joyce8/EMBER2024-capa huggingface dataset:
Function at 0x974232
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ebx
movzx ecx, byte [edx + ecx - 0x1d0547e6]
inc ecx
xor cl, ah
inc ecx
push edi
push eax
sub cl, 0x2b
ror cl, 1
inc ecx
movzx ebx, si
pop eax
neg edx
xor cl, 0x9a
xchg bx, ax
rol cl, 1
inc edx
xchg dword [esp + ecx - 0x1d0547d6], ebx
dec esi
xor esi, dword [esp + ecx - 0x1d0547e6]
cwd
neg cl
dec eax
bswap ebx
sub cl, 0x9f
dec edx
mov dword [esp + ecx - 0x1d0547ce], 0xff9505ad
dec edx
mov dword [esp + edi - 0x45c4b6af], 0x9f1b1a0a
inc edx
sal dword [esp + edi - 0x45c4b6af], 0x68
inc esp
xor ah, cl
dec eax
lea ecx, [esp + ecx + 0x20]
dec esi
lea ecx, [ecx*8 - 0x7fdd14fb]
dec ecx
sal edi, 3
inc cx
adc edx, dword [ecx + ecx - 0x684d2a35]
pop eax
inc esi
sub byte [esp + esi - 0x45c4b6ba], al
dec edx
lea edi, [edi + esi - 0x45c4b6c1]
inc cx
mov dword [esi + edi - 0x45c4b6bf], edx
dec eax
cwde
inc ecx
inc al
btr ebx, 0xae
pop eax
inc ecx
pop edi
pop eax
jae fcn.008c5046

Function at 0x9745e8
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ebx, ecx
push eax
add byte [esp + eax*8 - 0x41c], 0xa1
bswap edx
adc edi, ecx
movsx ecx, al
mov ecx, dword [esi + eax - 0x84]
add ax, word [esp + eax - 0x78]
shr eax, 0xab
pop edx
mov eax, dword [esi + edx*4 - 0x20c]
dec edx
bts edx, 0xb6
not ecx
sar dx, 5
not eax
or ecx, eax
not edx
mov eax, ecx
dec dword [esp + 4]
mov edx, dword [esi + 8]
add eax, edx
ror dword [esp + 4], 0x56
mov dword [esi + 8], eax
mov ecx, dword [esp + 8]
movzx edx, cl
lea esi, [esi + edx*2 - 0xfe]
mov eax, dword [esp + edx*2 - 0xfe]
jae 0xa25f30
mov dword [esp], 0xa694c084
mov ecx, dword [ebp - 4]
add ebp, 0xfffffffc
push 0xbc107937
xor ecx, ebx
push 0x9427f52d
mov edx, dword [esp + 8]
movzx eax, dl
lea ecx, [ecx + edx - 0x168f98f0]
xadd word [esp + eax*8 - 0x41b], dx
ror ecx, 1
sub edx, dword [esp + eax - 0x7e]
neg ecx
dec dword [esp + eax*4 - 0x208]
xor ecx, 0x3197dba4
xor dword [esp + eax*8 - 0x41d], eax
jno 0x82e7f3
setae cl
mov dword [esp + edx - 0x83], edi
ret 8

Function at 0x974b7d
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
sar edx, 0xeb
rol al, 1
lea ecx, [ecx + edx*2 + 0x48865a81]
sal ecx, cl
xor ecx, 0x623c509d
not al
xor dx, dx
btr ecx, ecx
lea ecx, [ecx + ecx*8 + 0x572f01a9]
rol al, 1
mov dword [esp + edx - 0x60000], ecx
neg al
imul edx, ecx
not al
mov dword [esp + ecx - 0x4bcfa3aa], edx
rol al, 1
sar dx, 0x4c
dec edx
sbb al, 0x81
ror dx, cl
xor bl, al
ror dword [esp + ecx - 0x4bcfa3aa], cl
lea eax, [esp + eax + 8]
inc dword [esp + ecx - 0x4bcfa3aa]
mov cx, word [eax + ecx - 0x4bcfa3ae]
jne 0x82e225

Function at 0x975a9a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [ecx + edi - 0x6cafa97e], eax
call fcn.007ed80d

Function at 0x9766b6
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc edx
mov dword [esp + ebp - 0xcb07], eax
dec ebp
adc ebx, esi
pop ebx
pop ecx
inc ecx
pop ebp
pop eax
inc ecx
pop esi
inc ecx
pop edi
jmp fcn.008c5046
Function at 0x9767d3
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
add eax, edx
mov dword [ebp - 4], eax
push 0x398840bf
push 0x94b56534
mov dword [esp + 8], 0x7509fe99
test ebx, ebx
lea esp, [esp + 0xc]
je 0x89bec5

