joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400060b0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.14000a080
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.140006d20
mov ebx, 1
lea rcx, [0x1400055a0]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.140010410
mov rcx, rax
call fcn.140014fb8
mov ecx, eax
call fcn.140012ea8
mov ecx, ebx
mov qword [rsp + 0xe0], rax
call fcn.140010410
mov rcx, rax
call fcn.140014fb8
mov ecx, eax
call fcn.140012ea8
lea ecx, [rdi + 2]
mov qword [rsp + 0xe8], rax
call fcn.140010410
mov rcx, rax
call fcn.140014fb8
mov ecx, eax
call fcn.140012ea8
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140006218
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140006230
lea rdx, str.Error_creating_child_process__n
lea rcx, [0x140027bf8]
call fcn.140001cb0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.14000a050
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x1400062d0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rsi, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.140010254
mov r15, rax
test rax, rax
je 0x1400063e3
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.14000cb38
test eax, eax
js 0x1400063e3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140013880
mov rbx, rax
cmp rax, rsi
jb 0x1400063de
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rbp, [rbx - 0x2000]
cmovb rbp, r13
sub rbx, rbp
cmp rbx, rsi
jb 0x1400063d4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.14000cb38
test eax, eax
js 0x1400063d4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000c868
cmp rax, rbx
jne 0x1400063d4
sub rbx, rsi
add rbx, 1
je 0x1400063bb
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14000b6c0
test eax, eax
je 0x1400063cd
dec rdi
sub rbx, 1
jne 0x1400063a0
lea rbx, [rsi - 1]
add rbx, rbp
test rbp, rbp
jne 0x140006340
jmp 0x1400063d4
lea r13, [rbp - 1]
add r13, rbx
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140010240
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1400069d0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2070
call fcn.14000a080
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebx, ebx
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140006aa1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140006a58
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140006aa1
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.140010238
mov rbx, rax
test rax, rax
je 0x140006aa1
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140006aa1
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov rcx, rbx
call fcn.140010240
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x140006aba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
lea r9, str.S_1_3_4
test rbx, rbx
lea r8, str.D:_A__FA____s_
mov edx, 0x1000
lea rcx, [rsp + 0x60]
cmovne r9, rbx
call fcn.1400066d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov dword [rsp + 0x48], 0x18
lea r8, [rsp + 0x50]
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x140006b2e
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
jmp 0x140006b33
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14000a050
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2070
pop rdi
ret
Function at 0x14000aac0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ab0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ab0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ab0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ab0a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ab0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ab0c
xor al, al
add rsp, 0x28
ret

Function at 0x14001269c
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400126bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011e5c
or eax, 0xffffffff
jmp 0x1400126be
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400129ec
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x14001272b
call fcn.140011ecc
mov dword [rax], 0x16
call fcn.140015cfc
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000a050
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x1400126f2
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140012799
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14001276c
cmp eax, 3
jbe 0x140012789
cmp eax, 8
je 0x140012779
cmp eax, 0x12
je 0x140012789
call fcn.140011ecc
mov dword [rax], 0x16
jmp 0x140012702
call fcn.140011ecc
mov dword [rax], 0xc
jmp 0x140012702
call fcn.140011ecc
mov dword [rax], 2
jmp 0x140012702
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.140012934
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140012934
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140012934
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001b404
test eax, eax
jne 0x1400127f7
mov rax, rdi
jmp 0x140012706
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140015d1c
int3
jmp 0x1400126c4
Function at 0x1400129f4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x140012869
call fcn.140011ecc
mov dword [rax], 0x16
call fcn.140015cfc
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000a050
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x140012835
test rbx, rbx
je 0x140012835
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400128c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14001289d
cmp eax, 3
jbe 0x1400128b7
cmp eax, 8
je 0x1400128aa
cmp eax, 0x12
je 0x1400128b7
call fcn.140011ecc
mov dword [rax], 0x16
jmp 0x140012845
call fcn.140011ecc
mov dword [rax], 0xc
jmp 0x140012845
call fcn.140011ecc
mov dword [rax], 2
jmp 0x140012845
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.140012934
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140012934
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140012934
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001b404
test eax, eax
je 0x140012848
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140015d1c
int3
jmp 0x14001280c

Function at 0x140012f20
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140012f40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011e5c
or eax, 0xffffffff
jmp 0x140012f42
xor eax, eax
add rsp, 0x28
ret

