joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401de850
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402326d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x218]
mov rsi, qword [rcx]
mov rbx, rcx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1401de8c1
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rbp
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.1401cab20
mov rcx, rsi
cmp rdi, 0xffffffffffffffff
jne 0x1401de8e6
lea rdx, [0x140297c50]
call fcn.1401c7400
lea eax, [rdi + 0x1f]
jmp 0x1401de94d
lea rdx, [0x140297c28]
call fcn.1401c7350
mov edx, 1
mov rcx, rdi
mov dword [rbx + 0x568], 0
mov qword [rbx + 0x218], rdi
call fcn.1401edc10
mov dword [rbx + 0x234], 1
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x1401de94b
mov rcx, qword [rsi + 0x280]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x1401de94b
mov rcx, rbx
call fcn.1401de720
mov eax, Ordinal_46
jmp 0x1401de94d
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14019e850
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1401e2430
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1401e2482
lea rdx, [0x1402987c8]
call fcn.1401c7400
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x1401e2497
lea rdx, [0x140298790]
call fcn.1401c7350
cmp edi, 0x13
jne 0x1401e24a6
mov rcx, rsi
call fcn.1401e23b0
jmp 0x1401e24d1
cmp edi, 0x14
jne 0x1401e24b5
mov rcx, rsi
call fcn.1401df3a0
jmp 0x1401e24d1
cmp edi, 0x15
jne 0x1401e24c4
mov rcx, rsi
call fcn.1401e2410
jmp 0x1401e24d1
cmp edi, 0x16
jne 0x1401e24d3
mov rcx, rsi
call fcn.1401e2420
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e2bc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
mov ebx, dword [rcx + 0x9ec]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rdi, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x1401e2c4c
test ebx, ebx
jne 0x1401e2c0a
lea rdx, [0x140298840]
mov rcx, rsi
call fcn.1401c7350
mov dword [rdi + 0x58c], ebx
inc ebx
cmp ebx, 2
jne 0x1401e2c33
lea rdx, [0x140298828]
mov rcx, rsi
call fcn.1401c7400
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401debb0
lea rdx, [0x140298808]
mov rcx, rsi
call fcn.1401c7350
xor edx, edx
mov rcx, rdi
call fcn.1401dea70
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401e2a20
Function at 0x1401e9e50
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402326d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1401b6b20
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1401e9eb6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1401e9eb6
lea rcx, [rsp + 0x20]
call qword [fcn.1401a1c2c]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019e850
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019e850
add rsp, 0x148
ret
jmp 0x1401e9e50

Function at 0x1401e9ed0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402326d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1401b6b20
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1401e9eb6
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1401e9eb6
lea rcx, [rsp + 0x20]
call qword [fcn.1401a1c2c]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019e850
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019e850
add rsp, 0x148
ret
jmp 0x1401e9e50