Function at 0x976e9f
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc ecx
push edi
dec esp
mov esi, dword [esi + eax - 0x6a3e]
inc ecx
sal bh, 2
mov eax, ebx
dec eax
lea edi, [edi + esi*2 - 0xd484]
dec esi
and edi, dword [esp + ebp - 0xaf17]
cbw
dec eax
sal dword [esp + esi*2 - 0xd47c], 0xed
dec esp
mov dword [esi + edi - 0x6a3e], esi
inc ecx
pop ebp
pop ecx
jae fcn.008c5046
xor al, 0x62
invalid

Function at 0x978628
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg ecx
sub ecx, edx
call fcn.0076b69c

Function at 0x978631
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not ecx
call fcn.0080087f
mov ecx, 0x3a3a51ad
mov eax, ebp
lea ebp, [ebp + ecx*2 - 0x7474a35c]
bts ecx, ecx
mov word [ebp + ecx - 0x3a3a71ad], ax
lea eax, [ecx + ecx*8 + 0x47853fa1]
sar cx, cl
rol eax, cl
lea esi, [ecx + esi - 0x3a3a0007]
bt ecx, 0x3f
rol ax, cl
dec cx
mov ecx, dword [esi + ecx*2 - 0x74740004]
xor ecx, ebx
ror ax, 0x46
lea eax, [eax*4 + 0x6b34343f]
movsx edx, ax
dec ecx
mul dx
rol ecx, 1
or dx, ax
bswap ecx
adc ax, ax
not ecx
or dx, 0x6e22
xor ebx, ecx
add edi, ecx
movzx ecx, dx
btr ax, 0x84
jae fcn.0098b9e9

Function at 0x9786ac
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
inc cx
inc eax
inc cx
ror eax, 1
dec eax
mov dword [esp + edx - 0x7041c2b2], ebp
pop eax
inc ebp
mov edi, esi
inc bp
xor esp, eax
and bx, dx
inc ebp
or ecx, ecx
inc eax
rol ch, cl
inc si
mov dword [edi + esi - 0x7041c35a], eax
dec eax
bts eax, edx
inc ecx
mov eax, 0xdc1ae4b8
dec edx
lea edi, [edi + ecx - 0x4a07c060]
jae fcn.008c5046
Function at 0x979d06
Capabilities:
Authenticate hmac
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
inc ebp
movzx esi, ax
inc edx
xor dword [esp + ebp*4 - 0x6cb445f0], esi
inc ecx
pop esp
inc esp
btc ecx, esi
dec eax
arpl si, si
xchg bl, al
dec esp
add ebx, esi
inc bp
bt esi, eax
shr bx, 0x68
dec edx
lea eax, [edi + ebp*2 - 0x365a22f6]
dec edx
mov dword [edi + ebp*2 - 0x365a22fe], eax
inc ecx
not edi
dec edx
lea edi, [edi + ebp*2 - 0x365a22fe]
jae fcn.008c5046
mov edx, 0xa5af93a2
sub ebp, 4
push edx
mov eax, dword [ebp]
lea ecx, [edx - 0x7bf6d8df]
sub cl, 0x90
xor eax, ebx
jmp 0x948a25
movzx ecx, byte [esi + 1]
xor cl, bl
bswap edx
and dx, dx
not cl
not dx
not dx
call fcn.00810110
mov word [esi + ecx*2], ax
call fcn.00832b22
inc eax
mov ch, byte [edi + 2]
movzx eax, dl
btr eax, 0x24
inc esp
movzx eax, dl
inc eax
or cl, ch
inc ecx
not ebp
not cl
dec ecx
sar ebp, 0x76
inc ecx
push eax
bt ax, 0xaf
inc dx
mov dword [edi + ebp*2 + 2], ecx
inc edx
shl byte [esp + ebp*4 + 5], 0xa7
inc ebx
mov esi, dword [edx + ebp*2 - 4]
dec esp
lea eax, [eax*2 + 0x1b2d0fbc]
inc ecx
push eax
inc dx
mul dword [esp + ebp*2 + 0xc]
dec edi
lea edx, [edx + ebp - 4]
dec eax
sar dword [esp + eax*2 + 7], 0x85
inc esi
add byte [esp + ebp + 0xd], al
movzx ebp, al
inc ecx
xor esi, esp
dec esi
jmp 0xa1056a
inc eax
xor eax, 0xca0a5691
rol edx, cl
neg eax
xor ecx, edx
inc cl
ror eax, 3
lea ecx, [ecx + edx*4 - 0x29e1ce55]
sub dword [esp], ecx
dec eax
add cl, dl
sbb cx, word [esp + 2]
rol eax, 1
sub edx, ecx
xor eax, 0xc51cb108
ror ecx, cl
xor ebx, eax
or dl, byte [esp + ecx - 0x41afaffe]
adc esi, eax
mov ecx, dword [ecx + edi - 0x41afaffe]
movsx eax, word [esp]
sub eax, 0xe2ce991
xadd dword [esp], eax
mov edx, dword ss:[ecx]
call fcn.00cb6e96
lea edi, [ecx + edi - 0x69bda327]
call fcn.007f81d9
add eax, esp
btc dx, 0xa8
lea edx, [ecx*8 - 0x7bf42660]
btc edx, edx
movzx cx, byte [eax]
mov ax, cx
jae 0x803b3f
inc esp
movzx edi, dl
bswap esi
inc ecx
pop ebp
xor ax, 0xe00
rol esi, 1
dec eax
shr dword [esp + eax - 0xe00], 0xee
inc edx
mov ebx, dword [esp + ebp*2 - 0x365a22f5]
dec eax
lea ecx, [edx + 0x24912d23]
lea esi, [esi + edx + 0xa0c009c]
inc edx
adc dword [esp + ebp*2 - 0x365a22f7], 0xdb23de0c
ror esi, 1
inc edx
lea esi, [esi + ebp*4 - 0x6ce3877d]
inc ecx
or al, 0x8a
inc eax
xadd ch, al
dec esp
mov dword [esp + eax*2 - 0x1c00], esp
je 0x7bacd4
Function at 0x97c485
Capabilities:
Hash data using murmur3

