joyce8/EMBER2024-capa huggingface dataset:
Function at 0x970748
Capabilities:
Manually build aes constants

Disassembly:
mov dword [esp], 0x249b5584
not edx
pop ecx
rol ecx, 0xdd
not eax
rol cx, 0x22
neg ecx
and edx, eax
imul ecx, ecx
btc cx, cx
mov dword [ebp + 4], edx
mov edx, dword [ebp + 4]
jb 0x9340bc
mov ecx, dword [ebp + 8]
mov eax, 0x6f1bcaa6
imul eax, eax
sbb eax, eax
xor edx, eax
and eax, 0xed9aef39
and al, 0x83
not ecx
and eax, 0xed32f38e
or edx, ecx
movsx ecx, al
inc eax
bswap eax
mov dword [eax + ebp - 0x1e312e5], edx
or ecx, dword [eax + ebp - 0x1e312e5]
movzx edx, al
not edx
mov edx, dword [ebp + eax*2 - 0x3c625ce]
xor al, ah
ror al, 0xe4
and ecx, edx
movzx edx, ax
dec eax
not ecx
or al, 0xd
mov dword [ebp + eax*2 - 0x3c625f2], ecx
lea eax, [eax - 0x356469dc]
jae 0x9fe2c4
xor edx, ebx
sal dword [esp + ecx - 0x420b], cl
inc edx
sar eax, cl
ror byte [esp + eax*2 - 0x65bd], 0xa3
not al
xor edx, 0xba325e3e
jmp 0x991aa7
inc ecx
dec edx
xadd dword [esp + eax*2 - 0x6436], ecx
sar dword [esp + eax - 0x3218], 0xfb
bt eax, eax
not edx
xor ebx, edx
sal byte [esp + eax - 0x3218], 0x86
pop eax
add edi, edx
mov edx, ecx
add byte [esp + ecx - 0x65e5ba71], ch
jnp 0x9ea44f
mov dx, word [ecx + ebp - 0x65e5ba74]
cbw
dec word [esp + ecx - 0x65e5ba73]
not cl
mov ax, word [ebp + ecx - 0x65e5ba81]
not dx
sbb ecx, 0xa5944d88
not ax
and dx, ax
and cl, byte [esp + 6]
pop eax
rol ax, 0x61
mov word [ebp + 6], dx
movzx edx, al
cmovg eax, dword [esp + edx - 0x1c]
lea ebp, [edx + ebp - 0x16]
and dword [esp + edx*4 - 0x70], ecx
lea eax, [edx + eax*8 - 0x25b86cb]
mov dword [esp + edx*8 - 0xe0], edi
ret
movsx ecx, ax
lea ebp, [edx + ebp - 0x12f3]
mov eax, dword [esi + edx - 0x12ff]
btr edx, edx
lea esi, [esi + edx - 0x12fb]
xor eax, ebx
and dl, 0x9d
seto cl
sbb edx, edx
dec eax
jmp 0xa60c24

Function at 0x97478a
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
lea esp, [esp + 0xc]
jne 0x9b320b
Function at 0x97b7f8
Capabilities:
Encode data using base64

