joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013d870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r12, rdx
mov rbx, rcx
call sub.api_ms_win_crt_locale_l1_1_0.dll_localeconv
xor edi, edi
lea r13, [0x1401d79d0]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x14013d8cf
nop
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x14013d8c0
mov qword [rsp + 0x58], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x14013d8e6
mov r15d, ebp
jmp 0x14013d8ef
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x14013da27
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14013da27
movsd xmm2, qword [0x1401d5d50]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x14013d93a
test r11d, r11d
jne 0x14013d98f
mov r11d, ebp
inc rdx
jmp 0x14013d920
test byte [r8 + r13 + 1], 0x10
je 0x14013d98f
test r10d, r10d
jne 0x14013d951
cmp r8b, 0x30
jne 0x14013d951
inc esi
jmp 0x14013d982
inc r10d
cmp r10d, 0x1e
jg 0x14013d97f
test byte [rcx + r13 + 1], 2
je 0x14013d967
add ecx, 0xffffffd0
jmp 0x14013d96d
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x14013d982
inc r9d
test r11d, r11d
je 0x14013d98a
dec r9d
inc rdx
jmp 0x14013d920
lea eax, [rsi + r10]
test eax, eax
je 0x14013da27
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x14013da0e
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x14013d9c0
mov eax, 2
jmp 0x14013d9ce
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x14013da27
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x14013d9e0
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x14013da1a
xorps xmm1, xmmword [0x1401d5d70]
mov edx, r9d
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_ldexp
jmp 0x14013da2a
xorps xmm0, xmm0
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1401413b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x1401414bf
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x140000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x14014141a.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x14014141a.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x14014141a.8
cdqe
movzx eax, byte [rdi + rax + 0x1414d4]
mov ecx, dword [rdi + rax*4 + 0x1414c0]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14014141a.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x14014143d
and dl, 0xc7
jmp 0x140141443
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x14014141a.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x14014141a.8
mov rcx, rbx
call fcn.140141ae0
jmp case.0x14014141a.8
cmp word [r10 + 0xa], 0
jne case.0x14014141a.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x14014147f
test byte [rdx + 9], 0x18
je 0x14014147f
mov rcx, rbx
call fcn.140141ae0
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x14014141a.8
mov rcx, r10
call fcn.140140950
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x1401413d3
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140142f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rdi, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
call fcn.140144610
test eax, eax
je 0x140142f88
xor r10d, r10d
mov r11d, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x140142f7e
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x140142f7e
mov rcx, rbx
call fcn.140141ae0
add r10, 0x10
sub r11, 1
jne 0x140142f60
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x140142fdf
test byte [r10 + 8], 0xf
movzx eax, byte [r10 + 9]
jne 0x140142fa8
test al, 0x40
je 0x140142fd6
mov byte [r10 + 9], ntohs
jmp 0x140142fd6
test al, 0x40
je 0x140142fbe
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x140142fbe
mov rcx, rbx
call fcn.140141ae0
test byte [r10 + 8], 0x40
je 0x140142fd6
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x140142fd6
mov rcx, rbx
call fcn.140141ae0
add r10, 0x18
cmp r10, rsi
jb 0x140142f91
movzx eax, byte [rdi + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x14014301b
mov rcx, rdi
call fcn.140140950
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], rdi
and byte [rdi + 9], 0xc7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x140143025
xor al, 2
mov byte [rdi + 9], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140143500
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rcx
xor eax, r8d
test rdx, rdx
je 0x14014352f
nop dword [rax]
movzx r8d, byte [r9 + rdx - 1]
mov ecx, eax
shl ecx, 5
add r8d, ecx
mov ecx, eax
shr ecx, 2
add r8d, ecx
xor eax, r8d
sub rdx, 1
jne 0x140143510
ret

