joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140416a58
Capabilities:
Read file on windows

Disassembly:
mov ecx, eax
call fcn.140060e6c
or edi, 0xffffffff
mov rcx, rbx
call fcn.14006a4e4
mov eax, edi
jmp 0x14006f15e
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006f10a
cmp dword [rsp + 0xb8], r13d
ja 0x14006f10a
add edi, dword [rsp + 0xb8]
mov rdx, qword [rsp + 0x40]
lea r11, [0x1403473e0]
mov rax, qword [r11 + rdx*8]
cmp byte [rax + r14*8 + 0x38], sil
jge 0x14006efd7
cmp byte [rsp + 0xa0], 2
movsxd r8, edi
je 0x14006f07b
mov r9, qword [rsp + 0xa8]
mov rax, r13
shr rax, 1
mov rdx, r15
mov ecx, r12d
mov qword [rsp + 0x20], rax
call fcn.14006e8e4
mov edi, eax
jmp 0x14006efd7
shr r8, 1
cmp byte [rsp + 0x48], sil
je 0x14006f0f8
mov r10, qword [rsp + 0x50]
mov rax, r10
mov rdi, r10
lea r9, [r10 + r8*2]
cmp r10, r9
jae 0x14006f0eb
mov esi, 0xa
movzx ecx, word [rax]
cmp cx, 0x1a
je 0x14006f0e1
cmp cx, 0xd
jne 0x14006f0c7
lea r8, [rax + 2]
cmp r8, r9
jae 0x14006f0c7
cmp word [r8], si
jne 0x14006f0c7
movzx ecx, si
mov r8d, 4
jmp 0x14006f0cd
mov r8d, 2
add rax, r8
mov word [rdi], cx
lea r8, [rdi + 2]
mov rdi, r8
cmp rax, r9
jb 0x14006f09e
jmp 0x14006f0eb
mov rax, qword [r11 + rdx*8]
or byte [rax + r14*8 + 0x38], 2
sub rdi, r10
sar rdi, 1
add edi, edi
jmp 0x14006efd7
mov rdx, qword [rsp + 0x50]
mov ecx, r12d
call fcn.14006e69c
jmp 0x14006f074
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14006f130
call fcn.140060edc
mov dword [rax], 9
call fcn.140060ebc
mov dword [rax], 5
jmp 0x14006efd4
cmp eax, 0x6d
jne 0x14006efcd
mov edi, esi
jmp 0x14006efd7
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
setl byte [rsp + 8]
cmp byte [rsp + 8], 0x36
mov dword [rsp + 8], 0x61af26b8
jb 0x1404ac4bc
push rsi
call int.140684220
push r13
ja 0x140614604
sub qword [rsp], rcx
push r13
bswap r13
xchg qword [rsp + 0x40], rbp
mov r13, qword [rsp + 0x18]
jno 0x1403fc069
shl qword [rsp + 0x38], 0x59
shr byte [rsp + 0x38], 0x75
mov rcx, qword [rsp + 0x28]
mov word [rsp + 8], 0x30b7
call fcn.1405a1f11
setns cl
je fcn.14059e937
xchg qword [rsp + 0x48], rsi
mov rbp, qword [rsp + 0x40]
call fcn.14065f498
ret
mov dword [rsp], 0x8b24f11e
push rbx
cmp word [rsp + 8], 0x1c33
mov qword [rsp + 0x38], rcx
mov rbx, qword [rsp + 8]
push rbp
jg 0x14006f00f
push r9
add qword [rsp + 0x20], 0xfffffffffff67777
movabs rcx, 0xb7a54ba2aa13760b
mov rbp, qword [rsp + 0x18]
push r8
call int.1405449a7
movsxd r12, ebp
ja 0x1405b4128
pushfq
sub r14d, 0xf39bc4ac
mov r14w, 0x8534
xor r14b, r14b
setge r14b
lea r14, [r14 + r14 - 0x788897a]
mov r14, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x359ffa2f
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407a20f4