Function at 0x1401edc10
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1401f0900
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1401f0939
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.1401ae420
test rax, rax
je 0x1401f0937
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401f0a10
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402326d0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401f0ae1
xor eax, eax
lea rdx, [rsp + 0x64]
mov rcx, rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.1401f0970
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.1401f5fd0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea r8d, [r9 + 0x14]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1401f0ae5
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1401f0b32
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14019e850
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401f0b60
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.1401f0a10
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.1401f0a10
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401f0a10
Function at 0x1401f0cb0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rbx, r8
mov rbp, rdx
not rcx
dec rcx
mov rsi, rcx
add rcx, rcx
call qword [fcn.1401a0a80]
mov rdi, rax
test rax, rax
jne 0x1401f0cf7
lea eax, [rdi + 0x1b]
jmp 0x1401f0db3
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1401f0c80
lea rcx, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401f0da0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1401f0d93
mov rcx, qword [rsp + 0x30]
lea r8d, [rsi + rsi]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], al
call qword [fcn.1401a0974]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1401f3810
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 3
mov rsi, rdx
jne 0x1401f385a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1401f384a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x1401f38a2
cmp qword [rbx + 0x10], 0
jne 0x1401f388e
mov rcx, qword [rcx + 0x10]
lea rdx, [0x140290dc4]
call fcn.14019f288
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401f388e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.14019ee50
mov rdi, rax
test rax, rax
jne 0x1401f38c5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401f38bc
call fcn.14019eb08
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401f6af0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.1401a0a80]
mov rdi, rax
test rax, rax
jne 0x1401f6b31
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x1401f6b75
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.WS2_32.dll_htonl]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x1401f6bd4
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
dec r12
jne 0x1401f6b90
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401f6c13
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14029c6e9]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14029c6ea]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401f6be0
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x140b892b6
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
push 0xffffffffb60fa0be
dec word [rsp + 3]
shl dword [rsp + 3], 0x25
lea rsp, [rsp + 8]
add rsp, rcx
call fcn.140baf90c
mov r10d, 0x86a0850f
lea rdx, [r10 + r10*4 - 0x715925da]
movsx ecx, dx
lea rdi, [rdi + rcx*2 - 0xe6e6]
neg r10d
movzx eax, r10w
jbe 0x140bc2dce

Function at 0x140b8c4fb
Capabilities:
Encode data using base64

Disassembly:
cdqe
xor r11w, cx
lea rcx, [rsp + rcx + 0x10]
neg word [rsp + r9*4 - 0x6b46c378]
mov qword [rsp + r9*4 - 0x6b46c380], r9
mov qword [rcx + r9 - 0x1ad1b0e0], rdx
inc r10b
lea rdi, [rdi + r9*4 - 0x6b46c384]
bswap r9
cwde
mov ebx, dword [rdi + riz]
xor ebx, r11d
cdqe
neg ebx
ror ebx, 1
cdqe
pop rdx
dec ebx
btr r10, r9
neg ebx
btc dx, 0x99
rol ebx, 3
movzx ecx, r10b
bswap r8
not rcx
mov qword [rsp + rax + 0xc2], r11
xor dword [rsp + rax*2 + 0x184], ebx
btr ax, ax
cbw
jb 0x140ba093a
pop r11
sal r9w, 0x63
movsxd rbx, ebx
neg rcx
add rsi, rbx
not ax
shr r10w, cl
jmp rsi

Function at 0x140b942ae
Capabilities:
Encode data using base64

Disassembly:
bswap edx
mov qword [rsp + r8 + 0x19], r9
adc edx, eax
inc r8d
pop rax
xor rbx, r9
push r11
rol bx, cl
xor dword [rsp], edx
xadd r9, rax
pop r11
rol cl, cl
movsxd rdx, edx
add rsi, rdx
mov r9d, dword [rbp + riz - 2]
neg r8w
rol al, 0x81
call fcn.140ba9c4c
jmp 0x140bcb461
mov edx, 0x820d1597
sub rdi, 4
mov ecx, dword [rdi + riz]
mov r10d, 0xd6ad1432
movsx r9d, r10w
xor ecx, r11d
bswap r9d
neg ecx

Function at 0x140b9ad7b
Capabilities:
Encode data using base64

Disassembly:
mov word [rdx + rbp - 0x25835a20], ax
mov eax, r9d
sub ax, r8w
sar r10d, 0x76
mov edx, dword [rdx + rdi - 0x25835a24]
sar r8w, 0x4a
dec cx
movzx ebx, r9w
lea rdi, [r9 + rdi - 0x642a]
sal bl, 0x81
sal bx, 0x6f
xor r8d, eax
xor edx, r11d
sub ecx, ebx
and r9, r8
ror edx, 2
or r9, rcx
inc edx
neg r8
call fcn.140b942ae
mov edx, 0xc3a5829f
lea r9, [rdx + rdx + 0x5e23baa2]
call fcn.140b9aada
mov qword [rsp + rdx - 0x25835a1e], r9
neg bx
and word [rsp + r9*8 - 0x3211a], 0x8a8d
xor al, ah
sal byte [rsp + rdx - 0x25835a1b], 0xa7
xor r11w, bx
lea rbx, [rsp + rbx + 8]
mov ax, word [r9 + rbx - 0x6424]
pop r8
jmp 0x140b8d148
Function at 0x140b9f184
Capabilities:
Encode data using base64