Disassembly:
call fcn.00abf63c
test edx, esi
lea ebp, [ebp + ecx*2 - 0x5d7eb62c]
or cl, dl
lea edx, [eax*4 - 0x36f3f54b]
not edx
mov ecx, dword [ebp + ecx*2 - 0x5d7eb628]
xor ecx, ebx
push edx
xchg al, dl
ror ecx, 2
cdq
or al, byte [esp + edx + 2]
pop edx
lea ecx, [ecx + edx*4 - 0x4bc7cf45]
or dl, ah
bt eax, eax
bswap ecx
adc edx, edx
or dl, dh
xor ecx, 0x1d3d7b22
not ecx
lea edx, [eax + eax*8 + 0x551edcae]
xor ebx, ecx
shr edx, 0x6d
call fcn.00aa6066
sbb eax, 0x6f39f76c
retf
inc ebx
mov eax, dword [esi + edi*2 - 0x26]
inc ecx
shr bh, 0x45
dec ecx
ror edi, cl
inc ebx
mov dword [ecx + edi], eax
call fcn.00a5cba2
sub ebp, 1
movzx eax, byte [ebp]
mov ecx, 0x5ba3bdbe
xor al, bl
dec cx
ror ecx, cl
not al
lea edx, [ecx + ecx*4 + 0x461a7f88]
dec al
neg edx
jge 0x9f1f25
call fcn.009f58f0
inc esp
sub ebp, esi
dec eax
arpl bp, bp
sub cx, cx
inc ecx
shl esi, 0x1b
dec eax
adc edi, ebp
inc si
xor ebp, dword [esi + ecx - 0x7cbd3c3e]
dec esp
lea eax, [ecx + ecx*2 + 0x2ebf31b1]
cbw
inc eax
inc dh
inc ebx
add cl, byte [ecx + esi*2 + 2]
dec edi
lea esp, [ebx + eax*4 + 0x62ab81bb]
dec esi
lea ecx, [esi + ecx - 0x7cbd3c3d]
inc cx
sal ebp, cl
inc eax
shl dh, 0x41
inc ecx
mul bl
inc di
mov dword [ecx + esi*2], ebp
inc cx
sar esi, 0x8e
inc ecx
push edi
dec eax
mov dword [esp + esi - 0x7cbd3c7e], edi
ret
pop ebx
jmp 0xab9498
ror al, 1
not al
bt ecx, edx
and dx, cx
jbe 0xb7ce1a
xor bl, al
dec edx
dec ecx
shl ecx, 0x65
add eax, esp
neg dl
sub cx, cx
lea ecx, [edx + ecx*4 + 0x1d18370f]
movzx dx, byte [eax + ecx*2 - 0x28b7fe5c]
lea esi, [esi + ecx*2 - 0x28b7fe5e]
btc ecx, ecx
bswap ecx
mov word [esi + ecx*2 - 0x5d7eb628], dx
mov edx, ecx
movsx eax, cl
jb 0x940212
and dword [edx - 0x41f02e75], 0xa0820fc1
loop 0x9f1f65
dec dword [0x85ff62c2]
or eax, 0x85ff62c2
jns 0x9f1f1f
scasb al, byte es:[edi]
and dl, byte [ebp + esi*4 + 0x79]
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
adc al, 0x28
sar dword [ecx - 0x5a], 1
scasb al, byte es:[edi]
jb 0x9f1fb0
mov eax, dword [0x18aea679]
je 0x9f1f6f
mov bh, 4
imul esi, dword [esi + 0x2b3dedbf], 0xfffffff8
cwde
or ebx, dword [ebp + 0x1b]
or al, 0x92
inc ebp
pop esp
enter 0xffffffffffffff4c, 0x27
xchg esp, eax
sar byte [edi + 0x38], 1
aaa
sahf
ret
outsd dx, dword [esi]
cmp al, 0x2e
cmp byte [0xb006065c], al
arpl word [ebp - 0x50488003], di
nop
push ebx
pop esi
je 0x9f1f65
cmpsb byte [esi], byte es:[edi]
jmp 0x9f1fe1
aad 0x6a
lahf
jmp 0x45503422
xor ecx, 0xfe1a069f
bts ax, 0x38
bswap ecx
inc ecx
shl edx, 0x52
lea eax, [edx + eax + 0x3de30]
xor ebx, ecx
or eax, 0x1704cdb5
cwde
adc edi, ecx
btr edx, eax
ror dx, 0x28
xor dx, word [edx + esi]
mov ax, word [esi + 2]
mov ecx, 0x931c0c92
xor cx, cx
imul ecx, ecx
add cl, byte [ecx + esi + 4]
add esi, 4
jmp 0x93d200
jmp 0x987ba8
imul dx, ax
xor ecx, ebx
sal dx, 0x8b
bt eax, 0x9c
inc ecx
shr al, 0x67
imul dx, dx
rol ecx, 1
sub ecx, 0xd2b42cbe
idiv ax
jmp 0xa554d7
Function at 0x98b36a
Capabilities:
Encode data using base64

Disassembly:
xchg dl, cl
sar dword [esp + ecx - 0x68e623f9], 0x13
neg ax
or dx, cx
rol ecx, 0x33
rol ax, 1
imul dx, word [esp + ecx - 0x2003472a]
sal dword [esp + edx - 0x3604363c], 0xf7
mov dword [esp + edx - 0x36043644], 0x18188030
xor bx, ax
call fcn.00b838f9