Function at 0x140014810
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001463c
Function at 0x140f8c634
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f8c63e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f8c667
pop rbp
sub rbp, 0x33
sub rbp, 0xf8c634
sub rsp, 0x20
jmp 0x140f8c686
mov rax, 0xf8c634
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x127104c0
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f8c6a5
jmp 0x140f8c6bc
mov byte [rcx + 0x29], cl
cld
rol al, 0xc0
mov byte [rcx + 1], al
enter 0xffffffffffffc0c1, 0xffffffffffffffc0
mov cl, al
sub dword [rax - 0x3f37fff9], ecx
rol al, 0x88
invalid
Function at 0x1402396fd
Capabilities:
Encode data using base64

Disassembly:
adc r9, r8
pop rax
neg esi
movzx cx, byte [r10 + rbp*2 - 0x5f02f772]
mov al, byte [r10 + rbp - 0x2f817bb7]
call fcn.1402b5d6f

Function at 0x14023cf72
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rsi - 0x7ffffff8], edi
add rsi, 0xffffffff929f7b19
mov rbp, qword [rsp + rsi*2 - 0x253ef62a]
mov qword [rsp + rsi - 0x129f7b19], rsi
neg byte [rsp + rsi*4 - 0x4a7dec63]
neg r11
movsxd rdi, edi
not rsi
xchg r9d, ecx
add r10, rdi
xchg byte [rsp + r11*4 + 0xf404], al
movzx ax, byte [rsi + r8 + 0x129f7b1a]
sal r11d, 0xda
add r9, rcx
mov r9b, byte [r8 + r11*8 + 2]
lea r8, [r8 + rsi + 0x129f7b1c]
jns 0x1402832ff
mov edi, 0x9310e212
inc rdi
mov cx, word [r11]
mov r10d, edi
call fcn.1402ddb1a

Function at 0x14024a7a1
Capabilities:
Encode data using base64

Disassembly:
dec qword [rsp + rcx + 8]
call fcn.14027581d
xor r8d, ebx
lea rsi, [rdi*4 - 0x266bfd7]
mov ecx, 0x978b3a34
inc dl
neg r8d
shr cl, 1
lea rbp, [rdi + rsi*2 - 0x18c08553]
bswap r8d
ror r8d, 3
xchg edi, ecx
not r8d
rol si, 1
sbb rdx, rbp
cmovbe ebp, ecx
push rbx
xor dword [rsp], r8d
and bp, dx
movzx eax, cx
pop rbx
lea rbp, [rax*8 + 0x2d29d5a7]
movsxd r8, r8d
push rdx
sbb bpl, sil
adc r9, r8
xor dword [rsp + rbp - 0x2d2e5e52], 0x9e3a353d
push rdx
mov r8w, word [r10 + rbp*2 - 0x5a5cbca8]
lea r10, [r10 + rbp*2 - 0x5a5cbca6]
movzx esi, byte [rbp + r11 - 0x2d2e5e54]
lea r11, [r11 + rax*2 - 0x12237]
inc rax
xor sil, bl
pop rdx
shr qword [rsp + rbp*2 - 0x5a5cbca8], 0xc7
not cl
ror sil, 1
add sil, 0x21
xor sil, 0xa8
dec sil
sub rdi, 0x14bb49b6
not edx
ror byte [rsp + rbp - 0x2d2e5e53], cl
not sil
sub ecx, edx
jnp 0x14029817f
mov ecx, 0x1c8c68bd
mov r9, qword [rcx + r11 - 0x1c8c68bd]
lea r11, [rcx + r11 - 0x1c8c68b5]
lea rbp, [rbp + rcx*2 - 0x3918d17c]
movzx edx, cl
movzx edi, word [rbp + rcx*2 - 0x3918d17a]
movzx eax, cl
ror dl, 0xa5
xor di, si
mov r8d, 0x6336fc2a
xor di, 0x149b
lea rdx, [rcx + 0xaa6321e]
neg dx
sub di, 0xbe18
movsx r10d, al
sar dx, 0xc5
rol di, 1
not rdx
dec di
bswap r8
jmp 0x14027bdbc
neg di
add r8d, r8d
not dx
ror di, 1
xadd r8d, ecx
sbb dl, dh
shl eax, 0xb
sbb di, 0x5b36
shr al, 7
sets al
xor si, di
add rdi, rsp
ror r8w, 0x85
add r8b, dl
mov qword [rdi + rcx*4], r9
lea rbp, [rbp + rcx*4 - 4]
sbb r8, 0x4204330a
call fcn.1402c1c82
xor r11d, r8d
and r11d, 0xff
mov r11d, dword [rdx + r11*4]
shr r8d, 8
xor r8d, r11d
call fcn.1402b590f
mov r9d, 0x478aff07
lea rbx, [rbx + r9 - 0x478aff0b]
mov edx, r9d
mov eax, dword [rbx + r9 - 0x478aff07]
lea rcx, [rdx + r9*2 + 0x4a83dd9c]
lea rcx, [rcx + r9*8 - 0x7fe1a953]
mov edi, ecx
xor eax, ebp
lea rdx, [rdx + rdi*8 - 0x7bed2df4]
ror eax, 1
xor eax, 0x6509478f
movzx r11d, dl
xchg r11, r9
ror eax, 1
sal edi, 0x48
call fcn.1402ae790
mov ecx, 0xcd0b2a0b
movsx edx, cl
xchg dh, cl
mov rbp, qword [rdx + r10 - 0xb0b]
movsx edi, cx
call fcn.14024e0dd
xor eax, ebx
lea rdi, [rbp*4 - 0x716fe344]
not eax
jmp 0x1402998a5
not eax
dec rcx
xadd rbp, rdx
dec edi
xor eax, 0xaba580a7
push rbx
jmp 0x1402bd1cb
xor bl, sil
lea rsi, [rsp + rsi + 8]
jmp 0x1402e2533
ror eax, 2
xor eax, 0x65297e1a
bswap eax
movzx edx, di
sub r8b, r8b
jbe 0x140291620
Function at 0x14024f5ea
Capabilities:
Encode data using base64

