joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa251a5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, eax
sbb eax, dword [esp + eax]
mov eax, esi
sbb dword [esp], edx
sub edx, dword [esp]
lea esi, [esi + edx - 0x75f01afa]
lea ecx, [edx + 0x65863485]
dec word [esp + edx - 0x75f01af4]
call fcn.00a33c97
mov dword [esp], 0x562c29a6
sub ebp, 4
mov eax, dword [esp]
movzx ecx, byte [esp + eax - 0x562c29a6]
mov ecx, dword [ecx + ebp - 0xa6]
movsx edx, byte [esp + eax - 0x562c29a6]
shr dword [esp + eax - 0x562c29a6], 0x74
xor ecx, ebx
dec ecx
idiv word [esp + eax - 0x562c29a6]
xor ecx, 0xd429b61f
dec ecx
or al, byte [esp + eax - 0x562cef50]
not edx
setnp al
xor ecx, 0xeb35ebb6
neg edx
xor ebx, ecx
xadd dword [esp + eax - 0x562cef00], eax
mov dword [esp + eax*4 - 0x1588], 0x8a0fdf19
adc edi, ecx
jmp 0x75a360

Function at 0xa25f5e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
lea edi, [edi + ebx*4 - 0x58e11aa4]
inc esp
mov dword [ebx + edi - 0x163846a8], edi
inc ebp
mov ebp, eax
dec eax
lea esi, [ebx*2 - 0x197ab970]
dec esi
lea edx, [ebx + edx - 0x163846ac]
dec eax
mov dword [esp + ebx*2 - 0x2c708d50], 0x5d3d9839
sal esi, 7
dec ecx
lea edx, [eax + ebx*4 + 0x2ba5e732]
inc ecx
mov ebp, dword [edx + ebx*2 - 0x2c708d50]
inc ecx
xor ebp, esp
not ebp
sub ebp, 0xbc381a38
inc esp
mov edi, esi
neg dl
inc ecx
neg bh
xor ebp, 0x1db49336
ror ebp, 3
lea ebp, [ebp + ebx*2 + 0x618f98da]
dec eax
xor edx, 0x2493f60b
dec eax
lea ecx, [edx*8 + 0x47bb430b]
neg ebp
shl dx, cl
dec esp
mov dword [esp + ebx - 0x163846a8], esp
xor dword [esp + ebx - 0x163846a8], ebp
dec eax
not edx
inc ecx
pop esp
dec edx
lea eax, [eax*4 - 0x29e705d9]
dec eax
arpl bp, bp
inc ecx
dec ebp
dec esp
add ebx, ebp
inc ecx
movsx ebp, bh
btr ax, 0x80
and ax, ax
jge fcn.008c5046
mov ecx, 0x4e261086
mov edx, dword [ebp + ecx - 0x4e26108a]
call fcn.009582fd
mov ecx, 0x1a1e5999
movsx edx, cx
mov ax, word [ecx + edi - 0x1a1e5999]
mov cl, byte [ecx + edi - 0x1a1e5997]
call fcn.00a236b0

Function at 0xa264b6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push eax
xor edx, ebx
inc cl
or word [esp + ecx - 1], ax
lea edx, [edx + ecx*4 - 0x239b2a6]
neg edx
neg ax
mov dword [esp + ecx + 2], 0x5c3d0899
dec byte [esp + ecx - 1]
dec edx
btc ecx, 0x19
push ecx
btc eax, ecx
bswap edx
dec cl
xor ebx, edx
add esi, edx
ror ecx, cl
cdq
xor dword [esp + eax*4 - 0x3ffe6], edx
pop edx
pop eax
pop eax
jg fcn.00cad447
Function at 0xa27b7b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sar dword [esp + edx*2 + 7], 2
push edx
pop edx
pop edx
pop ecx
pop edx
jp fcn.007194ad
xchg esi, eax
xor eax, 0x5f1765bd
mov eax, dword [0xde47e406]
mov al, byte [0x47dc5ec3]
fisub word [eax + 0x47ac34b1]
fisub word [eax + 0x47bc32a3]
mov al, byte [0x47bc32a3]
fisub word [eax - 0x48ac0b91]