Function at 0x14041e6aa
Capabilities:
Packed with generic packer

Disassembly:
shr r14w, 0xe3
add r14, 0x89486b4
mov r14, qword [rsp + 0x18]
je 0x1406bce2f
ja 0x14061f8d2
jle 0x14042f2ca
cmp bpl, 0x97
push r8
mov r8, rbp
je 0x1403fc795
ja fcn.14071bc57
xchg qword [rsp + 0x48], rdx
mov r14, qword [rsp + 0x30]
js 0x140707ae0
pop rbp
add byte [rsp + 0x30], 0x3d
shl qword [rsp + 8], 0x2d
push qword [rsp + 0x28]
call fcn.1404a6ba5
jge 0x140533de2
Function at 0x140432251
Capabilities:
Encode data using xor

Disassembly:
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
test cl, 7
setne dl
bt ecx, 9
setb al
and dl, al
bt ecx, 8
setb al
test al, dl
jne 0x140077c32
mov dword [rbx], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov word [rax + rax], ss
movabs rbp, 0x4f9c5694d439fa07
push r12
jl 0x140077c0e
shr rbp, 0x8d
add qword [rsp + 0x10], 0xffffffffbfb97d24
push r8
mov r12, rbp
mov rbp, qword [rsp + 0x30]
mov rbp, qword [rbp + riz]
mov r8, rsi
shl r8b, 0xf7
bswap rsi
jns 0x1405f27cb
mov ebx, 0x21
mov es, word [rcx - 0x7e47ffcb]
xor eax, 0x5106e800
add byte [rsi], al
js 0x14043228f
jge 0x140432239
mov ebx, 0x51586dba
sbb ah, byte [rbp + 0x30a86d9a]
xchg esp, eax
insd dword [rdi], dx
test dword [rax + 0x3c925845], 0x9240a012
lahf
retf

Function at 0x140436de3
Capabilities:
Authenticate hmac

Disassembly:
push rdi
mov rax, qword [rsp + 8]
mov rax, qword [rax]
sub r10b, 0xa2
mov rdi, r10
bswap rbp
test edi, ebp
call fcn.140570ab8
add qword [rsp], 0x4c4cf
and bpl, r10b
jge 0x1404cad1b
movabs rax, 0xd39d6037a12f1f0e
cmp rax, 0xfffffffff18fef05
jno 0x14002e246

Function at 0x140436e0c
Capabilities:
Authenticate hmac

Disassembly:
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x14005739b
test byte [rbx], 8
jne 0x140057396
test rax, rax
jne 0x14005739b
mov edi, 0x1994000
mov edx, 1
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x28]
mov qword [rsp + 0x30], rsi
mov ecx, 0xe06d7363
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_RaiseException]
pop rax
push r9
pushfq
movabs r9, 0x9c9934b2760967bf
test r9w, r9w
setne r9b
movsx r9d, r9b
and r9d, 0x5388b29b
test r9, 0xffffffffb70de73c
xchg qword [rsp + r9 + 0xf], rax
jb 0x14059eeec
bswap r9d
jl 0x14005737c
shr r9, 0x2f
shl r9b, 0x5c
call fcn.14059d1b1
js 0x14060d296
add qword [rsp + 0x18], 0xfffffffffff15843
neg r14w
xor r14, 0xffffffffd231a235
shl ebx, 0xb9
movabs rax, 0x4e291929e722610c
and r14, 0xffffffffad13f58f
jbe 0x140350ac0
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
movabs rbx, 0xc08e7482b0a11938
jge 0x1406593aa
cmp edx, 0xeea032bd
not dx
lea rax, [rax - 0x19f67cc6]
lea rbx, [r14*4 + 0x34ac641c]
jg 0x1404bae7b
movabs rdx, 0xdb3f7128f89b219e
lea rbx, [r14 + rbx*4 + 0x7bb28402]
shl rdx, 0x44
call fcn.140568156
scasb al, byte [rdi]
invalid
lea rcx, [rcx + 0x3b810716]
call fcn.14043eb82
push r14
call fcn.14066cf3a
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
ret
jb 0x1404fd880
jge 0x14069197f
mov qword [rsp + 0x10], 0x285b1b35
lea rsp, [rsp + 0x10]
call fcn.1407d1649
movsd dword [rdi], dword [rsi]
xor dword [rsi + 0x3cfb1e6e], ecx
int3
neg rbp
mov byte [rsp + 0x50], bpl