Function at 0x140143790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x1401437b5
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.140143240
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x14014381d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.140140de0
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.14014af30
int3
Function at 0x140166ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2d8]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.140155ad0
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140166f26
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x140166f7d
mov ebp, 0x4b0000
jmp 0x140166f8b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.140158010
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140166fa1
mov eax, r12d
jmp 0x140166faa
mov edx, edi
mov ecx, ebp
call fcn.140158010
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140166fc6
shl esi, 0x10
mov ecx, esi
jmp 0x1401670b5
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x140167024
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.140155ad0
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140167014
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.140157ee0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.140155ad0
add ebx, eax
jmp 0x1401670be
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x140167031
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x140167070
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.140155ad0
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x140167075
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.140157ee0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.140155ad0
add ebx, eax
jmp 0x1401670be
cmp eax, r12d
jge 0x1401670ae
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.140155ad0
sub ebp, eax
sub r15d, esi
je 0x1401670ae
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.140157ee0
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.140155ad0
add ebx, eax
jmp 0x1401670be
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.140155ad0
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.140155ad0
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x14019f8d0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x14019fa1b
movzx r10d, r14w
mov edi, r14d
mov r8, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + r8]
call fcn.14019fd90
test al, al
jne 0x14019fab6
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x14019f9ab
cmp edx, dword [rbx + 0x60]
jl 0x14019f9ab
cmp edx, dword [rbx + 0x64]
jg 0x14019f9ab
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14019f9ab
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rcx + 0x18]
xor cl, byte [rax + 0x18]
test cl, 8
jne 0x14019f9ab
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x14019f9ce
test byte [r9 + 0x18], 8
je 0x14019f9ce
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x14019f9df
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.1401a0750
test al, al
jne 0x14019fab6
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x14019fa02
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r10w
cmp esi, eax
jl 0x14019f934
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x14019faba
test rdx, rdx
je 0x14019faba
mov ebp, 0xffff
nop dword [rax + rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x14019fa58
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x14019fa5b
mov r10, r14
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x14019fa76
dec r11d
add r11d, eax
jmp 0x14019fa8d
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.1401a0a20
test al, al
jne 0x14019fab6
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.1401a0a20
test al, al
jne 0x14019fab6
mov rdx, qword [rsi]
add di, bp
jne 0x14019fa40
jmp 0x14019fabe
mov al, 1
jmp 0x14019fac9
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14007e2a8
Capabilities:
Encode data using base64

Disassembly:
btc r8d, 0xbc
mov qword [rsp + rcx], rcx
xor dword [rsp + rbx - 0x5e30cf30], r11d
xadd word [rsp + rcx*8 + 1], dx
jnp 0x1402271f6
inc r8
movsxd r11, r11d
sal rbx, 0xd7
adc rdi, r11
mov qword [rsp + rcx*2], rdi
ret 8
not dword [rsp + rcx*2 + 4]
mov r9, qword [rsp + rcx*2 + 8]
inc esi
ja 0x1400edc02
sbb bl, al
lea rsi, [rsi + rax*4 + 2]
mov qword [rsp + rax + 0x10], r8
inc byte [rsp + rax*2 + 0x15]
shl edx, cl
mov dword [rax + rsi], edx
movzx edx, al
mov qword [rsp + rax], rbp
ret 0x10

Function at 0x140082353
Capabilities:
Encode data using base64

Disassembly:
add sil, al
pop rdx
jno fcn.1400e29ec

Function at 0x140086601
Capabilities:
Encode data using base64

Disassembly:
lea rsi, [r10 + r10 - 0x5172a7e9]
lea rsi, [rsi - 0x3fc7dec1]
or r9w, word [rbp + r8 - 0x5d6cb400]
lea rbp, [rbp + r8 - 0x5d6cb400]
mov qword [rsp + r8 - 0x5d6cb402], 0x651bcd1e
jmp 0x140110d1f
not cx
bt rsi, 0x1f
call fcn.140190459
movsx ebx, cl
sbb al, 0xa6
imul ebx, ecx
not al
inc qword [rsp + rdi*4]
xor r9b, al
lea rax, [rsp + rax + 8]
jmp 0x14014b72a
add cl, cl
pop r8
mov qword [rax + rdi*4], r11
lea r10, [r10 + rdi*2 - 4]
mov eax, dword [rdi + r10]
mov r11d, 0xf1372184
xor eax, r9d
neg eax
call fcn.14018b02b

Function at 0x14008bbce
Capabilities:
Encode data using base64

Disassembly:
bswap ebx
mov qword [rsp + rax*4 - 0x40], rcx
xor dil, cl
mov r11d, ecx
not ebx
sets r11b
mul qword [rsp + rax*8 - 0x80]
lea ebx, [rbx + rdi*2 - 0x24144a30]
idiv dword [rsp + r11 - 0x4abf8fc]
xor ebx, 0x6230f21c
mul r11w
inc ebx
inc edx
ror r11w, cl
sbb al, al
ror ebx, cl
bswap ebx
lea ebx, [rax + rbx + 0x4f3d1b8d]
call fcn.14007a1d6

