joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008d10
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140008d58
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
lea r8d, [r9 + 4]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov r12d, eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140008d9b
xor eax, eax
jmp 0x140008e6e
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 2]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x140008e67
lea r8d, [r12 + 1]
mov r9, rax
mov edx, ebx
shr r8d, 1
je 0x140008dfa
nop word [rax + rax]
movzx eax, word [r9]
add r9, 2
add edx, eax
mov ecx, edx
movzx edx, dx
shr ecx, 0x10
add edx, ecx
add r8d, 0xffffffff
jne 0x140008de0
mov ecx, edx
mov eax, 0x20b
shr ecx, 0x10
add cx, dx
movsxd rdx, dword [rdi + 0x3c]
add rdx, rdi
cmp word [rdx + 0x18], ax
jne 0x140008e67
movzx eax, word [rdx + 0x58]
cmp cx, ax
adc ax, bx
sub cx, ax
movzx eax, word [rdx + 0x5a]
cmp cx, ax
setb bl
sub cx, bx
sub cx, ax
movzx eax, cx
mov rcx, rdi
add eax, r12d
mov dword [rdx + 0x58], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140008e69
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x140008e90
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x30
lea rdx, [0x14001be40]
xor r15d, r15d
call fcn.14000ad24
mov rbx, rax
test rax, rax
je 0x14000910e
lea r8d, [r15 + 2]
xor edx, edx
mov rcx, rax
call fcn.14000ba78
mov rcx, rbx
call fcn.14000b95c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000910e
mov rcx, rbx
call fcn.14000b38c
lea r11d, [rdi + 1]
movsxd rsi, r11d
mov rcx, rsi
call fcn.140009e50
mov rbp, rax
test rax, rax
je 0x14000910e
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14000fcd0
lea r8d, [r15 + 1]
mov r9, rbx
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x78], rdi
call fcn.14000b778
test eax, eax
jle 0x140009106
mov rcx, rbx
mov qword [rsp + 0x60], r12
call fcn.14000b040
movsxd rax, dword [rbp + 0x3c]
lea r12, [rax + rbp + 0x108]
mov eax, 0x5a4d
mov qword [rsp + 0x70], r12
cmp word [rbp], ax
je 0x140008f66
xor eax, eax
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x20], r14
mov r14d, dword [rbp + 0x3c]
add r14, rbp
cmp dword [r14], 0x4550
jne 0x140009044
mov eax, pe_nt_image_headers64
cmp ax, word [r14 + 0x14]
jne 0x140009044
mov qword [rsp + 0x28], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14000ad30
call fcn.14000ad48
mov r13d, r15d
mov dword [r14 + 8], eax
movzx eax, word [r14 + 6]
dec eax
test eax, eax
jle 0x140009009
add r12, 8
nop dword [rax]
mov ecx, dword [r12]
mov edi, dword [r12 + 0xc]
mov eax, dword [r12 + 8]
add rdi, rbp
sub eax, ecx
mov rbx, r15
add rdi, rcx
movsxd rsi, eax
test eax, eax
jle 0x140008ff1
call fcn.14000ad48
inc rbx
cmp rbx, rsi
mov byte [rbx + rdi - 1], al
jl 0x140008fe0
movzx eax, word [r14 + 6]
inc r13d
add r12, 0x28
dec eax
cmp r13d, eax
jl 0x140008fc0
mov r12, qword [rsp + 0x70]
call fcn.14000ad48
mov edi, eax
mov eax, 0x51eb851f
mul edi
shr edx, 5
imul edx, edx, 0x64
sub edi, edx
imul edi, dword [r14 + 0x38]
movsxd rsi, edi
mov rcx, rsi
call fcn.140009e50
mov r13, qword [rsp + 0x28]
mov rbx, rax
test rax, rax
jne 0x14000905b
mov rcx, rbp
call fcn.14000a9ac
xor eax, eax
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14000fcd0
movzx eax, word [r14 + 6]
add dword [r14 + 0x50], edi
lea rcx, [rax + rax*4]
lea rdx, [0x14001be18]
add dword [r12 + rcx*8 - 0x20], edi
movzx eax, word [r14 + 6]
