joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001820
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140001260
test eax, eax
js 0x140001a5e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1400018ad
lea r8, [rbx + 8]
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop word [rax + rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140001860
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x140001a5c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
mov eax, r8d
inc r11d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0xf0980]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0xf1180]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0xf1580]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 + 3]
xor r9d, dword [rdi + rcx*4 + 0xf0d80]
movzx edx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 + 4]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov r8d, dword [rdi + rdx*4 + 0xf1180]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xf0d80]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0xf0980]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0xf1580]
movzx edx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 + 8]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0xf1180]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xf0d80]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0xf0980]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0xf1580]
movzx edx, byte [rdi + rax*4 + 0xf0580]
movzx eax, byte [r10 + 0xc]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0xf1180]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xf0d80]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xf0980]
movzx ecx, byte [rdi + rax*4 + 0xf0580]
xor r8d, dword [rdi + rcx*4 + 0xf1580]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400018d0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400026c0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rbx, rcx
xor edx, edx
lea r8d, [rdx + 0x5c]
add rcx, 4
call fcn.1400d8b80
mov dword [rbx + 4], 0x67452301
mov dword [rbx + 8], 0xefcdab89
mov dword [rbx + 0xc], 0x98badcfe
mov dword [rbx + 0x10], 0x10325476
lea rax, [rbx + 0xa0]
mov qword [rax + 0x18], 0xf
xor edi, edi
mov qword [rax + 0x10], rdi
cmp qword [rax + 0x18], 0x10
jb 0x14000272b
mov rax, qword [rax]
mov byte [rax], dil
lea rax, [rbx + 0xc0]
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rdi
cmp qword [rax + 0x18], 0x10
jb 0x14000274b
mov rax, qword [rax]
mov byte [rax], 0
mov word [rbx], 0x101
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x28]
call fcn.140002ed0
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], rdi
mov byte [rsp + 0x38], 0
cmp byte [rax], 0
jne 0x140002785
mov r8, rdi
jmp 0x14000279a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002790
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140004560
nop
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rdi
mov byte [rsp + 0x58], 0
xor r8d, r8d
lea rdx, [0x1400f1e98]
lea rcx, [rsp + 0x58]
call fcn.140004560
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140002870
nop
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x14000283b
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, 0x1000
jb 0x140002835
test cl, 0x1f
je 0x140002808
call fcn.1400daf34
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140002817
call fcn.1400daf34
int3
sub rcx, rax
cmp rcx, 8
jae 0x140002826
call fcn.1400daf34
int3
cmp rcx, 0x27
jbe 0x140002832
call fcn.1400daf34
int3
mov rcx, rax
call fcn.1400d6f24
nop
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x2c]
mov ecx, 8
rep stosb byte [rdi], al
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140003cd0
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
lea r8d, [rdx + 0x5c]
call fcn.1400d8b80
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.140004080
mov rbx, qword [rsp + 0xa0]
cmp qword [rbx + 0x10], 0
je 0x140003d63
cmp qword [rbx + 0x18], 0x10
jb 0x140003d54
mov rdx, qword [rbx]
jmp 0x140003d57
mov rdx, rbx
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140004080
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140003ba0
nop
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rdi
call fcn.1400d8b80
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8d, 0x10
mov rcx, rdi
call fcn.140004080
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.140004080
cmp qword [rbx + 0x10], 0
je 0x140003de9
cmp qword [rbx + 0x18], 0x10
jb 0x140003dda
mov rdx, qword [rbx]
jmp 0x140003ddd
mov rdx, rbx
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.140004080
