1
mov ecx, 0x9e9af4b3
jb 0x9968c0
xor bl, al
btr ecx, ecx
sal dl, 0x23
call fcn.007128a7
Function at 0x9b484d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bt ecx, 0xbb
mov cl, byte [ecx + esi - 0x1f0ef089]
mov eax, 0x83a5d519
sar eax, 0xde
rol ax, 0x49
adc esi, 1
imul eax, eax
add ax, ax
add ax, ax
shr dx, cl
call fcn.0090c840
ror eax, 3
xor eax, 0x21bc698d
neg eax
neg dx
ror eax, 1
sub ecx, dword [esp + 6]
push edx
xor ebx, eax
add ecx, edx
not dword [esp + ecx - 0xe242bef]
add ebp, eax
or cx, dx
sub dword [esp + ecx - 0xe24ffdf], ecx
pop eax
pop ecx
pop eax
pop eax
pop eax
pop ecx
js fcn.008ca50c
mov eax, 0x328b1413
movsx ecx, al
movsx edx, cx
mov edx, dword [eax + ebp - 0x328b1413]
shr cl, 0x66
xor cl, byte [ebp + eax - 0x328b140f]
shr al, 0xc2
shr edx, cl
movzx ecx, ax
call fcn.00942776
sub ebp, 4
mov eax, 0x238d7a6
mov ecx, eax
jmp 0xc9c947
mov ecx, dword [eax + ebp - 0x238d7a6]
movzx edx, ax
xor ecx, ebx
bt edx, edx
call fcn.009c5355
not ecx
neg ecx
div dl
neg dl
xor ebx, ecx
bt eax, 0x80
adc esi, ecx
movzx ecx, ax
neg al
adc eax, 0x912ebb15
or cl, byte [eax + edi - 0x1863bb15]
mov al, byte [edi + eax*4 - 0x618eec52]
btc dx, 0xbb
bswap edx
sal dx, 0x44
adc edi, 3
bts dx, dx
or cl, al
movzx eax, dx
not cl
call fcn.00a200a7
mov ecx, 0x65bdd0b0
mov ecx, dword [edi + ecx - 0x65bdd0b0]
mov eax, 0x2fb358b2
movsx edx, al
inc dl
lea edi, [edi + eax - 0x2fb358ae]
lea ebp, [eax + ebp - 0x2fb358b3]
not al
btc edx, edx
dec ax
movzx eax, byte [ebp + eax - 0x2fb3584c]
inc dl
xor dl, dl
sal dl, 0xa1
xor al, bl
add al, 0x80
and edx, 0x631e51b
dec dl
rol al, 1
dec edx
not dl
not al
xor dl, dh
neg al
xor bl, al
btr edx, 0x87
shl dl, 0xe4
shr edx, 0x48
adc eax, esp
and edx, edx
mov dword [eax + edx*2 - 0xc63ca], ecx
or dl, dl
lea ecx, [edx*8 + 0x55962903]
lea ebp, [edx + ebp - 0x631e9]
xchg ch, dl
mov ecx, dword [ebp + edx*2 - 0xc6370]
push edx
not dword [esp + edx*2 - 0xc6370]
xor ecx, ebx
mov eax, 0xdbc82b8
dec ecx
dec word [esp + edx*4 - 0x18c6df]
ror ecx, 1
lea ecx, [ecx + eax*2 + 0x698d4029]
call fcn.009d063b
mov ecx, 0x1f0ef08c
lea edx, [ecx*8 + 0x133e8907]
dec cx
mov dx, word [esi + ecx - 0x1f0ef08b]
jle 0x8d361f
mov ecx, 0x73051a0a
mov ecx, dword [esi + ecx - 0x73051a0a]
mov edx, 0x3988070a
lea esi, [esi + edx*2 - 0x73100e10]
push edx
xor ecx, ebx
lea eax, [edx + edx*4 - 0x54f4aadb]
bswap ecx
inc ecx
not word [esp + edx - 0x39880709]
neg dl
rol ecx, 2
sar edx, 0x28
xor ecx, 0xcbbf1eb4
xor ebx, ecx
bswap eax
add edi, ecx
call fcn.00960014
Function at 0x9b519c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esp
adc ebx, ebp
jmp 0x9f7ae0
mov edx, dword [ebp - 4]
call fcn.007253e4
inc ecx
mov ecx, 0xb612588a
inc ebp
movzx esi, cx
inc ecx
xor ebp, esp
inc bp
bts esi, esi
inc ecx
movsx eax, si
inc edx
lea ebp, [ebp + esi - 0x3083c324]
inc esp
movsx edi, al
jb 0xa4f23c
xor ebp, 0xd909149c
dec ecx
add esi, 0xb6a7259a
mov esi, eax
jle 0xcb4cd0
dec ecx
shr ecx, 0x53
movsx ebx, bp
inc ecx
jmp ebx
bswap ebp
cwde
inc esp
mov eax, esi
not ebp
dec ecx
lea edx, [esi - 0x5059ed7c]
inc ebp
inc ecx
push esp
dec esp
lea ebp, [eax*8 + 0x8233523]
dec eax
sar esi, 0x48
inc ecx
movsx ecx, al
xor dword [esp + eax - 0x5c8a], ebp
inc ecx
pop esp
inc cx
not eax
dec ecx
sal ebp, cl
inc ecx
mov ebx, ecx
dec eax
arpl bp, bp
inc cx
xchg edi, ecx
jne 0x8061dd