Function at 0x1404373f3
Capabilities:
Packed with generic packer

Disassembly:
jne 0x140547b01
add dword [rdx - 0x1d], edx
or edx, dword [rdi]
xlatb
invalid
Function at 0x14043a5c0
Capabilities:
Encode data using xor

Disassembly:
pushfq
push r14
movabs r14, 0x7b39eb96059d08b3
movzx r14, r14w
add qword [rsp + 0x10], 0x41660
push rbp
movabs rbx, 0x4f3b9b389eb36d0a
push r10
test bl, 0xa
push r8
jno 0x1406e8b98
lea rbx, [rbx + rbp - 0x50da9ae0]
call fcn.140541a60
push send
fisubr word [rax + 0x47af7e30]
mov al, 0xde
out 0x30, al
invalid
push r13
mov rbp, r14
seto bpl
mov rbx, qword [rsp + 0x30]
mov rbx, qword [rbx + r14*2 - 0x1166]
mov r8, r14
mov r10, r8
mov qword [rsp + rbp - 0x7d0], r14
xor r14b, 0xb6
setbe r14b
jg 0x14052ff73

Function at 0x14043dda2
Capabilities:
Read file on windows

Disassembly:
je fcn.140416a58
neg word [rsp + rbx - 0x10980798]
test word [rsp + rbx*2 - 0x21300ff6], r12w
xchg qword [rsp + r11 - 0x57bb1309], rcx
mov rbx, qword [rsp + 0x48]
setbe r12b
or qword [rsp + 0x68], 0xffffffffd61cfcbc
call fcn.14044b8ef

Function at 0x14043efd6
Capabilities:
Encode data using xor
Encrypt data using aes mixcolumns step
Packed with generic packer

Disassembly:
je 0x1406dde82
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.14084c046
pop rdx
call fcn.1404e5c1d
mov r8, qword [rsp + 0x10]
jbe 0x1403c9e31
jg 0x1406dde82
call 0x14043efd6

Function at 0x1404498a2
Capabilities:
Packed with generic packer

Disassembly:
lea rcx, [rcx + 1]
call fcn.1404b93e7
sub r12d, 0xaabd4cb2
mov dword [rsp + r12 - 0x3a7dfaca], 0x3e1ed6ba
add dword [rsp + r12*2 - 0x74fbf5c4], r12d
mov r12, qword [rsp + r12 - 0x3a7dfac2]
add byte [rsp + 0x30], 0x16
call fcn.140482605

Function at 0x1404545d1
Capabilities:
Packed with generic packer

Disassembly:
and r8d, 0x6eb2fc3b
mov r12, qword [rsp + 0x30]
mov r8, qword [rsp + r8 - 0x6322bf2]
jno 0x1404498ab

Function at 0x140456163
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
and dword [rsp + 0x10], 0x4bb34533
mov qword [rsp + 0x20], r15
jo fcn.1404a861a
lea rbx, [rbx + 0x36a4adad]
setb byte [rsp + 0x10]
shr r15, 0x20
or r15d, 0x1a7b691
shr word [rsp + r15*4 - 0x69eda34], 0x65
xchg qword [rsp + r15 - 0x1a7b669], rbx
mov r15, qword [rsp + r15*2 - 0x34f6d1a]
test byte [rsp + 0x20], 0x99
sete byte [rsp + 0x10]
ja fcn.14055f209
jae 0x14055f1e1
push r13
pushfq
movabs r13, 0xa92fa9b60a38ef08
mov r13, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffb59ba82d
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1407a20f4
call fcn.140423039
in eax, dx
movsb byte [rdi], byte [rsi]
invalid