Function at 0x991ada
Capabilities:
Manually build aes constants

Disassembly:
lea ebp, [ebp + ecx - 0x6403be1f]
push ecx
bts cx, 0xad
ror ecx, 0xc
mov ecx, dword [ebp]
xor ecx, ebx
not dword [esp]
shr byte [esp + 2], 0xa5
push 0xc62e8606
inc ecx
sar byte [esp], 0xc7
call fcn.00a1d104
dec ebp
lea ebp, [eax + eax*4 + 0x42118a5]
inc ecx
ror esp, 2
inc ecx
not esp
push ebx
inc eax
sub dh, 0x20
dec esp
add eax, esi
inc esi
xor dword [esp + esi - 0x5e2d], esp
mov ecx, 0xf83ff531
pop ebx
dec ebp
arpl sp, sp
inc sp
imul ebp, eax
jno 0x98a888
inc eax
imul dh
dec ecx
add edi, esp
inc cx
sub eax, 0x8d4b651e
xchg esp, eax
out dx, al
sbb dword [edi], edi
xor esi, dword [0xb841e7ff]
push es
inc byte [eax]
push es
dec edi
lea edx, [eax + edx - 0x600fe0a]
dec edx
lea esi, [eax*2 - 0x1b6c77fd]
dec ebx
lea ecx, [eax + eax*8 + 0x100c15ae]
inc ebx
mov ebp, dword [eax + edx - 0x600fe06]
xor ebp, ebx
inc esp
mov ebx, esi
inc ecx
sal ebx, 0xc9
not ebp
dec esp
lea ebp, [ecx*4 + 0x3ae5628]
dec ebp
inc ecx
movsx edx, ch
xor ebp, 0x8b3919b2
rol ebp, 1
inc ebp
mov esp, ebx
dec eax
inc edx
inc sp
and ebp, esi
inc edx
lea ebp, [ebp + eax + 0x6a20e6a1]
dec esp
lea edi, [edx*8 - 0x495b4350]
ror ebp, 1
movsx eax, cl
push ebx
call fcn.009badd7
dec esi
lea eax, [edi*8 + 0x73294ab4]
movzx esi, bp
inc ecx
neg dh
inc ecx
sub dh, 0x3b
inc ecx
not dh
inc ecx
inc dh
dec ecx
inc eax
inc ebp
sub bh, ah
mov ecx, esi
inc ecx
neg dh
inc cx
inc ecx
xor bl, dh
movsx eax, cl
not esi
dec ebp
lea ecx, [ecx + ebp*4 - 0x36000002]
inc cx
or esi, esp
dec eax
sub eax, 0x31158889
inc ecx
add ebp, ebx
inc di
mov dword [ecx - 0x254], esi
dec edi
lea edx, [edx - 0x258]
inc esp
and bl, cl
inc ebx
mov ecx, dword [edx - 0x254]
inc ecx
seta bh
inc ecx
sar al, 0x63
xor ecx, ebx
xor ecx, 0xb7af0ca0
inc ecx
shl bl, 0x61
inc ecx
lea ecx, [esp + ecx + 0x2d123401]
xor ecx, 0x6804bd8d
inc esp
add bh, al
inc ax
dec eax
neg eax
inc edx
lea ecx, [ecx + 0x1a0168f0]
inc esp
mov esi, eax
bswap ecx
inc esp
or al, ch
xor ecx, 0x4021e687
push edx
inc edx
mul byte [esp - 0x124]
dec edx
mov dword [esp - 0x12a], ebx
inc edx
xor dword [esp - 0x95], ecx
call fcn.00976042
mov eax, dword [ebp]
lea esp, [esp + 4]
call eax
mov esi, 0x6b9976ba
movsx edx, si
mov ebp, dword [ebp + edx*2 - 0xed78]
btr dx, dx
mov dword [ebp + edx - 0x72ba], eax
sub si, dx
mov ecx, edx
xadd esi, ecx
mov esi, ebp
not cx
movzx ebp, cx
pop ebx
pop edi
jne 0xa73034
not ecx
mov ecx, dword [esi]
add esi, 4
movzx eax, dx
cwd
or eax, eax
xor ecx, ebx
xor ecx, 0x83129026
xchg dx, ax
call fcn.00a24336
jmp 0x9fd7f9
jmp 0xb77ae4
movsx eax, dx
shr ebp, cl
pop ebp
btr eax, eax
setb dl
mov dword [ebp - 4], eax
call fcn.00a002c1
mov ecx, 0x6403be1b
jmp 0x963425

Function at 0x995664
Capabilities:
Encode data using base64

Disassembly:
rol edx, 0x2c
lea ebp, [ebp + edx - 0x54d7002]
xadd cx, dx
pop eax
pop eax
pop edx
ja fcn.00989a2c
Function at 0x99a5a0
Capabilities:
Encode data using base64

Disassembly:
sar ecx, 0x13
ja 0xa1288d
mov eax, dword [esi + ecx*4]
sar ecx, 0x8c
mov edx, dword [esi + ecx*2 + 4]
setp cl
lea ecx, [ecx + ecx*4 - 0x187d11f4]
adc ecx, ecx
mov cl, byte [esi + 8]
adc esi, 5
mov dword [esp], 0xc28d6d97
jmp 0xab564d
shld eax, edx, cl
call fcn.009c2f6a
dec esp
jb 0xab56b2
push ss
ror dword [ebx], 1
mov dl, 0xc3
jp fcn.00ab56cf
dec edi
jne 0xab568d
aam 0x45
ror byte [ebp + 0x3c934d04], 4
xchg ebp, eax