lea rcx, [rax + rax*4]
add dword [r12 + rcx*8 - 0x18], edi
mov r12, qword [rsp + 0x68]
mov rcx, r12
call fcn.14000ad24
mov rdi, rax
test rax, rax
je 0x1400090ee
mov rdx, qword [rsp + 0x78]
mov r9, rax
mov r8d, 1
mov rcx, rbp
call fcn.14000af10
mov r9, rdi
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call fcn.14000af10
mov rcx, rdi
call fcn.14000b040
cmp dword [r14 + 0x58], 0
mov r15d, 1
je 0x1400090ee
mov rcx, r12
call fcn.140008d10
mov r15d, eax
mov rcx, rbx
call fcn.14000a9ac
mov rcx, rbp
call fcn.14000a9ac
mov eax, r15d
jmp 0x140009046
mov rcx, rbp
call fcn.14000a9ac
xor eax, eax
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000aae8
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x14000aafe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000ab00
xor eax, eax
test eax, eax
je 0x14000ab10
mov ecx, eax
call fcn.14000dcb8
or eax, 0xffffffff
jmp 0x14000ab12
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000c6eb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140020090]
jne 0x140009e8a
rol rcx, 0x10
test cx, 0xffff
jne 0x140009e86
repz ret
ror rcx, 0x10
jmp 0x14000c644
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140021890]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x140021988]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c6c9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140021890]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x14000c6eb
mov rax, qword [rsp + 0x88]
mov qword [0x140021988], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140021928], rax
mov rax, qword [0x140021988]
mov qword [0x140021800], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140021910], rax
mov dword [0x1400217f0], 0xc0000409
mov dword [0x1400217f4], 1
mov rax, qword [0x140020090]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140020098]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140021888], eax
mov ecx, 1
call fcn.14000fcb0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140019758]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140021888], 0
jne 0x14000c772
mov ecx, 1
call fcn.14000fcb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000fa6c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140014ac0
nop
cmp dword [0x140021e10], 1
je 0x14000fa18
mov dword [0x140021e0c], 1
mov byte [0x140021e08], r12b
test ebx, ebx
jne 0x14000fa04
mov rcx, qword [0x140024098]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000f9f1
mov rcx, qword [0x140024090]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000f990
call fcn.14000d8dc
cmp qword [rdi], rax
jne 0x14000f990
jmp 0x14000f976
cmp rdi, rsi
jb 0x14000f9f1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14000d8dc
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140024098]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140024090]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000f9cf
cmp r13, rax
je 0x14000f9ef
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000f976
lea rdx, [0x140019520]
lea rcx, [0x140019508]
call fcn.14000f7c0
lea rdx, [0x140019530]
lea rcx, [0x140019528]
call fcn.14000f7c0
nop
test r12d, r12d
je 0x14000fa27
mov ecx, 8
call fcn.1400149c0
test r12d, r12d
jne 0x14000fa52
mov dword [0x140021e10], 1
lea ecx, [r12 + 8]
call fcn.1400149c0
mov ecx, r15d
call fcn.14000f754
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000f8e0