mov edx, dword [esi - 0x68a096c5]
inc ebp
std
in al, dx
push esp
out dx, eax
or byte [edi + 0x71], 0x5f
push ecx
rcr dword [eax], cl
loopne 0xa27bfa
outsb dx, byte [esi]
push ecx
stosd dword es:[edi], eax
jle 0xa27c3b
sub byte [edx + 0x50], cl
or dword [ebx], esi
push 0xffffffffffffff8a
nop
cmpsd dword [esi], dword es:[edi]
or ch, byte [esi + esi*8 + 0xaa790ce]
loopne 0xa27ba2
not byte [eax - 0x3b3bf559]
mov ebx, 0x4fcb00b0
int3
dec edi
ljmp 0x27ab
call 0xc5bf098a
lodsb al, byte [esi]
add eax, 0xf473a0e
mov dh, 0xb4
adc eax, 0xffffc48a
inc ebp
and ch, al
inc ebp
movzx ecx, al
inc ebp
xor dh, ah
inc ebp
mov edi, ecx
movsx eax, bx
inc ecx
inc dh
dec eax
lea esi, [eax - 0x77e61aed]
inc ecx
shr ch, 0xe2
inc cx
btr eax, 0x3b
inc ecx
not dh
inc ecx
rol dh, 1
dec eax
neg ebx
inc ecx
btc edi, 0x1b
inc cx
btc edi, ebx
inc ecx
dec dh
inc cx
shl ebp, 0x83
inc ecx
and eax, 0x800a9c82
dec ecx
xchg ecx, ebx
inc ecx
neg dh
dec esp
xchg esi, eax
inc ecx
not dh
movzx edx, bl
mov ecx, 0x268fbcac
inc ebp
xor ah, dh
dec esp
add esi, esp
inc eax
not dh
inc bx
movzx ecx, byte [esi + ebp*4 - 0x363a0]
idiv eax
dec edx
lea edi, [edi + ebp*4 - 0x363a2]
inc ecx
movsx ebp, bh
inc ecx
bts ecx, edx
inc dx
mov dword [edi + ebp*2 - 0x1b1d0], ecx
dec esi
lea ebp, [eax + ecx*4 - 0x21f77bde]
dec ebp
lea edx, [edx + ebx*2 - 0xf0]
inc ebp
mov edi, dword [edx + ebx*4 - 0x1d8]
xor edx, esi
inc ecx
adc bl, al
ror bx, 0xcd
inc ebp
xor edi, esp
btr bp, 0x27
inc ebp
add ch, ch
inc ebp
lea edi, [edi + ebx*2 - 0x2883030e]
inc esp
movzx esi, bl
dec ecx
or eax, 0xf92c8a33
imul ebp
inc ecx
rol edi, 1
mov ecx, ebp
inc ecx
sub edi, 0xbb29c319
inc ecx
idiv al
dec ecx
lea eax, [ecx + ecx*8 + 0x29202b30]
inc ecx
xor edi, 0x5c094226
cdq
dec ebp
lea esi, [ebp - 0x5efd28dd]
sar si, cl
inc esp
add edi, edx
dec eax
sub ecx, ecx
inc ecx
push esp
shl esi, 5
inc esi
xor dword [esp + eax + 0x6c23181], edi
idiv esi
cbw
inc ecx
pop esp
shl cx, 0xaa
imul esi
dec ebp
arpl di, di
cdq
dec ebp
adc ebx, edi
jmp fcn.008c5046
Function at 0xa27e46
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esi, [esi + eax*2 - 0x19860]
btr eax, 0x8d
imul dl
xor ecx, ebx
inc dx
shr dl, 0xa3
bswap ecx
xor edx, 0x5b2cea98
bts eax, edx
xadd ax, dx
lea ecx, [ecx + edx*2 + 0x50b4ddf2]
setae al
bswap ecx
sar eax, 0x38
sbb ecx, 0xd0a5043e
neg dl
neg ecx
xor ebx, ecx
mov dword [eax + ebp - 0x10], ecx
bt ax, 0x91
sbb ebp, eax
inc eax
btc ax, 0xd
neg edx
jle fcn.0092c225
dec esi
mov dword [esp + edi*2 - 0x5679ed70], edi
inc ecx
lea ebx, [edi + ebx - 0x2d69c64d]
dec eax
lea ebp, [edx*4 - 0x2df5f7f3]
inc esp
movsx ebp, ch
rol ebx, 1
dec edx
xor dword [esp + edi*2 - 0x5679ed70], 0x8e9709a9
xor ebx, 0x3f2ac60e
dec ebx
lea esi, [ebp + ebp*2 - 0x2502b68]
rol ebx, 1
dec esi
mov dword [esp + edi - 0x2b3cf6b8], esp
