joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8ba3bb
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc cl
mov dword [esp + 4], 0x3a520a5a
lea esp, [esp + 4]
call fcn.007bb6d9
mov dword [esp + edx*2], ecx
xor ebx, eax
and ecx, 0x57b57838
sbb ecx, ecx
adc esi, eax
mov eax, dword [esp + ecx*8]
add eax, dword [esp + ecx]
lea ebp, [ebp + ecx - 1]
idiv ax
shr al, 0x84
add word [esp + ecx*4 + 2], cx
movzx edx, byte [ecx + ebp]
xor dl, bl
bswap ecx
inc dl
neg dl
lea eax, [eax + eax*4 - 0x68655ae6]
sal eax, 0xcb
push eax
adc dl, cl
ror dl, 1
call fcn.00a190eb
mov eax, 0x721e489d
movsx edx, al
lea edi, [edi + eax - 0x721e48a1]
and eax, edx
movzx ecx, ax
cwde
mov eax, dword [edi + eax*4 - 0x12274]
adc cl, dl
bts ecx, ecx
xor eax, ebx
shr ecx, cl
neg ecx
call fcn.0090822e
neg word [esp + edx*2 - 0x71ac5d2a]
mov word [esi + edx*2 - 0x71ac5d28], ax
mov eax, dword [ebp + edx*2 - 0x71ac5d2e]
lea ecx, [edx*2 - 0x86034cb]
setb byte [esp + ecx - 0x694c285c]
pop ecx
lea ebp, [ebp + edx - 0x38d62e99]
sal dx, 0xed
xor eax, ebx
push ecx
sub edx, edx
dec eax
ror dword [esp + edx*4], cl
xor eax, 0xd429b61f
xor byte [esp + edx + 3], 0x87
dec eax
lea edx, [ecx*4 - 0x1279dbf9]
xor eax, 0xeb35ebb6
xor ebx, eax
or cl, dh
adc edi, eax
pop ecx
lea ecx, [esi + 2]
lea eax, [edx + edx - 0x1f49bf4d]
mov dword [esi - 2], ecx
dec edx
add esi, 0xfffffffe
sar eax, 0x95
jae fcn.0073c645
mov edx, 0xdc982216
mov eax, edx
mov edx, dword [ebp - 4]
xor eax, 0xc1966f31
not eax
sbb ebp, 4
mov ecx, eax
xor edx, ebx
neg edx
ror cx, 0x2d
ror ecx, 0x1c
or cx, 0xb892
inc edx
btr ax, ax
btr ecx, ecx
ror ax, 0x65
rol edx, 2
ror ax, 0x8f
xor edx, 0x302c5592
sar eax, cl
neg edx
xor ebx, edx
inc eax
cwde
add esi, edx
movzx edx, al
ror dx, 0xc1
sal ecx, cl
add eax, dword [edi + eax]
sub cl, dh
xadd dl, cl
mov ecx, dword [edi + ecx - 0x7ffffffc]
jnp 0x8a0055
or dx, 0x7221
and dx, 0x5db3
adc eax, ecx
mov ecx, eax
movsx eax, dx
bts eax, edx
mov eax, dword ss:[edx + ecx - 0x5021]
movsx ecx, dl
mov dword [edx + edi - 0x501d], eax
lea ecx, [ecx + edx - 0x21c03eea]
and dx, cx
lea edi, [edx + edi - 0xffc]
neg edx
neg ecx
cmovo dx, cx
jmp esi

Function at 0x8bab54
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop ecx
pop edx
jp fcn.00cad447
cmc