Disassembly:
lea eax, [eax + ecx*8 + 0xdf00732]
shl cx, 0xa1
xor eax, 0x537642d
lea edx, [edx + ecx*4 - 0x26c4127e]
xor ebx, eax
add cl, dl
add edi, eax
jmp edi
bswap edx
not ecx
lea edx, [edx + eax + 0x17e1491d]
inc ecx
bswap edx
sar ax, 5
shl cx, 0xe3
inc eax
xor edx, 0xed1ed7bd
idiv al
btr ecx, ecx
xor ebx, edx
not cl
dec cl
lea ecx, [ecx*4 + 0x7710bd0a]
add esi, edx
mov dx, word [edi + eax*4 - 0x29480004]
xchg ecx, eax
cbw
mov cl, byte [edi + eax - 0x73100020]
btc eax, eax
lea edi, [edi + eax - 0x73100024]
xor ax, 0x8d83
lea eax, [eax + eax*2 - 0x1640524b]
sal dx, cl
mov word [edi + eax - 0x42f156a4], dx
rol eax, 0xbf
movsx edx, al
jae 0x7686d1
shr edx, 0xe3
call fcn.00704dd8
cdq
or ebp, 0xd0bcdab6
pop edi
xor ebp, ecx
bswap ebp
pop ebp
lea ebp, [ebp + edx - 4]
mov eax, dword [ebp + eax*2 - 0x6b821274]
dec ecx
inc dx
xor eax, ebx
inc edx
jo 0x8be3fc
sub eax, 0xac373ab3
jmp 0x9cc515
mov dword [esp], ecx
bts dx, dx
rol eax, 3
btr edx, 0xbb
rol dl, 0x83
adc eax, 0x29a64596
rol eax, 1
not ecx
neg eax
shr ecx, cl
sbb dl, dl
bswap eax
dec ecx
ror eax, 1
push edx
or dl, 0x31
xor eax, 0x3fb8d30a
shl word [esp + ecx*4 - 0x5972], 0x8a
lea eax, [eax + edx - 0x1d3d1a24]
imul dx, word [esp + ecx*2 - 0x2cb4]
and cl, byte [esp + ecx - 0x165f]
ror eax, 2
bts edx, 8
bswap edx
setae dl
dec eax
shr cl, 0xc3
add edx, dword [esp + edx - 0xc2bbefb]
rol eax, 1
jmp 0x9042f6
not dl
shr ecx, 0xc2
neg eax
or dl, dl
dec eax
xor eax, 0x593f7605
sub dl, cl
bt edx, 0x82
jae 0x76f2c9
mov eax, 0xf5123298
call fcn.008e3d73