Function at 0x1404604ed
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
jle 0x14046bf60
lea rax, [rax - 0x3af5f7ca]
test bl, 0x8a
mov qword [rsp + 0x40], rcx
jns 0x1403efba7
and rbp, 0xffffffffb028d735
mov rbp, qword [rsp + 0x10]
jae 0x1404e6009
mov rbp, qword [rsp + rbp*2 + 0x18]
mov rbp, qword [rbp + riz]
lea rsp, [rsp + 8]
ret 0x10
jne 0x1405c12d4
pop rax
push 0x241ebf0e
pushfq
cmp dword [rsp + 8], 0x870485a4
jge 0x14060e475
punpckldq mm7, dword [0xe054fd8a]
outsb dx, byte [rsi]

Function at 0x140467776
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x40], rsi
mov r15, qword [rsp + 0x38]
xor r10w, 0x2d1d
neg r10b
movzx r10d, r10b
jns 0x14047bbcb
call fcn.1406d3cf8
Function at 0x140467793
Capabilities:
Packed with generic packer

Disassembly:
movabs rdx, 0xfa19872a1023b838
pushfq
shl dl, 0x78
or rdx, 0xffffffffdfbceb15
jg 0x1406ada33
xchg qword [rsp + rdx + 0x204004fb], rsi
push r8
push rax
movabs r8, 0x8dbe771a6407250f
call fcn.140020c36
neg byte [rsp + 0x48]
sub dword [rsp + 0x48], 0xb904ec19
add qword [rsp + 0x58], 0x136e19d
add qword [rsp + 0x60], 0xffffffffbfa9dc50
call fcn.14048ac46
loop 0x1403bd90f
insd dword [rdi], dx
test eax, 0x13684a7c
sal byte [rdx], cl
or byte [rcx - 0x56], 0xf2
jle 0x1403bd95e
mov dl, 9
scasb al, byte [rdi]
invalid
lock add byte [rdx], dh
lodsd eax, dword [rsi]
mov edx, 0x8797653f
vmread qword [rdx + 0x75], rdi
xor edx, dword [rdx + 0x28e65775]
fisubr word [rax]
mov dl, byte [rbp - 0x1133bcab]
outsd dx, dword [rsi]
adc cl, byte [rbx]
pop rax
sub ah, byte [rdx - 0x65]
in al, dx
or al, 0xbe
invalid
push rbx
lea r8, [rdx + riz - 0x3a60c4e1]
jno 0x1406ebb50
pop rcx
call fcn.1403cf3bf
call fcn.14055b8d5
jns 0x1405b1e65
je 0x1405ddeed
call fcn.140401db1
push qword [rsp + 0x10]
popfq
movabs r15, 0x71392bb873933eaa
call fcn.14061ba41
jbe 0x1403bd8eb
test r12b, 0xaf
xchg qword [rsp + 0x68], rdi
mov r10, qword [rsp + r10 - 0x419ba519]
jne 0x1404ada84

Function at 0x14046bf3f
Capabilities:
Authenticate hmac

Disassembly:
sub r14, r14
mov qword [rsp + 0x18], rcx
xor r14b, 0x39
push rbp
add qword [rsp + r14*2 - 0x6a], 0x2b2bdd

Function at 0x140475e98
Capabilities:
Encode data using xor

Disassembly:
movabs rcx, 0xaead52144f0cc0aa
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx + rsi - 0x10c]
ja 0x140510158
shl bx, 0xed
not bx
mov qword [rsp + rsi*8 - 0x850], rbx
neg word [rsp + rbx - 0x44e41fef]
call fcn.14046b623
invalid
and word [rsp + r13 - 0xd0], 0xfb1b
lea rcx, [rcx + r13 - 0x8de0f23]
mov dword [rsp + 0x10], 0xe0c3e26
shr qword [rsp + 0x10], 0x6c
neg word [rsp + r13*2 - 0x1b0]
call fcn.140629997