Function at 0x8bbdbc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor cl, 0x2c
idiv ax
not cl
sal al, 0xe4
mov dword [esp + eax - 0x56be0010], 0x1135561a
add dx, dx
sbb cl, 0x90
push edx
not cl
xor dword [esp + eax - 0x56be000f], eax
xor cl, 0x3c
shr edx, 0xb
xor bl, cl
lea ecx, [esp + ecx + 8]
imul edx, dword [esp + edx - 0x1ed7bc]
mul dl
bswap edx
mov edx, dword [ecx + edx*2 - 0x11ac5a0]
push eax
lea ecx, [eax + eax*8 - 0x4e4421c7]
sub eax, 0x12199785
mov dword [eax + edi - 0x44a46883], edx
lea edi, [edi + eax - 0x44a46883]
mov edx, 0x6318c51e
inc cx
pop eax
pop eax
pop eax
jno fcn.008360bb
Function at 0x8bc66e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
ror edx, 2
inc ecx
xadd cl, cl
xor edx, 0x72312728
btr ebx, 0xf
dec esi
mov dword [esp + edi], esp
sar ebx, 0xe9
inc edx
xor dword [esp + edi*2], edx
inc ecx
pop esp
inc esp
add ebp, ebx
inc ebp
xor cl, bh
inc ecx
shr ecx, 0x91
dec eax
arpl dx, dx
inc ecx
rol cl, 0xc6
dec eax
rol esi, 0x95
dec esp
add ebx, edx
inc ecx
mov edx, esi
cbw
jmp fcn.008c5046
Function at 0x8bcd85
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, dword [edx + eax - 0x74168e36]
btc ecx, ecx
movsx edx, cx
mov dword [edi - 4], eax
mov dword [esp], ecx
and dword [esp], edx
movzx ecx, byte [ebp - 2]
xor cl, bl
lea eax, [edx + 0x2803b8ac]
add dl, dh
rol cl, 1
shl dword [esp + eax*2 - 0x50077154], 0x1d
cwde
sbb cl, 0x36
ror cl, 1
lea eax, [edx + edx + 0x5a278f31]
dec edx
xor dword [esp + eax - 0x5a278f2b], edx
xor cl, 0x8a
call fcn.007a29ee
mov edx, 0x68ada3a8
inc ecx
mov edi, 0xeb13ea11
rdtsc
dec eax
sub edi, 8
inc ecx
movsx ebp, di
inc ebp
mov esi, edi
rol bp, 0x88
mov dword [edi + 4], eax
inc ecx
mov ecx, 0x1394838
inc ecx
mov esi, esi
inc edx
mov dword [edi + ecx*2 - 0x2729070], edx
inc eax
add ch, 0xbb
inc ecx
sub ebp, esi
dec ebp
lea edx, [edx + ebp*2 - 0x29d64f2c]
inc esp
adc cl, dh
inc ebp
mov edi, dword [edx + ebp*2 - 0x29d64f28]
mov eax, 0x48b2cbba
dec ecx
lea ebx, [esi + ebp - 0x1a6c0859]
je 0x9c762e
inc ebp
xor edi, esp
dec eax
or esi, ebx
dec eax
rol ebp, 0x21
inc ecx
ror edi, 1
inc esp
mov eax, esi
inc cx
bts eax, 0x85
inc ecx
movzx edx, al
inc ecx
inc edi
inc esp
movzx ebp, si
dec bx
inc cx
not esi
inc ecx
xor edi, 0x7dbc69b1
inc edi
lea edi, [esi + edi - 0x70728f6a]
dec esp
xor ebp, edx
inc ecx
bswap edi
inc ecx
push esp
inc ecx
or ebp, eax
sete al
inc esi
xor dword [esp + ecx*8 - 0x9ca4248], edi
inc ecx
neg eax
inc ecx
pop esp
dec ebp
arpl di, di
dec ax
dec ebp
add ebx, edi
xadd al, ah
jl fcn.008c5046
inc ax
inc esi
lea esi, [ebp + esi - 0x5498403f]
add ebx, ebx
inc ecx
push esp
inc ecx
add ecx, eax
inc esp
movzx esp, bl
inc ecx
dec al
inc esp
xor dword [esp + ebp - 0x10b5], esi
dec eax
cwde
inc ecx
pop esp
neg al
dec eax
inc ecx
dec ebp
arpl si, si
dec ebp
add ebx, esi
dec esi
lea edx, [ebp + edx - 0x10b6]
inc esp
or cl, ch
inc esp
sub eax, ebp
call fcn.00717c5e
mov ebp, 0xd6172107
call fcn.007468a7
mov ecx, dword [esi]
mov edx, 0x54076034
add edx, edx
movsx eax, dl
lea esi, [esi + eax*4 - 0x19c]
adc edx, edx
call fcn.009808b0
bt edx, edx
xor ebx, eax
lea edi, [edi + edx - 0x55f740c3]
mov dword [edi + edx - 0x55f740bf], eax
jmp fcn.00cad447
dec esp
mov esi, dword [esp + 0x40]
push edi
dec esp
mov dword [esp + 0x38], ecx
dec eax
mov ecx, dword [esp + 0x50]
inc ecx
inc edx
dec esp
mov ecx, dword [esp + 0x58]
pop ebp
dec eax
mov dword [esp + 0x40], esi
cmovnp di, ax
dec eax
mov edi, dword [esp + 0x58]
dec eax
mov dword [esp + 0x18], 0x31964a30
dec ecx
btr edx, 0x1e
xchg word [esp + 0x13], ax
push dword [esp + 0x60]
popfd
dec eax
lea ebx, [esi + ebp*8 - 0x5455d9e1]
dec eax
mov ebx, dword [esp + 0x68]
cwde
cbw
dec esp
mov edx, dword [esp + eax*8 - 0x7fbd0]
xchg bp, ax
xchg word [esp + eax*4 - 0x2a34d], ax
dec eax
mov ebp, dword [esp + eax*8 - 0x110]
push esi
dec eax
mov eax, dword [esp + eax + 0x57]
not esi
dec eax
xchg dword [esp + esi - 0x33a9097d], esi
dec eax
mov esi, dword [esp + 0x90]
call fcn.00cb743b
inc ecx
xor esi, esp
call fcn.0070237d
Function at 0x8be149
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov eax, dword [edx]
sbb ebp, 3
mov edx, ecx
mov dword [esp + 4], ecx
and cx, 0x9ea6
mov dword [ebp], eax
pop ecx
pop ecx
pop ecx
pop ecx
pop edx
pop edx
js fcn.0089b138