Disassembly:
push 0x1fb9bd09
lea rsp, [rsp + 0x10]
je 0x1402bae45

Function at 0x1402582e5
Capabilities:
Encode data using base64

Disassembly:
sub qword [rsp + r10 - 0x63276cfd], 0x57008126
lea rbp, [rbp + r10 - 0x63276d03]
mov eax, dword [r10 + rbp - 0x63276cff]
xor qword [rsp + r10 - 0x63276cff], r10
shr r8, 0x2b
xor eax, esi
call fcn.140283a6a
mov qword [rsp + r10 - 0x63276cff], 0xffffffffcc145e1e
xadd cx, ax
mov qword [r9 + r10 - 0x63276cff], rdx
push rcx
jb 0x14023a4a0
call fcn.1402da4fc

Function at 0x14025a63d
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [rbx + rsi*4]
shr r8d, 8
xor r8d, esi
inc rdx
xor r8d, 0x7323b582
dec rcx
push 0xffffffffdc071510
lea rsp, [rsp + 0x10]
jne 0x14024821b
pop rsi
jmp 0x14028451b

Function at 0x1402631df
Capabilities:
Encode data using base64

Disassembly:
rol edx, 2
lea rdi, [rcx + r10 - 0xfd87047]
sar r9w, 0x66
bswap edx
lea r8, [rdi + 0x10991aa9]
bswap rcx
lea edx, [rdx + r10*2 - 0x488defc]
sar r10w, 0xc8
neg edx
add qword [rsp + r10 - 0x46d2fff6], 0xffffffff9122343b
call fcn.14029bd7b
mov rax, qword [r11 + 8]
neg cl
neg edi
lea r11, [r11 + rdi - 0x2745265a]
movsx r8d, cx
not rdx
not rax
lea r9, [rdi + rdi + 0x3da518a7]
and rdx, rax
ror rdi, cl
mov eax, r9d
mov qword [r11], rdx
mov r10d, 0x43af3a38
lea rbp, [rbp + r10 - 0x43af3a3c]
sbb r8b, r10b
or cl, 0x35
ror r8w, 0xc3
mov r10d, dword [rbp + r10 - 0x43af3a38]
sbb r8b, 0x89
xor r10d, esi
mov edx, r9d
add edx, 0x6e256714
neg rdx
neg r10d
add di, 0x8a2e
call fcn.1402e1709

Function at 0x14026604d
Capabilities:
Encode data using base64

Disassembly:
adc r9, rdi
dec qword [rsp + rbp + 0x10]
mov rax, qword [r10 + rbp*8]
call fcn.14024741e

