joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7850
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [0x140139a1c], 0
jne 0x1400c79e5
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
xor esi, esi
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400c7918
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400c7918
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400c7913
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400c78f0
cmp edx, 0xebcdfe95
je 0x1400c79ad
test r8d, r8d
jne 0x1400c78d0
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x1400c792d
cmp qword [rax + 0x30], rsi
jne 0x1400c78a0
mov rax, rsi
call rax
mov rdi, qword [rsp + 0x58]
mov ecx, eax
mov rbp, qword [rsp + 0x50]
xor eax, eax
lock cmpxchg dword [0x140139a1c], ecx
jne 0x1400c79e5
mov rbx, qword [0x140139a08]
mov qword [0x140139a38], rsi
mov qword [0x140139a30], rsi
mov qword [0x140139a28], rsi
test rbx, rbx
je 0x1400c79db
nop
mov rcx, qword [0x1401399a8]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
mov r8d, 0x10000
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x50]
test al, al
je 0x1400c79c9
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400c7970
mov dword [0x140139a20], esi
mov eax, esi
jmp 0x1400c79ea
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c7930
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
call qword [rax + 0xc0]
mov esi, eax
mov dword [0x140139a20], esi
mov eax, esi
jmp 0x1400c79ea
mov eax, 0x10dd
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d0100
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1400c8430
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x20
mov eax, dword [0x140139a20]
mov r14, rcx
test eax, eax
jne 0x1400c866e
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400c84e4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400c84e4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400c84df
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400c84c0
cmp edx, 0x9bc5a608
je 0x1400c8521
test r8d, r8d
jne 0x1400c84a0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400c84fa
cmp qword [rax + 0x30], 0
jne 0x1400c8470
xor eax, eax
call rax
cmp r14, rax
je 0x1400c865d
mov ecx, 0x10
call fcn.1400d0248
mov rsi, rax
test rax, rax
jne 0x1400c853a
lea ebx, [rax + 8]
jmp 0x1400c861a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c84fc
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rbp
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400c85d4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400c85d4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400c85cf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400c85b0
cmp edx, 0x5ccb1d2b
je 0x1400c862f
test r8d, r8d
jne 0x1400c8590
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x1400c85ea
cmp qword [rax + 0x30], 0
jne 0x1400c8560
xor eax, eax
mov rcx, r14
call rax
mov rbp, qword [rsp + 0x38]
cmp eax, 0xffffffff
jne 0x1400c8648
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
call qword [rax + 0xc0]
mov ebx, eax
mov edx, 0x10
mov rcx, rsi
call fcn.1400d0120
mov dword [0x140139a20], ebx
mov eax, ebx
mov qword [0x140139a28], 0
jmp 0x1400c865f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c85ec
mov rax, qword [0x140139a30]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [0x140139a30], rsi
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400c86b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r13, qword [rsp + 0xe0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov r14, rcx
mov esi, r9d
movups xmmword [rsp + 0x40], xmm0
mov r12, r8
mov r15, rdx
movups xmmword [rsp + 0x50], xmm0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rbx, rbp
nop dword [rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400c8784
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400c8784
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400c877f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400c8760
cmp edx, 0x305caa6d
je 0x1400c87e2
test r8d, r8d