Function at 0x14008bc45
Capabilities:
Encode data using base64

Disassembly:
neg si
dec si
call fcn.14013ef21
neg ebx
mov eax, ecx
lea ebx, [rbx + r11 - 0x79a49517]
imul r11w, r11w
bts r11d, eax
push rbp
dec ecx
xor dword [rsp + r11*4 - 0x10], ebx
imul ecx, r11d
pop rbp
lea rdx, [rdi*4 + 0x3395e08e]
neg r11b
movsxd rbx, ebx
adc r11w, ax
adc r9, rbx
movzx r11d, byte [r10 + r11*8 - 0x477f8]
lea r10, [r10 + rdi - 0x61]
xor r11b, bpl
neg dl
div ecx
sub r11b, 5
not r11b
lea rbx, [rdi*4 + 0x199d9226]
sub r11b, 0xad
ror r11b, 1
sub bl, dl
push rdi
inc r11b
or qword [rsp + rdi*2 - 0xc4], rax
add qword [rsp + rdi - 0x62], rdi
neg r11b
call fcn.1400ff989
mov r8d, 0xdea3ed01
mov esi, 0x292962a
mov ecx, r8d
mov r9d, dword [rbx + rsi - 0x292962a]
mov eax, r8d
movsx edx, cl
lea rbx, [rbx + rsi*8 - 0x1494b14c]
cdq
xor r9d, r11d
rol r9d, 2
xadd cx, dx
neg r9d
shr rcx, 0x5e
inc r8b
not r9d
bt ecx, esi
push rdx
sbb r9d, 0xe63bad94
dec ax
xadd dword [rsp + rsi*2 - 0x5252c51], r8d
sar qword [rsp + r8*8 - 0x7f8], 0x29
ror r9d, 1
sub rsi, rdx
ror word [rsp + r8*8 - 0x7f4], 0xa1
inc r9d
ror r9d, 1
and dword [rsp + r8*2 - 0x1fc], ecx
call fcn.1400eaab8
Function at 0x14008cf92
Capabilities:
Encode data using base64

Disassembly:
ror eax, 2
mov qword [rsp + rdx - 0xa18cfb2], 0x4585f98b
or sil, 0x90
sub byte [rsp + rdx*8 - 0x50c67d8b], sil
sbb eax, 0xd0ac261c
neg eax
sar word [rsp + rdx*8 - 0x50c67d8a], cl
movzx r10d, dl
mov qword [rsp + rdx - 0xa18cfb2], r11
bt r10d, edx
bts r9, r10
xor dword [rsp + rdx*8 - 0x50c67d90], eax
btr cx, si
pop r11
setb r10b
rol edx, 0xed
adc r8, 0xffffffffc11cbcbe
movsxd rax, eax
xor cl, 0x9f
lea rdx, [rsi + rsi*2 - 0x2a79b366]
ja 0x1400a1411
adc rdi, rax
movzx r8d, word [rbx + r10*2]
lea rbx, [rbx + r10*2 + 2]
jmp 0x140126c4a

Function at 0x14008ee82
Capabilities:
Encode data using base64

Disassembly:
add rbx, rdx
and r8b, al
pop rcx
pop rsi
pop rsi
jne fcn.140189ca6

Function at 0x14008ef10
Capabilities:
Encode data using base64

Disassembly:
mov r9, qword [rsp + rdi*2 - 0x10]
cdq
movsxd rbx, ebx
mov qword [rsp + rdi*2 - 0x10], rdi
dec ax
add rbp, rbx
btr edx, 5
mov qword [rsp + rdi*4 - 0x30], rdi
lea r10, [r10 + rdi*4 - 0x32]
not byte [rsp + rdi - 1]
xor cx, 0x559e
push r11
movzx ecx, word [r10 + rdi*2 - 0x18]
xor cx, r9w
movsx ebx, al
ror cx, 1
not cx
movzx r8d, word [rsp + rdi + 5]
add cx, 0x6b9f
push r8
inc dil
cqo
not cx
add cx, 0x3507
not al
mul bl
not cx
neg cx
not r8
xor r9w, cx
jmp 0x14023acae