Function at 0x8c1c21
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0x15a7f1af
shr eax, 8
xor eax, edi
jmp 0x74e0e3

Function at 0x8c4bec
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bt eax, edx
xor ebx, ecx
not dx
neg eax
add esi, ecx
lea ecx, [edx + edx - 0x73e16dc4]
mov eax, dword [edi + eax - 0x27c16aa8]
bswap edx
mov ecx, dword [edi + edx - 0x4feb03fa]
xor edx, 0x35a3878d
jns 0x8ac9df
shr dx, 9
add eax, ecx
movsx ecx, dx
inc edx
push ecx
mov dword [edx + edi - 0x7a48003c], eax
sub ecx, ecx
lea edi, [edi + ecx*2 + 6]
movzx eax, word [esp + ecx*8]
mov dword [esp + edx - 0x7a480042], esi
ret
call fcn.009f52a6
mov eax, 0xffb7b635
mov edx, dword [edi]
mov cl, byte [edi + 4]
sub al, 0x28
xor ax, ax
lea eax, [eax*8 + 0x78968296]
shr edx, cl
mov dword [edi + eax - 0x764e8294], edx
cwde
movzx edx, ax
add eax, 0x96026089
mov ecx, dword [ebp + edx*2 - 0x10530]
lea ebp, [edx + ebp - 0x829a]
lea eax, [eax + eax*8 - 0x6dd20f00]
xor ecx, ebx
xchg ah, al
dec al
bswap ecx
sub ax, dx
ror edx, 0xdd
dec ecx
rol ecx, 3
xor ecx, 0xd98958b1
jmp 0x7e49c4