Function at 0x97d905
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
movzx eax, word [ebp + eax - 0x279175d0]
lea ecx, [edx*2 + 0x6aba8889]
pop ecx
xor edx, edx
xor ax, bx
btr dx, 0x86
movsx ecx, byte [esp + edx*4]
sal edx, 0xcf
inc ax
call fcn.007d7051

Function at 0x97db5a
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor ecx, ecx
push 0xe8a272b7
mov dword [esp + 4], 0xc10d9122
test edx, edx
not dword [esp + 6]
jmp 0xcacbec
push 0x5506ce05
lea esp, [esp + 0x10]
je 0x90403b
push 0xc5a5f6af
mov dword [esp], esi

Function at 0x97e2ad
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pushfd
pop ebx
dec eax
mov dword [esp], ebx
push edi
inc ecx
push ecx
inc esp
mov edx, ebp
dec edx
lea edi, [esp + edx*8 - 0x18270c0]
call fcn.009895ca
Function at 0x983a68
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sal dword [esp + 4], 0x5b
movzx eax, dx
mov dword [esp + eax - 0xf], ebp
ret 4
add ecx, dword [esp + 4]
ror edx, 1
sub edx, 0x3da7a104
rol ax, 0x27
xor ecx, 0xa01d3d02
mov dword [esp], eax
xor ebx, edx
idiv al
call fcn.00a2fcc3
mov ecx, 0xcbb7341a
or ecx, 0xdea344b2
mov eax, dword [esi]
push ecx
adc esi, 4
and byte [esp + 1], 0x93
movsx edx, cl
push ecx
xor eax, ebx
dec cx
setno dl
imul ecx, dword [esp + 1]
ror eax, 2
neg dl
sub eax, edx
xor eax, edx
ror eax, 2
ror edx, cl
xadd dword [esp], ecx
neg eax
bswap eax
not dword [esp + 1]
and cx, 0x2931
xor ebx, eax
add ebp, eax
movzx eax, byte [esp + 2]
mov ecx, dword [edi + eax - 0x90]
and ax, ax
shl eax, 0xfd
add dx, dx
add al, byte [edi + eax + 4]
add edi, 6
xor byte [esp + 6], dh
shr dx, 0x4c
xor byte [esp + 1], dh
mov byte ss:[ecx], al
jae 0x957855
mov edx, 0x9ab7572c
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
add ebp, 4
and eax, ecx
not eax
mov dword [ebp], eax
movzx eax, dl
sar eax, 0x51
movsx ecx, al
lea esi, [esi + eax*2 - 4]
ror cl, 0x25
adc eax, dword [eax + esi]
dec edx
xor eax, ebx
neg eax
dec ecx
jle 0xa27fe4
rol dl, 0x27
xor eax, 0x51080b26
rol cl, 0x86
not cl
and dx, cx
ror eax, 1
neg eax
xor ebx, eax
bts ecx, 0x2b
inc ecx
imul dx, cx
add edi, eax
lea eax, [ecx + ecx + 0x75a78997]
jmp edi

Function at 0x9883da
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp], 0x78a69955
call fcn.0092458a
mov ecx, 0xc12fa78f
dec esp
lea esi, [ecx*2 + 0x611d9c93]
inc esp
mov eax, ecx
dec ecx
sub edx, 4
dec ecx
lea eax, [esi + 0x76bd8997]
push eax
inc ecx
mov ebp, eax
inc ebp
mov eax, dword [edx]
inc ebp
xor eax, esp
mov esi, eax
inc ecx
inc eax
inc ecx
neg eax
not ax
dec esp
lea ebp, [eax + eax*2 + 0x48bbd11d]
inc ecx
xor eax, 0xac29b628
sub dword [esp + esi - 0x5a3a7545], eax
dec eax
mul eax
inc ecx
bswap eax
inc ebp
lea eax, [eax + esi - 0x478222aa]
dec esp
mov dword [esp + edx - 5], esp
dec eax
bt edx, eax
inc ecx
ror ch, 0x42
inc esp
xor dword [esp + edx*8 - 0x28], eax
inc cx
sub edx, esi
inc ecx
pop esp
dec ebp
arpl ax, ax
inc esp
mov ecx, esi
jge 0x91ee5f
mov edx, 0x87ba54bd
sub esi, 4
mov eax, dword [esi]
bt dx, 0xa5
xor eax, ebx
movsx ecx, dx
sub edx, ecx
xor dx, 0x3c94
inc eax
xor eax, 0xb6072081
not eax
add edx, ecx
neg eax
btr cx, cx
and cl, dl
xor ebx, eax
add ebp, eax
ror edx, cl
movsx eax, dx
movzx ax, byte [edx + edi - 0x48a8c3dd]
mov cl, byte [edx + edi - 0x48a8c3db]
push edx
rol edx, 0x97
ror edx, 0x52
lea edi, [edi + edx*2 - 0x2a30f750]
neg edx
ror edx, 0xd0
shr al, cl
mov word [edi], ax
movsx eax, dl
lea ecx, [edx + eax*8 + 0x280cfd86]
sub ecx, 0x5e81cab0
mov dword [esp + ecx - 0x4de31cf5], ebp
ret
Function at 0x98958d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
or dword [esp + esi - 0x165fa0e9], 0x883e011d
dec eax
mov dword [esp + esi*2 - 0x2cbf41f4], eax
dec esp
mov esp, dword [esp + esi*4 - 0x597e83d0]
cbw
inc cx
btc ebp, 0x8f
dec ebp
arpl di, di
dec eax
bswap edx
dec ebp
add ebx, edi
dec eax
shl ebx, 0xb0
inc ecx
pop ebp
inc ecx
pop esi
pop edx
inc ecx
pop ebp
ja fcn.008c5046