Function at 0x140091353
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r11 + 0xd6bcca1], 0xb3e20ac
ror word [rsp + rbp*2 - 0x6481b4a3], 0x41
inc eax
xor rbp, 0x58981503
bts rbp, rbp
lea rcx, [rbx + r11*4 - 0x1b51c349]
xor eax, 0xd82e5da2
dec r11b
not eax
xadd qword [rsp + rbp - 0x6adacf51], rbx
push rbx
dec eax
call fcn.1400a21bb
Function at 0x140093d01
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea esi, [rsi + r8*2 - 0x30643974]
imul rax
mov qword [rsp + rdx*4], rbp
jb 0x140159762
jmp 0x14011f6b9
jmp 0x1401c8360
mov eax, 0xafa54205
mov r10d, 0x6490c40e
mov ecx, dword [rbx + r10 - 0x6490c40e]
lea rbx, [r10 + rbx - 0x6490c40a]
xor ecx, r11d
btc r10, rax
shl r10w, 0xcf
lea rsi, [r10*4 + 0x110efe90]
dec ecx
push r10
xor ecx, 0xd6bc5710
bswap ecx
movsx edx, word [rsp + r10 - 0x648ffffc]
movzx r8d, sil
lea ecx, [rdx + rcx - 0x7b8d2809]
not ecx
sar r8, 0x26
xadd dword [rsp + r10 - 0x648ffffd], edx
dec ecx
sal dl, 0xc1
sbb rax, 0xffffffffb6130aaf
mov qword [rsp + r10 - 0x64900000], r11
dec eax
xor dword [rsp + r10 - 0x64900000], ecx
pop r11
shl r10w, 0x8a
dec eax
jb 0x1400c89ab
movsxd rcx, ecx
sbb dx, 0xd68d
cmovbe rsi, r8
add rdi, rcx
inc esi
lea rcx, [rdx - 0x1be4c14e]
mov rax, qword [rbp + r10 - 0x64900000]
dec r10d
call fcn.1400c4bfe
mov edi, 0xb520f220
mov ecx, edi
add cl, dil
mov rcx, qword [rsi + riz]
movsx eax, dil
btr rdi, rax
jb 0x1400ba247
lea rsi, [rax + rsi - 0x18]
cqo
lea r10, [rax + r10 - 0x22]
xchg edi, edx
and eax, 0x4d9904b6
movzx r11d, al
movzx r8d, word [r10 + rdi*8]
imul dl
and dil, 0xa1
xor r8w, r9w
not r11
add r8w, 0x72b4
jmp 0x1400c2f85
not esi
mov qword [rsp + r8 - 0x5bc24c40], r9
xor eax, dword [rsp + rdx*2 + 3]
pop r8
xor dword [rsp + rdx*2 + 8], esi
xadd word [rsp + rax - 0x7abf9981], cx
movsx r9d, cx
bts r9w, cx
mov r9, qword [rsp + rdx*2 + 8]
movsxd rsi, esi
sub eax, 0x500040a6
not bpl
inc r8b
adc rbx, rsi
btc edx, 8
div eax
pop rsi
pop r8
jmp fcn.14009521e
rol r8w, 1
movsx ebx, dx
not r8w
bswap edx
idiv rbx
neg r8w
xchg bl, dil
shr r11w, 0x21
xor r9w, r8w
imul ax
add r8, rsp
mov qword [r8 + rdi*4 - 0x80], rcx
call fcn.1401763bb
btr si, 0x39
rol edx, 1
inc r8d
lea rsi, [r8*2 + 0x638a68bb]
not edx
push r11
mov ecx, eax
xor dword [rsp + rax + 0x6eeb9af6], edx
movsx r11d, r10b
call fcn.1401c2bc9
mov rcx, qword [rbp + riz]
push 0xfffffffff3bb94ac
mov esi, 0x68a55398
movzx edx, word [rsp + rsi - 0x68a55397]
mov rax, qword [rbp + rdx*2 - 0x17720]
sub word [rsp + rsi - 0x68a55396], si
ror sil, 0xe1
mov r9d, dword [rsp + rdx - 0xbb91]
lea rbp, [rbp + rsi - 0x68a5533c]
lea r8, [rdx + rsi*4 + 0x7a06b6b5]
xor dx, dx
mov qword ss:[rcx + rsi - 0x68a5534c], rax
dec edx
mov esi, dword [rbx + rsi - 0x68a5534c]
not r8b
adc rbx, 4
xchg word [rsp + 3], r8w
pop r10
xor esi, r11d
rol dx, 0xcb
ror esi, 1
sal r10, 0x8b
lea rax, [r9 + 0x7622922b]
add esi, edx
bts r9w, r10w
sar r9d, 0xea
neg esi
bts rdx, 0xac
sbb esi, edx
push r11
movzx ecx, r8b
jmp 0x14007d71a

Function at 0x140098c8a
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov qword [rsp + rbp*2 + 0x1e7f0d6a], rsi
xor dx, r9w
sub r8b, dil
lea rcx, [r8 + rdi + 0x896ab82]
inc dx