Function at 0x8c50e6
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [edi]
add edi, 2
movzx ecx, byte [esi]
mov edx, 0x1c3584a2
bswap edx
mov dword [esp], 0xacbc3337
add esi, 1
sub dword [esp], 0x26390825
xor cl, bl
not edx
inc cl
neg cl
mov byte [esp + edx - 0x5d7bcae3], dh
shr dl, 0x41
sbb cl, 0x1b
neg cl
push edx
mov dword [esp + edx - 0x5d7bca69], 0x3b28b07
sar byte [esp + edx - 0x5d7bca6e], 1
xor bl, cl
and byte [esp + edx - 0x5d7bca6e], dh
sub edx, 0x612620b8
jl 0xa2db13
mov eax, 0x9c015b1e
movzx edx, al
lea ebp, [edx + ebp - 0x22]
mov edx, dword [ebp + edx - 0x1e]
sal eax, 0x27
btc eax, 0x1b
setb al
xor edx, ebx
shl ax, 0x81
bswap edx
ror eax, 0xbc
ror edx, 1
or ax, ax
bswap edx
rol edx, 2
lea edx, [edx + eax - 0x50197fe8]
sar eax, 0xc4
sub eax, 0xd62a791e
bswap eax
ror edx, 1
btc ax, ax
adc eax, eax
sbb edx, 0x85bed6bd
xor ebx, edx
jmp 0x8b412d
lea ecx, [esp + ecx + 0xc]
neg dword [esp + 4]
xchg word [esp], dx
ror dword [esp + 7], 0x6d
mov word [ecx], ax
not word [esp + 4]
movsx eax, dx
mov ecx, dword [esi]
adc esi, 4
neg eax
xor ecx, ebx
sar dword [esp + eax - 0x358e], 0x49
xor ecx, 0xcb3344ab
xchg dword [esp + eax - 0x358a], eax
and al, byte [esp + 8]
dec al
inc ecx
mul byte [esp + 6]
sub byte [esp + 9], ah
shl dl, 0x21
not ecx
sal dl, 0xc1
imul dx, word [esp + 9]
idiv eax
lea ecx, [ecx + eax*4 - 0x2d97d1b5]
call fcn.007ba44d
dec bl
neg bl
shr eax, 0x43
mov esi, edx
inc edx
not byte [esp + eax - 0x220c8408]
not bl
neg esi
inc cx
dec ebp
inc esp
xor ah, bl
call fcn.007f48ed
cmp eax, 0x7ec3c494
xchg esi, eax
xchg byte [esi + ebx*8 + 0x6aba1d2b], dh
movsb byte es:[edi], byte [esi]
fisubr word [ebx]
sbb eax, 0xde800a82
sub ebx, dword [0xdfb77a9a]
push 0x4c
pop ds
invalid
Function at 0x8c532a
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
bswap eax
bt edx, edx
sar dl, 0xc5
jae 0xa00d3e
neg al
xor edx, 0x9e2f6837
lea ecx, [ecx*8 + 0x1f3dea1d]
call fcn.0074c21d
sysenter
push edx
pushfd
mov edx, 0xb68476a5
and edx, 0x63948b26
mov edx, dword [esp + 4]
mov dword [esp + 4], 0x816b163a
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.00991696
call fcn.0076c681
inc edx
bswap eax
lea eax, [ecx + eax - 0x20eb90fd]
shr ecx, 0xad
lea ecx, [ecx + 0x6bbe7d1f]
ja 0x82ec09
sbb eax, 0xec8d3d0f
shl ecx, cl
adc edx, 0xe0c0d19
btr cx, cx
rcr byte [ecx], cl
or eax, 0xf660e0c
mov bl, 0xc9
not eax
cmovae dx, cx
jae 0x8f0fed
xor eax, 0x1b0c3c1f
stosb byte es:[edi], al
mov edi, 0xd9735f1a
mov bh, 0xa0
pop es
jae 0xa00d46
wait
dec esi
fbstp tbyte [ebx - 0x27]
iretd

Function at 0x8c5348
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esi
mov esp, dword [esp + ecx - 0x15]
cwde
dec esp
mov dword [esp + eax - 0x27], ebp
dec eax
arpl si, si
dec esp
add ebx, esi
inc ecx
pop ebp
pop eax
inc ecx
pop edi
jmp fcn.008c5046

Function at 0x8c889f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Get number of processors
Parse pe header