Function at 0x14047d8c5
Capabilities:
Packed with generic packer

Disassembly:
test dword [rsp + 0x18], r10d
jb 0x14070d336
push rsi
test r12, 0xa3e2423
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
movabs rsi, 0xb7b33801118ba595
mov qword [rsp + 0x18], r12
not r12b
jns 0x14064ffcb
xchg qword [rsp + 0x70], rax
mov r10, qword [rsp + 0x20]
jno 0x1404347e3
and bp, 0xad1a
jns 0x14065f8ec
mov qword [rsp + 8], rcx
shr word [rsp], cl
mov rbx, qword [rsp + 0x38]
mov rbx, qword [rbx]
xor r13w, 0x90a0
mov bpl, r13b
add dword [rsp + 0x20], ecx
je fcn.140588f52
mov qword [rsp + 0x38], rbp
lea rbx, [rbx - 0x59dbb051]
call fcn.1404f7f4e
and r14b, byte [rsp + 0xa]
not r14b
add word [rsp + 8], 0x76bb
je fcn.1405be32f
not qword [rsp + 0x28]
call fcn.14051065c
jbe 0x1405d0d12
xor dword [rsp + 0x18], 0xd4280200
and r10w, 0x8c27
jge 0x1406e441d
mov qword [rsp + 0x58], rbp
mov qword [rsp + 8], r10
or byte [rsp + 8], 0x10
add qword [rsp + 0x38], 0xffffffffffd02269
add qword [rsp], 0xffffffffffd18dc8
push r12
mov r12, qword [rsp + 0x20]
nop
push r14
sub qword [rsp + 0x28], 0x36901927
jno 0x14040c7a1
push rsi
setle byte [rsp]
shl dword [rsp + 0x38], 0x8c
call fcn.14070e3d5
Function at 0x1404805b5
Capabilities:
Packed with generic packer

Disassembly:
jns 0x1405e0ab4
add edi, dword [rsi]
mov rcx, qword [rsp + 0x1c0]
call fcn.14071d373
movabs rax, 0x9c532febc0000005
push rbx
pushfq
movabs rbx, 0x5e2b792e888cc526
mov qword [rsp + 0x18], 0x10ef2e35
mov rbx, qword [rsp + 8]
add qword [rsp + 0x10], 0xffffffffbfb314c6
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407d1649
add r12d, 0xfa9b9f84
jno 0x14036b087

Function at 0x14048baca
Capabilities:
Packed with generic packer

Disassembly:
push 0x42a8d39e
mov qword [rsp + rdi*2 - 0xfdc], rbp
jle 0x1406ce728
add qword [rsp + rdx + 0x73f210d1], 0xffffffffffeae24e
push rdi
xor byte [rsp + rdx + 0x73f210a9], 0x30
and byte [rsp + r14 - 0x3ca464a2], r14b
nop
add qword [rsp + r14 - 0x3ca46492], 0xffffffffffe7254d
push r10
mov r10, qword [rsp + rdx + 0x73f210b1]
mov rbp, qword [rsp + rdx + 0x73f210b1]

Function at 0x14049a330
Capabilities:
Packed with generic packer

Disassembly:
jbe fcn.1406e4983
jle fcn.1405d5f94
seto byte [rsp + 0x10]
mov r10, qword [rsp + 0x28]

Function at 0x1404a5a87
Capabilities:
Packed with generic packer

Disassembly:
jne 0x1405905d4
add qword [rsp], 0xffffffffbf9743a9
neg dword [rsp + 0x40]
or qword [rsp + 0x30], 0xffffffffad81f029
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x1404bb32a
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push r8
pushfq
movabs r8, 0x28341d1704b1e002
neg r8b
mov qword [rsp + 0x20], 0xffffffffeb30409e
mov r8, qword [rsp + 8]
add qword [rsp + 0x10], 0xffffffffbf98b63a
push qword [rsp]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407c955e

Function at 0x1404bb3c3
Capabilities:
Packed with generic packer

Disassembly:
shl r15, 0xdc
not r15
sub r15w, 0x9a2
xchg qword [rsp + 0x40], rsi
mov r15, qword [rsp + 0x20]
jle 0x1405aa998
add dword [rax + rcx], edx
add byte [rsp + riz*2], dl
or al, byte [rax]
adc al, 0x54
or dword [rax], eax
adc al, 0x34
or byte [rax], al
adc al, 0x52
adc byte [rax + 0x48], dh
xchg dword [rsp + 0x20], ecx
jl fcn.1403b6fce
cmp dword [rsp + 0x10], 0x8ab962b1
push r15
call fcn.1403cc11d
add qword [rsp + 8], 0xffffffffbfaeffcf
add qword [rsp], 0xffffffffbf9e0717
lea rsp, [rsp + 0x28]
ret 8

