joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cb337
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x2908513a
push 0x4f37d7ba
adc edi, 4
inc dword [esp + 1]
xor ecx, ecx
not dword [esp + 4]
test eax, eax
lea esp, [esp + 8]
je 0xa0bc52
push 0x7ba75406
rol dword [esp], 0xd
mov dword [esp], edi
mov edi, 0x503b6616
rol edi, 0x16
or edi, edi
movzx edi, byte [edx]
ja 0x97ba25
mov ecx, 0x3e10c5a2
movsx edi, cl
call fcn.00902ba4
js 0x7cb3a1
adc eax, dword [eax]
add byte [edi], cl
mov dh, 0xca
movzx ecx, dl
inc cx
mov word [ebp + ecx - 0x81], ax
mov edx, dword [esi + ecx*2 - 0x102]
lea esi, [esi + ecx - 0x7d]
xadd cl, ch
jp 0xcaeb3a
invalid
xchg ebp, eax
loopne 0x7cb417
arpl word [esi + ecx + 0x78d1ccf2], bp
les edi, [ebp - 0xd]
or byte [ecx], ch
or byte [ecx], ch
cwde
les edi, [ebp - 0xd]
sbb cl, ah
js 0x7cb38c
jge 0x7cb3bd
add bl, al
add bl, al
push eax
les edi, [ebp - 0xd]
in al, 0x87
xor ah, al
jge 0x7cb3c9
cld
cld
pop ss
add ah, 0x7d
jl 0x7cb38d
xor ah, al
jge 0x7cb3d5
pop ds
sar dword [edi - 0x16c9594e], cl
fld dword [esi - 0x74]
int1
leave
ret
stosd dword es:[edi], eax
xlatb
mov eax, dword [0x8bff98f5]
pop ss
and ebp, esi
cwde
jmp dword [edx - 0x670a1eda]
xor edi, ecx
push 0x90118c31
and edi, 0xff
or dword [esp], 0x41cd5b9
js 0x967c8f
mov edx, 0x84af800e
movsx eax, dx
shl ax, 1
not ecx
mov dword [edi], ecx
add ax, dx
cbw
dec dx
mov eax, dword [esi]
movzx ecx, dx
neg dl
ror cl, 0x82
lea esi, [esi + ecx*2 - 0x10082]
xor eax, ebx
neg cx
inc dx
sal edx, 0x27
bswap eax
neg eax
call fcn.0089cc4c
xor edx, ebx
not cl
xor ecx, ecx
sbb edx, 0xa53ff213
movsx eax, cl
sal cl, 0x67
bswap edx
sar ax, 0x23
sbb eax, 0x9d1fc5a6
lea edx, [edx + eax - 0x42ce31d0]
neg edx
not edx
xor edx, 0x3da18b0d
dec edx
xor ebx, edx
bswap eax
add edi, edx
xor ax, cx
xor al, al
adc ecx, edi
jmp ecx

Function at 0x7cd400
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push eax
xor ebx, edx
inc word [esp + eax - 0x550afff8]
and dword [esp + eax - 0x550afff3], ecx
adc edi, edx
ror ecx, 0x7f
cwde
push eax
mov eax, dword [ebp + eax*2 - 6]
jb 0x8b9a70
mov edx, dword [ebp + ecx*2 - 0x7238fc]
bts cx, cx
btc ecx, 0xaa
add eax, edx
mov edx, ecx
lea edx, [edx*2 - 0x5cc640e3]
mov dword [ebp + ecx*8 - 0x1c8c404], eax
shr edx, cl
mov eax, dword [esp + ecx*8 - 0x1c8c3f4]
cbw
movzx eax, byte [ecx + esi - 0x391886]
xadd word [esp + ecx*2 - 0x7230f3], dx
xadd dl, dh
sete dl
lea esi, [ecx + esi - 0x391886]
dec dx
xor al, bl
sub al, dl
mov edx, dword [esp + 8]
add edx, 0x2b5949
jmp edx
lea ebp, [ebp + ecx*8 - 4]
cbw
call fcn.009697c4
xchg ecx, eax
sar ecx, 0xa1
adc edx, 0x2943e84
shl ecx, 0x16
jbe 0xc990de
push eax
bswap edx
ja 0x9b9d0a
rol dword [esp], 0xbb
ror eax, 0x61
rol edx, 2
shr al, 0x67
and byte [esp + eax - 0x7ffffefd], cl
lea edx, [eax + edx - 0x7ae7f3ca]
pop ecx
bswap edx
xor ebx, edx
sub ecx, ecx
sal ecx, 0xb4
adc ebp, edx
ror cx, 0xe5
mov edx, eax
or ecx, dword [eax + esi - 0x7fffff00]
add dl, byte [edx + esi - 0x7ffffefc]
bswap eax
lea esi, [eax + esi - 0xffff79]
mov byte [ecx + eax*4 - 0x3fffdfc], dl
jmp ebp
Function at 0x7cffed
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sub cl, ch
add ecx, 0xc7be2e39
mov ax, word [edx]
add ecx, 0xb1bd6da5
imul cx, cx
lea edi, [ecx + edi - 0x797c36ff]
mov word [edi + ecx - 0x797c3701], ax
mov dword [esp + ecx - 0x797c36fd], 0xea8e0ac
call fcn.009425da