Function at 0x140099b8d
Capabilities:
Encode data using base64

Disassembly:
sal byte [rsp + rdi - 0x45af], 4
not r10w
or word [rsp + rdi - 0x45ab], di
sbb r10w, 0xf426
pop rcx
sal qword [rsp + rdi - 0x45b7], 0x25
xor bp, r10w
lea r10, [rsp + r10 + 8]
and dl, 0x27
movsx ebx, di
mov ebx, dword [r10 + rdi*8 - 0x22db8]
pop rdx
jne 0x1401a2df1
Function at 0x14009a6fa
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x58d9f0e
mov cl, byte [rsi + rax*2 - 0xb1b3e14]
mov qword [rsp + rax - 0x58d9f0e], 0xffffffffc4850934
pop rbx
movzx r8d, bx
lea rsi, [rsi + rax*2 - 0xb1b3e16]
shld edx, r11d, cl
sal r8b, 0x63
mov dword [rsi + rax*8 - 0x2c6cf870], edx
lea r10, [rax + r10 - 0x58d9f12]
mov eax, dword [rax + r10 - 0x58d9f0e]
jne 0x1400e0eac
mov r8d, 0x773b2d88
movsx eax, r8b
rol rax, 0x7a
mov edx, dword [rdi + r8 - 0x773b2d88]
lea rdi, [rdi + rax*8 - 0x1fffffec]
movzx ecx, r8b
xor edx, r11d
mov r10d, r8d
xadd rcx, r10
lea edx, [rcx + rdx - 0x487e7fe8]
inc rcx
not cl
neg edx
sub edx, 0xf527e138
lea r9, [r10 + r10*4 + 0x143c9ca0]
bt r10, 0xa1
bswap edx
dec edx
idiv al
add eax, r8d
bswap edx
sal r8w, 8
adc rcx, r8
sal eax, 2
push r11
and r10b, 0x97
inc r8d
lea rsi, [rcx + r9*2 + 0x3c81da93]
xor dword [rsp + r10*2 - 0x100], edx
jmp 0x14011b185
lea r11, [r8*4 - 0x145a7de9]
bt rbx, 0x23
xor eax, r9d
ror eax, 1
lea eax, [rax + rbx*2 + 0x4ec9917c]
add r8, r8
neg eax
neg r8
jne 0x140096df7
rol r8, cl
xor ax, 0xe312
push rcx
xadd dl, r10b
adc ax, dx
sar si, cl
xadd dword [rsp + r10 - 0xfc], r9d
pop rdx
rol ax, 1
xor r11w, ax
btr r8d, r8d
jae 0x140135d5d
pop r11
jmp 0x14012e62e
sal r9w, 0xcd
sal si, cl
movsxd rdx, edx
sbb ax, cx
btr ax, 0x1b
and r10d, r8d
adc rbx, rdx
xchg r8, r9
movzx eax, word [rdi + r8*4 - 0x50f00000]
mov edx, r8d
shl rsi, 0x2c
lea rdi, [rdi + r8*2 - 0x2877fffe]
not edx
or cl, 3
xor ax, r11w
dec r8b
ror ax, 1
jmp 0x14011552c

Function at 0x14009b1d6
Capabilities:
Encode data using base64

Disassembly:
movsxd rcx, ecx
adc rbx, rcx
sub r10, r9
mov qword [rsp + r9*2 - 0x194b8], 0xffffffffa3ac749e
add esi, r8d
movzx ecx, byte [r9 + rdi - 0xca5c]
neg al
lea rdi, [r9 + rdi - 0xca5b]
xor cl, r11b
dec r10b
inc cl
not cl
inc r10w
ror cl, 1
neg r10w
jbe 0x1401dcc4b
adc cl, 0x82
or r8w, dx
or r8d, 0x62a5993e
xor r11b, cl
sal sil, 0xc6
dec byte [rsp + r9 - 0xca55]
lea rcx, [rsp + rcx + 8]
rol word [rsp + r9*4 - 0x32970], 0xe5
div r8w
mul word [rsp + r9 - 0xca59]
mov r8d, dword [r9 + rcx - 0xca5c]
lea rbp, [rbp + r9*2 - 0x194bc]
sbb esi, r10d
mov dword [rbp + r9*4 - 0x32970], r8d
sal word [rsp + r9 - 0xca59], 0x2e
push rax
pop r10
pop r9
jae fcn.140189ca6

Function at 0x14009cba8
Capabilities:
Encode data using base64

Disassembly:
and rdx, rbx
adc rbp, 4
lea rsi, [r10 + rdx*4 - 0x17db46cc]
xor eax, r11d
and ebx, 0x6f14db3e
mov qword [rsp + rbx - 0x2204c12e], rsi
sbb eax, r10d
sar dword [rsp + rbx*2 - 0x4409825c], 0xba
shl word [rsp + rbx - 0x2204c12c], 0xa5
xadd si, r10w
bswap eax
not eax
ja 0x140136b61