Disassembly:
mov word [eax], cx
sal byte [esp + 2], 3
pop ecx
jmp ebp
adc al, 0x1e
mov dword [esp], edx
rol dx, 0xe9
jae 0xc9fe11
neg al
not al
ror dword [esp], 0x5d
xor bl, al
xadd dword [esp], edx
ror edx, 0xea
dec byte [esp + 3]
lea eax, [esp + eax + 4]
jne 0x7a3ebd
mov ebx, 0xa0add1bc
dec eax
mov esp, edi
inc esp
mov eax, ebx
inc esp
movzx ebx, bx
inc ecx
pop edi
pop edx
inc bx
call fcn.009a7a17
mov ecx, 0x50bc2619
mov edx, dword [edi + ecx - 0x50bc2619]
lea eax, [ecx*8 + 0x4f8b448b]
movzx ax, byte ss:[edx + ecx - 0x50bc2619]
movzx edx, cl
mov word [edi + ecx - 0x50bc2617], ax
movzx eax, dl
and eax, ecx
mov ecx, dword [ebp + edx*8 - 0xcc]
setno dl
lea ebp, [edx + ebp - 5]
btr eax, edx
inc eax
shr eax, 0xef
xor ecx, ebx
add ecx, edx
sal eax, 0x62
neg dl
not ecx
div dl
cwde
inc ecx
shr dl, 3
dec edx
xor ecx, 0x15b58390
rol al, 0x43
inc ecx
xor ebx, ecx
ror dx, 0xa9
sbb eax, edx
dec dx
add esi, ecx
movzx cx, byte [edi + edx*4 - 0x3bfa]
xor al, byte [edi + edx - 0xefb]
or cl, al
shr edx, 0xbc
mov eax, 0x1ab53720
sal eax, 0x2b
not cl
or dl, al
jnp 0x804902
adc eax, edx
mov word [edi + edx*8 + 4], cx
bts ax, ax
sal eax, 0x7d
movzx ecx, dl
lea edi, [edi + edx + 4]
adc edx, esi
jmp edx

Function at 0x8ca8b1
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
setb byte [esp + 4]
shr ecx, 0x83
lea esi, [esi + ecx*4 - 0x643346e0]
movsx edx, cx
xor eax, ebx
lea ecx, [ecx + edx*8 - 0x7b6163d5]
sal dl, 0x41
mov dword [esp], ecx
dec eax
lea ecx, [edx*4 - 0x56a75ed]
ror eax, 2
xor eax, 0x150b9a25
pop ecx
neg eax
add ecx, edx
inc ecx
rol eax, 3
not eax
xor ebx, eax
add ebp, eax
movsx eax, word [esp]
bt ecx, ecx
pop edx
jb fcn.008360bb
Function at 0x8caa1c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not ecx
bts eax, eax
bt dx, 0x88
rol ax, 0xed
xor ebx, ecx
push eax
btc ax, 0x82
adc edi, ecx
add dl, byte [ebp + edx - 0x137f3f00]
and ax, ax
push eax
movzx ax, byte [ebp + 2]
mov ecx, 0x851549ac
adc ebp, 2
imul dl
mov word [ebp], ax
or ecx, dword [esp + 1]
movzx eax, cx
xadd word [esp + eax - 0xc9fd], ax
mov dword [esp + eax - 0x75d4], edi
ret 4
lea edi, [edx + edi + 6]
mov byte es:[ecx + edx], al
shl dword [esp + edx*2], 0x3a
lea ecx, [edx*8 + 0x11148729]
lea edx, [edx*8 - 0x6c6c767e]
lea ebp, [ebp + ecx - 0x1114872d]
mov edx, dword [ebp + ecx - 0x11148729]
bswap ecx
shl cx, 0xd
movsx eax, cx
xor edx, ebx
call fcn.007fd08a
sub esi, 4
mov ecx, 0x4f1d9aa4
movsx eax, cl
mov ecx, dword [esi + ecx - 0x4f1d9aa4]
mov edx, 0x8826a59b
xor ecx, ebx
xor ecx, 0x3e03512e
bswap ecx
cwde
xor al, dl
mul ax
xor ecx, 0xa72b8990
sal edx, 7
xor eax, edx
js 0x72a34f
mov ebx, 0xa93eb911
movsx esi, bl
mov ebp, esi
dec esp
mov eax, dword [edi + esi - 0x11]
inc esp
movsx edi, dh
inc ecx
and bh, 0x3a
dec ebp
dec ebp
mov esi, dword [eax + esi - 0x11]
dec eax
adc esi, ebp
mov ecx, 0x14144f30
dec esp
mov dword [edi + esi - 0x21], esi
adc ebp, ebp
dec ebp
lea edx, [edx + esi - 0x25]
movsx eax, cl
inc ebp
mov ecx, dword [edx + esi - 0x21]
inc ebp
xor ecx, esp
inc ecx
neg ecx
mul ebx
inc ecx
ror ecx, 2
dec eax
not ecx
or cl, cl
inc ebp
lea ecx, [ecx + esi + 0x693ebff5]
jns 0x945f77
adc cx, cx
inc ecx
bswap ecx
inc ebp
mov esi, edi
adc al, ch
inc ecx
push esp
inc esp
xor dword [esp + esi - 0x21], ecx
dec esi
lea ebp, [esi*2 - 0x10cfddc2]
dec dx
cdq
inc ecx
pop esp
inc ecx
and cl, dh
mul dl
inc cx
and esi, 0x634d2f21
leave
sar ebp, 0x4c
dec dl
pushfd
dec eax
add dword [esp + 8], 0xff7ceebc
dec eax
mov dword [esp + 8], 0xb7099e27
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.0073fd82
cdq
rol al, 0xc6
xor al, byte [edi + eax + 4]
push edx
jmp 0x750c79