Function at 0x1402666a4
Capabilities:
Parse pe header

Disassembly:
xor r11d, 0xda27e735
push 0xffffffffda83951d
shl byte [rsp + 0x20], 0xc5
dec rdx
push 0xfffffffffeb3ba91
lea rsp, [rsp + 0x30]
jne 0x14026e939
mov r10d, 0x2d1bf3a4
pop r10
Function at 0x14026b3d2
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rdi*2 + 0x7196fee2], r9d
mov qword [rsp + rdi + 0x38cb7f65], 0xffffffffa8bd249a
xor rax, 0x6b3eada2
and rsi, 0xffffffffa4a36f83
mov rbp, qword [rsp + rdi + 0x38cb7f7d]
movsxd r9, r9d
ja 0x1402430d4

Function at 0x140280e4f
Capabilities:
Encode data using base64

Disassembly:
mov r9d, dword [rsp + 0x13]
xor dword [rsp + r9 - 0x68], ecx
mov rbp, qword [rsp + r9 - 0x68]
xchg r11b, al
mov esi, eax
ror r11b, 0xe1
movsxd rcx, ecx
and r9, 0xffffffffc61b570c
shr edx, 0xa6
push rsi
add r10, rcx
and rdx, r9
jno 0x1402d353c
push 0xfffffffffd188686
mov ebp, 0xc18fc41c
mov r8, qword [r10]
movsx esi, bp
add qword [rsp], rsi
movsx ecx, word [rsp + 2]
mov bpl, byte [r10 + 8]
neg dword [rsp]
add r10, 0xa
inc qword [rsp]
movsx eax, cx
mov byte [r8], bpl
mov esi, dword [r11]
jl 0x140249f11
add qword [rsp], rax
adc r11, 4
shl cx, 0xe3
pop r8
xor esi, ebx
lea rdx, [r8 + rax*4 - 0x7c445ac8]
bswap esi
jmp 0x1402ce9a7
sar r8w, 0x49
xadd rcx, r8
ror esi, 3
ror eax, 0x5a
not esi
movsx edi, al
jb 0x140246249
lea rcx, [rdx + rsi*2 - 0x214f40d8]
lea rbx, [rdx + rbx - 1]
mov qword [rsp + rdx*2 + 0x10], rax
setle byte [rsp + rdx*2 + 0x17]
rol eax, cl
movzx eax, byte [rdx + rbx]
pop rdx
call fcn.1402c781d

Function at 0x140286be9
Capabilities:
Encode data using base64

Disassembly:
adc rbx, rdi
dec r10w
pop rcx
pop rdx
jno fcn.1402bef60
ror ecx, 2
sar rbp, 0xa4
xor ecx, 0x65297e1a
ror dil, 0xa4
jb 0x1402e5805
bswap ecx
call fcn.1402917f5
rol r8w, 0xe4
movsx edx, sil
mov rsi, qword [rsp + r8 - 0x5de9cbe8]
cmovb edx, r8d
movsxd rdi, edi
sal byte [rsp + r8 - 0x5de9cbee], 0xc4
jae 0x14027c1b4

Function at 0x14028bdb2
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [r8 + r9 - 0x6b8ea4ff]
bswap rdi
lea r8, [r8 + r9 - 0x6b8ea4ff]
call fcn.1402a65f2

Function at 0x1402abc00
Capabilities:
Encode data using base64

Disassembly:
sar eax, cl
lea rbx, [rsi + rbx - 0x1a]
mov qword [rsp + rsi - 0x16], 0x6cbe7aab
mov r9d, dword [rsi + rbx - 0x16]
inc si
xor r9d, ebp
xor rsi, rsi
jl 0x140271dcf
inc r9d
push rsi
shr byte [rsp + rsi + 0xe], 0x21
rol r9d, 1
push r11
sub rsi, 0xfffffffff01b7f95
not r9d
lea rcx, [rsi + rsi + 0x63a01fb5]
pop rdi
movsx eax, word [rsp + rsi - 0xfe48059]
lea r9d, [r9 + rcx*2 - 0x3595f75f]
mov qword [rsp + rsi - 0xfe4805b], rbp
xor dword [rsp + rsi - 0xfe4805b], r9d
shr qword [rsp + rsi - 0xfe48063], cl
jp 0x1402cc657
Function at 0x1402c69d5
Capabilities:
Encode data using base64