Function at 0x7d629a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
shl dword [esp + eax - 0x843fffc], 0x70
and eax, ecx
xor ebx, edx
push ecx
inc eax
add ebp, edx
movsx edx, word [esp + eax*2 - 2]
lea edx, [ecx + edx*4 + 0x3c36a693]
lea ecx, [ecx*4 - 0x4d7f43c5]
pop ecx
pop edx
pop edx
jmp fcn.008360bb

Function at 0x7d6433
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp + ecx*2 - 0x484d4a13]
bts ecx, ecx
or word [esp + ecx - 0x2426a583], cx
lea ebp, [ebp + ecx - 0x2426a58c]
pop eax
xor edx, ebx
lea eax, [eax*4 - 0xa729a53]
rol edx, 1
inc edx
ror ecx, 0x97
call fcn.008de6e3
rol eax, cl
call fcn.00a2364d
inc ebx
jbe 0x7d64a7
retf
test eax, 0xf7cfc042
sar byte [ecx + 2], cl
mov ss, word [esp + ebp*8 + 0x5fc04c53]
pop edi
lds ecx, [ecx]
mov ebp, 0xc7d3816e
push ecx
salc
xchg esp, eax
sahf
rol edi, cl
mov ebx, dword [ecx]
cli
call 0x9be8a535
push ds
fistp qword [edx + 0x22]
pop ecx
sbb ah, byte [edi + 0xbae78db]
sahf
stosd dword es:[edi], eax
xor eax, 0xa6ce5133
stc
jl 0x7d6527
pop ebp
outsd dx, dword [esi]
in eax, 5
wait
aad 0x62
invalid
stc
stc
dec edi
dec esp
xchg edi, eax
jp 0x7d6522
stc
dec edi
scasb al, byte es:[edi]
cmp eax, 0xb5730618
fld dword [edi + 0x20]
push ds
cmpsd dword [esi], dword es:[edi]
das
xchg ebx, eax
fst dword [eax]
mov dword [0xa3980510], eax
imul edi, dword [ebx + 0x490d3333], 0xe3590cf
xor esi, dword [ebx]
or eax, 0x3590cf49
push cs
add eax, esp
jle 0x7d6541
xchg edi, eax
mov bl, 0xd2
push edi
sahf
inc esi
push edx
mov dword [0x741d6929], eax
shl byte [ecx - 0x25], 0x13
mov ah, 0xc9
xchg edi, eax
cdq
sub byte [esi - 5], dh
jae 0x7d65de
rcr byte [esi - 0xf], 0xe2
mov cl, 0xa6
cmp eax, 0x9e29e431
js 0x7d65be
dec eax
retf
insb byte es:[edi], dx
shl ecx, 1
dec esi
adc al, 0xb8
mov dl, 0x16
mov ch, 0x69
ror eax, 0xe4
mov ecx, 0xdb8dd783
mov ecx, dword [edi + eax*2 - 0x4d36a2d6]
lea eax, [eax + eax - 0x7ac228f1]
btr ax, ax
movzx edx, byte [ebp - 1]
xor dl, bl
neg dl
btc ax, ax
rol dl, 1
dec ax
sub dl, 0xa3
neg dl
sar eax, 0xd6
shl eax, 0x6f
push eax
xor bl, dl
rol ax, 0xaf
dec eax
lea edx, [esp + edx + 4]
btc eax, eax
mov dword [edx + eax - 0x7fa43fff], ecx
push eax
lea ecx, [eax*4 + 0x2595a50b]
bt ax, ax
mov edx, dword [ecx + edi - 0x2426a503]
cwde
lea edi, [edi + eax - 0x3ff7]
rol dword [esp + ecx - 0x2426a504], 0x26
lea eax, [esp + eax - 0x3fe7]
mov dword [ecx + eax - 0x2426a507], edx
jb 0x7d0d4a
Function at 0x7d75c9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Manually build aes constants