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140003ba0
nop
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140002d20
nop
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x140003e60
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x140003e5b
test cl, 0x1f
je 0x140003e2e
call fcn.1400daf34
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140003e3d
call fcn.1400daf34
int3
sub rcx, rax
cmp rcx, 8
jae 0x140003e4c
call fcn.1400daf34
int3
cmp rcx, 0x27
jbe 0x140003e58
call fcn.1400daf34
int3
mov rcx, rax
call fcn.1400d6f24
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], 0
mov byte [rsp + 0x50], 0
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140003ecf
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x140003eca
test cl, 0x1f
je 0x140003e9d
call fcn.1400daf34
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140003eac
call fcn.1400daf34
int3
sub rcx, rax
cmp rcx, 8
jae 0x140003ebb
call fcn.1400daf34
int3
cmp rcx, 0x27
jbe 0x140003ec7
call fcn.1400daf34
int3
mov rcx, rax
call fcn.1400d6f24
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov rcx, rbx
call fcn.140002d80
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140006260
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
xor edx, edx
lea ecx, [rdx + 2]
call fcn.140078c30
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400062a9
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call fcn.140078b50
test eax, eax
jne 0x1400062bc
mov rcx, rbx
call fcn.14007c7b0
xor al, al
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret
mov qword [rsp + 0x1a0], rdi
xor dil, dil
lea rcx, [rbp - 0x74]
call fcn.14007d9e0
movzx r8d, byte [rbp - 0x74]
or ecx, 0xffffffff
test r8b, r8b
je 0x14000638d
lea rdx, [rbp - 0x74]
nop word [rax + rax]
movzx eax, r8b
lea rdx, [rdx + 1]
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
movzx eax, byte [rdx]
movzx r8d, al
test al, al
jne 0x1400062f0
not ecx
mov dword [rsp + 0x20], 0xce659691
mov dword [rsp + 0x24], 0xd50dea99
xor eax, eax
mov dword [rsp + 0x28], 0xb4ca0887
mov dword [rsp + 0x2c], 0x406ef54c
mov dword [rsp + 0x30], 0x60d51755
mov dword [rsp + 0x34], 0x5f1c2fc2
mov dword [rsp + 0x38], 0x175dbf9c
mov dword [rsp + 0x3c], 0x1a35902a
mov dword [rsp + 0x40], 0xad508441
mov dword [rsp + 0x44], 0xa531cc94
mov dword [rsp + 0x48], 0x4b8cfba
mov dword [rsp + 0x4c], 0xf1cc23e4
mov dword [rsp + 0x50], 0x6ccef6bb
mov dword [rsp + 0x54], 0x25afd43
mov dword [rsp + 0x58], 0xc0496880
mov dword [rsp + 0x5c], 0x2e30dbe9
cmp dword [rsp + rax*4 + 0x20], ecx
je 0x140006437
inc rax
cmp rax, 0x10
jl 0x140006411
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140078a70
test eax, eax
jne 0x1400062c7
jmp 0x14000643a
mov dil, 1
mov rcx, rbx
call fcn.14007c7b0
mov rbx, qword [rsp + 0x1a8]
movzx eax, dil
mov rdi, qword [rsp + 0x1a0]
add rsp, 0x190
pop rbp
ret
Function at 0x140006470
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x150
xor edx, edx
lea ecx, [rdx + 2]
call fcn.140078c30
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400064ad
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call fcn.140078b50
test eax, eax
jne 0x1400064b8
mov rcx, rbx
call fcn.14007c7b0
xor al, al
add rsp, 0x150
pop rbx
ret
mov qword [rsp + 0x160], rdi
xor dil, dil
mov dword [rsp + 0x168], 0xf321d342
nop
lea rcx, [rsp + 0x4c]
call fcn.14007d9e0
movzx edx, byte [rsp + 0x4c]
or ecx, 0xffffffff
test dl, dl
je 0x14000658c
lea r8, [rsp + 0x4c]
nop
movzx eax, dl
lea r8, [r8 + 1]
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
movzx eax, byte [r8]
movzx edx, al
test al, al
jne 0x1400064f0
not ecx
xor eax, eax
cmp dword [rsp + rax*4 + 0x168], ecx
je 0x1400065b9
inc rax
cmp rax, 1
jl 0x140006590
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140078a70
test eax, eax
jne 0x1400064d0
jmp 0x1400065bc
mov dil, 1
mov rcx, rbx
call fcn.14007c7b0
movzx eax, dil
mov rdi, qword [rsp + 0x160]
add rsp, 0x150
pop rbx
ret
Function at 0x1400c1870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
cmp byte [rcx + 8], 0
mov r9, rcx
je 0x1400c18ab
xor ecx, ecx
cmp dword [r9 + 0x3d0], ecx
jle 0x1400c18a6
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc ecx
xor byte [rdx], al
lea rdx, [rdx + 1]
cmp ecx, dword [r9 + 0x3d0]
jl 0x1400c1890
add rsp, 0x58
ret
lea rax, vtable.std::exception.0
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x38]
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov rax, qword [0x140116050]
mov qword [rsp + 0x20], rax
call fcn.1400d8d3c
lea rdx, [0x1401140e8]
lea rcx, [rsp + 0x30]
call fcn.1400d8308
int3