inc ecx
push edi
inc edx
xor dword [esp + edi - 0x2b3cf6b0], ebx
dec esi
mov esp, dword [esp + edi*2 - 0x5679ed68]
inc cx
xchg edi, esi
inc dx
ror dword [esp + edi*2 - 0x5679a7fa], 5
dec esi
mov dword [esp + edi - 0x2b3cd3f7], edi
dec eax
arpl bx, bx
dec edx
lea esi, [ebp*2 - 0x14e7bccd]
dec eax
lea esi, [edx*2 - 0x28643ff2]
inc ecx
movsx eax, bp
dec esp
adc ebx, ebx
inc ebp
btr edi, edi
dec edi
lea edx, [edi + edx - 0x2b3cd407]
inc esp
mov esi, edx
setb al
mov ebx, ebp
dec edi
mov edi, dword [edi + edx - 0x2b3cd3ff]
pop ebx
dec eax
lea ecx, [edx + esi - 0x1071af7f]
inc si
mov dword [esp + esi*2 - 0x5679ecdc], ebp
dec ebp
xor edi, esp
dec eax
or ecx, dword [esp + ebx*2 - 0x5679ed70]
inc esp
movzx ecx, bp
dec ecx
inc edi
dec ecx
not edi
dec ecx
neg edi
dec ecx
inc edi
inc edx
sub ecx, dword [esp + esi - 0x2b3cf66c]
dec ecx
bt esi, 0x87
inc ecx
pop ecx
dec ebp
xor esp, edi
dec esp
xor esi, ebp
dec eax
lea edi, [edi + ebx*2 - 0x5679ed78]
dec esp
mov dword [edi + ebx*2 - 0x5679ed70], edi
dec ecx
imul ebp
jo fcn.008c5046
pop edx
bt edx, ecx
mov ecx, dword [eax + esi - 0xcb36]
xor ecx, ebx
xor al, 0x2d
neg ecx
neg edx
not ecx
rol edx, 0x4a
push eax
xadd word [esp + eax*2 - 0x1962e], dx
dec ecx
pop eax
dec dx
dec eax
xor ecx, 0x36150336
rol ecx, 1
ror edx, 0x21
xor ebx, ecx
add al, dh
mov dword [eax + ebp - 0xcc3a], ecx
mov ecx, dword [esi + eax*2 - 0x19864]
adc edx, edx
jp 0x8cbd86
dec ebx
invalid
Function at 0xa2b8fc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.00a4f70f
mov ecx, 0x8e92a58d
movzx eax, cx
mov ecx, dword [edi + eax*2 - 0x14b1e]
and ax, ax
movzx edx, al
xor ecx, ebx
shr edx, 0x91
bswap ecx
not dl
rol ecx, 2
bswap ecx
imul edx
not ecx
neg ecx
dec ecx
xor ebx, ecx
shr edx, 0xd7
lea edx, [eax*2 - 0x5a706348]
adc esi, ecx
movsx ecx, dx
btc ax, cx
movzx edx, byte [edi + eax - 0xa4a778]
or cx, 0xafae
sal al, 4
lea edi, [edi + eax*8 - 0x5253985]
add cl, ah
or ecx, ecx
xor dl, bl
sub dl, 0x96
rol dl, 1
sub dl, 0x20
not dl
sar cx, cl
bswap ecx
inc ecx
xor dl, 0x9d
xor bl, dl
add eax, eax
shr ecx, cl
adc ax, cx
adc edx, esp
mov ecx, dword [edx + eax - 0x149ce61]
cwde
movzx edx, ax
mul edx
mov dword [ebp + edx*2 - 0x19cc4], ecx
lea eax, [edx*4 + 0x42af5a15]
mov ecx, edx
mov eax, dword [ebp + edx - 0xce64]
imul edx, ecx
setb dl
mov ecx, dword [ecx + ebp - 0xce60]
jno 0xa25e85
sub edx, edx
or eax, ecx
not eax
mov dword [edx + ebp], eax
add dx, 0xf2a2
jmp esi
jae 0x7a8506
xor ecx, 0x91107fbf
not byte [esp + 0x17]
push 0x790326a2
and word [esp + 0x16], 0x1bb7
bswap ecx
jg 0x827b7c
push ebp
sbb bp, si
mov ebp, esp
sub esp, 8
sub eax, eax
cmc
cmp edi, esp
test ebx, 0xd60a44b5
push ebx
jmp 0x746ea8
Function at 0xa2c49d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey

Disassembly:
pop eax
pop eax
pop edx
pop edx