Function at 0x8caa4c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec edx
mov dword [esp + esi*2 - 0x1fffe], ecx
dec ecx
lea edi, [esi + edi - 0x10005]
inc ecx
pop ecx
ja fcn.008c5046
Function at 0x8cb8e6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, ebx
shr cx, 0xee
not eax
inc eax
mov dword [esp + ecx*2 - 0x7533fffc], ecx
push edx
neg eax
or dword [esp + ecx*2 - 0x75340003], ecx
rol eax, 1
xor ebx, eax
shl dword [esp + ecx - 0x3a99fffd], 0xea
adc esi, eax
movzx eax, cx
ror edx, cl
push eax
pop eax
pop ecx
pop eax
pop edx
pop edx
jb fcn.00747049
inc dl
mov dword [esp + ecx - 0x3a9a8091], 0x80d7135
mov eax, dword [ebp + ecx*2 - 0x75350122]
jnp 0x749175
mov byte [esp + 2], 0x94
call fcn.008eccd6
sub ebp, 4
mov eax, 0x829ee42a
movzx ecx, ax
mov edx, dword [ebp + ecx*4 - 0x390a8]
sal al, 0x82
xor edx, ebx
sar eax, cl
xadd al, cl
dec edx
not edx
dec ecx
bt eax, ecx
lea edx, [edx + ecx*2 + 0x230723a6]
ror cl, 0xc1
jae 0xa21e8b
or eax, ecx
bswap edx
rol edx, 3
dec cx
xor ebx, edx
add esi, edx
dec al
setnp al
mov ax, word [edi + ecx*2 - 0x1c8b6]
lea edx, [ecx + ecx + 0x1f905b38]
mov cx, word [ecx + edi - 0xe459]
lea edi, [edi + edx - 0x1f9223ec]
and edx, edx
add edx, edx
not ax
sbb edx, edx
sar edx, 0xbe
not cx
jb 0xa39ceb
push edx
push edx
and ax, cx
xor dword [esp + edx*8 + 4], edx
movsx ecx, dx
call fcn.008e84b3

Function at 0x8cc786
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + 4], eax
mov dword [esp], 0x473a710b
dec ebx
push 0xee92cea8
push 0x5cbfdc84
lea esp, [esp + 0xc]
jne 0x9cdfb5

Function at 0x8cc7ac
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea esp, [esp + 0x10]
jne 0x994fca

Function at 0x8ceb7b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
neg edx
lea eax, [eax + edx*2 - 0x5c9709d5]
shr ecx, cl
shr ecx, 0x2b
bswap eax
btr edx, edx
call fcn.007bf369
mov eax, 0x6ea58415
mov edx, dword [eax + esi - 0x6ea58415]
movzx ecx, al
xor edx, ebx
shr ax, 0x68
lea edx, [ecx + edx + 0x4295de80]
bswap edx
call fcn.0075a3ef