Function at 0x1400c1920
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov rax, rcx
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x1400c1970
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov dword [rsp + 0x20], ecx
mov r8, r9
mov rdx, rax
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rcx
mov rcx, rbx
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
call fcn.1400c1a90
mov rdx, rdi
mov rcx, rbx
call fcn.1400c1b70
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x1400c9fc0
Capabilities:
Check http status code

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rbx, rcx
xor r14b, r14b
call fcn.140006260
movzx edx, al
lea rcx, [rbp - 0x49]
call fcn.140073c60
nop
mov rdx, qword [rax]
mov qword [rbp + 0x1f], 0xf
xor r15d, r15d
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], r15b
or rdi, 0xffffffffffffffff
cmp byte [rdx], r15b
jne 0x1400ca01b
mov r8d, r15d
jmp 0x1400ca029
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400ca020
lea rcx, [rbp + 7]
call fcn.140004560
mov r12d, 1
mov r9d, r12d
lea r8d, [r12 + 0x4f]
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.1400c91f0
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, r12d
jg 0x1400ca068
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + OleUIPromptUserA]
cmp byte [rbx + 0x20], 0
je 0x1400ca1f3
xor eax, eax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov dword [rbp + 0x7f], eax
mov word [rbp + 0x83], ax
xor edx, edx
lea rcx, [rbp - 0x19]
call fcn.1400c9320
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400ca0a5
mov rsi, qword [rax]
lea rcx, [rbp - 0x39]
call fcn.1400cd230
mov rdi, rax
lea rcx, [rbp + 0x7f]
call fcn.1400caa90
mov r8, rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x4080000
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9, rdi
mov rdx, rsi
mov rcx, qword [rbx + 0x30]
call fcn.14007e510
mov rsi, rax
mov rcx, qword [rbp - 1]
cmp rcx, 0x10
jb 0x1400ca140
inc rcx
mov rdx, qword [rbp - 0x19]
cmp rcx, 0x1000
jb 0x1400ca138
test dl, 0x1f
je 0x1400ca10b
call fcn.1400daf34
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x1400ca11a
call fcn.1400daf34
int3
sub rdx, rax
cmp rdx, 8
jae 0x1400ca129
call fcn.1400daf34
int3
cmp rdx, 0x27
jbe 0x1400ca135
call fcn.1400daf34
int3
mov rdx, rax
mov rcx, rdx
call fcn.1400d6f24
mov qword [rbp - 1], 0xf
mov qword [rbp - 9], r15
mov byte [rbp - 0x19], 0
lea rdi, [rbp + 0x7f]
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
lea rdi, [rbp + 0x81]
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rbp - 0x39]
mov ecx, 9
rep stosb byte [rdi], al
lea rdi, [rbp - 0x2f]
mov ecx, 0x12
rep stosb byte [rdi], al
test rsi, rsi
je 0x1400ca1cf
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14007ec70
mov dword [rbp + 0x6f], r15d
mov dword [rbp + 0x77], 4
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x6f]
mov edx, 0x20000013
mov rcx, rsi
call fcn.14007ea00
movzx r14d, r14b
cmp dword [rbp + 0x6f], 0xc8
cmove r14d, r12d
mov rcx, rsi
call fcn.14007e7d0
cmp byte [rbx + 0x20], 0
je 0x1400ca1f3
mov rcx, qword [rbx + 0x30]
call fcn.14007e7d0
mov rcx, qword [rbx + 0x28]
call fcn.14007e7d0
mov byte [rbx + 0x20], 0
movzx eax, r14b
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400d547b
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
ret
cmp al, 0x25
xor ch, byte [rsi]
sub dword [rdi + rbp + 0x22], esp
cmp ecx, dword [rdi + 0x25]
and rax, 0x40735423
and edx, dword [rbx + rsi*2 + 0x40]
ja 0x1400d54b3
jno 0x1400d54be
jl 0x1400d5501
jo 0x1400d5479
and ebp, 0x7b
jmp 0x1400d550f
jg 0x1400d5487
jne 0x1400d5485
sub eax, 0xf07ff17b
jg 0x1400d5496
ja 0x1400d5493
in al, dx
test ch, ch
jbe 0x1400d5491
xor eax, 0xe67dee7e
jp 0x1400d5499
test cl, ch
ja 0x1400d54a3
in al, dx
jne 0x1400d54a6
jne 0x1400d54a9
jne 0x1400d54a5
invalid
out 0x7b, al
out 0x76, al
in al, 0x7a
jns 0x1400d54b6
xor eax, 0xef7ef282
xor ecx, 0x7d
out 0x77, al
invalid
cmp al, 0xad
cmp ebp, dword [rdi - 0x58c04cc4]
cmp dh, byte [rax - 0x4fc855c3]
xor eax, 0x40a63dac
movsd dword [rdi], dword [rsi]
mov r12b, 0x3b
scasb al, byte [rdi]
lodsd eax, dword [rsi]
cmp byte [rdi - 0x58be4fc8], ah
cmp ebp, dword [rdx - 0x4bbd53bf]
cmp dh, byte [rcx - 0x4cc35ac0]
xor al, 0xa9
test eax, 0xb037a53a
invalid