jae fcn.0098b9e9
jmp 0x82469f
jne 0x926185
pushfd
jno 0x739121
das
pop edi
jg 0x739124
cmp eax, 0x9aa0a4d7
xor dword [ebx - 0x5b5f794e], ebp
add edx, dword [edi - 0x6b5f794e]
xor eax, 0xa086b2d7
sbb al, 0x73
stosd dword es:[edi], eax
mov al, byte [0xd7e2e4a]
mov al, 0xaa
mov al, byte [0xe03b1123]
and al, 0x48
test al, 5
jb 0x7391c3
mov al, byte [0x1380981]
jmp 0x147e080c
add eax, 0xa454a051
shl al, 0x2b
int1
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
xor bl, bh
jp 0x739172
or dword [ecx], 0x7ab47cae
jbe 0x7391e4
add al, 0xe4
jp 0x739255
or ch, byte [esi + 0x767ac00c]
or ah, byte [0x6151ce]
jbe 0x7391f0
and eax, 0x6151ce
inc esi
pushal
fild word [edi + edi*2]
or esp, dword [eax - 0x5124c446]
cld
pop edi
adc byte [edi - 0x2f], ch
pop edi
dec esi
and al, 0x36
sahf
fld dword [esi]
stc
insb byte es:[edi], dx
pushfd
cmpsb byte [esi], byte es:[edi]
salc
or dword [eax - 0x56], edi
lds ebx, [eax - 0x6d]
popfd
add dword [eax - 0x1d1d164e], esp
add byte [edx - 0x7e], dl
test byte [ebp + 0x17049c19], al
not dword es:[edi]
int1
adc eax, dword [ecx]
mov ebx, 0xebfb7c13
mov byte [0xa304a312], al
mov dword [edx - 0x7fe7dbfc], edi
or dword [ecx + 0x208f962d], edx
push dword [esi]
sbb dword [edx + 0x1b47dd54], ecx
hlt
cwde
popal
sal bh, 1
push edi
ret 0xfee5
shr al, 0x66
not edx
setb cl
sub ecx, eax
neg edx
jmp 0x933b2e
neg eax
movzx ecx, dl
ror word [esp + ecx*4 - 0x14c], 0x61
xor ebx, eax
xor ecx, ecx
rol dx, 0x68
adc edi, eax
call fcn.0093a1ea
call fcn.0080f978
dec al
bswap ecx
shl byte [esp + ecx - 0x67ffffef], 0x66
ror al, 1
xor edx, ecx
inc edx
shr edx, 0x85
sbb al, dl
rol al, 1
xchg byte [esp + ecx - 0x67ffffed], dh
imul dx, cx
sbb al, 0x14
rol dl, 0xc5
not byte [esp + ecx - 0x67fffff6]
imul cx, word [esp + edx - 0x4beffee]
xor bl, al
ror edx, 0x6c
lea eax, [esp + eax + 0x14]
pop edx
adc edx, 0xffe1f30f
jmp edx
mov eax, 0xc18d1231
not ax
sub edi, 4
movzx ecx, al
movzx edx, ax
sub eax, eax
mov edx, dword [edi + eax]
xadd ecx, eax
rol ecx, 0xee
xor edx, ebx
bswap edx
inc eax
or cl, al
rol edx, 2
bswap edx
idiv cl
jmp 0x79eec9
xor edi, edx
push 0xe9a5f185
and edi, 0xff
call fcn.007ac94a
syscall
call fcn.009d1071
sar ax, 0xec
sbb edx, eax
cbw
xor ebx, edx
xor cx, cx
or cl, al
adc esi, edx
call fcn.007eeb57
mov dword [esp], edx
jmp 0x7cd9a2
adc edi, 4
mov dword [esp], 0x1f961a90
xor edx, edx
test ecx, ecx
not word [esp + 1]
lea esp, [esp + 4]
je 0x73493e
push edi
mov edi, 0x85059a3c
neg edi
movzx edi, byte [eax + edi - 0x7afa65c4]
jg 0x73914f
push 0x84a8f12e
mov dword [esp], 0xe0019021
call fcn.00809b07

Function at 0xa2e6cb
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
je 0x7e4b68
push ebx
Function at 0xa2f158
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
adc edi, 4
push 0x18f8a15
call fcn.0074ace2