Disassembly:
mov edi, ebp
mov dword [esp + ebx - 0x15ab], ecx
sub ecx, esi
sbb esi, ebx
mov ebx, dword [esp + ecx*4 + 4]
mov ebp, dword [esp + ecx*2 + 8]
mov dword [esp + ecx + 8], 0x32b05f1f
jb 0x9c4dd4
mov esi, dword [esp + ecx + 0xc]
dec ecx
movsx edx, byte [esp + 8]
js 0x96a91d
lea esi, [edx + esi - 0x23]
shl dword [esp + edx*8 - 0xf8], 0xd
setns cl
lea eax, [ecx*2 - 0x694ac1eb]
mov ecx, dword [edx + esi - 0x1f]
shr ax, 0x6e
push eax
xor ecx, ebx
shr eax, 0x74
neg edx
mov dword [esp + eax - 0x963], 0xf88ea83
lea ecx, [ecx + eax + 0x39a1a5c0]
rol ecx, 1
cdq
rol eax, 0xb0
neg ecx
call fcn.008fdce6
jmp 0xa3ac58
jmp fcn.00802574

Function at 0x7d8491
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc cx
rol cx, cl
bswap eax
push ecx
call fcn.00786a87
dec edx
mov dword [esp + ecx*2 - 0x40], esi
dec eax
mov ecx, dword [esp + esi*2 + 0x6136f3be]
dec esi
mov ecx, dword [esp + ecx*2 - 0x28]
dec eax
mov edi, dword [esp + esi*2 + 0x6136f3ce]
push dword [esp + 0x48]
popfd
call fcn.00a3ea52
Function at 0x7dd39e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not eax
xor ecx, ecx
add edx, 0x7a8009ac
xor ebx, eax
add esi, eax
shr ecx, 0xdb
inc edx
setae dl
mov edx, dword [edx + edi - 0x7a820901]
push ecx
and cx, 0xe0b1
xor cl, byte [edi + ecx*8 + 4]
add edi, 2
sal dword [esp], 0x10
mov eax, dword [esp]
shr edx, cl
mov dword [edi + eax*4], edx
cdq
xor dword [esp + eax*2], esi
ret
jae 0x72784c
lea edx, [edx + ecx*2 + 0x1bb3b919]
push eax
neg edx
xor eax, 0x9ea27028
push eax
xor ebx, edx
add cx, ax
adc edi, edx
lea ebp, [ebp + ecx - 0x7153]
movzx edx, word [esp + ecx*4 - 0x1c544]
not eax
lea esp, [esp + 8]
ja 0x7eeab1
mov edx, 0x50a03c22
movzx ecx, dl
mov eax, esp
lea ecx, [ecx + 0x2e]
and edx, edx
lea edx, [edx + edi - 0x50a03ca2]
jg 0x8c03b7
mov edx, dword [edi - 4]
mov ecx, 0xd12f89b0
push ecx
xor edx, ebx
not cx
dec edx
movsx eax, cl
neg dword [esp + eax*8 - 0x278]
adc dword [esp + eax - 0x4f], eax
xor edx, 0xa7393f12
rol edx, 3
and cl, 0x25
inc edx
xor ebx, edx
not ax
add esi, edx
neg byte [esp + eax - 0xffaf]
push eax
movzx edx, byte [edi + eax*8 - 0x7fd85]
lea ecx, [ecx*2 - 0x1e614241]
lea edi, [edi + eax - 0xffb5]
not dword [esp + eax - 0xffac]
ror eax, 0xed
dec ax
xor dl, bl
pop eax
rol ecx, cl
rol dl, 1
cwde
bt ecx, eax
adc dl, 0x3c
xor dl, 0x8e
dec eax
bt ax, cx
dec dl
xchg dword [esp], eax
rol dl, 1
mov byte [esp + 2], 0x2e
or word [esp + 1], 0xf126
xor bl, dl
sar cx, cl
shl ecx, 0x8f
sar word [esp + 2], 0x4e
lea edx, [esp + edx + 4]
neg ax
push eax
push eax
or cl, byte [edx]
mov word [ebp - 2], cx
xadd dword [esp + 8], eax
mov edx, 0x65277e34
movzx dx, byte [ebp + edx - 0x65277e36]
jns 0x7bff26
mov cl, byte [ebp]
or eax, dword [esp + 2]
shr dl, cl
mov word [ebp], dx
movzx ecx, al
inc al
mov dword [esp + ecx*2 - 0x15e], esi
ret 8
inc eax
mov dword [ebp + 4], ecx
call fcn.0096378e
sub ebp, 4
mov edx, 0x861a1a24
movsx ecx, dl
mov edx, dword [ecx + ebp - 0x24]
xor edx, ebx
inc edx
ror cl, cl
not cl
movzx eax, cl
ror edx, 1
jmp 0x746ecd
push 0x45868022
cmp edi, ecx
jmp 0x754d9b
and edx, 0xfffffffc
call fcn.0096537d
mov eax, 0xfab20b02
movzx edx, al
lea ebp, [ebp + edx - 6]
xchg dl, al
mov eax, dword [ebp + edx*2 - 4]
xor eax, ebx
mov ecx, edx
dec ecx
add eax, 0x950c5f84
not eax
btr cx, 0xba
ror eax, 2
bts edx, 0xb1
bts ecx, ecx
sub cx, 0x3c90
inc eax
btr ecx, ecx
jae 0x73bb34