Function at 0x9b5729
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor dl, al
bswap eax
ror al, 0x87
or cl, dl
call fcn.0096afbb
inc ecx
sal ch, 0xc1
xor cl, 0x86
inc dx
xchg dword [esp + eax - 0xd4a77f6], ebx
inc esp
and ebp, dword [esp + edx - 0x29]
dec ebp
lea eax, [eax + edx*4 - 0x2a649343]
ror cl, 1
inc dx
inc dword [esp + eax*2 + 0x3a343503]
inc ecx
shl ch, 1
dec edx
mov dword [esp + eax + 0x1d1a1a7b], 0xfcbf5411
xor cl, 0x9c
inc ecx
sub ebp, 0x42889124
not cl
inc esp
xor ah, cl
inc eax
inc edx
xor dword [esp + eax + 0x1d1a1a87], ebx
dec eax
lea ecx, [esp + ecx + 0x10]
dec ecx
mov dword [eax + ecx + 0x1d1a1a7b], esi
inc edx
or byte [esp + ecx*8 - 0x18c], 8
jl 0x9d5214
xor ebx, edx
add esi, edx
shr ecx, cl
dec ecx
mov edx, 0x458f471c
pop edx
pop edx
pop edx
jne fcn.00ca4448
push ecx
not al
btr ecx, edx
ror edx, cl
xor al, 0x3d
xchg byte [esp + ecx - 0x38e1fffa], cl
xor bl, al
or edx, dword [esp + edx - 0x733e71c2]
sar byte [esp + ecx*2 - 0x71c3fe18], 0x26
neg word [esp + ecx - 0x38e1ff08]
lea ebp, [ebp + ecx*2 - 0x71c3fe1e]
and dx, cx
dec edx
shl word [esp + ecx - 0x38e1ff08], 7
mov word [ecx + ebp - 0x38e1ff0e], ax
or ecx, 0xbcbfdd01
sbb edi, 4
rol dl, 0x82
sal edx, 0xf6
mov edx, dword [edi + edx - 0x4d000000]
xor edx, ebx
add ecx, 0x981ea105
sar cl, 0x85
movzx eax, word [esp + ecx - 0x551e9ffd]
bswap edx
bt ecx, 0x82
imul ecx, ecx
bswap eax
ror edx, 1
lea edx, [edx + ecx - 0x75e44669]
pop eax
shr ecx, 0xa4
mov dword [esp + ecx - 0xe400000], ecx
xor edx, 0x7b9be0bb
imul ax, word [esp + ecx*4 - 0x38ffffff]
rol eax, 4
dec edx
cwde
xor ebx, edx
add esi, edx
call fcn.008dd357
lea edx, [edx + eax*4 - 0x3956dbe6]
mov dl, byte [edi + eax*4 - 0x85c2]
sbb eax, eax
cbw
bts ax, ax
xor cl, al
and al, al
sar eax, 0x68
jb 0x972f8e
sysenter
call fcn.0093b7d6
Function at 0x9b5882
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
or ecx, dword [esp + 8]
xor bl, dl
push eax
not ax
lea edx, [esp + edx + 0x10]
shl dword [esp + 4], 0x5b
or dword [esp + 3], ecx
movzx ax, byte [edx]
jg fcn.00caf9a1
not cl
sbb edi, 2
jmp 0x7efe82
mov word [edi], ax
pop edx
pop edx
pop eax
pop eax
jmp fcn.008360bb
xor ebx, ecx
lea edx, [edx + 0x7188792f]
add esi, ecx
jmp esi
dec eax
movsx ecx, ax
add esi, 1
push ecx
btr ecx, ecx
and al, 0x93
xor dl, bl
neg al
bswap ecx
sbb dl, 0x2c
xor dl, 0x3f
mov dword [esp + 4], eax
shr ax, 0xa1
rol dl, 1
dec cx
btc eax, ecx
neg dl
xor eax, 0x20ad7b20
ja 0x7e6516
mov ecx, 0xf19bf9b
movzx cx, byte [edi + ecx*4 - 0x3c66fe6c]
mov al, byte [edi + 2]
mov edx, 0xdd1e3217
rol edx, 0x50
bt edx, edx
lea edi, [edx + edi - 0x3217dd1c]
sar dx, 0xb
adc dx, dx
not cl
shl dl, 0x25
sar edx, 0xd5
btr dx, dx
not al
sub dl, dl
or cl, al
shr dx, 8
neg dl
lea eax, [edx + edx*4 + 0x4601b911]
mov word [edi + edx*2 - 0x1fe], cx
sbb eax, eax
ror dx, 0x41
lea ebp, [edx + ebp - 0x8083]
or dx, dx
movzx ecx, dl
mov ecx, dword [ecx + ebp - 0x7f]
shl dl, 0x21
not edx
sal dl, 0xe3
xor ecx, ebx
sar dl, 0xc3
xor ecx, eax
add ecx, 0x272ecb9a
btr dx, dx
inc edx
xor ecx, 0x6ac3918
ror ecx, 2
jmp 0x935f5e