Function at 0x1404bb422
Capabilities:
Packed with generic packer

Disassembly:
mov byte [rsp + 0x68], dl
jle fcn.1403f649b
call fcn.14045610b
call fcn.1404ac4d8
Function at 0x1404c5e87
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp], rcx
jl 0x140429120
bswap r10
shl byte [rsp + rcx*2 - 0x4020006e], 0x6d
lea rax, [rax + rcx*4 - 0x981a02f]
call fcn.1405f72e6
and bl, byte [rcx]
adc r8d, dword [rax]
xor ecx, dword [rax + 0x782e00a1]
movabs byte [0x51742600a3682a00], al
add dword [rsi], esp
push rax
add dword [rsi], esp
xor al, 0x4f
add dword [rsi], esp
add dword [rax + 1], ecx
sbb al, dh
invalid
push r15
mov r11, rdx
xchg qword [rsp + 0x90], rcx
mov r9, qword [rsp + r10*4 + 0x7115d044]
not r11
mov r11b, byte [rsp + r10*2 + 0x388ae824]
add r10w, r11w
cmp bx, word [rsp + 0x5e]
mov rdx, qword [rsp + 0x88]
jge fcn.140588783
neg dword [rsp + r10*2 + 0x388aaece]
jge 0x1406be4f0
not rbx
bswap r11
and r10b, r11b
add qword [rsp], 0x1705e1
mov r8b, 0x1b
movsx cx, r10b
shl r8d, cl
test r8b, 0xaf
mov r10b, 0xae
mov rax, qword [rsp]
mov rax, qword [rax]
jns 0x140350258

Function at 0x1404de8ea
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xfffffffffffd227d
mov rcx, r12
not r12d
neg rcx
jb 0x1404f7fbb

Function at 0x1404e1a96
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
jne 0x1405314e9
mov word [rsp + 0x20], 0xa015
movabs r14, 0x68714b4d90d473f
add r14b, byte [rsp + 0x25]
xchg qword [rsp + 0x30], rsi
mov r14, qword [rsp + 8]
and r13b, byte [rsp + 0x25]
sub r13b, byte [rsp + 0x26]
test byte [rsp + 0x20], r13b
mov r13, qword [rsp + 0x18]
mov byte [rsp + 0x20], 0x3d
jns 0x1403e3341

Function at 0x1404ed574
Capabilities:
Encode data using xor

Disassembly:
bswap r13d
test r13w, 0x5d12
mov r13, qword [rsp + r13 + 0x10]
jge 0x1403f1252

Function at 0x140513dad
Capabilities:
Packed with generic packer

Disassembly:
movsxd r11, r11d
sub r11b, r11b
bswap r11
ja 0x1406726d6
xchg qword [rsp + r11 + 0x30], rdi
mov r11, qword [rsp + r11*2 + 0x28]
jns 0x14053ee56
test qword [rsp + 0x10], 0xffffffffb337248d
movsx di, byte [rsp + 0x10]
push rcx
mov rcx, rdi
lea rbx, [rbx + 0xe0b8a91]
mov cx, di
jle 0x1406f40df
invalid
push r15
call fcn.140721a6c
add qword [rsp + 0x10], 0xffffffffbf9a029d
call fcn.1404483a2

Function at 0x14051d704
Capabilities:
Encrypt data using aes mixcolumns step
Packed with generic packer

Disassembly:
mov byte [rsp + 0x70], 0x2d
call fcn.14057d25c

Function at 0x1405314d8
Capabilities:
Packed with generic packer

Disassembly:
push rdi
pushfq
movabs rdi, 0x50e9036ffb6450e
call fcn.140723325
cmp qword [rsp + 0x20], 0xffffffffbebea8b9
jbe 0x1406e3d84
Function at 0x14053bf84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rdx*8 + 0x40], rbp
push r12
mov r12, qword [rsp + 0x28]
jno 0x1404252d1