Function at 0x99a939
Capabilities:
Encode data using base64

Disassembly:
sub ebp, 4
mov eax, dword [ebp]
call fcn.009fb27b
sbb ebp, 5
xor eax, ebx
mov ecx, edx
pop ecx
or dx, dx
rol eax, 1
neg eax
lea ecx, [edx*4 - 0x6e5e1be2]
sub edx, edx
xor eax, 0x6bd912e
lea edx, [ecx + ecx*4 - 0x16f89a62]
shl dx, 5
or ecx, 0x82f699
lea eax, [eax + edx*2 - 0x4fb75250]
and cx, 0xb81b
sar cx, 0xc8
xor ebx, eax
add edi, eax
inc edx
jns 0xa972bb
or edx, edx
mov al, byte [esi + edx - 0x6f75c681]
not dl
jp 0xea7f2d
bt dx, cx
movzx cx, byte [edx + esi - 0x6f75c683]
jae 0xa224f7
mov eax, 0xe51e13b7
sub ebp, 4
cwde
mov edx, dword [ebp + eax*8 - 0x9db8]
movzx ecx, ax
xor edx, ebx
bt eax, ecx
bt cx, ax
neg ax
lea edx, [eax + edx - 0x7f06af72]
neg ecx
neg eax
lea eax, [ecx + ecx*4 + 0x6c80d7a2]
ror edx, 3
neg edx
bts ax, ax
cwde
not eax
lea edx, [edx + eax - 0x50a5a20]
ror ecx, 0x8c
xor eax, eax
and ecx, 0x3b058c32
xor ebx, edx
xadd cl, ch
shl cx, 0xca
btr cx, 0xa6
adc edi, edx
push ecx
mov dword [esp + eax*8], ecx
lea edx, [ecx + ecx*8 + 0x5b06aa17]
mov esi, dword [esi + eax]
not cl
sar ax, 4
pop ecx
jae fcn.00a106d2

Function at 0x9a18ec
Capabilities:
Encode data using base64

Disassembly:
inc ecx
mov ebp, 0x7eb34536
inc ecx
movsx eax, bp
dec ecx
mov edx, dword [ecx + eax - 0x4536]
call fcn.00988d6c
dec esi
dec eax
mov dword [esp], 0x34a90b3e
cbw
dec eax
shr dword [esp], 0xcf
ror esi, 3
and byte [esp + 2], 0x88
inc esp
movsx esi, word [esp + 3]
dec eax
cwde
bswap esi
dec esi
lea ebx, [edi*8 + 0x6c89048a]
ror esi, 3
inc ecx
push edi
neg esi
rol esi, 1
inc ecx
push esi
dec eax
cwde
dec esi
inc ecx
pop edi
inc dx
shl dword [esp + edi + 4], 0x4e
ja 0x977e7a
bswap esi
dec edx
mov dword [esp + edi + 8], ebx
inc ecx
movzx ebp, bl
inc sp
xadd ebp, edi
dec ecx
rol ebx, 0x17
inc edx
xor dword [esp + edi*4 - 0x300], esi
inc dx
or dword [esp + edi*2 - 0x181], eax
inc cx
sal edi, 0xcc
dec edx
mov ebx, dword [esp + edi - 0x1ff8]
inc ecx
pop ebp
dec eax
arpl si, si
inc ebp
xchg edi, ebx
dec ecx
not ebp
dec eax
adc edi, esi
dec eax
shr ebp, 0x33
je 0xa2e56d
dec eax
dec ebx
cmp al, al
add byte [ebp + 0x7e467c62], dl
sbb eax, 0x4843efa1
Function at 0x9ab0dc
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x95b87ab7
not ecx
bswap edx
mov dword [esp + edx*8 - 0x2031880], edx
sub al, 2
xor ecx, 0xd51d0f9c
mul word [esp + edx*2 - 0x80c620]
bt ax, 0x9d
pop eax
xor ebx, ecx
or al, ah
add al, dh
mul edx
add edi, ecx
mov eax, dword [edx + ebp - 0x1028]
sal edx, 0x4b
push edx
lea ebp, [edx + ebp - 0x813ffc]
xor edx, 0xe1aafaa7
jno 0xea8df7
call fcn.009e11aa
dec esp
jb 0x9ab18d
push ss
rcl dword [esi]
mov ah, 0xeb
invalid
jo 0x9ab19e
invalid
Function at 0x9b96ba
Capabilities:
Execute syscall