Disassembly:
push 0x6d9a0f8b
lea rsp, [rsp + 8]
call rax
mov edx, 0xa4b93f1e
movsx ecx, dl
mov rsp, qword [rbp + rcx*2 - 0x4c]
bswap rcx
lea r10, [rdx + rdx*4 - 0x50eebf7e]
mov ebx, r10d
mov rbp, qword [rbp + riz - 8]
sar cx, 0xa9
and dx, cx
push rcx
mov qword [rbp + riz], rax
pop rdi
sbb rdi, 0xffffffffda04fe95
mov r8, rbp
movzx ebp, dl
and di, 0x17a8
pop rbp
jp 0x140263d0f
movsx r9d, r10b
jg 0x1402c191e
jmp r10
shl di, 0x42
xor r9d, 0x6caa8018
sar byte [rsp + rcx*2 - 0x1df], 0xe4
rol r9d, 2
jmp 0x140252f02
jmp 0x1402454d9
mov rax, qword [rbp + riz]
push 0xffffffffe99dc410
sub rsp, 0x18
jmp 0x14027cc99
pop r10
sal rbx, 0x2d
pop rbx
sar rdi, 0x35
mov eax, edx
adc edx, 0xb0b36102
lea rbx, [rbx + rdx - 0x556c6106]
sal al, 0xa3
rol al, 0x61
and eax, ecx
mov r9d, dword [rbx + rdi*2 - 0x1e0]
bswap rax
sar cx, 0xec
shl cl, 0x87
xor r9d, ebp
inc r9d
jmp 0x1402dcc6a
lea rsp, [rsp + 0x10]
je 0x1402bae65
mov rax, qword [rbp + rbx*8]
jmp 0x1402d3a35
cmp ebx, 1
push 0x69959437
lea rsp, [rsp + 8]
jne 0x14026480a
mov ecx, 0x309ef118
mov rcx, rax
jmp fcn.1402bae53
movzx esi, dil
ror r9d, 2
add dil, 0x32
xor r9d, 0x310bdea6
ror rdx, 0xf1
lea r11, [rsi + rcx - 0x786537e5]
push rsi
bswap r9d
add ecx, esi
jp 0x1402788fa
bswap esi
push rbp
add r9, rax
inc byte [rsp + rsi*2 - 0x748c56c6]
mov di, word [r10 + r8 - 0x652ba500]
shl dword [rsp + rsi*2 - 0x748c56c8], 0x3f
push rbp
mov dx, word [r10 + rbp*2 - 0x194c4e]
mov eax, 0x48907605
mov qword [rsp + r8 - 0x652ba4e8], rax
xor byte [rsp + rsi*2 - 0x748c56b0], 2
mov cl, byte [r10 + rsi*2 - 0x748c56c6]
dec bpl
lea r10, [r10 + r8 - 0x652ba4fc]
shld di, dx, cl
mov word [r10 + r8 - 0x652ba500], di
mov qword [rsp + rbp*2 - 0x194c4e], r9
ret 0x18

Function at 0x1402c6aed
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
jmp 0x1402e6983
push 0x7030b723
lea rsp, [rsp + 8]
add rsp, rcx
jmp 0x1402b7d8e

Function at 0x1402cc664
Capabilities:
Encode data using xor

Disassembly:
xor dword [rsp + rsi*2 - 0x778], r9d
call fcn.1402d81ee
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x36a80ca6], ah
xchg esi, eax
or ebx, edi
mov edi, es
add al, byte [rsi + 0x1a]
test dword [0x1a18f7fc0], 0x66522faf
fcom dword [rbp + 0x3416f03]
xor ebp, dword [rax + 0x36]
xchg edx, eax
xlatb
cmpsb byte [rsi], byte [rdi]
add al, 0x1e
rcl cl, 1
mov esi, 0x2848d94f
jg 0x1402cc685
invalid
Function at 0x1402d9aa8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xb531e19f
add ax, ax
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
jmp 0x1402e4a7b
cmp ebx, 4
push 0xffffffff9695cf87
lea rsp, [rsp + 0x10]
jne 0x14029a8e1
mov r9, rax
call fcn.1402a95d6

