joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009cfd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009d0eb
movabs rax, 0xfce73fea784962f1
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x9cbb4a057606a30d
mov qword [r11 - 0x20], rax
movabs rax, 0x8b9550ac012d0db3
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x9cbb4a057662d16c
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009d062
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009d057
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009d0a8
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009d074
mov rax, qword [0x1800c4508]
test rax, rax
jne 0x18009d0cf
call fcn.180047230
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180023250
mov qword [0x1800c4508], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1800466c4
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009d0fc
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.1800a08b8
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18009d110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009d22b
movabs rax, 0xe3f239fe784962f1
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x9cbb4a057662d118
mov qword [r11 - 0x20], rax
movabs rax, 0x8b9550ac012d0db3
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x9cbb4a057662d16c
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009d1a2
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009d197
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009d1e8
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009d1b4
mov rax, qword [0x1800c4508]
test rax, rax
jne 0x18009d20f
call fcn.180047230
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180023250
mov qword [0x1800c4508], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1800466c4
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009d23c
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.1800a08b8
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18009e248
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009e363
movabs rax, 0xfce73fea654c68fb
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0x9cbb4a057606a30d
mov qword [r11 - 0x20], rax
movabs rax, 0x8b9550ac012d0db3
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x9cbb4a057662d16c
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009e2da
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009e2cf
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009e320
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009e2ec
mov rax, qword [0x1800c4508]
test rax, rax
jne 0x18009e347
call fcn.180047230
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180023250
mov qword [0x1800c4508], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1800466c4
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009e374
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.1800a08b8
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800a2790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x1800a2819
mov rax, qword [rcx]
xor r9d, r9d
test rax, rax
je 0x1800a2819
mov rbx, qword [rax + 0x10]
mov r10d, r9d
cmp byte [rbx], r9b
je 0x1800a27cb
inc r10
cmp byte [r10 + rbx], r9b
jne 0x1800a27c2
movabs r11, 0xcbf29ce484222325
test r10, r10
je 0x1800a2814
mov al, byte [r9 + rbx]
movzx ecx, byte [r9 + rbx]
add al, 0x20
mov r8b, byte [r9 + rbx]
sub r8b, 0x41
movzx edx, al
cmp r8b, 0x19
movabs rax, 0x100000001b3
cmova edx, ecx
inc r9
imul r11, rax
movsx rcx, dl
xor r11, rcx
cmp r9, r10
jb 0x1800a27da
mov rax, r11
jmp 0x1800a281b
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x1800a2f94
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rcx
cmp edx, 1
jne 0x1800a3132
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800a303c
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1800a303c
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0x9f50b523
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x1800a3037
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1800a300c
cmp edi, 0x4277c37d
je 0x1800a3041
test r10d, r10d
jne 0x1800a2fef
mov rax, qword [rax]
jmp 0x1800a2fca
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r8
call rax
mov rax, qword [0x1800c4a70]
test rax, rax
jne 0x1800a3117
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800a30f2
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x1800a30f2
mov r14d, dword [r9 + 0x20]
dec r11d
mov esi, 0xa7efa7f7
lea rcx, [r14 + r11*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov bl, byte [r10]
inc r10
test bl, bl
je 0x1800a30ed
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r10]
cmova edx, ecx
inc r10
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x1800a30c2
cmp esi, 0xc1704bef
je 0x1800a30f7
test r11d, r11d
jne 0x1800a30a5
mov rax, qword [rax]
jmp 0x1800a3080
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1800c4a70], rax
and qword [rsp + 0x28], 0
lea r8, [0x1800a2f80]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14078c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14078c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14078c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078c06f
add dl, dl
jne 0x14078c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078c0f6
xor eax, eax
add dl, dl
jne 0x14078c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078c1ad
add dl, dl
jne 0x14078c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14078c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14078c07e
mov eax, 1
add dl, dl
jne 0x14078c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078c0fb
sub eax, ebx
mov ebx, 1
jne 0x14078c14c
mov ecx, 1
add dl, dl
jne 0x14078c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14078c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078c15d
cmp eax, 0x7d00
jae 0x14078c19b
cmp eax, 0x500
jb 0x14078c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078c07e
cmp eax, 0x7f
ja 0x14078c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14078c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14078c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1406cf058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406cf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406cf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cf06f
add dl, dl
jne 0x1406cf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cf0f6
xor eax, eax
add dl, dl
jne 0x1406cf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cf1ad
add dl, dl
jne 0x1406cf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406cf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406cf07e
mov eax, 1
add dl, dl
jne 0x1406cf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cf0fb
sub eax, ebx
mov ebx, 1
jne 0x1406cf14c
mov ecx, 1
add dl, dl
jne 0x1406cf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406cf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406cf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406cf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cf15d
cmp eax, 0x7d00
jae 0x1406cf19b
cmp eax, 0x500
jb 0x1406cf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cf07e
cmp eax, 0x7f
ja 0x1406cf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406cf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406cf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003e4c
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 0x5c
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140177f20
mov rax, qword [rsp + 0x30]
mov dword [rax], 0x67452301
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0x10325476
mov eax, 1
add rsp, 0x28
ret