Function at 0x7de075
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
btr si, 0x2b
dec esp
add ebx, ebx
dec edx
mov edi, dword [edi + esi*2 - 0x3741ea70]
inc ecx
pop ecx
dec eax
imul edx, esi
jae fcn.008c5046
rdtsc
or cl, ch
lea ebp, [ebp + ecx*4 - 0x378]
shr cx, 0xcc
setnp byte [esp + ecx + 6]
sub ecx, 0xfcafed28
mov dword [ebp + ecx*2 - 0x6a025ac], eax
setle byte [esp + ecx - 0x35012d5]
push ecx
jbe 0xa02442
mov dword [ebp + ecx - 0x35012d8], edx
pop ecx
pop edx
pop edx
jge fcn.0098b9e9
mov dword [esp + eax - 0x8e], esi
ret 8
Function at 0x7df655
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec edx
lea esi, [edi*4 - 0x75dd8e5b]
dec edx
mov eax, dword [edi + edi - 0x5dbfd81f]
inc ecx
mov ebp, 0x79b3a68c
inc ecx
push edi
inc edx
mov cl, byte [edi + ebp - 0x79b3a684]
inc edx
movsx ebp, byte [esp + edi - 0x5dbfd81d]
dec eax
btc ebp, 0x31
jb 0x70884e
dec edx
lea edi, [edi + ebp - 0x79b3a68a]
dec edx
mov dword [esp + ebp - 0x79b3a684], 0x969b7630
dec eax
shr eax, cl
inc edx
ror byte [esp + ebp - 0x79b3a68c], 0xe2
dec edx
mov dword [edi + ebp - 0x79b3a68c], eax
dec edi
lea edx, [edx + edi - 0x5dbfd823]
inc ebp
movsx eax, bp
inc edi
mov ecx, dword [edx + ebp - 0x79b3a68c]
inc ecx
shr ebp, 0x52

Function at 0x7e44f6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
movzx ax, byte [ebp]
mov cl, byte [ebp + 2]
add ebp, 2
mov edx, 0x3919cb95
push edx
and al, cl
inc word [esp + edx*2 - 0x72339728]
and edx, 0xa7b79d89
dec dl
not al
lea ecx, [edx + edx + 0x718dd320]
sbb dx, word [esp + edx*2 - 0x422312fe]
rol dl, 0xe6
mov word [ebp + edx*2 - 0x4222a132], ax
movsx eax, dl
mov edx, dword [esi + edx - 0x21115099]
pop ecx
lea esi, [esi + ecx - 0x391acb91]
jnp 0xa01abd
btr ax, cx
cbw
xor edx, ebx
sal ecx, 0x88
bswap edx
neg edx
rol ax, 0x86
call fcn.008ea42d
mov word [ecx - 0xf], ss
add ebp, dword [edi + ecx*4 - 0x5cd610f2]
fdiv qword [ebx - 0x5cd610fe]
xor bl, dl
push 0xffffffffffffffef
sub dword [ebx + 0x6450a3a8], esp
sub byte [ebx + 0x3a04457], ah
mov dword [0x2897bcdc], eax
mov byte [ebp - 0x763ddd07], ch
dec esi
pop esi
nop
invalid
mov edx, dword [esi]
mov eax, 0xa23fd401
lea ecx, [eax + eax*2 - 0x44d0f361]
not cl
add esi, 4
xor edx, ebx
rol edx, 3
call fcn.008eb4ee
mov ecx, 0xf6b1c58e
mov edx, dword [esi]
add esi, 4
mov eax, ecx
xor edx, ebx
ror eax, 0xe2
call fcn.0075c78a
mov dword [esp], 0xca247b0b
lea edx, [edx + eax*2 - 0x2be5f5e3]
mov ecx, 0x97859d04
sub cx, word [esp + 1]
jae 0x80ebaf
mov edx, 0x94bb7491
inc dx
jno 0x71ebad
jmp 0x711d16
xor ebx, edx
inc word [esp]
call fcn.007d0f09
and eax, 0xcc2e7d29
bt dx, ax
mov dword [esp + edx], esi
ret