Disassembly:
sub al, r8b
sub dx, r8w
sbb rdi, 0xc
lea rax, [rax + 0xa99a4bd]
xor rcx, r11
mov byte [rsp + 7], r10b
bswap rcx
sub r10w, dx
dec r9d
adc rcx, 0xb83a739
dec eax
call fcn.140ba6c96
movzx ebx, dx
mov rdi, qword [rsp + r10 - 0x4a182489]
push rbx
sbb dx, 0xb00c
lea rdi, [r10 + rdi - 0x4a1824a5]
lea rcx, [rax*4 - 0x78fb8ffb]
mov eax, dword [rax + rdi - 0xa1]
xor eax, r11d
xchg qword [rsp + rdx - 0x5084], r9
mov qword [rsp + r9 - 0x89], 0xffffffff9409cd82
xchg ebx, ecx
dec eax
ror eax, 3
imul dx, r9w
dec eax
sal cx, 0xc7
adc qword [rsp + r10 - 0x4a18248b], rcx
xor rcx, qword [rsp + r9 - 0x89]
bswap eax
js 0x140ba320d
inc bl
bts ax, 0x9c
xor bl, 0x2e
rol bl, 1
pop rax
neg bl
pop rdx
not bl
lea rax, [rdx*4 + 0x140e0bb7]
btc dx, 0x39
adc bl, 0x2b
xor r11b, bl
rol r9b, 0xc2
jae 0x140bb74fd
mov qword [rsp + r9 - 0x81], r11
mov r8d, 0x1d9cddb2
xor dword [rsp + r9*2 - 0x122], eax
push rcx
mov r11, qword [rsp + r9*2 - 0x11a]
xor byte [rsp + r9 - 0x83], 0x1a
movsxd rax, eax
xchg qword [rsp + r9*2 - 0x122], r10
adc bl, dl
setg bl
adc rsi, rax
mov qword [rsp + r9 - 0x91], 0xffffffffba886a2f
and r9b, 0x8d
mov qword [rsp + r9*4 - 0x204], rsi
ret 0x28
lea rbx, [rsp + rbx + 0x10]
and r9w, dx
sar dword [rsp + 3], 0x70
mov qword [rbx + riz], rcx
mov rcx, qword [rdi + riz - 0xd]
jae 0x140b96ad9

Function at 0x140ba161a
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x28]
mov qword [rbp + riz - 0x10], rsp
sub rsp, rcx
call fcn.140b892b6
sub rdi, 2
mov ebx, 0x2dbe2628
lea rcx, [rbx + rbx*8 + 0x5e01bc34]
movzx r8d, cl
movzx r9d, word [rdi + rbx - 0x2dbe2628]
xor ebx, ebx

Function at 0x140ba23a2
Capabilities:
Encode data using base64

Disassembly:
sal dword [rsp + 0xe], 0xf
call fcn.140b8ee37

Function at 0x140ba7666
Capabilities:
Encode data using base64

Disassembly:
lea rax, [rsi + rcx*4 - 0x7f72aa60]
mov qword [rsp + rcx*4 - 0x83f0], rbx
lea rdi, [rsi + r8*8 + 0x57218e83]
inc rdi
sub al, 0x1d
mov edi, dword [rsp + rcx*8 - 0x10780]
dec edi
neg edi
ror edi, 1
lea edi, [rdi + rdx*2 + 0x168cc68e]
add dx, 0x1eaf
sub r11b, 0x29
btr rcx, rdx
xor edi, 0xfd04f128
dec sil
mov qword [rsp + rcx*2 - 0xcbd6], r9
btc dx, dx
movsx r11d, r8b
inc ecx
movabs rbx, 0
mov qword [rsp + rcx*8 - 0x32ef0], r13
sbb dl, 0x95
neg cl
and cx, 0x3102
push rdi
adc esi, ecx
jne 0x140b8de1f
Function at 0x140ba7e0a
Capabilities:
Encode data using base64