Function at 0x14000fa78
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000f8e0
Function at 0x1400173e8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000d8dc
xor ebx, ebx
mov rdi, rax
cmp qword [0x140022578], rbx
jne 0x1400174ee
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400175c3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400175c3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140022578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140022580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140022588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140022598], rax
test rax, rax
je 0x1400174e5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140022590], rax
jmp 0x1400174f5
mov rax, qword [0x140022590]
jmp 0x1400174fc
mov rax, qword [0x140022590]
mov r11, qword [0x140022598]
cmp rax, rdi
je 0x140017564
cmp r11, rdi
je 0x140017564
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140022598]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140017564
test rax, rax
je 0x140017564
call rsi
test rax, rax
je 0x14001755e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001755e
test byte [rsp + 0x38], 1
jne 0x140017564
bts ebp, 0x15
jmp 0x1400175a2
mov rcx, qword [0x140022580]
cmp rcx, rdi
je 0x1400175a2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400175a2
call rax
mov rbx, rax
test rax, rax
je 0x1400175a2
mov rcx, qword [0x140022588]
cmp rcx, rdi
je 0x1400175a2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400175a2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140022578]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400175c3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400175c5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140013d60
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
xor r13d, r13d
mov rdi, rdx
sar rdx, 0x3f
mov rbp, rcx
shr rdx, 0x3e
mov r12, rdi
lea rsi, [rdi - 1]
lea rax, [rdi + rdx]
and eax, 3
sub rax, rdx
sub r12, rax
cmp rdi, 3
jle 0x140013ed0
nop dword [rax]
cmp rdi, rbx
jle 0x140013e90
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp rbx, r12
jl 0x140013da8
mov rax, rdi
xor ebx, ebx
sar rax, 0x3f
shr rax, 0x3e
lea r14, [rdi + rax]
and r14d, 3
sub r14, rax
test r14, r14
jle 0x140013e4c
lea rsi, [rdi - 1]
jmp 0x140013e15
test r15, r15
js 0x140013e22
movzx eax, byte [rbp + r15]
shl ebx, 8
or ebx, eax
test r14, r14
je 0x140013e3d
sub r14, 1
lea r15, [r12 + r14]
cmp r15, rdi
jl 0x140013e00
mov rdx, rsi
mov rcx, r15
shl ebx, 8
call fcn.14000e210
movzx eax, byte [rbp + r15]
or ebx, eax
test r14, r14
jne 0x140013e15
imul ebx, ebx, 0xcc9e2d51
rol ebx, 0xf
imul ebx, ebx, 0x1b873593
xor r13d, edi
mov eax, r13d
xor eax, ebx
mov r13d, eax
shr r13d, 0x10
xor r13d, eax
imul r13d, r13d, 0x85ebca6b
mov edx, r13d
shr edx, 0xd
xor edx, r13d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdx, rsi
call fcn.14000e210
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp r12, rbx
jg 0x140013da8
jmp 0x140013ddb
xor r12d, r12d
jmp 0x140013ddb
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
test rcx, rcx
je 0x140013efb
mov rdx, qword [rcx]
test rdx, rdx
js 0x140013f10
add rbx, 0x10
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140013d60
lea rax, [rdx - 1]
mov r8, rdx
xor ecx, ecx
mov rdx, rax
call fcn.140010d10
mov rdx, qword [rbx]
jmp 0x140013ef7
Function at 0x1400429a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rbx
test rdx, rdx
mov eax, r8d
lea r8, [rdx + 7]
mov r9, rcx
cmovns r8, rdx
mov r10, rdx
xor r11d, r11d
lea rcx, [0x1400698a0]
sar r8, 3
cmp rdx, 7
jle 0x140042a70
nop
mov ebx, dword [r9 + r11*8 + 4]
xor eax, dword [r9 + r11*8]
add r11, 1
mov esi, ebx
movzx edx, bl
shr esi, 0x18
mov edx, dword [rcx + rdx*4 + 0xc00]
xor edx, dword [rcx + rsi*4]
movzx esi, al
xor edx, dword [rcx + rsi*4 + 0x1c00]
mov esi, eax
shr esi, 0x18
xor edx, dword [rcx + rsi*4 + 0x1000]
movzx esi, bh
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [rcx + rsi*4 + 0x800]
xor edx, dword [rcx + rbx*4 + 0x400]
movzx ebx, ah
shr eax, 0x10
movzx eax, al
xor edx, dword [rcx + rbx*4 + 0x1800]
xor edx, dword [rcx + rax*4 + 0x1400]
mov eax, edx
cmp r8, r11
jg 0x1400429d0
shl r8, 3
cmp r10, r8
jle 0x140042a68
add r8, r9
lea rcx, [0x1400698a0]
add r9, r10
movzx edx, byte [r8]
add r8, 1
xor edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [rcx + rdx*4]
cmp r9, r8
jne 0x140042a50
pop rbx
pop rsi
ret
xor r8d, r8d
jmp 0x140042a3e