Function at 0x7e4b50
Capabilities:
Encode data using base64

Disassembly:
call fcn.0071481e
inc ecx
mov ebp, 0x9fb4f22e
inc ecx
movzx ebx, ch
inc ebp
movsx eax, bp
inc esp
mov eax, dword [edi + ebx*8 - 0x170]
dec edx
lea eax, [ebp*2 + 0x42088630]
movzx ecx, al
call fcn.007a4e6f
xor ebx, eax
and ebx, 0xff
jmp 0x7805aa
dec edx
lea esp, [esp + 0x14]
jne 0xa2e6d6
push 0xa8a3ca3e
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
not eax
mov ecx, 0x8ca59794
jmp 0x8e3085
btc ecx, ecx
mov dword [esi], eax
lea eax, [ecx*4 - 0x1c88b4b]
mov edx, eax
mov ecx, dword [edi + eax - 0x310dd305]
imul eax
seto al
lea edi, [edi + eax - 0x6733dfd]
mov ebx, 0x373ee697
or ebx, ebx
movzx ebx, byte [ecx + ebx - 0x373ee697]
jno 0x79053d

Function at 0x7e84de
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey

Disassembly:
mov edx, 0x82120134
mov dword [esp], edx
sub esi, 1
rol edx, 0xa2
jae 0x815b04
Function at 0x7e858e
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov word [edi + ebp - 0x322ad5b3], bx
dec ebp
pop eax
pop edx
jne fcn.008c5046
mov edx, 0x5f9a12ae
lea ecx, [edx + edx*2 - 0x164c62ee]
lea ebp, [edx + ebp - 0x5f9a12b2]
shr dl, 7
btr edx, ecx
push edx
mov ecx, dword [ebp + edx - 0x4f9a1201]
xor ecx, ebx
lea eax, [edx + edx - 0x72f01a7d]
or eax, edx
pop edx
lea ecx, [ecx + edx + 0x587d39ae]
xor ecx, 0x1225798
sub eax, edx
jg 0x96e90d
call fcn.00766124
mov eax, 0x460cf0aa
mov ecx, 0x2b3ea6
add eax, eax
lea ebp, [ecx + ebp - 0x2b3eaa]
mov edx, dword [ebp + ecx - 0x2b3ea6]
and cx, cx
sar ax, 3
neg cl
xor edx, ebx
shl ecx, 0x50
sub ecx, ecx
lea edx, [edx + ecx*2 + 0x7db56d90]
imul ax, ax
sar eax, 0x44
bswap edx
dec edx
rol edx, 1
inc edx
call fcn.007f2a32
xor ebx, ecx
imul al
bt ax, ax
add dl, ah
adc esi, ecx
mov edx, dword [edi + eax - 0x70ad0e89]
movzx ecx, al
lea ecx, [ecx + eax*4 - 0x23cd0fec]
call fcn.00a52635
lea ecx, [ecx + eax + 0x6b66fda1]
neg ecx
xor eax, edx
inc dx
adc edx, 0x58b0a92d
bswap ecx
ror eax, 0x2b
ja 0x8f8e50
mov ecx, 0xef8a0239
movzx cx, byte [edi]
mov edx, 0xb5b4cd02
lea eax, [edx*8 - 0x6bdc93e3]
mov al, byte [edi + eax - 0x41c9d42b]
sar edx, 0x78
sar dl, 0x21
inc edx
adc edi, 1
add edx, edx
add cl, al
movsx eax, dl
mov word [edi], cx
sal eax, 0x34
rol ax, 0x69
sbb esi, 4
inc al
cbw
sub edx, 0x1bbaba0f
mov ecx, dword [esi]
sar edx, 0xf9
adc edx, 0x9b40f8a
xor ecx, ebx
rol edx, 0xa1
imul edx, eax
dec ecx
mul al
rol eax, 3
sar al, 0xa1
neg ecx
and dx, ax
dec ecx
inc dx
shl eax, 0x72
rol ecx, 1
imul ax
call fcn.0094fbbf