Function at 0x1400d54e6
Capabilities:
Encode data using base64

Disassembly:
ja 0x1400d551c
xor eax, 0x78624d79
push rbp
insb byte [rdi], dx
insd dword [rdi], dx
pop rbx
jns 0x1400d5539
jns 0x1400d5536
invalid
jl 0x1400d552c
invalid
jnp 0x1400d555a
push rsi
jb 0x1400d5549
and al, 0x5c
pop r14
invalid

Function at 0x1400d5562
Capabilities:
Encode data using base64

Disassembly:
jge 0x1400d54e5
mov byte [rdx - 0x76], bh
xchg byte [rcx - 0x777d7e80], al
jge 0x1400d54f4
jle 0x1400d54fa
xchg byte [rsi + 0x7c], bh
mov dword [rcx - 0x78778281], eax
Function at 0x1400d5fa0
Capabilities:
Parse pe header

Disassembly:
xor al, byte [rbx + 0x7d307931]
cmp bh, byte [rdi + 0x2f]
xor dword [rcx + 0x30], edi
jns 0x1400d5f86
jge 0x1400d5f92
jg 0x1400d5f89
xor byte [rax + rcx*4], 0x37
jl 0x1400d5f8f
xor al, 0x88
invalid
jns 0x1400d5f9c
cmp al, byte [rdi + 0x79318134]
xchg dword [rcx + rax*4], esi
xor dword [rcx + 0x36], edi
cmp dword [rbx], 0xffffff82
cmp dword ss:[rbx], 0xffffff82
cmp eax, dword [rdx - 0x79c578d4]
invalid
sub al, 0x87
cmp al, byte [rsi + 0x7f337a37]
xchg byte cs:[rdx], bh
jnp 0x1400d5fa5
xor dword [0x16c9599fb], 0x337b3682
jns 0x1400d5fb1
cmp dword [rdx], 0x2d833787
xchg dword [rdi], esi
sub dword [0x1a767b7bd], 0x3e
pop rax
pop rdx
invalid
invalid
sub eax, 0x675a582e
invalid
pop rax
invalid
pop r8
push rbp
push rsi
invalid
xor eax, 0x3e74572f
push rdi
je 0x1400d5fdd
js 0x1400d5f53
js 0x1400d5f53
jp 0x1400d5f54
invalid
test al, 0x7f
mov al, 0x7d
cmpsb byte [rsi], byte [rdi]
jg 0x1400d5f51
xor byte [rcx - 0x4e89507e], 0x7a
mov cl, 0x7a
lodsb al, byte [rsi]
jg 0x1400d5f5b
jge 0x1400d5f69
jl 0x1400d5f61
ja 0x1400d5f67
xor byte [rax - 0x517d577d], 0x78
movsd dword [rdi], dword [rsi]
sub dword [rdx + rax*4 + 0x79a27cae], 0xffffffae
jle 0x1400d5f73
and dword [rbp - 0x5a825182], 0x7a
test al, 0x7a
lodsd eax, dword [rsi]
jns 0x1400d5f86
sub byte [rbx - 0x547e5982], 0x7f
mov cl, 0x79
movsd dword [rdi], dword [rsi]
js 0x1400d5f89
cmpsb byte [rsi], byte [rdi]
sub dword [rbx - 0x5a864e81], 0xa37fa378
jg 0x1400d5f8b
jp 0x1400d5f9a
jns 0x1400d5f9c
jl 0x1400d5f9c
and byte [rdx - 0x5b7e558a], 0x7b
movabs dword [0x2d5e3b2ea77eb083], eax
cmp ebx, dword cs:[rsi + 0x2d]