Function at 0x98a34c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg word [esp + 0x13]
inc ecx
jmp 0xc9f01d
rol cl, 0x84
ror edx, 1
xor ebx, edx
and eax, dword [esp + ecx*2 - 0x796bb0c9]
sal dword [esp + ecx*2 - 0x796bb0c6], 0xf7
push eax
add esi, edx
mov dword [esp + ecx*2 - 0x796bb0ca], esi
ret 8
sub cx, ax
not edx
jle 0x7da3ea
sal edi, 0x59
mov edi, dword [esp + ecx - 0x3cb5a7bf]
mov eax, edx
push ecx
lea edi, [edi + ecx*2 - 0x796b4f8a]
lea eax, [edx*8 - 0x7cf5765d]
mov edx, dword [edi + ecx*2 - 0x796b4f86]
mov dword [esp + ecx*2 - 0x796b4f7e], eax
and ax, cx
xor edx, ebx
add al, ch
bt ax, cx
adc dword [esp + ecx - 0x3cb5a7bb], eax
bswap edx
mov dword [esp + ecx - 0x3cb5a7bf], 0x1e183135
rol edx, 2
add ax, cx
jbe 0x9f8d9f
pop ecx
neg edx
jmp 0x82b46d
xor eax, ebx
jmp 0x79186e
movzx ebx, byte [ecx]
push 0x4a046494
xor ebx, eax
call fcn.0098a5ef
jl 0xa15ebb
scasd eax, dword es:[edi]
mov ebp, 0xaaf2d346
add esp, dword [esi - 0x710c5fd2]
in eax, 0x4e
mov al, byte cs:[0x2e95d2f3]
mov al, byte cs:[0x6ed19af3]
mov al, byte cs:[0x9e337ef3]
mov al, byte cs:[0x6edfc6f3]
mov al, byte cs:[0x169d4ef3]
mov al, byte cs:[0x623939f3]
mov al, byte [0x623939f3]
mov dl, 0x6a
jo 0xa15e9a
xor ebx, dword [ebx + 0x29c79f8c]
pop edi
cmpsd dword [esi], dword es:[edi]
pop ds
inc ebp
invalid
push 0x7abf3235
mov dword [esp + 0x10], 0xbe901c85
xor eax, 0x5e9f850b
sub byte [esp + 2], 0x9f
dec edx
lea esp, [esp + 0x1c]
jne 0xa15e5c
mov edx, 0xe2a74537
pop ebx
mov ecx, 0x4c3e4cb3
movzx edx, cl
not eax
mov dword [ecx + edi - 0x4c3e4cb3], eax
sal dl, 4
jmp esi