Function at 0x14000a89c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp], 0xffffffff
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x14000a92f
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov dword [rsp + 8], 7
jmp 0x14000a8fa
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x14000a923
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x14000a8f0
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x14000a8b4
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x14012533c
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x10325476
ret

Function at 0x140127288
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x50], 0
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
call fcn.140127464
lea rcx, [rsp + 0x68]
call fcn.1400078e0
nop
mov edx, 0x20
lea rcx, [rsp + 0x68]
call fcn.140127678
mov dword [rsp + 0x30], 0
jmp 0x1401272e1
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x10
jge 0x14012742c
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x62
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x30
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x38
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x32
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x35
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x39
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x37
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x33
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x66
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x36
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x34
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x31
movsxd rax, dword [rsp + 0x30]
movzx eax, byte [rsp + rax + 0x58]
sar eax, 4
and eax, 0xf
cdqe
mov al, byte [rsp + rax + 0x38]
mov byte [rsp + 0x20], al
mov dl, byte [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140008de8
movsxd rax, dword [rsp + 0x30]
movzx eax, byte [rsp + rax + 0x58]
and eax, 0xf
cdqe
mov al, byte [rsp + rax + 0x38]
mov byte [rsp + 0x28], al
mov dl, byte [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.140008de8
jmp 0x1401272d7
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xa8]
call fcn.140007068
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x68]
call fcn.140007a68
mov rax, qword [rsp + 0xa8]
add rsp, 0x98
ret
Function at 0x14012b110
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 8]
mov qword [rax + 0x28], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x5be0cd19
ret
Function at 0x140131b08
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
mov dword [rsp + 0x5c], 0
mov byte [rsp + 0x40], 0
call fcn.14000a93c
mov byte [rsp + 0x41], al
lea rax, [rsp + 0x100]
mov qword [rsp + 0x78], rax
mov dl, byte [rsp + 0x41]
lea rcx, [rsp + 0x90]
call fcn.14000abb4
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.14000780c
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
xor ecx, ecx
call fcn.140130880
nop
mov r9d, 1
mov r8d, eax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x130]
call fcn.140130614
nop
mov rax, qword [rsp + 0x90]
sub rax, 0x18
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x98]
call fcn.14002c01c
mov rax, qword [rsp + 0x130]
movzx eax, byte [rax + 0x20]
test eax, eax
je 0x140131d4c
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
bts eax, 0x1a
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
bts eax, 0x13
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0xc0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xa8], rax
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.1401308b4
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xa8]
call fcn.14013f42c
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb0]
call fcn.1400079d8
mov qword [rsp + 0x38], 0
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xb8]
mov r9, rcx
lea r8, [0x1401dd6b4]
mov rdx, rax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rax + 0x30]
call fcn.14009bf84
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xe0]
call fcn.140007a68
nop
lea rcx, [rsp + 0xc0]
call fcn.140033fe0
nop
cmp qword [rsp + 0x50], 0
je 0x140131d42
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14009c478
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x48]
mov edx, 0x20000013
mov rcx, qword [rsp + 0x50]
call fcn.14009c2e8
cmp dword [rsp + 0x48], 0xc8
jne 0x140131d42
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x50]
call fcn.14009c17c
mov rcx, qword [rsp + 0x130]
call fcn.1401306f0
mov al, byte [rsp + 0x40]
add rsp, 0x120
pop rdi
ret
Function at 0x140144423
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [rsi + 0x50], 0x27
xor edi, dword [rcx + 0x20]
insd dword [rdi], dx
xor dl, byte [rax + 0x77]
and edi, dword [rcx]
invalid