Function at 0x1402dd621
Capabilities:
Encode data using base64

Disassembly:
movsxd r10, r10d
shl eax, 0xec
add rbx, r10
push rax
sar dword [rsp + rax - 0x3a481000], 0x2d
mov r11d, dword [r11 + r8 - 0x6a138d69]
push rdi
setb dil
pop rax
pop r9
jns fcn.1402bef60
mov word [rsp + rdx - 0x2d04], dx
xor dword [rsp + rdx - 0x2cfd], r8d
rol word [rsp + rdx - 0x2d05], 0xc3
lea rsi, [r9*8 + 0x3fa2b88a]
mov rsi, qword [rsp + rdx - 0x2cfd]
shr r9w, 0x41
movsxd r8, r8d
call fcn.1402e09b3
dec r9b
xor r9b, 0xb0
or si, 0xe20b
shl sil, 1
rol r9b, 1
xor bpl, r9b
and ax, cx
jae 0x1402e0d8f
xor ecx, 0x1fb3a3a7
lea rdi, [r8 + rdx*4 + 0x6a139e27]
ror r10d, 1
shl eax, cl
xchg edi, r8d
sub r10d, 0xc1b26e36
not dil
ror r8b, 0xe1
lea rax, [rdx*4 + 0x2e262235]
bswap r10d
sub rdx, rdx
cmovge rax, r8
push rsi
shl rcx, cl
add ax, 0x1719
xor dword [rsp + rdx], r10d
jmp 0x1402a309f
inc r8w
ror edi, 0x1d
pop rsi
jp 0x1402516f6
call fcn.140257a27
mov ecx, 0xc21825ae
sub rbx, 1
movzx r9d, byte [rbx]
mov eax, ecx
movzx edx, ax
xor r9b, bpl
movsx edi, dx
add r9b, 0xb6
movsx esi, dl
ror r9b, 1
or dx, 0x2e25
or dx, di
sar eax, 0x52
xor r9b, 1
mov r11d, edx
rol cl, 0xe1
jb 0x140278af5
adc r9, rsp
mov edx, dword [r9 + rdx*2 - 0x5f5e]
neg di
lea r8, [r8 + rdi*2 - 0x1b4a8]
mov dword [r8 + rdi*8 - 0x6d290], edx
lea rbx, [rbx + rdi*4 - 0x3694c]
sbb ecx, 0x72eb420
rol rsi, cl
mov edi, dword [rdi + rbx - 0xda52]
adc sil, al
xor edi, ebp
not edi
xor edi, 0xadbcb28d
dec sil
call fcn.1402c38f0

Function at 0x1402e2fa5
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r9*4 + 4], rsi
call fcn.140254240

Function at 0x1402e4c09
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jmp 0x14025137e

Function at 0x1402e51ce
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebx
xor ecx, ecx
cmp ebx, 4
lea rsp, [rsp + 0x10]
jbe 0x1402c0ac7
call fcn.1402c0ab9
movzx r11w, byte [r8]
mov edx, 0x2f8476a3
shr dl, 0xe5
mov cl, byte [r8 + rdx*2 - 0x5f08ec08]
movzx eax, dl
dec eax
jge 0x1402d370e
Function at 0x1402e8582
Capabilities:
Encode data using base64

Disassembly:
ror qword [rsp + rbp], 0x65
bswap esi
lea rdi, [rdx + r8*2 + 0x7be1a06]
xor esi, 0x3c2921a6
dec esi
neg esi
push rdx
lea esi, [rsi + r8*2 - 0x7101cfa5]
sar rdi, 0xe5
xor esi, 0xc79f65bd
call fcn.14029c47f
xadd dword [rsp + rsi*4 - 0x525a721e], esi
dec byte [rsp + rcx + 0x20c90858]
neg r8d
add r8d, 0xf329ff04
not sil
and dword [rsp + rcx + 0x20c90856], 0x798ab137
not r8d
jo 0x14027ce5e
and qword [rsp + rcx*2 + 0x419210a8], rsi
sub qword [rsp + rcx + 0x20c90854], rbp
inc r8d
dec qword [rsp + rcx + 0x20c90854]
movzx eax, bp
rol r8d, 1
mov qword [rsp + rsi - 0xa69], rbx
not rsi
xor dword [rsp + rsi*8 + 0x5350], r8d
movsx ebx, sil
sar cx, 0xcb
ja 0x1402d2d4b
pop rbx
setae cl
lea rdx, [rax + rbp*2 - 0x53def5e8]
not cx
movsxd r8, r8d
movzx edi, cx
xor eax, edx
adc rsi, rbp
add r9, r8
mov rsi, qword [r10 + rcx*2 + 0x4193fe02]
mov cl, byte ss:[rsi + rcx*2 + 0x4193fe02]
movsx r8d, di
inc edx
ror r8, 0xb6
lea r10, [r10 + rbp*4 - 0x25a6a]
not edx
mov word [r10 + rbp*2 - 0x12d38], cx
jmp r9
xor esi, ebx
mov qword [rsp + r8*8 - 0x6de00060], 0xffffffffb8242b13
mov ecx, eax
rol esi, 3
jmp 0x14025ede3