mov eax, 0xae100699
shr eax, 0x24
mov ecx, eax
lea ebp, [ebp + eax*2 - 0x15c200d6]
add cl, 0x15
lea edx, [eax + eax*8 - 0x30502f59]
mov ecx, dword [eax + ebp - 0xae10069]
btc edx, edx
call fcn.00915a6a

Function at 0xa2fcc3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
add esi, edx
sal cx, 0xa4
mov ecx, dword [edi]
mov dword [esp], eax
inc byte [esp + 2]
mov eax, dword [edi + 4]
neg dword [esp + 0xc]
mul ecx
mov ecx, 0x110a6d96
xor cl, ch

Function at 0xa31c6b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, ebx
call fcn.00c9cf82
call fcn.0093b819
dec esp
mov dword [esp + ebx - 0x93], esp
inc ecx
movsx esi, ax
inc edx
xor dword [esp + edi - 0x78593108], ecx
mov word [esp + eax - 0x7fd7ffc4], 0x8d8e
dec esp
mov esp, dword [esp + ebx - 0x93]
dec eax
arpl cx, cx
inc ecx
or edi, 0x9c887b33
inc esp
movsx ebp, si
dec esp
adc ebx, ecx
sal bl, 0x66
dec esp
lea eax, [edi + ebx*8 - 0x5fe]
movzx ebp, word [esp + eax - 0x7fd7ffc4]
not byte [esp + eax - 0x7fd7ffc0]
dec esp
mov dword [edi + ebx - 0xc6], eax
dec eax
lea edi, [edi + eax - 0x7fd7ffcc]
pop eax
pop ebx
js fcn.008c5046
mov dword [esp + eax*4 - 0x330002a8], ebp
ret 8
inc cx
dec eax
not ecx
dec eax
mov dword [esp + eax - 0x2d8a7a21], eax
dec eax
imul eax, eax
bswap ecx
dec ecx
dec eax
cwde
xor ecx, 0x7d237e8f
div bl
inc ecx
neg eax
dec ecx
cbw
inc ecx
sal esi, 0x66
jp 0x99574b
mov eax, 0xf928eb12
sub ebp, 4
dec ax
inc eax
mov eax, dword [ebp]
js 0x8ec805

Function at 0xa33750
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, ebx
neg ecx
xor eax, 0x5d0f9310
add cl, dh
inc eax
neg eax
dec dx
xadd dl, ch
sar ecx, 0xe
rol eax, 3
sub edx, 0x95b0e3b6
xchg cx, dx
lea eax, [eax + edx - 0x50cf3c3d]
call fcn.0077d4ac
ror dl, 0xc1
xor cl, bl
mov dword [esp + eax*2 - 0xaf50000], edx
dec cl
rol word [esp + eax - 0x57a7ffe], 0x8a
jae 0x8f0917
ror cl, 1
neg cl
sal dword [esp + eax - 0x57a8000], 0x9d
not word [esp + eax*4 - 0x15e9ffff]
xchg al, dl
dec cl
mov dword [esp + eax*2 - 0xaf5004c], 0x642c1733
xor bl, cl
lea ecx, [esp + ecx + 4]
call fcn.0099a3da
mov eax, 0xaa955299
movsx ecx, al
inc ecx
mov ax, word [ebp]
lea edx, [ecx*4 + 0x66a902ab]
mov dx, word [ebp + edx - 0x66a90111]
lea ecx, [ecx - 0x2efdbdda]
push ecx
add ebp, 2
xor ecx, ecx
ror dword [esp + ecx*4], 0xc1
or ax, dx
rol dword [esp + ecx*2], 0x14
not ax
mov edx, ecx
xor dx, dx
mov word [ebp + ecx*2], ax
or word [esp + ecx], dx
lea eax, [ecx + edx*8 - 0x2a44a54b]
xor edx, 0xc42b1f1b
lea esi, [ecx + esi - 4]
push ecx
mov eax, dword [esi + ecx*2]
inc dword [esp + ecx + 4]
shl dword [esp + ecx*2 + 2], 0xdb
xor eax, ebx
lea edx, [edx + edx*8 - 0x43601efd]
jmp 0x7df8a5
Function at 0xa34b9f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor cl, bl
xor cl, 0x16
mov dword [esp + edx*8 - 8], edx
rol cl, 1
not cl
bt edx, 0x32