Function at 0x14053eeb2
Capabilities:
Packed with generic packer

Disassembly:
sub r13, qword [rsp + r8 - 0x6a9ef66f]
and r13w, r9w
add qword [rsp + 0x38], 0xffffffffbfa2fb3b
mov qword [rsp + r9 - 0x6a9ef647], r9
lea rdx, [rdx - 0x4ff87dc9]
call fcn.14050f5b2
Function at 0x140541492
Capabilities:
Packed with generic packer

Disassembly:
mov r11, rbx
sub rbx, r11
or r11d, 0x8d0b6028
cmovne r11w, r13w
test bx, r13w
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
push rcx
call fcn.14042324f
not r9
pop r9
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
ret
jb 0x140640b15
not r12w
mov rdi, qword [rsp + 0x40]
mov rdi, qword [rdi + r12*4 - 0x3fcd8]
je 0x1404457b7
jle 0x14069d9eb
add dx, 0xe73d
jo 0x140539eda
call fcn.14064f970
and r10w, 0xb81e
cmp r10d, 0xea3864a3
jl 0x14057836b
or cx, cx
jns 0x140549f82
mov r10, qword [rsp + 0x20]
call fcn.140675818
mov qword [rsp + 8], rbp
jae 0x140535832
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi + r13 - 0x44720000]
test qword [rsp + 8], 0x12a86584
call fcn.140716358
sub byte [rsp + 0x28], 0x1c
or byte [rsp + 0x28], 0x18
call fcn.1403c876f
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rbx
shr ebx, 0x23
push rbx
push r13
not rbp
call fcn.1405da46f
push r8
neg r8d
push rdi
shr r10b, 0x6f
mov ax, word [rsp + 0xd]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + r8 - 0x1c490000]
not r8w
mov qword [rsp + 0x50], r11
mov rdi, qword [rsp + 0x50]
call fcn.140494a18
add byte [rsp + 0x20], 0x28
test word [rsp + 0x20], 0xf49c
lea rsp, [rsp + 0x10]
ret 0x10
jno 0x14060d2f0
and dword [rsp + 0x28], 0x1f17aaa1
xchg qword [rsp + 0x30], rcx
mov r15, qword [rsp + 0x10]
call fcn.14067db66
add byte [rsp + 0x90], 0x13
call fcn.1403da198
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x78]
ret
add qword [rsp + 0x20], 0x25453b
movabs r15, 0x119fa87258c7f08
mov rcx, r15
and rcx, 0xffffffffe6a24908
test cx, 0xbaa0
push rdx
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r15
mov rdx, qword [rsp + 0x28]
jl 0x1405a9413
jb fcn.1400018fd
lea rcx, [rcx - 0x15f5e271]
bswap r15d
movzx r15d, word [rsp + r15*8 - 0x43fc6100]
add r15d, dword [rsp + 0x28]
mov dl, byte [rsp + 0x2f]
jge 0x1405ed47d
setbe bl
setae bl
movabs r10, 0x7f1535b813a88f34
lea rax, [rax + rbx*2 + 0x2d12f50c]
sets bl
shl r10d, 0x4e
jb 0x1403da76a
mov r10w, 0xbd16
mov bx, 0x5fad
add qword [rsp + r10*2 - 0x479b79f4], 0xffffffffbfa75cf8
mov qword [rsp + r10*2 - 0x479b79d4], rbx
xor r10w, word [rsp + r10*2 - 0x479b79d2]
cmovae bx, word [rsp + r10 - 0x23cdb3c3]
xchg qword [rsp + rbx*4 - 0x2423ff98], rax
mov r10, qword [rsp + r10 - 0x23cdb3d7]
sub bx, 0x394
call fcn.14035601b
mov rdi, rcx
shr edi, 0x1b
add qword [rsp + 0x10], 0xffffffffffff77ca
shr ecx, 0x8d
movabs rsi, 0xd480f0bd44bf7519
push rdx
bswap edi
call fcn.140644cd6
push rbp
call fcn.14043ef98
sbb edi, dword [rcx - 0x1a]
movsb byte [rdi], byte [rsi]
add dh, dl
mov ah, 0x9c
add byte [rdx + 0x60], cl
imul edi, dword [rdi - 1], 0x62
add al, 0x99
mov byte [rax], 0x3c
fiadd word [rax - 0x32f9bc00]
ja 0x14069da31
dec esi
movsd dword [rdi], dword [rsi]
sub dword [rax + 0x37337d00], eax
call qword [r14 + riz*4]
invalid
invalid