Function at 0x98ad32
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
neg eax
sar ecx, 0x5f
ror cl, 0xa1
sub dl, cl
xor ebx, eax
bswap ecx
dec ecx
mov dword [esp], 0xed2f709d
add edi, eax
mov esi, dword [esi]
and dword [esp + 7], edx
lea eax, [ecx*4 + 0x4c9f0a25]
add byte [esp + eax - 0x4c9f0a1c], ah
pop edx
pop edx
pop eax
js fcn.0073c645
mov word [esi + 2], dx
shr cl, 0xc3
mov ecx, dword [ebp - 4]
adc ebp, 0xfffffffc
mov eax, 0xd50d7782
ror al, 0x61
xor ecx, ebx
bswap eax
dec ecx
xor ecx, 0xd429b61f
xor eax, 0x9a2a8192
inc al
or al, ah
dec ecx
xor ecx, 0xeb35ebb6
lea edx, [eax*8 - 0xf40047a]
xor ebx, ecx
or eax, eax
sub edx, edx
adc edi, ecx
lea eax, [esi + edx*4 + 2]
movzx ecx, dl
mov dword [esi + edx*4 - 2], eax
shr ecx, 0x26
setne cl
lea esi, [esi + edx*4 - 2]
bt cx, dx
jae fcn.0073c645
Function at 0x98eda2
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esi
mov dword [esp + eax - 0x77eb95e0], ecx
inc ecx
btc edi, eax
dec esp
add esi, edi
dec eax
and ebx, edx
inc ecx
shl al, 0x47
sal si, 0x28
dec eax
lea edi, [edi + ebx*2 - 4]
js 0xa17b80
call fcn.00771e30
invalid
sar dx, 0x48
inc esp
sub bh, bl
inc ebp
mov dword [eax + edi - 0x77eb9500], esi
dec ecx
lea edx, [ecx + edx + 0x7a07c8a2]
push ebp
dec eax
rol dword [esp + ebx*2 + 8], 0x39
pop ebp
pop ebx
ja fcn.008c5046

Function at 0x99115d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [esp + edx*2 - 0x1fffe], ebp
ret 4
pop eax
pop ecx
pop ecx
inc ecx
pop edi
jb fcn.008c5046
jmp 0x83bee3

Function at 0x992ee8
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov word [ebp + eax - 0x3fdc4000], dx
movzx edx, al
mov dword [esp + eax - 0x3fdc4000], 0x121ef231
mov dword [esp + edx], esi
ret 0xc
inc eax
sub dh, 0xa0
neg ecx
bswap ecx
movzx ebp, dl
inc edx
lea ecx, [ecx + ebp - 0x73b8d727]
dec esi
mov dword [esp + ebp - 0xa860000], ebp
dec esi
mov dword [esp + ebp - 0xa85fff8], esp
inc edx
xor dword [esp + ebp*2 - 0x150bfff8], ecx
inc edx
movsx eax, word [esp + ebp - 0xa860000]
dec esi
mov esp, dword [esp + ebp - 0xa85fff8]
xor eax, 0xcb183a88
dec eax
arpl cx, cx
ja 0x731020
mov eax, 0x7218f191
lea esi, [esi + eax - 0x7218f195]
movzx ecx, ax
call fcn.007e2923
mov eax, 0x44bf1e00
cdq
sar dl, 0xe4
mov ecx, dword [ebp + edx]
ror eax, 0x5f
div ax
mov eax, dword [edx + ebp + 4]
lea ebp, [edx + ebp + 4]
not ecx
bts dx, 0x2c
not eax
adc dx, 0x9610
and ecx, eax
mov dword [ebp + edx*8 - 0x53080], ecx
lea ecx, [edx + 0x20a683b7]
mov ecx, dword [esi + edx*4 - 0x29840]
sar dl, 1
jno 0x7fe776
shr dx, cl
bts eax, 0xbc
jb 0x8d545f
adc edx, dword [0xeb283206]
aad 0xa0
sbb dword [eax - 0x68], eax
aad 0x8c
xor dword [eax - 0x68], eax
mov ecx, 0x9840d942
leave
sbb al, 0x89
inc eax
cwde
test eax, 0x984041e6
xchg ebp, eax
xchg edx, eax
xor dword [eax - 0x68], eax
dec ecx
mov bl, byte [ecx]
inc eax
cwde
push edi
pop edx
mov dl, 0xf1
fistp dword [eax + 0x5d]
mov dword [0x47c8ad8c], eax
invalid