shr dword [esp + edx - 1], 0xb8
lea eax, [edx*4 + 0x9265832]
neg cl
rol cl, 1
sub eax, eax
xchg dl, al
adc cl, 0x32
jmp 0x95eef8

Function at 0xa38975
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
neg ecx
dec eax
not edx
inc ecx
xor ecx, 0x40329221
inc ecx
neg ecx
inc esi
lea ecx, [edx + ecx + 0xdac6713]
mov eax, edx
dec esp
mov dword [esp + edx + 0x7131cf9e], esp
inc esp
xor dword [esp + edx + 0x7131cf9e], ecx
dec esp
lea esi, [eax + edx*8 + 0x35026596]
inc esp
movsx esp, ax
movzx esi, cx
inc ecx
pop esp
dec eax
cdq
inc eax
neg ch
dec eax
sal edx, 0x6c
dec ebp
arpl cx, cx
shl ebp, 0x35
rol bp, 0xc
inc esp
movsx eax, dx
dec ebp
adc ebx, ecx
dec eax
inc edx
jo 0xa463c2
dec eax
mov edi, dword [edi + edx - 1]
dec ecx
sar esi, 0xef
jbe fcn.008c5046
mov ax, word [ebp]
mov edx, 0x7a9b6a27
or edx, edx
xor dl, 0x3d
lea ebp, [ebp + edx - 0x7a9b6a18]
sal dx, 0x8b
shl dl, 0x84
movsx ecx, dx
lea esi, [edx + esi - 0x7a9bd001]
bswap ecx
shl cl, 0xa2
movzx ecx, byte [esi + edx - 0x7a9bd000]
imul edx, edx
dec dx
lea edx, [edx + edx*8 - 0x2a45285b]
xor cl, bl
sal edx, 0x7b
rol dl, 0x81
inc cl
btr edx, 0x35
setb dl
xor cl, 0x18
add cl, 0x87
rol cl, 1
xchg dh, dl
dec cl
sal dx, 0xc1
call fcn.009b933d
mov ecx, dword [edi]
imul eax
sal edx, 1
sar ax, 0xc1
xor ecx, ebx
btr eax, eax
lea eax, [edx*2 + 0x7dbb013d]
rol edx, 0x2d
rol ecx, 1
mul edx
shr eax, 0xe1
not ecx
xor ecx, 0xe413808f
ror ecx, 3
jmp 0x829878
xor ebx, ecx
imul eax
not eax
setae al
add esi, ecx
jmp esi
inc esi
mov ecx, dword [edx + edx - 0x7131cf9d]
dec eax
mov dword [esp + edx - 0x7131cf9d], 0x4099b40c
inc ebp
xor ecx, esp
dec eax
ror dword [esp + edx - 0x7131cf9d], 0x98
inc ecx
dec ecx
dec esp
lea esi, [edx + edx - 0x7b7c0554]
inc ecx
movzx ebp, dh
mov ecx, dword [esp + edx - 0x7131cf9b]
inc ecx
bswap ecx
rol dword [esp + edx - 0x7131cf9b], 0x28
inc ecx
xor ecx, 0xa1bc0c93
inc ecx
inc ecx
not byte [esp + ebp - 0xe3]
jmp 0x8243dd
not ax
dec esp
mov dword [esp + ebx + 0x10], esp
inc ecx
and esi, ebp
inc esp
xor dword [esp + ebx*8 + 0x10], ecx
dec esp
mov esp, dword [esp + ebx*4 + 0x10]
dec ebp
arpl cx, cx
inc ecx
bswap edi
dec ebp
add ebx, ecx
push edx
dec esp
mov dword [esp + ebx], ebx
ret 0x18

Function at 0xa3d8fd
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bswap eax
idiv cl
mov ecx, dword [eax + edx - 0x40000000]
movzx edx, al
xchg ecx, esi
mov edi, ecx
not eax
pop ecx
pop ecx
pop edx
jmp fcn.00942dca
and dword [esp + eax - 0x3f], 0xa6abe53e
lea edx, [esp + edx + 0xc]
jno 0x79ad09
mov dword [esp], 0x44bc0429
mov eax, dword [esp]
movzx edx, byte [edi + eax - 0x44bc0429]
bt eax, 0x12
xor dl, bl
lea ecx, [eax + 0xf97961e]
push ecx
not dl
sub eax, eax
mov edi, ecx
push edi
neg dl
shr dword [esp + eax + 8], cl
shr word [esp + ecx - 0x54539a43], 0xa1