jne 0x1400c8740
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rbp
je 0x1400c879a
cmp qword [rax + 0x30], 0
jne 0x1400c8710
xor eax, eax
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call rax
test rax, rax
je 0x1400c8832
mov r11, qword [0x1401399a8]
mov rax, qword [r11]
mov rbx, qword [rax + 0x48]
mov eax, esi
and eax, 0xf0
test byte [rsp + 0x54], 0xf0
je 0x1400c87fd
test eax, eax
jne 0x1400c8818
mov ecx, esi
mov eax, esi
and ecx, 0xf
shl ecx, 4
mov esi, ecx
jmp 0x1400c8811
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400c879c
test eax, eax
je 0x1400c8818
mov r10d, esi
mov eax, esi
shr r10d, 4
and r10d, 0xf
mov esi, r10d
and eax, 0xffffff00
or esi, eax
mov qword [rsp + 0x28], r13
mov r9, r12
mov r8, r15
mov dword [rsp + 0x20], esi
mov rdx, r14
mov rcx, r11
call rbx
movzx eax, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c8850
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdx, rcx
test rcx, rcx
jne 0x1400c8948
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400c8903
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400c8903
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400c88f6
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x1400c88e0
cmp edx, 0xd263bde6
je 0x1400c8926
test r8d, r8d
jne 0x1400c88c0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400c8919
cmp qword [rax + 0x30], 0
jne 0x1400c8890
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
call rdx
mov rdx, rax
jmp 0x1400c894a
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
xor ebx, ebx
xor ecx, ecx
call rdx
mov rdx, rax
jmp 0x1400c894a
xor ebx, ebx
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400c8970
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
mov edx, 0xc1
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8a6e
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400c899c
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
mov edx, 0xbf
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8a6e
movzx eax, word [r8 + 0x14]
test ax, ax
jne 0x1400c89c2
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
mov edx, 0xc0
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8a6e
lea r9, [r8 + rax]
mov dword [rsp + 0x20], ebx
movzx eax, word [r8 + 6]
cmp ebx, eax
jae 0x1400c8a3e
mov eax, ebx
lea rcx, [rax + rax*4]
lea rcx, [rcx*8]
cmp byte [rcx + r9 + 0x18], 0x2e
jne 0x1400c8a3a
cmp byte [rcx + r9 + 0x19], 0
jne 0x1400c8a3a
mov eax, dword [rcx + r9 + 0x24]
test eax, eax
je 0x1400c8a3e
cmp dword [rcx + r9 + 0x28], 0
je 0x1400c8a3e
lea rbx, [rdx + rax]
mov eax, dword [rbx]
cmp eax, 0x40
jb 0x1400c8a3e
cmp dword [rbx + 4], 0x727444
jne 0x1400c8a3e
cmp dword [rbx + 8], 0
jne 0x1400c8a1f
mov dword [rbx + 8], eax
mov rcx, qword [0x1401399a8]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xc8]
xor edx, edx
call r8
mov rax, rbx
jmp 0x1400c8a6e
inc ebx
jmp 0x1400c89c6
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
mov edx, 0xc0
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8a6e
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c8a80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rbx, [rcx + 0x10000]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov edi, 0x5a4d
nop word [rax + rax]
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
mov rdx, rbx
call qword [rax + pe_nt_image_headers64]
test rax, rax
jne 0x1400c8af5
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d0100
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
cmp dword [rsp + 0x40], 0x1000
jne 0x1400c8b4e
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1400c8b4e
bt eax, 8
jb 0x1400c8b4e
cmp word [rbx], di
jne 0x1400c8b47
mov eax, dword [rbx + 0x3c]
cmp rax, qword [rsp + 0x38]
ja 0x1400c8b47
cmp eax, 0x40
jb 0x1400c8b47
cdqe
cmp dword [rax + rbx], 0x4550
jne 0x1400c8b4e
mov rcx, qword [0x1401399a8]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xc8]
xor edx, edx
call r8
mov rax, rbx
jmp 0x1400c8add
jmp 0x1400c8b4e
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x1400c8ac0