Function at 0x998ef8
Capabilities:
Execute syscall

Disassembly:
call fcn.007493b2
sysenter
call fcn.0098cb8b
Function at 0x99abb5
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec esp
mov dword [esp + ebx - 0x753b0001], esp
xor dword [esp + ebx - 0x753b0001], ecx
inc esp
xor al, al
inc ecx
pop esp
inc esp
xadd dl, ch
inc sp
bt ebx, eax
dec eax
arpl cx, cx
dec esp
adc ebx, ecx
inc ebp
or edi, ecx
shr esi, 0xbf
jns fcn.008c5046
xor ecx, 0x6ac3918
push edx
bts eax, 0x38
jae 0xca26d7
add cx, cx
xchg ch, cl
mov ecx, dword [ebp + ecx*2 - 0x660a1ce2]
push 0x65acba10
inc word [esp + 2]
call fcn.0078977e
dec esp
mov dword [esp + ebx - 0x753b0001], ecx
rol esi, 0xac
bswap ecx
inc ecx
imul ebp
btc bp, dx
inc ecx
sar ebp, 0xff
jp 0x786cd1
mov ecx, 0xf91ad88a
shr ecx, cl
movzx ax, byte [edi + ecx - 0x3e46b6]
mov edx, 0xaca2a491
push ecx
btc cx, dx
mov dl, byte [edi + ecx*2 - 0x7c8d66]
neg ecx
adc edi, 1
push ecx
and dword [esp + 4], ecx
and al, dl
not al
rol cx, cl
mov word [edi], ax
sbb ebp, 4
mov ecx, dword [ebp]
mov edx, dword [esp + 4]
pop eax
mul eax
xor ecx, ebx
not ecx
and edx, dword [esp + eax - 0x52b6ee90]
sar edx, 0xf6
push eax
lea ecx, [ecx + edx*2 + 0x272ecb9a]
or eax, edx
adc edx, 0x3d17e000
jne 0x8b1c20
mov edx, 0x4daebaa9
imul edx, edx
movzx ax, byte [esi]
btc edx, edx
mov dl, byte [esi + 2]
adc esi, 1
mov ecx, 0xe332218b
sub ecx, ecx
or al, dl
lea edx, [ecx + ecx - 0x5e59434a]
call fcn.008388ce
Function at 0x99b976
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not dl
shl cl, 0xa3
sbb dl, 0x8d
or cl, cl
mov dword [esp + eax], 0xb58cab0c
xor bl, dl
lea edx, [esp + edx + 4]
shl byte [esp + eax*8 + 2], 0x87
sal cl, 0x81
movzx cx, byte [edx + eax*2]

Function at 0x99de74
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
bt ecx, ecx
call fcn.008a96d5
mov ebx, 0xc71f63a6
dec ecx
sub edx, 4
inc ecx
mov edx, dword [edx]
inc esp
movsx esi, bl
inc esp
movsx eax, bx
inc bp
btr eax, esi
inc ecx
xor edx, esp
inc ecx
mov ecx, 0x71334e80
dec edx
inc ecx
sal al, 0x23
bswap edx
xor edx, 0xa1bc0c93
inc edx
neg edx
xor edx, 0x40329221
inc esp
mov edi, ebx
neg edx
inc edx
lea edx, [edx + eax - 0x6385cbbb]
inc ecx
push esp
dec esi
lea ebp, [eax*8 - 0x596458f3]
inc edx
xor dword [esp + eax - 0x6330], edx
inc ecx
push esi
inc bp
xchg esi, ebp
dec esi
mov esp, dword [esp + eax*2 - 0xc658]
inc esi
mov dword [esp + eax - 0x632d], esi
dec eax
arpl dx, dx
inc edx
or dword [esp + eax*2 - 0xc65c], 0x9d8291a8
dec edx
mov dword [esp + eax - 0x6328], 0xd102a386
inc ecx
ror ch, 0x41
dec esp
adc ebx, edx
dec ecx
lea ecx, [ecx + 0x16b75c02]
inc edx
movsx ebp, byte [esp + eax*2 - 0xc65e]
dec edx
mov edi, dword [edi + eax*2 - 0xc660]
inc edx
dec dword [esp + eax - 0x632a]
mov edx, ebx
shr ebp, cl
inc ecx
pop edi
pop ebp
jne fcn.008c5046
push 0xd59da834
mov ecx, 0xce31a687
mov eax, dword [esi]
sal byte [esp], 0xc1
mov cl, byte [esi + 4]
push 0xa60f29bd
sal dword [esp + 3], 0x51
adc esi, 2
dec dword [esp + 4]
and word [esp + 6], 0x6333
pop edx
shr eax, cl
lea edx, [edx*8 - 0x61ce00fc]
xadd word [esp + 2], dx
movzx ecx, byte [esp]
mov dword [esi + ecx*4 - 0x3fc], eax
add dx, cx
lea ebp, [ebp + ecx*2 - 0x202]
mov eax, dword [ebp + ecx*8 - 0x7f8]
shl cl, 0x82
ror dword [esp + ecx*4 - 0x3f0], cl
adc edx, dword [esp + ecx*2 - 0x1f8]
xor eax, ebx
sub eax, 0xedbaa5b1
shl dl, 0x41
xor eax, 0xac0a9890
bswap eax
sub dword [esp + ecx*4 - 0x3f0], edx
lea eax, [eax + ecx*4 + 0x5ba4cc31]
bts ecx, edx
mov dword [esp + ecx - 0x400fc], edx
push edx
not eax
xchg dword [esp + ecx*2 - 0x801f6], ecx
and edx, edx
shr ecx, 0x88
bswap eax
lea eax, [eax + ecx*2 - 0x3195b77f]
ror ecx, cl
sar edx, 0xdd
or dword [esp + ecx - 0x849f4], 0xe51252a7
xor ebx, eax
ror dword [esp + ecx*8 - 0x424fbe], cl
sbb byte [esp + ecx - 0x849f5], 0xad
adc edi, eax
xor dword [esp + ecx*8 - 0x424fbe], ecx
adc word [esp + ecx - 0x849f7], cx
mov dword [esp + ecx*8 - 0x424fc0], edi
ret 4
Function at 0x9a0b50
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
dec ebp
lea edx, [edx + ebx*4 - 0xc0]
pop ebx
dec esp
lea esi, [eax*2 + 0x5ca6c6a8]
inc esi
mov eax, dword [ebp + edx]
inc ebp
xor eax, esp
dec dword [esp + ebp*2 + 3]
dec ebp
xor edi, esi
inc ebp
lea eax, [eax + ebp*4 - 0x22ccf95]
inc ecx
rol eax, 1
inc esp
mov ecx, eax
inc esp
add esi, dword [esp + ebp]
inc ecx
xor eax, 0x3f2ac60e
inc ecx
movzx ebx, dh
ror byte [esp + ebp + 1], 0xe4
pop ebx
inc ecx
rol eax, 1
inc ecx
push esp
or ax, 0x8793
inc ecx
movsx edx, di
inc esp
xor dword [esp + ebp], eax
dec eax
or eax, 0xb215d983
movzx esi, al
inc ecx
pop esp
movzx ecx, bl
inc cx
rol esi, 0xe9
bswap ebp
dec ebp
arpl ax, ax
dec eax
btr esi, eax
dec ebp
adc ebx, eax
inc esp
movsx eax, dx
inc ecx
idiv edi
jmp fcn.008c5046