Function at 0x7ea81d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec eax
cdq
inc sp
add esi, eax
inc ebp
movzx ebp, al
inc ecx
sub edx, ebp
inc cx
ror esi, 1
dec esi
mov dword [esp + eax*2 - 0x10020], eax
inc bp
xor esp, esi
inc dx
imul dword [esp + eax*8 - 0x4007a]
inc edx
movzx ebp, word [esp + eax - 0x800e]
dec eax
cdq
dec eax
lea edi, [edi + edx - 2]
inc cx
div edi
dec eax
not dword [esp + edx]
inc sp
mov dword [edx + edi], esi
inc ecx
pop ecx
jmp fcn.008c5046
Function at 0x7efd06
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
mul dx
shr dx, 5
bswap ecx
btc eax, edx
jae 0x82feeb
xor ebx, ecx
inc ax
pop edx
add edi, ecx
inc eax
mov ax, word [ebp + 2]
pop ecx
mov dx, word [ecx + ebp - 0x471eede4]
dec cl
or ax, dx
movsx edx, cl
dec dl
sub edx, edx
not ax
add dl, dl
mov word [ebp + edx + 4], ax
neg cx
lea ebp, [ebp + edx + 4]
mov eax, ecx
bt ecx, edx
xor edx, edi
jmp edx
mov edx, dword [esp + eax - 0x39a9]
call fcn.008d7856
inc esp
mov esi, ebx
inc cx
dec ebp
mov dword [edi + edi - 0xf2a8ea6], ebp
inc edi
mov ecx, dword [edx + edi*2 - 0x1e551d41]
dec cx
inc ebp
xor ecx, esp
inc ecx
rol edi, 0xfe
dec esp
lea ebp, [ecx*8 - 0xc7287c3]
btc cx, dx
inc ecx
bswap ecx
jae 0x8dfee2
movsx eax, dx
inc ecx
inc ecx
inc ecx
ror ecx, 1
not cl
dec eax
add edx, ebx
inc edi
lea ecx, [ecx + eax - 0x500dbdec]
cbw
mov esi, 0x31bb621b
inc ecx
neg ecx
shr cx, 7
inc ecx
neg dh
dec eax
btr esi, edx
inc ecx
push esp
jb 0x946bab
inc ecx
sub edi, 0xcb95a2b8
inc esp
xor dword [esp + ebx - 0x6130554f], ecx
mov ebp, eax
inc cx
sar edi, cl
dec ecx
bts eax, esi
inc ecx
pop esp
dec ebp
arpl cx, cx
inc eax
inc dh
dec ebp
adc ebx, ecx
dec cl
inc esi
movzx ecx, word [ebx + edx - 0x61305556]
inc esp
add bh, ch
dec esi
lea edx, [ecx + edx - 0x6f77006c]
inc ecx
shl ch, 0x41
setbe al
inc bp
xor ecx, esp
dec eax
rol ebx, cl
inc cx
adc ecx, 0x4166e8bb
ror ecx, 1
inc ecx
ror al, cl
inc cx
neg ecx
rol al, 0x27
inc cx
inc ecx
shl cx, 0x45
inc ecx
xor al, ch
ror ecx, 5
inc bp
xor esp, ecx
inc dx
and eax, 0x8e4209
dec dx
inc sp
mov dword [edi + ecx*2 - 0x6f770d4], ecx
mul bl
inc eax
xor bl, dh
dec eax
lea edi, [edi + ecx - 0x37bb86f]
cwd
rol dl, cl
jae fcn.008c5046
mov ecx, 0x380ec211
lea esi, [esi + ecx*2 - 0x701d8426]
movzx edx, cx
lea edx, [ecx + edx*8 - 0x11c0336b]
movzx eax, dl
mov edx, dword [esi + edx - 0x26549f2e]
btc ecx, 0x8b
lea eax, [ecx + eax*8 + 0x402af38c]
xor edx, ebx
rol cl, 5
sar ecx, cl
cbw
inc edx
bts ecx, eax
bswap edx
xadd ecx, eax
jns 0x9f70b0
sub cx, cx
sbb edx, 0x8610f813
or cx, 0x191
bswap edx
xor ebx, edx
sub ecx, ecx
adc edi, edx
mov ebp, dword [ebp + ecx*2]
btc ecx, ecx
jae fcn.0098b9e9
mov cx, word [eax + edi - 0x10d8a]
mov si, word [eax + edi - 0x10d88]
dec eax
lea edi, [edi + eax*2 - 0x21b12]
dec ebp
lea edi, [eax + edx*2 - 0x1bf64478]
inc esp
movsx ebp, word [esp + eax - 0x10d89]
not cx
not si
or cx, si
mov word [edi + eax - 0x10d8a], cx
dec esp
mov dword [esp + eax - 0x10d8a], ebx
ret
cwde
inc esp
xor eax, edx
inc ecx
push esp
inc ecx
imul ecx
cwde
inc esp
xor dword [esp + ebp*2 - 0x156], eax
inc ecx
pop esp
dec ebp
arpl ax, ax
dec eax
cdq
dec ebp
add ebx, eax
dec esp
lea ebp, [esi*8 - 0x1ff10cd5]
dec ecx
or edx, ebx
jmp edx
ror ecx, cl
add dx, ax
mov dword [esp], ecx
movsx eax, cx
mov word [edi], dx
Function at 0x7f0ff4
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
rol ax, 0xeb
xor ebx, edx
mov dword [esp + eax], ecx
add ecx, dword [esp + eax + 4]
lea edi, [edi + eax*2 - 4]
ror eax, 0x3b
or eax, dword [esp + eax + 4]
cwde
mov dword [edi], edx
sbb ebp, 4
ror ecx, cl
mov eax, dword [ebp + ecx - 0x7b474e35]
push ecx
lea edx, [ecx + ecx + 0x79259d81]
jb 0x91e95a
xor eax, ebx
xor word [esp + ecx - 0x7b474e30], 0x7537
neg ecx
bswap eax
adc byte [esp + edx - 0x6fb439e0], dl
lea ecx, [ecx + ecx*2 - 0x7cfd5b5c]
sbb cl, byte [esp + ecx*2 - 0x22597409]
neg eax
not edx
lea eax, [eax + edx*2 - 0x610cf022]
and dword [esp + ecx - 0x112cbaae], 0x2ba72618
pop ecx
btc edx, 0xb9
ror eax, 1
mov dword [esp + ecx - 0x7b474e34], 0x7b258389
imul ecx, ecx
shl dword [esp + ecx - 0x674a56f6], cl
sbb eax, 0x4f2952b6
not word [esp + ecx - 0x674a56f9]
rol eax, 2
dec cx
sal word [esp + ecx - 0x674a56f2], 0xc6
neg eax
push ecx
inc dl
sub dl, cl
xor ebx, eax
add esi, eax
push ecx
pop eax
pop edx
pop eax
pop edx
jmp fcn.00ca4448