shr word [esp + eax + 6], 0x46
dec dl
sar byte [esp + eax*2 + 0xa], 0x66
not dl
adc ecx, ecx
sal eax, 0xa2
bts ax, 0x86
xor bl, dl
jmp 0x9b6334
Function at 0xa3fbbe
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
je 0x8ebbad
movzx ecx, byte [edi + eax*4]
xor cl, bl
push eax
xor eax, 0xcc3dbb3e
ror dword [esp], 0x66
xor cl, 9
add al, 0xa2
lea eax, [eax*8 - 0x8674046]
cwde
sbb cl, 0xb4
pop eax
and eax, eax
rol cl, 1
or word [esp + eax + 0xa], ax
imul ax, ax
neg cl
call fcn.00a4087d
rcl byte ds:[esi], cl
cmpsd dword [esi], dword es:[edi]
aas
invalid
Function at 0xa40919
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
shr word [esp + 1], 0xae
rol word [esp + 2], 0xe1
xor edx, esi
inc eax
dec byte [esp + 1]
js 0x924a2c
sub cx, cx
bts ecx, ecx
mov dword ss:[eax], edx
push ecx
shl dword [esp], cl
mov ecx, dword [esi - 4]
mov edx, 0x45a36c9b
neg word [esp + edx - 0x45a36c9b]
movzx eax, dx
xor ecx, ebx
neg al
dec ecx
neg dword [esp + eax - 0x6c65]
ror ecx, 3
xor ecx, 0x21bc698d
neg ecx
jmp 0x8de039
dec eax
dec dl
xor eax, 0xa7393f12
neg word [esp + edx*2 - 0x1fd]
neg cl
neg dword [esp + edx*2 - 0x1fe]
rol eax, 3
rol ecx, cl
inc eax
neg byte [esp + edx - 0xfe]
xadd edx, ecx
neg edx
xor ebx, eax
not byte [esp + ecx*8 - 0x7f7]
jmp 0x8c8137
not dword [esp + edx - 0x3a7ffab4]
add esi, eax
jmp 0x999ee7
rol byte [esp + eax - 0x6c64], 0x23
bts dx, dx
ror ecx, 1
ror eax, 0xf0
xor ebx, ecx
neg dx
ja 0x992d9d
add ebp, ecx
lea ecx, [eax + edx*2 + 0x5161608]
push ecx
mov eax, dword [esi + eax - 0x6c650008]
and word [esp + edx - 0x45a3935f], 0x21a2
pop ecx
sar ecx, 0x4d
lea esi, [edx + esi - 0x45a3936d]
sbb word [esp + edx - 0x45a39365], cx
setns cl
xor eax, ebx
inc eax
ror byte [esp + edx - 0x45a39363], 0x24
not cl
jb 0x7826f3
neg eax
xchg dh, cl
pop edx
xor edx, ecx
rol eax, 3
sub eax, 0x46073a15
shr edx, cl
rol eax, 3
neg eax
dec edx
neg edx
imul edx, ecx
xor ebx, eax
or dx, dx
bswap ecx
mov dword [edi + edx*2 - 0x65ada48], eax
call fcn.008dd0e2
sub edi, 1
mov ecx, 0x498a7683
movzx eax, byte [ecx + edi - 0x498a7683]
xor al, bl
shr ecx, cl
rol al, 1
lea edx, [ecx + ecx*8 - 0x1dfacadb]
sub dx, dx
add dl, ch
xor al, 0xbe
not al
push ecx
xchg ch, cl
neg al
shl edx, cl
and dword [esp + ecx*2 - 0x1263a09c], edx
inc word [esp + ecx - 0x931d04d]
xor bl, al
xor word [esp + ecx - 0x931d04e], 0x669b
and edx, 0xc014f6b9
lea eax, [esp + eax + 4]
shl dx, 0x2b
adc word [esp + ecx*2 - 0x1263a09c], cx
and cx, 0x58b7
movzx cx, byte [eax + ecx*4 - 0x24c54018]
movzx eax, dx
or byte [esp + edx*2 - 0x1ffffd], al
cwde
lea ebp, [ebp + edx*2 - 0x200002]
or edx, dword [esp + edx - 0x100000]
mul edx
mov word [ebp + edx*8], cx
neg eax
inc dword [esp + edx*2]
mov ecx, dword [esp + edx]
lea edi, [edi + edx*2 - 4]
cdq
inc byte [esp + edx + 2]
adc eax, dword [edi + edx*2]