Disassembly:
movsx r9d, dl
mov r10w, word [rbp + rdx*2 - 0x5734c45a]
neg r9
bt r9w, 0x82
lea rbp, [rdx + rbp - 0x2b9a622c]
setb bl
not r8w
not r10w
and r8w, r10w
call fcn.140ba9e6f
mov ecx, 0xb9a7f49b
movzx edx, cl
mov rdx, qword [rbp + rdx - 0x9b]
movsx eax, cx
lea r8, [rcx + rcx*2 + 0x79853a27]
neg al
mov r8, qword [rbp + riz + 8]
xor ax, ax
mov cl, byte [rbp + riz + 0x10]
push rax
sub dword [rsp + 3], eax
adc rbp, 9
movsx r10d, al
jmp 0x140b90ae0
shrd rdx, r8, cl
mov qword [rbp + r10*2], rdx
cdqe
lea rdi, [rdi + rax*2 + 0x1fffc]
mov ebx, dword [rdi + rax*2 + 0x20000]
lea r8, [r10 + rax*8 + 0x7b00ad00]
shr dword [rsp + rax + 0x10004], 2
mov r9d, r10d
xor ebx, r11d
movzx edx, r8w
shl al, 0x83
not word [rsp + rax + 0x10004]
xor ebx, 0xff2f9cb0
lea rcx, [rax + rax*4 - 0x26c6706e]
or r8w, 0x608d
imul eax, r8d
bswap ebx
shl rax, cl
call fcn.140bc5a91
pop r11
sar r8b, 0x62
adc rax, rax
movsxd rcx, ecx
ror r10, 0xb1
neg bx
mul r8w
add rsi, rcx
shl edx, 0x71
mov r9w, word [rbp + rdx - 0x6a560000]
mov cl, byte [rdx + rbp - 0x6a55fffe]
cqo
neg r10b
setle dl
lea rbp, [rbp + rdx*2]
and r8d, ebx
cbw
jg 0x140ba30d3
cmp ebx, 4
jne 0x140ba7432
call fcn.140ba6795
sal r9w, cl
or al, bh
push rdx
mov word [rbp + rdx - 1], r9w
xchg word [rsp + rdx + 4], bx
mov qword [rsp + rdx - 1], rsi
ret
mov eax, 0x3d8065b4
neg ax
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
sub rbx, rax
xor dword [rsp + rbx*2 - 0x44916dee], edx
dec r8w
mov r11, qword [rsp + rbx - 0x2248b6ef]
movsxd rdx, edx
sal r9, cl
shl cx, 0x26
adc rsi, rdx
call fcn.140ba6fa4
mov edx, 0x2b9a622e
movzx ebx, dx
mov r8w, word [rbp + rbx - 0x622e]
movsx ecx, bl
jmp 0x140b8d9cc