Function at 0x7f4acb
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + eax - 0x58010e87], eax
lea edx, [esp + edx + 4]
rol dword [esp + eax - 0x58010e87], 0x49
ror dword [esp + eax - 0x58010e87], 0xa1
ror ax, 0x6e
mov dword [edx + eax - 0x58013a1c], ecx
mov ecx, dword [eax + ebp - 0x58013a21]
xor ecx, ebx
sal eax, 0x38
rol word [esp + eax*2 - 0x37fffffe], 0xae
rol ecx, 2
movzx edx, byte [esp + eax - 0x1c000000]
neg ecx
rol dx, 0x8f
ror ecx, 1
rol al, 0xc5
xadd ax, dx
neg ecx
push edx
neg eax
sbb ax, dx
xor ebx, ecx
add edi, ecx
mov ecx, 0x7d0a4b98
cdq
movzx edx, byte [ebp + ecx - 0x7d0a4b9e]
lea ebp, [ebp + ecx - 0x7d0a4b9e]
idiv byte [esp + ecx - 0x7d0a4b92]
xor dl, bl
xor eax, dword [esp + ecx - 0x7d0a4b95]
not cl
not dl
ror ecx, cl
not ecx
sbb dl, al
or ecx, 0x6d3faa23
not dl
ja 0x95f081
and dword [esp + ecx - 0x7d3feb6a], ecx
pop eax
inc dl
xor dl, 0x9f
ror ax, cl
neg eax
adc dl, 0x37
add eax, 0xf0a71585
add word [esp + ecx - 0x7d3feb69], ax
not dl
cwde
xchg word [esp + ecx - 0x7d3feb6b], ax
pop ecx
xor bl, dl
cwde
sub eax, eax
adc edx, esp
cbw
neg ecx
add eax, dword [ecx + edx - 0x6a37ea7b]
mov edx, ecx
inc edx
mov dword [esi + edx - 0x6a37ea7c], eax
lea eax, [ecx + edx*4 + 0x5f81e617]
ror edx, cl
jmp edi
Function at 0x7f585d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
neg bh
dec eax
sar ebp, cl
inc esp
adc bh, al
sal ax, cl
inc ecx
rol bh, 1
neg ebx
inc ebp
xor ah, bh
inc sp
mov dword [edi + ebp*2 - 0xa], edi
dec eax
lea edi, [edi + ebp*2 - 0xa]
dec ecx
sal eax, 0xc4
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop ecx
pop esi
jb fcn.008c5046
shl edx, 0x83
mov byte [eax + edx*8], cl
lea ecx, [edx + edx*2 - 0x21c386dd]
adc dx, word [edx + edi + 1]
xor dx, bx
xor cx, cx
sbb ecx, ecx
sar cl, 0x83
not dx
lea eax, [ecx*2 + 0x6b845d85]
ror dx, 1
add cl, al
push eax
dec dx
ror dx, 1
xor dx, 0x429f
sub cl, ah
sal ecx, cl
sbb dx, 0xe6ba
xchg dword [esp + ecx - 0x2800], ecx
rol dx, 1
ror eax, 0x7a
xor bx, dx
xadd al, ah
shr al, cl
mov word [ecx + esi - 0x6b845d85], dx
lea edx, [ecx + ecx*2 - 0x166aca5c]
cwde
shr dword [esp + ecx - 0x6b845d85], 0x23
mov edx, dword [edi + eax - 0x5a02]
lea edi, [edi + ecx - 0x6b845d7e]
call fcn.00949aaa
mov edx, 0x6e8852b6
movsx ecx, dx
mov ecx, dword [edi + ecx*8 - 0x295b0]
mov edx, dword [ecx + edx - 0x6e8852b6]
mov ecx, 0xab19acad
xadd cl, ch
movsx eax, cl
mov dword [edi + eax*8 - 0x2c8], edx
dec eax
cdq
lea ebp, [eax + ebp - 0x5c]
mul ax
not dl
inc dl
mov ecx, dword [eax + ebp - 0x1e40]
xor ecx, ebx
sal edx, 0x13
and dx, ax
inc al
rol ecx, 1
sub ecx, 0x9929e42e
xor dl, dh
rol ecx, 2
neg al
dec eax
neg ecx
div ax
btr edx, edx
rol dl, 0x62
xor ebx, ecx
bt eax, 0x8b
add dl, dh
adc esi, ecx
sar eax, 0x5e
xchg al, dl
xor eax, esi
jmp eax