Function at 0x140547986
Capabilities:
Authenticate hmac

Disassembly:
not cl
jl 0x1405698b3
cmp r13b, cl
add qword [rsp], 0x24b2cf
test ecx, 0x2290ed03
call fcn.140474e88
ret
Function at 0x1405479a5
Capabilities:
Packed with generic packer

Disassembly:
lea r14, [r14 + r14*2 - 0x1c75b2cd]
mov r14d, 0x58c1d39
and r14w, 0x9088
movsx r14d, r14b
jb 0x1407074cb
mov r14, qword [rsp + r14 + 0x10]
call fcn.1403d7e7b
mov qword [rsp + 0x20], 0xffffffffcb99c800
mov r10, qword [rsp + 0x10]
and r14b, 0x21
ja 0x1403c0aa0

Function at 0x1405479bd
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x20]
call fcn.1407c955e

Function at 0x1405479c7
Capabilities:
Packed with generic packer

Disassembly:
push r15
movabs r15, 0xb69d05107a226eaa
js fcn.1406e43f9
shl r15, 0xa4
add qword [rsp + 8], 0x336e81
movabs rsi, 0x4a85e0b58d309000
shr rsi, 0x52
call fcn.140543c72

Function at 0x140547a0d
Capabilities:
Authenticate hmac

Disassembly:
add r14, 0xffffffffb8107c97
nop
jno 0x1404fb936
push rdi
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
xchg qword [rsp + rdx - 0x3b16c], rcx
mov rbp, qword [rsp + 0x10]
shl edx, 0xf4
lea rcx, [rcx + 0x4b169011]
and byte [rsp + rdx*4 + 0x28], 0xa4
jl 0x140564d92
xor edx, dword [rsp + 0x29]
sub dx, bp
jno 0x14046bf58
lea rbp, [rbp + rbp - 0x64cf727a]
jg 0x140489807

Function at 0x140547a25
Capabilities:
Packed with generic packer

Disassembly:
xor r12b, byte [rsp + 0x60]
push rdi
jle 0x1406ff5e5
not word [rsp + 0x68]
lea r12, [rsi + rsi*2 + 0x731ceeba]
push rbx
xchg qword [rsp + 0x88], rbp
mov r12, qword [rsp + 0x20]
mov rdi, rsi
je 0x1406b5c7e
Function at 0x140552c1c
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x10], 0xffffffffffff3f50
push r10
movabs rax, 0xc29dd23e22214304
push rbp
mov r10, r15
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + r10*8]
movabs rbp, 0xad17353b091c0839
shl r15d, 0x3e
shl bp, 0xc1
jo 0x1406ff5a3
mov r15w, 0x5d3e
lea rax, [rax + r10 + 0x57b3a4bc]
jge 0x1404886f8
pop qword [rcx - 0x2de145fe]
pop rsp
push rsi
hlt
setb r15b
shr r15, 0x6c
jns 0x140465a05

Function at 0x140567833
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x38], 0xffffffffbfaf20e0
lea r12, [r13 + rbx*4 + 0xbbe5690]
mov r13, qword [rsp + 0x68]
shr r12, 0xb2
shl dword [rsp + r12*8 + 0x40], 0x63
and r12b, bl
add r12, qword [rsp + r12 + 0x40]
mov r12, qword [rsp + rbx + 0x60]
test byte [rsp + rbx*2 + 0x40], bh
not bl