Function at 0x9a3974
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov edx, 0x862bf1aa
mov dword [esp], edx
xor eax, ebx
neg dword [esp + 4]
ror dword [esp + 4], 0xc
sbb eax, 0x4d33b08c
shr byte [esp + 4], 0x27
movsx ecx, word [esp + 1]
neg eax
ror cx, 0x25
not eax
not dx
add edx, dword [esp + ecx - 0x895b]
sbb dword [esp + edx - 0x6bc53a52], edx
xor eax, 0x583684b6
xchg dword [esp + ecx - 0x895b], ecx
xor ebx, eax
sar edx, 0xe8
adc ebp, eax
rol dword [esp + edx - 0x6bc538], cl
mov esi, dword [edx + esi - 0x6bc53a]
pop eax
pop ecx
jb fcn.007194ad
inc ecx
mov edi, 0x6d0823ab
jmp 0x9b2c41

Function at 0x9a440d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not eax
inc esp
or ch, dl
sbb eax, 0xbc381a38
dec esi
lea ebp, [ebx + ecx*2 - 0x8f661fa]
xor eax, 0x1db49336
dec eax
mov dword [esp + esi - 0x8338], 0x2a33832f
inc sp
or dword [esp + esi - 0x8334], ebp
setge byte [esp + esi*2 - 0x1066b]
ror eax, 3
ror byte [esp + esi - 0x8332], 0xa5
inc esp
movzx eax, byte [esp + esi - 0x8338]
lea eax, [edx + eax - 0x520e5d0e]
dec ecx
adc ebp, 0x500e1fa3
inc ecx
rol eax, 2
dec edx
lea ecx, [ecx*2 + 0x631c0414]
neg eax
inc word [esp + esi - 0x8337]
dec esp
mov dword [esp + esi - 0x8338], esp
xor dword [esp + esi - 0x8338], eax
inc ecx
pop esp
dec eax
not edx
dec eax
arpl ax, ax
dec esp
add ebx, eax
mov ebp, 0x3ba39bb2
inc eax
sub dh, bl
dec esp
mov eax, edi
inc ecx
shr ch, 0xa4
inc sp
bt ebp, ebp
dec eax
lea edi, [edi + esi - 0x8304]
sar si, cl
inc esp
mov dword [esi + edi - 0xf830], eax
jp fcn.008c5046