Function at 0x7f5ea9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions
Parse pe header

Disassembly:
inc edx
sal dword [esp + esi - 0x66333c99], 0x8e
dec edi
lea edx, [esi + edx - 0x66333ca8]
dec edx
not dword [esp + esi - 0x66333c9b]
dec eax
lea edx, [ebx - 0x6053d96d]
dec dword [esp + edx - 0x3650b7f9]
inc ebp
xor edi, esp
dec eax
ror ebx, 0xa7
inc ecx
dec al
inc ecx
sbb edi, 0x659062a1
inc ecx
xor edi, 0x2b9c5d0a
xor edx, 0xaa97dca6
inc ebp
movzx ecx, si
dec eax
lea eax, [ecx*8 + 0x17adb596]
inc ecx
inc edi
inc ecx
shl eax, cl
inc esp
sub al, bl
inc ecx
neg edi
dec edx
mov dword [esp + eax - 0x2d4923de], 0x639527b5
call fcn.007a0272

Function at 0x7f7269
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
mov dword [esp], 0x61849184
xor edx, edx
call fcn.007e8c60

Function at 0x7f7851
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor esi, ecx
push 0x21f7a09
mov dword [esp + 4], 0x7a029e32
and esi, 0xff
jmp 0xa3709c

Function at 0x7fa0e5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esi
lea esi, [esp + esi + 0x18]
dec eax
mov dword [esp + edx - 0xd3ed4ae], ebp
dec esp
lea ecx, [esi*2 + 0x473e7c80]
inc dx
mov dword [ebx + esi], ecx
dec ebp
lea edx, [edx + edx - 0xd3ed4ba]
inc ebp
mov ecx, dword [edx + edx*4 - 0x34fb52d8]
dec esp
lea eax, [ebx + eax*8 + 0x6902811f]
call fcn.00925696
call fcn.007436a7