Function at 0x9b9ce6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
hlt
neg edx
xor edx, 0xe6ae9cbf
or eax, ecx
rol edx, cl
xor ebx, edx
add eax, eax
sbb edi, 3
mov dword [esp], 0xafacd502
xchg byte [esp + 1], al
neg ecx
mov dword [edi + ecx - 0x4f8868ff], edx
and ecx, 0x149935ae
jg 0xa01a43
mov dword [0x43a2e86b], eax
inc ebx
sal dword [0xd32f0ecb], 1
outsb dx, byte [esi]
stc
push dword [esi]
das
shr dword [esi - 0x29], cl
outsd dx, dword es:[esi]
cmp dword [edi - 0x1e], ecx
cmp byte es:[ecx], al
scasb al, byte es:[edi]
test al, 0xec
add dword [esi - 0x5ed71358], ebp
daa
xchg ebp, eax
in eax, dx
int 0x6e
sub byte [ecx - 0x32126ad9], ah
outsb dx, byte [esi]
jno 0x9b9d37
cwde
inc edi
dec edx
nop
jb 0x9b9d21
lodsb al, byte [esi]
pop ebx
dec edx
nop
jb 0x9b9d3b
mov bh, byte [ebx + 0x4a]
nop
jb 0x9b9d41
xchg edx, eax
dec edx
nop
jb 0x9b9ce3
sahf
mov cl, 0xb5
xlatb
pop edx
pop edx
jno fcn.008360bb

Function at 0x9bc33c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec edx
jmp 0x9bc337
call fcn.00a22053
dec cx
jle 0x729e91
add ebp, eax
call fcn.0076aa92

Function at 0x9bc34c
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
not byte [esp + 7]
test ebx, ebx
call fcn.007dceb9
Function at 0x9bc7fd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Get number of processors

Disassembly:
dec eax
dec edx
jmp 0xca9f27
shr ax, 0x2e
inc al
mov eax, dword [edi + eax*4 - 0x3af80000]
push 0x93b170bc
jg 0x967e96
mov dword [edi], edx
not byte [esp + 1]
mov ecx, 0xfc17b23a
mov dword [edi + 4], eax
movsx eax, cl
lea ebp, [eax + ebp - 0x3e]
ror byte [esp + eax - 0x3a], 0xc5
ror al, 0x62
adc eax, ecx
mov edx, dword [ebp]
dec dword [esp]
xor edx, ebx
ror dword [esp], 0xb3
jae 0x7111ab
bts edx, 0x2d
inc esp
mov dword [edi + esi*2 - 0x18424840], ecx
jae 0xa0bc2e
mov edx, 0xb223a535
mov ax, word [esi]
bt edx, edx
movsx ecx, dl
mov cl, byte [esi + ecx - 0x33]
sal dx, 0xa7
bts edx, 0x8d
btc edx, 0xb7
adc esi, 2
shl ax, cl
jmp 0x98c5f8
mul ecx
jmp 0x96460d
or edx, edx
mov word [esi], ax
movsx ecx, dl
mov eax, 0xc5a9f435
sbb ebp, 4
ror al, 0x41
sar dl, 0xc5
rol ecx, 0x7f
mov ecx, dword [ebp + ecx - 0x7fffffc0]
lea eax, [eax + edx*4 + 0x663d66b1]
sal edx, 0xdd
add ax, 0x5889
xor ecx, ebx
inc eax
xadd edx, eax
not ecx
cmovg eax, edx
setge dl
and al, al
rol ecx, 1
bt eax, eax
adc dx, ax
btr edx, eax
dec ecx
xor eax, 0x66214094
neg ecx
call fcn.007fe8d3
sub esi, 4
mov eax, 0x6d250f3a
mov eax, dword [esi + eax - 0x6d250f3a]
mov edx, 0xe5ba2992
xor eax, ebx
ror eax, 2
movsx ecx, dl
inc dx
sub eax, 0xad1aa8ae
ror ecx, 0x4b
inc cx
bswap eax
jo 0x81a8a5
adc cl, 4
rol cl, 1
rol edx, 0x46
imul edx, edx
inc cl
add edx, dword [esp + 4]
pop edx
neg byte [esp]
ror cl, 1
dec byte [esp]
mov edx, 0xe026818
dec cl
ror cl, 1
shl edx, 0x59
sal edx, 0xec
inc word [esp + edx + 1]
xor bl, cl
dec dx
pop edx
add ecx, esp
ror dl, 0x62
sal edx, 0x9e
mov dword [ecx], eax
or dl, 0xb8
inc edx
call fcn.00757975
mov eax, 0xebe03b7
mov ecx, dword [edi + eax - 0xebe03b7]
jmp 0x812745
inc cl