Function at 0x8cf909
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc eax
or eax, dword [eax + edi + 4]
neg dword [esp + 8]
push 0xc7a6b29f
mov dword [esp + 4], 0x3e3bf586
adc edi, 3
xor ecx, ecx
test eax, eax
call fcn.0094905d
xor ecx, 0x9ae5a9d
sar edx, 0xb
neg ecx
call fcn.009fc9e1

Function at 0x8cf9e9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], ecx
xor eax, 0x4d3e0d25
dec edx
neg eax
ror edx, 0xdf
shl ecx, 0xd9
inc eax
sar ecx, 0xde
xor ebx, eax
or edx, edx
js 0x772428
Function at 0x8d2eb4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ecx, 0x60b1c113
dec ecx
bswap ebp
inc ebp
xadd cl, dh
dec ecx
or ebx, ecx
lea ecx, [ecx + ebp*2 + 0xfd20634]
inc ecx
add cl, 0xbc
inc ecx
push esp
dec eax
xadd ebx, edx
xor dword [esp + ebp - 0x54aa6285], ecx
inc eax
sar ch, 0x83
inc ecx
pop esp
and esi, ebp
dec eax
arpl cx, cx
jge 0x96659e
sets al
adc esi, ecx
cwde
pop edx
jmp esi
call fcn.0082fe8b
btr bp, dx
lea ecx, [ecx + ebp*4 - 0x5b88bde4]
inc ebp
movzx ecx, ch
bt bx, bp
ror ecx, 3
inc esp
or esi, ebp
jns 0xa08841
jl 0x827c4b
movsx eax, dl
dec esp
adc ebx, ecx
call fcn.00944fd6
inc edx
movsx ecx, word [esp + esi*4 - 0x11647]
dec esp
adc ebx, esi
inc cx
sal ecx, 0xc6
inc ecx
rol edi, 0xc1
dec eax
not dword [esp + edx*4 + 0xc]
pop ebx
inc ecx
pop edi
inc ecx
pop ebp
pop eax
jo fcn.008c5046

Function at 0x8d2ee3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
btr eax, 0x3e
dec edx
xor ebx, ecx
cwde
add ebp, ecx
pop edx
pop eax
jmp fcn.008360bb
xchg word [esp + eax + 8], cx
xor bl, dl
xchg byte [esp + eax + 0xa], al
and cl, ch
ror dword [esp + eax + 8], 0x61
lea edx, [esp + edx + 0xc]
rol ecx, 9
mov cx, word [edx + eax]
mov dword [esp + eax], eax
lea edi, [eax + edi - 2]
shr eax, 0xe4
neg dword [esp + eax*2 + 8]
mov edx, 0xe389e625
mov word [edi + eax], cx
setne al
cbw
pop eax
pop edx
pop edx
je fcn.008ca50c
mov word [edi + eax*2 - 4], dx
btr cx, cx
shr cx, cl
shr cx, cl
xor cl, byte [eax + esi]
bt eax, eax
xor cl, bl
sub cl, 0x14
rol cl, 1
neg cl
movzx edx, ax
imul eax
xor cl, 0x87
and dx, ax
cwde
rol cl, 1
div ax
not dx
sub dl, dh
xor bl, cl
add ecx, esp
or dx, dx
movzx dx, byte [eax + ecx - 1]
movsx ecx, al
push eax
mov word [edi + ecx - 5], dx
push ecx
movzx edx, cx
lea edi, [edi + eax*2 - 6]
dec edx
adc dword [esp + eax*2 + 2], ecx
mov ecx, dword [esi + eax*8 - 6]
idiv eax
xor dx, dx
neg word [esp + eax + 4]
lea esi, [eax + esi + 5]
xor ecx, ebx
imul edx, dword [esp + eax + 3]
idiv dword [esp + eax + 3]
ror ecx, 1
sub ecx, 0xfc027f9a
ror ecx, 1
inc dword [esp + eax]
cdq
neg ecx
sub ecx, 0x970fae96
jmp 0x8b86b0