Function at 0x1400c8c50
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
call qword [rax + pe_nt_image_headers64]
test rax, rax
jne 0x1400c8cb0
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
mov edx, 0xc1
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8d71
cmp dword [rsp + 0x40], 0x1000
jne 0x1400c8d41
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1400c8d41
bt eax, 8
jb 0x1400c8d41
mov rbx, qword [rsp + 0x28]
mov eax, 0x5a4d
mov rcx, qword [0x1401399a8]
cmp word [rbx], ax
je 0x1400c8cf4
mov rax, qword [rcx]
mov edx, 0xc1
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8d71
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x1400c8d13
mov rax, qword [rcx]
mov edx, 0xbf
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8d71
cmp word [rax + rbx + 0x14], 0
jne 0x1400c8d2d
mov rax, qword [rcx]
mov edx, 0xc0
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8d71
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xc8]
xor edx, edx
call r8
mov rax, rbx
jmp 0x1400c8d71
mov rcx, qword [0x1401399a8]
mov rax, qword [rcx]
mov edx, 0xc1
call qword [rax + 0xc8]
xor eax, eax
jmp 0x1400c8d71
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x60
pop rbx
ret
Function at 0x1400c9c70
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.140003310
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400031a0
lea rcx, [rsp + 0x38]
call fcn.140003210
movzx eax, al
test eax, eax
je 0x1400c9d07
lea rcx, [rsp + 0x38]
call fcn.140003250
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1400c9d07
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140003270
mov rcx, rax
call fcn.140003c50
cmp eax, 0x820621f3
jne 0x1400c9d05
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400032b0
jmp 0x1400c9d1e
jmp 0x1400c9cbf
lea rcx, [rsp + 0x28]
call fcn.140003380
movzx eax, al
test eax, eax
jne 0x1400c9c8d
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x68
ret
Function at 0x1400cf4e8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400cf516
xor eax, eax
jmp 0x1400cf5fc
cmp qword [rcx + 0x68], 0
je 0x1400cf527
call fcn.140059530
jmp 0x1400cf5fc
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400cf53e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400cf540
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400cf572
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400f7ce0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400cf5f6
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400cf5a9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400cf5d2
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400dd1b4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400cf5f6
cmp rsi, rbx
ja 0x1400cf5b0
test rsi, rsi
je 0x1400cf5f6
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400dd1b4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400d122c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140101150]
test rax, rax
je 0x1400d1276
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d1276
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d1276
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d1276
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d1276
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d1278
xor al, al
add rsp, 0x28
ret
Function at 0x1400e47d4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400e4843
xor ecx, ecx
call qword [0x140101150]
test rax, rax
je 0x1400e4843
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e4843
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e4843
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e4843
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e4843
cmp dword [rcx + 0xf8], 0
je 0x1400e4843
mov ecx, ebx
call fcn.1400e48f4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400e46d0
nop
cmp dword [rbp + 0x20], 0
je 0x1400e4891
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400e489c
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400e47d4