Disassembly:
call fcn.00a84279
mov ebp, 0xad1b6393
dec ecx
sub edx, 4
inc ebp
mov ebx, dword [edx]
inc esp
movzx eax, bp
mov esi, ebp
inc esp
movzx ebp, dh
inc esp
xor ebx, ebx
call fcn.009eb554
sal eax, 0xfb
inc edx
neg ecx
mov dword [esp + eax - 0x47fffffc], edx
cdq
inc ecx
imul dx, ax
rol ecx, 3
mov dword [esp + edx], eax
cwde
sal ax, 0xa
not ecx
pop eax
not word [esp + eax - 0x48000000]
add dword [esp + edx*2], 0xc50a330a
xor ebx, ecx
add edi, ecx
xor byte [esp + eax - 0x47fffffe], dh
jl 0x9aad95
mov ecx, 0xed3546a5
movzx edx, cx
mov ecx, dword [ebp + edx*2 - 0x8d4a]
shr edx, 0x44
imul edx, edx
mov edx, dword [ebp + edx*2 - 0x26f7c4]
mov eax, 0x3f8d7090
ror eax, 0xab
adc ecx, edx
mov dword [ebp + eax*2 - 0x240fe358], ecx
mov ecx, dword [esi + eax - 0x1207f1ae]
lea esi, [esi + eax - 0x1207f1aa]
not ax
xor ecx, ebx
rol ecx, 1
dec ecx
lea edx, [eax + eax*4 - 0x326fcef3]
not ecx
bswap edx
btc ax, dx
xor ecx, 0xdd11d828
not edx
xor ebx, ecx
mul al
neg eax
add edi, ecx
mov ecx, 0xe2adb4ab
mul al
sal al, 0xa6
mov edx, dword [edx + ebp - 0x5d874cd4]
mov eax, dword [ebp + 8]
sub cx, cx
call fcn.009b8c3f
sub ebp, 4
mov eax, 0x40911b8d
mov edx, dword [ebp + eax - 0x40911b8d]
xor edx, ebx
lea ecx, [eax*8 + 0x6508a888]
ror edx, 1
btc eax, 0xad
btc eax, ecx
dec edx
and eax, 0x12ae6f8e
or al, ah
bswap edx
not edx
xadd cl, ah
shl cx, 0x8e
xor ebx, edx
xchg cx, ax
add edi, edx
rol ecx, 0xd2
movzx ax, byte [esi + eax - 0x80c000]
lea edx, [ecx*4 + 0x5a1e5a24]
imul ecx, ecx
sal dx, 0xca
or dl, byte [esi + edx - 0x6513fffe]
rol cx, 0x45
adc ecx, 0xcb011f0b
lea esi, [esi + ecx - 0x57d8152d]
or cx, 0x6495
je 0xa9816d
add cl, cl
or al, dl
bswap ecx
movsx edx, cx
shr dx, 0x85
not al
adc cx, dx
mov word [esi + ecx - 0x7e75df1a], ax
jmp edi
jmp edi

Function at 0x9b9d01
Capabilities:
Encode data using base64

Disassembly:
inc eax
xor bl, ch
dec eax
xchg ecx, eax
dec eax
sar eax, 0x93
pop eax
dec eax
lea ebp, [esp + ebp + 0x20]
dec esp
mov dword [ebp + ecx*2 - 2], ebp
inc dword [esp + ecx + 0x17]
push ecx
dec edx
mov ebp, dword [ecx + ecx + 7]
inc sp
btr ecx, ebx
dec ecx
inc eax
inc ebp
mov bl, byte [edx + ecx*2 - 8]
setl cl
inc esp
xor bl, bl
dec eax
sal ecx, 0xb8
dec esi
dec eax
mov dword [esp + ecx*8 + 8], 0x93313eba
inc ebp
sbb bl, al
dec edx
lea eax, [edi*8 + 0xbb8338d]
inc ecx
xor bl, 0xac
inc ecx
rol bl, 1
cwd
call int.00a91d89

Function at 0x9ba766
Capabilities:
Encode data using base64

Disassembly:
inc ebx
mov cl, byte [ecx - 0xd82]
dec edi
lea ecx, [ecx - 0x3614]
inc esi
sub byte [esp - 0x1b09], ch
dec ebx
lea eax, [ebp + 0xa203918]
add edi, ecx
dec byte [esp + eax - 0x18ffa]
imul word [esp + eax*2 - 0x31ff8]
push edx
mov edx, dword [esi + eax*2 - 0x20000]
add ax, word [edx + eax*2 - 0x20000]
call fcn.00967c2b
inc bp
mov edi, dword [ecx]
inc ecx
mov esp, 0x6c31c5b7
dec ebx
lea ecx, [esp - 0x19740efb]
dec esi
lea ebp, [0x620b96aa]
inc bx
mov esi, dword [ecx - 0x6c31c5b5]
push ecx
inc ecx
sar esp, cl
ja 0x9ab171
mov edx, 0xbb92ec14
dec ecx
sub edx, 4
inc ecx
mov edi, 0xe4b63f33
jmp 0xa2c459
Function at 0x9badd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
pop edi
movzx ebx, cx
inc edx
xor dword [esp + eax*2 - 0xc01fc0c], ebp
dec eax
cwde
dec eax
cwde
pop ebx
inc esp
movzx esi, dl
dec eax
arpl bp, bp
inc cx
ror esi, cl
inc ecx
not ebx
inc ecx
mov edi, 0xe78e109b
dec eax
add edi, ebp
dec ebx
mov ebp, dword [ecx + eax - 0x600fe06]
inc bp
and esp, esp
inc ebx
mov dl, byte [ecx + eax*2 - 0xc01fc04]
jp 0xa556db
push ebp
or bp, 0xba1e
neg bp
mov ebp, esp
stc
clc
push ecx
test esp, edi
push esi
stc
cmc
xor esi, esi
stc
cmp dword [ebp + 0xc], esi
jmp 0xa25a30
jbe 0x9b3094
push ebx
rcr bh, cl
sbb bx, bx
mov ebx, 0xa08c5abd
lea ebx, [ecx + eax]
adc ax, ax
test ah, 2
push edi
dec ecx
inc esp
dec edi
lea ecx, [ecx + eax*8 - 0x3007f026]
inc edx
mov byte [ebp + eax*8 - 0x3007f030], dl
jmp edi