xor edx, edx
not dword [esp + edx*4]
and dl, ch
xor eax, ebx
jmp 0x7f2627
not dword [esp]
xor edx, 0xf2a9f0b4
dec ecx
push 0xdc9b0522
call fcn.0076f2e8
mov eax, 0x1838728a
rol eax, 0xa4
cdq
sbb esi, 3
and ax, ax
mul dl
push edx
mov eax, dword [esi]
xor eax, ebx
btc dx, dx
add dl, dl
not dword [esp]
ror eax, 1
sub dword [esp], edx
lea eax, [eax + edx - 0x12416c6e]
jae 0x984c50
mov ecx, 0xc406bd03
call fcn.008ce7ed
mov esi, dword [esi*4 + 0x83dbac]
mov dword [esp], 0x8e25928d
and byte [esp + 1], 0x30
shr edx, 8
jmp 0x782e1b
Function at 0xa42e28
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
rol ecx, cl
neg ebp
dec eax
mov dword [esp + ecx - 0x779a6602], esi
dec esp
mov dword [esp + esi*8 - 0x908], esp
inc ecx
bswap eax
inc ebp
mov ebp, esi
inc sp
imul eax, esi
xor dword [esp + ecx - 0x779a6602], ebp
dec ecx
bt ebp, ecx
sar ecx, cl
inc ebp
bt esi, eax
inc ecx
pop esp
dec eax
arpl bp, bp
inc ecx
setae dh
dec ebp
imul ebp, esi
inc cx
sal eax, 0xf
dec esp
adc ebx, ebp
jmp fcn.008c5046

Function at 0xa454c5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shl ecx, 0xc1
xor ebx, edx
add edi, edx
add ecx, 0x98187f1a
je 0x8a5a03
cwde
pop edx
jnp fcn.0098b9e9
call fcn.009b6dff
invalid
mov dword [esp], 0x41b57f25
call fcn.00a1e7f3
mov eax, 0x1218e7ac
movsx ecx, ax
mov ecx, dword [ebp + eax*4 - 0x48639eb0]
push eax
and byte [esp + eax*4 - 0x48639eae], ah
or eax, 0x8db7f0a3
mov eax, dword [ebp + 4]
shl dword [esp], 0xd
dec word [esp]
mul ecx
call fcn.00929780
mov edx, 0x24079322
mov eax, edx
mov ecx, dword [ebp + edx - 0x24079322]
mov eax, dword [ebp + edx - 0x2407931e]
and dl, dl
bt edx, edx
imul edx, edx
adc ebp, 7
neg dl
xor edx, edx
mov dword fs:[ecx + edx*8], eax
neg edx
lea esi, [edx + esi - 4]
jbe 0x8cdddd
shr dx, 0xed
neg al
sar dx, 6
not al
xor bl, al
bt ecx, ecx
shl dl, 0x27
lea ebp, [ebp + edx - 0x57840002]
not ecx
bt ecx, edx
mov word [ebp + edx - 0x57840000], ax
and ecx, edx
lea esi, [ecx + esi - 0x16800004]
mov edx, dword [esi + ecx - 0x16800000]
lea eax, [ecx + ecx*4 + 0x7202701b]
neg ecx
xor edx, ebx
sub eax, 0xb1a48634
xadd al, ch
inc al
neg edx
ror eax, 0x97
sbb edx, 0x3c3d2aa8
not al
ror eax, 0x81
neg edx
lea ecx, [ecx*4 - 0x44daeaea]
rol edx, 2
rol cx, 0x28
sub eax, eax
lea edx, [edx + ecx*2 - 0x534e9d6]
push eax
jno 0x7d0022

Function at 0xa470ee
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0xa8b3835
jmp 0x9879ef

Function at 0xa4721c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [edi + eax - 0x5ba3], ebx
mov dword [edi + eax*4 - 0x16ea8], ecx
mov ecx, 0x1934d917
lea eax, [ecx*2 + 0x29be4a2f]
mov dword [edi + ecx - 0x1934d917], edx
push ecx
call fcn.00704dc3
mov dword [esp], 0xe807f3be
push 0xbc3df304
sbb edi, 8
mov dword [edi + 0xc], eax
mov eax, 0x8a2f5bab
cwde
jmp 0x9af697