Function at 0x1400e49d8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400e47d4

Function at 0x1400f7810
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f7838
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400f7838
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14026a3fc
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [rbx]
mov edx, 0xb5304083
add rbx, 4
xor ecx, esi
mov qword [rsp], rdx
neg ecx
lea rbp, [rdx + rdx*8 + 0x3b1740b7]
xchg bpl, dl
add word [rsp + 5], 0x9db9
rol ecx, 2
or bp, word [rsp + 1]
mov r9d, 0x87a814a0
dec ecx
neg ecx
dec byte [rsp + 2]
ror rdx, 0x60
rol ecx, 1
dec dx
and bpl, 0xa7
mov qword [rsp], rsi
bswap rdx
xor dword [rsp], ecx
pop rsi
movsxd rcx, ecx
add r8, rcx
movzx r9d, byte [rbx]
dec edx
inc rbp
lea rbx, [rbx + rdx - 0x524030b3]
xor r9b, sil
dec dx
and edx, edx
rol r9b, 1
xor ebp, 0xb69dac1b
inc rdx
rol dx, 0x81
xor r9b, 0x88
rol r9b, 1
inc r9b
xor sil, r9b
jmp 0x1402c6928

Function at 0x140284c5e
Capabilities:
Encode data using base64

Disassembly:
call fcn.14029ee78
adc rcx, rdx
mov dl, byte [rbx + rdx*2 - 0xea]
lea rbx, [rbx + r9 + 5]
xor dl, sil
neg dl
movzx edi, cl
dec r11w
add dl, 0x95
xchg rdi, rcx
and r9, rax
lea rbp, [r9 + rdi*4 - 0x594469cf]
rol dl, 1
xor rcx, rbp
lea rax, [rdi + rdi*8 - 0x315db373]
bswap rcx
neg dl
add ecx, ebp
shl r9, 0x54
sbb eax, 0x8cbe74bb
sbb dl, 0x32
jmp 0x1402cd87b
Function at 0x140296cea
Capabilities:
Authenticate hmac

Disassembly:
xor r11b, sil
mov qword [rsp + rax - 0x2a], 0xd2b3c8f
movzx r9d, cx
neg cl
add r11b, 0xb8
mov qword [rsp + rax*8 - 0x148], 0xffffffff8da5e127
sub eax, 0xd82bd113
shl rcx, 0x92
rol r11b, 1
xor bpl, 0x87
sbb r11b, 0xb1
or cx, cx
xor r11b, 0x1d
inc r11b
sub r9b, r9b
xor sil, r11b
ror byte [rsp + rax - 0x27d42f17], 0x26
adc byte [rsp + r9 + 0xd], 0x36
lea r11, [rsp + r11 + 0x18]
add dword [rsp + rax*2 - 0x4fa85e2c], edi
call fcn.1402bc235

Function at 0x140298e64
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [rsp + rax + 8]
mov qword [rsp + rbp - 0x2847b7d7], r9
mov r11, qword [r9 + rax]
jmp 0x1402c64bf
not rbp
jmp 0x1402c691b
lea r10, [r10 + rbp*2 + 0x508f6fa8]
call fcn.1402aec9c
push rbx
push rbp
neg rbp
xor bp, word [rsp + rdx - 0x52406163]
mov qword [rsp + rbp*2 + 0x5ea8333e], r8
push rsi
inc edx
mov rbp, r10
movzx ebx, dl
jge 0x1402b9424
and r10d, esi
mov r15, qword [rsp + rbx*2 - 0xf954]
mov r10, qword [rsp + rbx - 0x7c72]
mov rsi, qword [rsp + rbx*2 - 0xf944]
mov rbx, qword [rsp + rbx*2 - 0xf93c]
xchg r13, rdi
mov qword [rsp + 0x68], 0xffffffffb92f431d
mov rdi, qword [rsp + 0x80]
seta r13b
jge 0x1402a2773

Function at 0x1402bf058
Capabilities:
Encode data using base64

Disassembly:
movsxd rdi, edi
pop r11
add r8, rdi
mov rdx, qword [r10 + rbp*2]
mov qword [rsp + rbp + 8], 0x34a89183
jmp 0x1402cd839
rol dword [rsp + rbp*4 + 6], 0xb3
mov dil, byte [r10 + rbp*2 + 8]
sub qword [rsp + rbp], 0xffffffffe31c509e
neg rcx
lea r10, [rbp + r10 + 0xa]
mov qword [rsp + rbp + 6], 0xffffffffe7ac9c0e
mov byte ss:[rdx + rbp], dil
mov edi, 0x72bb6337
call fcn.14028238d
mov ebp, 0x34332e0d
call fcn.1402c97cb