Function at 0x140057fc3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
js 0x1400b108d
bswap rsi
neg rsi
push r10
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
mov qword [rsp + 0x18], 0x60359932
sub word [rsp + 0x18], 0x3e26
push r13
jge 0x14009d392
movabs r13, 0x71b47b8e95852e15
lea rsi, [rsi + 0x1987418]
push rbx
movabs rbx, 0xfa1f0b3c60b0cf27
neg qword [rsp + 0x28]
setge bl
xchg qword [rsp + 0x38], rsi
mov r13, qword [rsp + 8]
mov r10, rbx
and word [rsp + 0x28], bx
sub r10b, byte [rsp + 0x28]
js 0x14009563e
mov rbx, qword [rsp]
or r10d, r10d
jg 0x140094db8

Function at 0x140058490
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14006fe20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400584b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400584b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400584b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14005850d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140058504
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400584b0
add rax, 0x28
cmp rax, r9
jne 0x1400584f0
xor eax, eax
ret

Function at 0x140058510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14006fe20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14005852f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140058538
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14005852f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400585d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14006fe20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400585ef
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400585f8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140094000
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push rbx
movabs rbx, 0xd2a563bbc61a4c25
pushfq
shl ebx, 0xcf
not ebx
xchg qword [rsp + 0x20], rsi
shl ebx, 1
cmp bx, 0x693b

Function at 0x140094588
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov r13, qword [rsp + 0x78]
bswap rcx
cmp rcx, 0x40a0ac9f
jo 0x1400ae899
ja 0x1400adb21

Function at 0x1400945a3
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
test byte [rsp + 0x28], 0
jno 0x14009d66b
jno 0x1400952a3
and dword [rbx], ebp
invalid
test ebx, ebx
mov cl, 0xd2
push 0x15
and al, 0xfb
mov cl, 0xd2
push 0xffffffffffffff9d
xor rsi, qword [rcx - 0x1dfe952e]
jnp 0x14009d5c1
shr byte [rdx + 0x51], cl
sbb al, byte [rbx]
mov cl, 0xd2
push 0x1d
sub esi, dword [rbx]
mov cl, 0xd2
push 0x25
mov dh, 0xea
out dx, al
sub byte [rsi - 0x75], cl
lodsb al, byte [rsi]
cmp al, 0x17
in eax, dx
fcmovne st(0), st(7)
test r13b, r13b
xchg qword [rsp + 0x38], rbx
mov r13, qword [rsp + r15 - 0x30241309]
jbe 0x1400619f8
jne 0x140098305
jae 0x14009901d
mov edx, 0x23b79931
jbe 0x14009d5fb
mov rax, qword [rsp + 0x28]

Function at 0x14009470a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
pop rsi
push r9
pushfq
movabs r9, 0x703ded0af634eeb4
call fcn.1400b1949

Function at 0x14009471d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or qword [rsp + 0x28], 0xffffffffae07d4bd
test cl, 0x1e
xchg qword [rsp + 0x50], rsi
mov rcx, qword [rsp + 0x40]
setno byte [rsp + 0x28]
or byte [rsp + 0x28], 0x8d
jne 0x14009730c
jg 0x14009c986
not dword [rsp + 0x28]
neg dword [rsp + 0x28]
shl byte [rsp + 0x28], 0xaa
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
ret 8
neg r12b
xor rsi, rbx
jns 0x1400b01cb
movabs rcx, 0xdabf8d905334fc9b
call fcn.14009c16e
jae fcn.14009c66a
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret

Function at 0x140094743
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xfffffffffffe7d26
movabs rcx, 0x128de87a38a1a8b
push rcx
shr cx, cl
cmova r10, rdi
jbe 0x14009f3eb
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
bswap r10
js 0x140098ea3
mov r10b, byte [rsp + 5]
jns 0x14009620f
or edx, esp
mov ds, ecx
mov eax, dword [rdi]
invalid
invalid

Function at 0x140094a3c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
shr byte [rsp + r14*4 + 0x68], 0xbd
mov r14, qword [rsp + r14*4 + 0x40]
test byte [rsp + 0x68], 0x93
jg 0x1400b1b5f
lea rsp, [rsp + 0x30]
ret 0x10
jle 0x14009d287

Function at 0x140094ae4
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
bswap r14
jns 0x140094961
Function at 0x140094c6f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
call fcn.1400b1acc
mov ebx, 0x4d85c69b
jae 0x14009e177