Function at 0x1400d5ffa
Capabilities:
Parse pe header

Disassembly:
cmp ebx, dword cs:[rsi + 0x2d]
pop rcx
js 0x1400d6045
jae 0x1400d607a
cmp byte [rbx + 0x2e], dh
and byte [rax + 0x6f], ah
cmp byte [rdi], ch
ja 0x1400d6072
invalid
scasd eax, dword [rdi]
mov dword [rax - 0x4b7a4775], edi
mov esi, dword [rax - 0x457b4b7a]
xchg dword [rsi - 0x4d7d5276], ebp
xor byte [rdx - 0x49754675], 0x8b
mov bh, 0x84
scasd eax, dword [rdi]
jo 0x1400d60a9
jnp 0x1400d6089
push rsp
invalid
push 0x65
cmp eax, 0x2849705e
invalid
sub byte [rdx + 0x5c], ah
invalid
jnp 0x1400d60da
invalid
jns 0x1400d60fc
jg 0x1400d60fd
test byte [rdi + 0x7a], al
test dword [rbp + 0x76], r9d
invalid
sets byte [rsp + rcx*4]
seto byte [rsi]
xchg edx, eax
adc byte [rax - 0x6aee74eb], dl
adc byte [rcx - 0x68e36df1], bl
adc dword [rbp - 0x6fe972e5], ecx
sbb dword [rax - 0x70e866e2], edx
sbb dword [rbp - 0x69e866e4], ecx
sbb al, 0x90
adc al, 0x98
adc byte [rbx - 0x67eb66f0], cl
adc al, 0x8d
invalid
sbb al, 0x99
cdq
invalid
Function at 0x1400dba6c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400db840
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400db840
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400db840
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400db840
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400db840
cmp dword [rcx + 0x84], 0xe
jbe 0x1400db840
cmp dword [rcx + 0xf8], esi
je 0x1400db840
mov ecx, r14d
call fcn.1400db988
mov ecx, 2
call fcn.1400e1b80
nop
cmp byte [0x140116fa8], 0
jne 0x1400db90a
mov r15d, 1
mov eax, r15d
xchg dword [0x140116f98], eax
test ebx, ebx
jne 0x1400db8b3
mov rdi, qword [0x140116080]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140116fa0]
cmp rcx, rax
je 0x1400db8aa
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400d7e80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1401170e8]
jmp 0x1400db8bf
cmp ebx, r15d
jne 0x1400db8c5
lea rcx, [0x140117100]
call fcn.1400e0d6c
nop
test ebx, ebx
jne 0x1400db8dc
lea rdx, [0x1400ef568]
lea rcx, [0x1400ef548]
call fcn.1400e1038
lea rdx, [0x1400ef578]
lea rcx, [0x1400ef570]
call fcn.1400e1038
movzx eax, byte [0x140116fa8]
test esi, esi
cmove eax, r15d
mov byte [0x140116fa8], al
jmp 0x1400db90a
mov ecx, 2
call fcn.1400e1bd4
test esi, esi
jne 0x1400db921
mov ecx, r14d
call fcn.1400db93c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400db7d0