Function at 0x9bb3fa
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
inc ecx
sal dword [esp + 0xb], 0xab
xor eax, 0xfd0f9f24
mov dword [esp], 0x3f3bff9a
ror byte [esp + 0xc], 3
dec edx
jmp 0x9b70c7
sal dword [esp + 0x10], 0x1a
ja 0x961592
dec ebp
mov esp, dword [ecx]
inc ecx
mov esi, 0xf4a3140b
inc ecx
rol esi, 0x19
inc edi
mov esi, dword [esi - 0x17e94628]
inc ecx
mov ebp, 0x6c089004
inc ecx
movzx ecx, ch
jae 0xa67bd7
mov cx, word [edx + ecx - 0x4d044d04]
rol byte [esp + eax*2 - 0x7a], 0x66
movsx edx, al
mov word [ebp + edx*4 - 0xf6], cx
cwde
sal dx, 0xc5
mov cx, word [ebp + eax*4 - 0xf6]
rol dword [esp + eax*2 - 0x7a], 0x6a
rol eax, 4
mov ax, word [ebp + eax - 0x3d0]
adc cx, ax
bt edx, 0x9a
sub dword [esp + edx*4 - 0x1e80], edx
mov word [ebp + edx*8 - 0x3d00], cx
sar byte [esp + edx - 0x79f], 6
mov edx, dword [esi + edx*4 - 0x1e7f]
add byte [esp + 3], 0x98
xor edx, ebx
shr dword [esp], 4
pop eax
lea ecx, [eax + eax*4 + 0x4abe9701]
ror edx, 3
dec ecx
not cx
xor edx, 0x698f3707
bts eax, ecx
neg al
lea eax, [eax*4 - 0x2c5aa160]
dec edx
ror edx, 1
inc edx
or eax, ecx
setne cl
btr ax, cx
xor edx, 0xd11c6b2a
jmp 0x995a91
dec esp
adc ecx, ecx
inc ebp
mov dword [ecx + ecx*8 - 0x20], esi
call fcn.009c8d83
Function at 0x9bb88f
Capabilities:
Encode data using base64