Function at 0x8d4616
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xchg dword [esp + eax - 0x4726b4bc], ecx
sub edx, 0xe2232286
xor ebx, edx
add edi, edx
xor dword [esp + eax - 0x4726b4bc], 0xbe237497
and ax, word [esp + eax - 0x4726b4bc]
jo 0x90c167
mov ecx, dword [eax + esi - 0x4726b400]
mov edx, 0x81b5ee10
push eax
sub dl, ah
mov edx, dword [esi + eax - 0x4726b3fc]
ror al, 0x61
lea esi, [esi + eax - 0x4726b3f8]
or al, al
bts ax, ax
shl eax, 0xcf
mov dword [ecx + eax - 0x5a008000], edx
call fcn.007386d4

Function at 0x8d6199
Capabilities:
Encode data using xor

Disassembly:
sar dword [esp], 0xee
rol word [esp + 1], 0xcf
test edx, edx
push 0x2c06c194
call fcn.00a2e6cb
adc esi, 4
mov dword [esp], 0x704f386
mov dword [esp], 0x2125c235
or byte [esp + 2], 0x2e
xor eax, eax
jmp 0x7f697c
Function at 0x8d748b
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov edx, dword [ebp + eax - 0xf0b359b]
mov eax, edx
mov edx, dword [esp + ebp*8 - 0x7859acd4]
xchg edi, eax
mov ebp, eax
pop ecx
pop edx
jmp 0x74f13b

Function at 0x8d8354
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esp
adc ebx, ebp
dec esi
mov dword [esp + ecx*2 - 0x40000000], ecx
dec edi
lea edx, [edx + ecx*2 - 0x40000001]
dec eax
cdq
inc sp
imul ecx, edx
push edx
inc ebx
movzx ebx, byte [edx + ebp - 0xbc]
inc ecx
xor bl, ah
inc edx
mov esi, dword [esp + ecx*2 - 0x3ffffff9]
rol bl, 1
inc ecx
push edi
inc bl
ror bl, 1
sub bl, 0x9c
inc edx
and byte [esp + ecx*2 - 0x3fffffff], 0x36
jg 0x7c7a0d
xadd bp, cx
dec esi
mov dword [esp + edi*2 - 0xb758944], esp
inc esi
xor dword [esp + edi - 0x5bac4a2], ebp
inc cx
bt edi, eax
dec eax
rol eax, 0x7d
dec eax
cdq
inc ecx
pop esp
dec ebp
arpl bp, bp
dec ebp
add ebx, ebp
inc esp
movzx ebp, bl
dec ecx
or edx, ebx
jmp edx

Function at 0x8d8c2e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
rol edx, 2
dec al
inc edx
ror ecx, cl
not edx
sub eax, 0x7db2a309
shl dword [esp], 0x8d
dec eax
bswap edx
xor ebx, edx
add esi, edx
shl ecx, cl
jbe 0x90df33
mov ecx, 0x5739449a
mov eax, dword [edi + ecx - 0x5739449a]
lea edi, [edi + ecx - 0x57394496]
sal cl, 0x25
lea ecx, [ecx + ecx*2 - 0x24cedff8]
xor eax, ebx
not eax
neg eax
inc cx
lea edx, [ecx*2 + 0x55862a05]
dec eax
xor eax, 0xe7903003
xor ebx, eax
lea ecx, [ecx + ecx*4 + 0x2bb00b95]
add ebp, eax
push ecx
call fcn.009f733b
syscall
push ecx
pushfd
dec eax
mov ecx, 0x23b9ff2f
add dword [eax - 0x74b78076], 0x4c
and al, 8
dec eax
mov dword [esp + 8], 0xb7796e09
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.0073fd82
xadd cx, ax
not edx
mov dword [esp + eax - 0xbd98], eax
jl 0x818f2f
mov ecx, 0x2fb9eab0
xor cx, cx
mov edx, dword [esi + ecx*2 - 0x5f720000]
movzx eax, cl
lea esi, [esi + ecx - 0x2fb8fffc]
xor edx, ebx
add cx, ax
rol eax, 0x24
shl cx, 0x81
ror edx, 1
xor eax, eax
xchg ecx, eax
sbb edx, 0xfc027f9a
add eax, 0x61a8df24
and ecx, eax
dec cx
ror edx, 1
neg edx
call fcn.007c229d