Function at 0x14014640c
Capabilities:
Create directory

Disassembly:
je 0x140146463
jo 0x140146445
sub dword [rbx + 0x64], edi
jne 0x140146470
jb 0x14014644e
pop rax
and al, 0x5b
cmp byte [rbx + 0x74], al
push rsi
invalid
invalid
rcr bl, 1
fcomp st(3)
invalid
invalid

Function at 0x140146455
Capabilities:
Create directory
Packed with generic packer

Disassembly:
rcl byte [rdx - 0x2c]
enter 0xffffffffffffd04c, 0x4c
int3
jbe 0x140146483
jb 0x1401464b8
sub eax, 0x316b562f
push rdx
xor dword [rbx + 0x61], esi
jne 0x140146401
wait
and dword [rbx + 0x2a], ecx
xor cl, byte [rcx + 0x48]
jg 0x1401464ce
cmp eax, 0x7867223e
pop rdx

Function at 0x1401464ef
Capabilities:
Create directory
Packed with generic packer

Disassembly:
insd dword [rdi], dx
cmp eax, 0x604b4a5c
jne 0x140146566
jne 0x140146542
xor dl, byte [rbp + 0x3c]
jbe 0x140146579
pop rbp
je 0x14014653c
cmp dh, byte [rbp + 0x2e]
push rsp
and ebp, dword [rbx]
outsb dx, byte ds:[rsi]
xor ebp, dword [rdi]
push 0x4c98576a
push rdi
cwde
cdqe
push rsp
int 0x5a
scasd eax, dword [rdi]
iretd
jo 0x1401465a5
sub al, 0x54

Function at 0x14014650d
Capabilities:
Create directory
Packed with generic packer

Disassembly:
push rdi
cwde
cdqe
mov rcx, qword [r11 - 0x67]
xchg rbx, rax
xchg r10, rax
xchg rcx, rax
mov cs, word [r9 - 0x6a]
push rdx
invalid

Function at 0x14014655f
Capabilities:
Create directory
Packed with generic packer

Disassembly:
fsub qword [rax - 0x5d2e532a]
shr byte [rdi - 0x5c255831], 1
xlatb
test al, 0x31
xor dword [rdi + 0x6f], edx
outsw dx, word cs:[rsi]
and si, word [rbx + 0x60]
jae 0x1401465ea
sub al, byte [rdi + 0x2c]
push rsp
sub edi, dword [rcx + rax*2 + 0x41]
invalid

Function at 0x14014656d
Capabilities:
Create directory
Packed with generic packer

Disassembly:
fsub qword [rax - 0x5d2e532a]
shr byte [rdi - 0x5c255831], 1
xlatb
test al, 0x31
xor dword [rdi + 0x6f], edx
outsw dx, word cs:[rsi]
and si, word [rbx + 0x60]
jae 0x1401465ea
sub al, byte [rdi + 0x2c]
push rsp
sub edi, dword [rcx + rax*2 + 0x41]
invalid

Function at 0x1401465fa
Capabilities:
Create directory
Packed with generic packer

Disassembly:
xor eax, 0x3959315e
pop rdi
cmp ebx, dword [rdi + 0x3d]
pop rsp
cmp dword [rbp + 0x31], ebx
pop rax
xor edx, dword [rbp + 0x3a]
push rsi
push rbp
xor al, 0x5d

Function at 0x140146610
Capabilities:
Create directory
Packed with generic packer

Disassembly:
insb byte [rdi], dx
and al, 0x20
push rsi
push 0x45
je 0x140146671
pop rdi
push 0x3e5e4063
xor al, 0x2e
push 0x4b2b5f48
and edi, dword [rdi]
push rsp
je 0x140146679
invalid
xor eax, dword [rax + 0x2c]
cmp esp, dword [rdi]
xor rax, 0x42787c76
xor eax, 0x42787c76
sub bh, byte [rdi + rbx*2 + 0x23]
jae 0x1401466aa
sub dword [rbx + 0x4f], edx
insb byte [rdi], dx
jne 0x1401466c4
invalid
adc dword [rsi + 0x5b7b3164], 0x527a7133