Function at 0x140312214
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x20], 0xffffffffbfc33ccf
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.14040c5f8
xor ah, byte [rbx - 0x5ec77119]
lodsd eax, dword [rsi]
xor al, byte [rax - 0x37]
enter 0xffffffffffffad31, 0xffffffffffffffeb
jnp 0x1403122b7
invalid
sbb byte [rdx - 0x36], bh
mov esp, 0xbdb7aaca
mov bl, 0xd0
clc
mov ch, dl
inc dword [rdx]
adc eax, 0x86d262b7
push rbp
mov esi, 0x1207968a
ja 0x1403122d1
sbb r8, rdi
sbb eax, edi
sar edi, 0xff
inc dword [rdi]
fild dword [rcx + 0x2651c4ea]
mov ecx, 0x7ffffff
jmp 0x14031229c
mov cl, dh
fstp xword [rdi - 0x5691bb34]
xchg edi, eax
xor al, 0x12
test al, 0xd8
xchg ecx, eax
popfq
jnp 0x14031227f
jp 0x140312293
add dword [rdi], esp
int 0x8a
jns 0x14031230a
add byte ds:[rax], al
add al, bh
xchg edi, eax
loopne 0x140312347
cli
jae 0x1403122b5
mov dl, 0xbd
movsb byte [rdi], byte [rsi]
movabs dword [0x44199086e4da733], eax
add byte [rax], al
clc
add sp, word [rcx - 0x61f76359]
add esp, dword [rcx - 0x194f9b59]
add esp, dword [rcx - 0x791bc359]
add esp, dword [rcx - 0x2cd7b359]
invalid
clc
invalid
mov dword [rbp - 0x1c], esi
std
fnstcw word [rcx + 0x3f]
out 0xbd, eax
push rsp
jne 0x140312388
xchg edx, eax
out 0xdd, al
invalid
xor dword [rbx], ebp
clc
retf
Function at 0x1403f545c
Capabilities:
Authenticate hmac

Disassembly:
mov r9w, word [r10]
pop r11
call fcn.1403fa50e
push 0xffffffff81098107
rdtsc
sub r10, 8
mov r11d, 0x71a93213
movzx edi, word [rsp + r11 - 0x71a93210]
mov dword [r11 + r10 - 0x71a9320f], eax
dec word [rsp + rdi*4 - 0x3fe01]
lea rcx, [rdi*8 + 0x53bc1193]
pop r9
mov dword [r11 + r10 - 0x71a93213], edx
xor cl, cl
mov edx, 0xe91d3128
xor r11d, 0x22a68eb0
mov ecx, dword [r11 + rbx - 0x530fbca3]
ror r9w, 0xed
and r11, rdi
adc r11b, 4
lea rbx, [r11 + rbx - 0xbc81]
movzx ebp, r9b
lea rbp, [r9 + r11*8 + 0x4c2e9a02]
xor ecx, esi
dec di
ror ebp, 0x2c
not r11
ror ecx, 1
lea rax, [rbp + rdi*8 - 0x5a7c32d7]
ror r9, 0xdc
lea ecx, [rcx + r11 - 0x17919018]
xadd rax, rdi
sar r9d, 0xf1
adc bp, bp
xor ecx, r9d
xadd dx, ax
lea ecx, [rcx + r11*2 - 0x3e1be117]
jae 0x1404331d2
mov edi, dword [rbx]
add rbx, 4
mov r9d, 0x8981adb1
dec r9d
movsx ecx, r9w
xor edi, esi
not edi
xor ecx, r9d
mov eax, ecx
mov r11d, ecx
xor edi, 0x7c2e752e
add r9, rax
rol edi, 2
push rcx
lea r9, [rax*2 - 0x7cf4767a]
xor edi, 0x879fe691
jmp 0x1403fa1cc
lea edi, [rdi + r9 - 0x7cbc2110]
add r9w, 0xc81a
bswap edi
inc dword [rsp + rax - 0x767dfffe]
jo 0x140427626
mov qword [rsp + rcx - 0x767e0000], rsi
call fcn.1404147b2

Function at 0x140409d90
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rax*4 - 0x12ad74a8], 0xfffffffffbbdd6b9
sal qword [rsp + rax*8 - 0x255ae949], 0xa9
xor edx, 0xf08e9db6
xadd byte [rsp + rax*4 - 0x12ad749d], r9b
jb 0x14042761d
mov qword [rsp + rax*2 - 0x956ba4c], rsi
xor dword [rsp + rax*8 - 0x255ae948], edx
shl qword [rsp + rax*2 - 0x956ba54], 0x9f
sar dword [rsp + rax*8 - 0x255ae94c], cl
mov rsi, qword [rsp + rax - 0x4ab5d22]
jne 0x14040d6e5