Function at 0x9be9ac
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
inc eax
sal byte [esp + 4], 0x61
jg 0x94971a
mov ecx, 0xd20579ac
sub esi, 4
mov eax, dword [esi]
movzx edx, cl
ror dl, 0xa2
sal edx, 0x1d
xor eax, ebx
xchg ch, cl
and edx, 0x3aa24ab8
btr ecx, edx
lea eax, [eax + edx*2 - 0x19d931cc]
sub cl, ch
ror edx, cl
xor eax, 0x80281210
neg eax
or ecx, edx
inc eax
sar ecx, 0x6b
sub edx, edx
xor ebx, eax
add ebp, eax
and ecx, ecx
adc edx, edi
lea eax, [ecx*8 - 0x5fd2f3cf]
sub edi, 4
mov dword [edi], edx
lea edx, [eax*2 - 0x59cfb0c9]
jmp fcn.008ca50c
lea esp, [esp + 8]
jne 0xcbbf32
mov edx, 0x183ab3
bt edx, 0xac
bswap edx
pop ebx
jge 0x9918d6
not edx
mov dword [esp + ecx - 0x9e796e4], eax
xchg dword [esp + ecx*2 - 0x13cf2dc8], eax
xadd al, ch
xor edx, 0xd721e735
xor ebx, edx
pop ecx
bswap eax
ror al, 0xc1
adc edi, edx
add ax, word [ecx + esi]
bt ecx, ecx
jae 0xa230dd
xor ecx, 0xd90fbf1a
dec edx
jmp 0x807b6d
jmp 0x75eb27
Function at 0x9c06b6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor bl, dl
mov dword [esp + eax*8], eax
pop eax
xchg ecx, eax
add edx, esp
inc eax
push ecx
or eax, dword [esp + ecx*4]
mov ax, word [eax + edx - 1]
sub cl, ch
sal byte [esp + ecx], 0x22
je 0x8a0132
mov ecx, 0xde02b327
sub edx, 0x2d037508
bts ecx, 0x9f
inc ecx
neg edx
xor ecx, ecx
sub ecx, ecx
ror edx, 2
lea eax, [ecx*8 - 0x146f125c]
neg edx
shr ecx, 0x36
ror eax, 5
xor ebx, edx
ror cl, 0xe5
adc ebp, edx
cdq
inc eax
or edx, dword [edi + ecx]
btc ecx, eax
lea eax, [eax - 0x5dd03762]
sar eax, 0xea
movzx cx, byte [edx + ecx - 0x4000]
movsx edx, ax
sar dx, 0x47
cdq
adc edi, 2
mov word [edi], cx
sub dl, dh
jmp ebp

Function at 0x9c0a6c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sub ebx, ebx
dec esp
mov dword [esp + eax - 0x6a12c5f9], esp
xor dword [esp + eax - 0x6a12c5f9], ebp
dec esp
mov esp, dword [esp + ebx*2 + 8]
inc ecx
bts edi, ecx
dec eax
arpl bp, bp
dec esp
adc ebx, ebp
inc ecx
push edi
dec eax
mov dword [esp + eax - 0x6a12c5f9], 0xab8b8c2b
inc ecx
pop eax
inc ecx
pop eax
inc ecx
pop eax
jmp fcn.008c5046