Disassembly:
xor ax, 0x67be
inc edx
xor ebx, edx
and ecx, 0xf1b85099
shl eax, 0x94
add edi, edx
not eax
mov dx, word [esi + eax - 0x1d9fffff]
inc cx
mov ax, word [esi + eax*2 - 0x3b3ffffc]
call fcn.00990a43
shl edx, 0xc8
adc edi, eax
movsx eax, dx
mov dword [esp + ecx*4 - 0x210], edi
ret 8
xor edx, 0xfe1a069f
rol eax, 0x8e
xchg ecx, eax
bswap edx
add al, ah
jle 0x9628e0
mov eax, dword [edx + ebp - 0x32274860]
sbb ecx, 0x61372034
xor dx, cx
sar cl, 0xa7
xor eax, ebx
lea eax, [edx + eax - 0x18eec179]
rol dl, 1
ror eax, 2
bts edx, edx
call fcn.00a67da7
mov ecx, 0x6aacf15
lea ebp, [ecx + ebp - 0x6aacf19]
mov ecx, dword [ebp + ecx*4 - 0x1aab3c54]
jmp 0xa81a2e
mov eax, 0x8cb6cc90
xor ecx, ebx
lea ecx, [eax + ecx - 0x1a1eca8f]
movsx edx, al
cdq
or dl, 0xc
ror ecx, 1
and eax, edx
rol eax, 0x9d
push eax
xor ecx, edx
sar dword [esp + eax*4 - 0x465b6648], 0x51
sbb ecx, edx
xor ebx, ecx
sub edx, eax
sar eax, 0x82
and al, 0x39
adc edi, ecx
lea ecx, [edx + edx*2 - 0x6278d7e5]
mov dword [esp + eax*2 - 0x8cb6c40], eax
lea ebp, [ebp + eax - 0x465b621]
inc dl
jp 0x98fae3
movzx ecx, byte [ebp + eax*2 - 0x8cb6c40]
cbw
rol eax, 0x2a
jb 0xb684cb
mov edx, 0x4718b71a
and cx, cx
mov edx, dword [ebp + ecx - 0x45a8f99f]
movsx eax, cx
inc eax
xor edx, ebx
or cl, cl
inc edx
push ecx
ror cl, 0xc2
rol edx, 1
ror ax, 0x85
and byte [esp + ecx - 0x45a8f9e4], cl
dec cl
sbb edx, 0xd2b42cbe
rol ecx, 0x2f
pop ecx
jae 0x9b8684
dec edi
lea edx, [edx + ebp*2 - 0x405]
inc esp
xor ah, bl
inc esi
xadd byte [esp + ebp - 0x1fa], ch
inc cx
rol esi, 0x4a
dec edx
not dword [esp + ebp - 0x2d9]
inc ecx
neg ah
cdq
neg ax
add si, 0x69a0
inc esp
xor ah, dl
xor si, 0x86b4
inc ecx
ror ah, 1
dec edx
rol dword [esp + ebp - 0x2d9], 0x6e
inc ecx
adc ah, 0xb7
imul al
inc ecx
xor bl, ah
inc edx
shr byte [esp + ebp - 0x2d9], 0x61
dec esp
lea edi, [eax + eax*2 + 0x56a61b3f]
dec esi
lea esp, [esp + 8]
not dx
inc edi
mov eax, dword [esp + ebp - 0x2d9]
inc edx
shl dword [esp + ebp - 0x2d9], 0x1c
push esi
inc esp
movsx esp, cl
inc edi
mov dword [ecx + ebp*4 - 0xb70], eax
dec eax
mul ebp
dec edi
lea ecx, [ecx + ebp*4 - 0xb70]
inc ebp
movsx ebx, ch
inc dx
neg dword [esp + ebp - 0x2d8]
inc ecx
pop eax
inc ecx
pop esi
jb fcn.00987526
xor cl, bl
call fcn.00a949e0
dec ecx
mov esi, dword [ecx]
inc ecx
mov edi, 0x9036cd30
Function at 0x9bcb59
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + esi - 0x646baea0]
not ecx
inc ecx
neg ecx
dec ebp
xor ebp, esp
dec eax
cdq
dec eax
mov dword [esp + edx], 0x85155811
bswap ecx
dec eax
mov dword [esp + esi - 0x6b17da44], ebx
call fcn.00982112
mov edx, 0xe3010a25
movzx ecx, dx
rol ecx, cl
mov ecx, dword [ecx + esi - 0x144a0]
dec dx
adc esi, 4
xor ecx, ebx
neg ecx
lea eax, [edx + edx - 0x4c7f8be1]
xchg dx, ax
bswap edx
inc ecx
neg ecx
add dx, ax
jno 0xa112d6
enter 0x6616, 0xffffffffffffffff
inc eax
lodsd eax, dword [esi]
mov byte [0x1c04f5ae], al
lodsd eax, dword [esi]
mov byte [0x4c05cfae], al
lodsd eax, dword [esi]
mov byte [0x7001edae], al
mov ebp, 0x789ad444
loopne 0x9bcc29
leave
mov al, byte [0x77cae26d]
inc eax
invalid
xor byte [eax - 0x6912d728], dh
in eax, dx
xchg esi, eax
xor byte [edx - 0x6912a76a], ch
xor byte [eax - 0x6927bc7e], ch
invalid
loopne 0x9bcc04
stosb byte es:[edi], al
mov byte [0xe90c70ae], al
mov bl, 0xbb
pushal
out 0x96, al
adc edx, ebp
push cs
cwde
cwde
jl 0x9bcc00
cld
sbb ebp, dword [esi + 0x5a]
ljmp 0x2bb5
ror ecx, 2
push eax
lea ecx, [ecx + edx*2 - 0x2b7f0076]
inc dl
bswap ecx
shr eax, 0xef
not ecx
and dx, ax
neg ecx
sub byte [esp + edx - 0x6787ffff], 8
not eax
dec ecx
ror edx, 0x98
cdq
xor eax, eax
neg ecx
cwde
not dx
lea ecx, [ecx + eax - 0x4486ea9e]
and word [esp + eax*8 + 2], ax
xor ebx, ecx
add edi, ecx
cwde
mov ecx, dword [ebp + eax*4]
xadd dword [esp + eax], edx
rol dl, 0xc1
not dl
add al, byte [ecx + edx*4 - 0xadc]
movzx ecx, word [esp + edx*2 - 0x56e]
add dword [esp + edx - 0x2b7], ecx
lea ebp, [ebp + edx*4 - 0xada]
add ecx, edx
jp 0xb6b83a
mov edx, 0x3328c1a1
ror edx, 0xd3
add edx, edx
movzx cx, byte [ebp + edx*2 - 0x60d09994]
mov dl, byte [ebp + edx - 0x30684cc8]
adc ebp, 2
and cl, dl
mov eax, 0x2436500a
not cl
inc al
mov word [ebp + eax*2 - 0x486ca016], cx
bt eax, 1
cwde
cwde
mov eax, dword [esi + eax*2 - 0xa016]
call fcn.009bbfeb
lea ebp, [eax + ebp - 8]
lea eax, [edx*8 + 0x2e852887]
xor cx, bx
neg edx
idiv al
lea edx, [edx + eax*4 + 0x261d3e3a]
add cx, 0xb199
ror cx, 1
cwd
add eax, edx
xor cx, 0x922
dec edx
sub cx, 0x410c
xor bx, cx
lea eax, [edx + edx*4 - 0x2d665a70]
bswap eax
idiv dx
mov word [esi + 2], cx
jmp 0xa4d9fc
sub esi, 0xfffffffe
jmp edi
shr dword [esp + ecx*8 - 0x26d8], 0x39
mov word [ebp + edx*2 - 0x56e], ax
mov dword [esp + edx*8 - 0x15b8], edi
ret
Function at 0x9be4db
Capabilities:
Manually build aes constants