Function at 0x140baca01
Capabilities:
Encode data using base64

Disassembly:
mov r10d, dword [rdi + r10*2 - 0xa]
xor r10d, r11d
cwd
idiv rcx
dec r10d
xor r10d, 0x4d902e1a
rol r10d, 1
dec al
and ecx, 0xc2047f35
dec r10d
add rdx, 0x79abc08a
bswap r8
ja 0x140ba0eea
or eax, ebx
lea rcx, [r8 + 0x1f17300f]
rol ecx, cl
movzx ebx, cx
mov dword [rbp + r10*2 - 0xa], eax
movzx eax, cl
lea rdi, [rdi + r10*2 - 0xe]
jae 0x140b8b3ba
push r11
xor dword [rsp + rbx - 0xf174], r10d
lea r11, [rax + rdx*4 - 0x437da05c]
call fcn.140b96fb9
lea rdx, [r9 + r10*2 - 0xdc851e0]
xchg dl, r9b
movzx ebx, byte [r10 + rdi - 0x6690]
mov qword [rsp + r10*4 - 0x19a40], rdx
push rdx
xor bl, r11b
lea r8, [r10 + r9*2 - 0xef2464]
inc bl
btc edx, 0x19
sar word [rsp + rdx - 0x6c45e17c], 0xcc
neg bl
push r8
rol r9b, 0x84
pop rax
sbb bl, 0x24
not bl
dec rax
xor al, 5
xor r11b, bl
sar r8d, 0xad
lea rcx, [r9 + rdx*8 + 0x50204cb6]
lea rbx, [rsp + rbx + 0x10]
push rcx
or qword [rsp + r9 - 0x7c0d6679], 0x49089720
mov r10d, dword [rbx + r9 - 0x7c0d667c]
ja 0x140b9bf64
mov ebx, 0x6b8bc605
lea rax, [rbx*2 + 0x6aba523e]
mov eax, dword [rbx + rbp - 0x6b8bc605]
movzx r10d, bl
imul ebx, r10d
adc ebx, 0x73b055b0
mov ebx, dword [rbp + r10 - 1]
movzx edx, r10b
movsx r8d, r10w
lea rbp, [rbp + r10*8 - 0x24]
lea r8, [r10 + 0x15254723]
adc rdx, r10
not eax
sar r8, 0xd0
not ebx
neg dl
btr dx, r10w
jb 0x140b93017
Function at 0x140baf90c
Capabilities:
Encode data using base64

Disassembly:
call fcn.140b8b20d
mov eax, 0x68096423
lea rdx, [rax - 0x5ddf38f5]
lea r9, [rax + rdx*2 - 0x407772c4]
lea rdi, [rdi + rdx*2 - 0x1454565d]
and rdx, 0x4e80f323
ror al, 0x64
sub r9b, al
movzx eax, byte [rdx + rdi - 0xa002322]
xor al, r11b
xor dx, r9w
call fcn.140b89088
mov ecx, 0x82aa18ae
lea rcx, [rcx + 0x42117bb]
lea rax, [rcx + rcx*4 + 0x1ca29194]
sub rdi, 4
mov r9d, dword [rdi + riz]
rol eax, cl
xchg ch, al
xor r9d, r11d
push rcx
add dword [rsp + rax*2 - 0x6a0e865c], eax
neg r9d
dec r9d
shl qword [rsp + rax - 0x35074330], 0xab
push rax
cdq
not r9d
btc ax, 0x81
lea r9d, [r9 + rax - 0x117fa110]
bswap rcx
rol byte [rsp + rdx + 5], 0xe7
dec dl
xor r9d, 0xc828ee26
mov qword [rsp + rdx*2 - 0x1f6], r11
or dword [rsp + rax - 0x35074331], edx
jbe 0x140bcb482
lea rbx, [rdx + rdx + 0x5503fdb0]
xor dword [rsp + rax - 0x3507432a], r9d
mov r11, qword [rsp + rdx*2 - 0x1f6]
inc ecx
mov qword [rsp + rcx*8], rbx
mov r10d, eax
movsxd r9, r9d
add rsi, r9
sub r10w, cx
mov r9d, dword [rsp + rcx - 1]
mov cx, word [rcx + rbp - 1]
and al, r10b
not rbx
shl dword [rsp + rax*2 - 0x6a0e8656], 0x73
mov ax, word [rbp + rdx - 0xfd]
lea r8, [rbx*4 + 0x278a2408]
lea rbp, [rdx + rbp - 0xfd]
adc cx, ax
push r10
lea rax, [rbx*8 - 0x37e37b74]
mov word [r10 + rbp - 0x35074331], cx
xchg ebx, r8d
sal r10w, 0xab
seta r8b
mov qword [rsp + rdx - 0xff], rsi
ret 0x10
call fcn.140bb0440