Function at 0x140094d14
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
push r8
add qword [rsp + 0x18], 0xffffffffbff6b5c4
movabs r8, 0xa6a2d59820051abf
or r8, 0xffffffff9e18ec33
jno 0x140098af1
add qword [rsp + r11*4 - 0x3fff4], 0x11973
movabs rdi, 0xa10051ba8caa8e3c
xor di, 0x9f0a
mov r11w, 0x1db1
js fcn.140098c41
movzx r11w, dil
nop
jge 0x140098b1d
je 0x1400b03ac
add qword [rsp], 0xffffffffbff4ff13
neg dword [rsp + 0x20]
jl 0x1400ae48c
push r14
push r9
mov qword [rsp + 0x30], rbp
push rdx
movabs rdx, 0x536238d2f15f818
seta r15b
and r15, r15
movabs r9, 0xc8a68825c2aea782
jge 0x1400b1a0f
jno 0x1400aeb87
xchg qword [rsp + r8 + 0x41e20179], rdi
mov rcx, qword [rsp + 0x30]
jg 0x14009a098
xor word [rsp + r8 + 0x41e20161], 0x94bb
jne 0x14009c8ce
or dword ds:[rsi], 0x10
xchg esi, eax
xchg ebx, ebp
push rdx
add qword [rsp + 0x18], 0xfffffffffffebe64
movabs rax, 0x57a9970f28181819
mov rax, qword [rsp + r11 - 0x26]
mov rdi, qword [rsp + r11 - 0x2e]
lea rsp, [rsp + r11 - 0x1e]
ret
mov rsi, qword [rsp + rbx - 0x7fbda868]
mov rsi, qword [rsi + rbx - 0x7fbda880]
add qword [rsp + rbx - 0x7fbda878], 0x8db1
add rbx, qword [rsp + rbx - 0x7fbda880]
mov r9, qword [rsp]
call fcn.140096390
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret
shl r8, 0x5c
jne 0x14009d3b6
mov r8, qword [rsp]
xor qword [rsp + 0x20], 0x2906ff37
neg dword [rsp + 0x20]
shr qword [rsp + 0x20], 0x43
setae byte [rsp + 0x20]
and byte [rsp + 0x20], 0x91
call fcn.1400ae70e
call fcn.1400965e4
and rbx, 0xffffffff8ba497bc
xor r13b, r11b
and r13, 0x384c91d
lea rax, [rax + r13 + 0x409bf593]
neg r13b
mov qword [rsp + rbx*4 - 0x1088], r11
neg r11b
or word [rsp + 8], 0xda99
movzx r13, byte [rsp + r13*4 - 0xa100398]
neg ebx
neg r11b
xchg qword [rsp + 0x38], rax
mov r11, qword [rsp + 0x28]
call fcn.140094ffa

Function at 0x140094f6c
Capabilities:
Encrypt data using speck

Disassembly:
mov word [rsp + r12*2 - 0x621aef22], 0x94a9
push r12
setns byte [rsp + r12 - 0x310d7781]
neg r12
add qword [rsp + 0x20], 0x2ef9
shl cx, 0x2c
call fcn.1400b185c

Function at 0x140094f97
Capabilities:
Encrypt data using speck

Disassembly:
sub r13b, r13b
mov r13d, 0xcb36130
jns 0x14009ec57
mov qword [rsp + 0x30], rcx
not r9d
push r9
push r10
ja 0x1400ad522
mov byte [rsp + 0x40], 0x23
call fcn.140057f37
mov rbx, qword [rbx]
add qword [rsp + 8], 0xffffffffbff68d0a
mov dx, 0xe137
add edx, 0x4387d221
mov qword [rsp + 0x18], rcx
je 0x140099aa3
lea rbx, [rbx + r13 + 0xbe68609]
mov qword [rsp + 0x20], r11
push r9
jg 0x14009d0b4
xchg qword [rsp + r13*2 - 0x1966c220], rbx

Function at 0x140095034
Capabilities:
Encrypt data using speck

Disassembly:
xchg qword [rsp + 0x18], rcx
call fcn.14009b5b6