Disassembly:
mov dword [esp + edx - 0x4b061e08], 0xf63dca14
xor cl, bl
inc dword [esp + edx - 0x4b061e08]
or dx, 0x488d
sal word [esp + edx - 0x4b065e8d], 0xc3
xor cl, 0x13
push edx
rol word [esp + edx - 0x4b065e8c], 0x81
adc cl, 0x9d
sal dx, 0x44
add word [esp + edx - 0x4b06e8cf], dx
not cl
jbe 0xa864d2
adc dl, byte [esp + edx - 0x4b06e8cc]
sets byte [esp + edx - 0x4b06e874]
ror cl, 1
dec byte [esp + edx - 0x4b06e874]
neg word [esp + edx - 0x4b06e878]
xor bl, cl
lea ecx, [esp + ecx + 8]
call fcn.009f2881
mov edx, dword [esi]
mov eax, 0x20801018
bt eax, 0x8e
lea esi, [esi + eax - 0x20801014]
xor edx, ebx
ror edx, 3
btc eax, 0x9c
call fcn.009485eb
bswap edx
not edx
xchg ecx, eax
xor ebx, edx
btr ecx, 0x95
shr eax, cl
sal cx, 0x8f
add edi, edx
ror ecx, 0xc8
jmp edi
bt edx, edx
bswap edx
add dl, dh
lea esi, [esi + edx - 0x5335fffe]
add dx, dx
call fcn.0095f4ca

Function at 0x9c1768
Capabilities:
Encode data using base64

Disassembly:
dec dl
bswap eax
rol ecx, 1
shr dx, 0xc3
xor ebx, ecx
ror edx, 0x4e
mov dword [esp + edx - 0x5adc2aa0], eax
sbb dx, ax
add edi, ecx
rdtsc
mov ecx, dword [esp]
jmp 0xa8115c
dec dword [esp]
sub ebp, 8
bts ecx, 0xba
mov dword [ebp + 4], eax
sar dword [esp], cl
mov dword [ebp], edx
pop ecx
jne fcn.00989a2c

Function at 0x9c178e
Capabilities:
Encode data using xor

Disassembly:
inc esp
or ah, byte [esp + eax - 0x50c8]
call fcn.00ac062d

Function at 0x9c3cad
Capabilities:
Check http status code
Encode data using base64

Disassembly:
inc ecx
dec eax
inc ebp
movzx edi, ch
inc ecx
rol eax, 1
inc cx
bt ebp, 0xbc
mov edx, esi
inc ecx
inc eax
dec eax
shr ecx, cl
inc cx
and edi, 0x8b441f81
test byte [ecx + 0xf], 0xc8
push eax
inc ecx
rol eax, 3
inc esp
xchg esi, ebx
inc ecx
inc eax
dec edx
mov dword [esp + ebp*2 - 8], ebx
xor cx, ax
adc cl, 0x2d
inc esi
xor dword [esp + ebx - 0x464d108a], eax
pop ebx
dec ebp
arpl ax, ax
dec eax
imul eax
dec eax
and esi, edx
inc eax
inc dh
dec ecx
adc edi, eax
cwd
rol cl, 0x42
jae fcn.00987526
inc ebp
btc ebx, esi
dec ebx
mov eax, dword [ebx + ecx - 0x5787]
inc ecx
mov edi, 0x678b84a5
add dl, byte ss:[eax + esi - 0x78961133]
dec esp
mov dword [esp + esi - 0x78961133], ebp
mov cx, dx
movzx cx, cl
inc byte [esp + esi - 0x7896112c]
inc esi
add byte [esp + ebx*4 - 0x15e18], al
inc edx
inc dword [esp + ebx - 0x5785]
inc edi
mov dh, byte [ecx + ebx*8 - 0x2bc30]
not cl
inc ecx
not dh
inc ecx
or cl, dh
inc cx
mov dword [ecx + esi - 0x7896112b], ecx
dec edi
lea ecx, [ebp + ecx - 0x577e]
neg dword [esp + esi - 0x7896112f]
jo 0x9805b8
dec ecx
dec esp
dec eax
mov dword [esp + esi - 0x78961133], edi
ret