joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d280
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9d, dword [0x1400d0cac]
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x14005d2fd
mov dword [0x1400d0cac], 0x20019
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14005d2f6
cmp dword [rsp + 0x30], r14d
je 0x14005d2f6
mov r9d, dword [0x1400d0cac]
bts r9d, 8
mov dword [0x1400d0cac], r9d
jmp 0x14005d2fd
mov r9d, dword [0x1400d0cac]
test rsi, rsi
je 0x14005d4d8
test rdi, rdi
je 0x14005d4d8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x298], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400a68e0]
mov qword [rsp + 0x38], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005d3bb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400a69b8]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov qword [rsp + 0x290], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
mov ebx, eax
sete bpl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x290]
jne 0x14005d3bb
movzx eax, bpl
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1400725e0
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
shr rdi, 1
mov r9d, 0x7ffffffe
lea rax, [rdi - 1]
cmp rax, r9
ja 0x14005d438
sub r9, rdi
lea r8, [rsp + 0x40]
sub r8, rsi
mov rdx, rdi
mov rcx, rsi
lea rax, [r9 + rdx]
test rax, rax
je 0x14005d424
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14005d424
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14005d404
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rdi
mov word [rax], r14w
jmp 0x14005d45a
test rdi, rdi
je 0x14005d4d1
mov word [rsi], r14w
cmp rdi, 0x7fffffff
ja 0x14005d4d1
mov rcx, rdi
test rdi, rdi
je 0x14005d470
mov rax, rsi
nop dword [rax]
cmp word [rax], r14w
je 0x14005d470
add rax, 2
sub rcx, 1
jne 0x14005d460
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x14005d4d1
mov rdx, rdi
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x14005d4c2
sub rax, rdi
lea r9, [0x1400a4608]
add rax, 0x7ffffffe
add rax, rdx
sub r9, rcx
test rax, rax
je 0x14005d4c2
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14005d4c2
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x14005d4a1
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov al, 1
jmp 0x14005d397
xor al, al
jmp 0x14005d39f
Function at 0x140067a60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, rcx
xor r15d, r15d
mov rax, rdx
mov dword [rsp + 0x50], r15d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x40], rcx
lea rdx, str.DisplayConfig
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rcx, rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x123
lea r8, [0x1400a8310]
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.140059c60
test eax, eax
jne 0x140067c13
mov rcx, qword [rsp + 0x60]
lea rbp, [r14 + 8]
mov dword [rsp + 0x28], 4
lea r9d, [r15 + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.pathInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, r15d
cmp dword [rbp], r15d
jbe 0x140067c0f
nop
mov r8d, esi
mov qword [rsp + 0x58], r15
lea rdx, str.pathInfo_d
lea rcx, [rsp + 0x70]
call fcn.140066310
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x12f
lea r8, [0x1400a8310]
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.140059c60
test eax, eax
jne 0x140067c13
mov rdx, qword [rsp + 0x58]
mov eax, esi
imul rdi, rax, 0x38
mov rcx, qword [rdi + r14 + 0x28]
call fcn.140069a10
mov rcx, qword [rsp + 0x58]
lea rbx, [r14 + 0x18]
add rbx, rdi
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.targetInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x58]
mov edx, dword [rbx]
mov rcx, qword [rdi + r14 + 0x20]
call fcn.140068890
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [rbp]
jb 0x140067b30
mov al, 1
jmp 0x140067c15
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006fd90
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006cbc0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rcx
mov rdx, rcx
lea rcx, [0x14006c620]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [r14 + 8]
xor r13d, r13d
mov rbx, qword [r14]
xor r12b, r12b
sub rax, rbx
mov ebp, r13d
sar rax, 3
test eax, eax
jle 0x14006ccef
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r15
mov r15d, r13d
mov qword [rsp + 0x58], rdi
mov rcx, qword [r15 + rbx]
mov edx, 4
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
je 0x14006cc53
mov rdi, qword [r14]
mov rbx, qword [r14 + 8]
mov rcx, rdi
cmp rdi, rbx
je 0x14006cc42
cmp qword [rcx], rax
je 0x14006cc42
add rcx, 8
cmp rcx, rbx
jne 0x14006cc34
call fcn.140006c60
cmp rax, rbx
je 0x14006cc53
mov qword [r15 + rdi], r13
mov r12b, 1
mov rsi, qword [r14 + 8]
inc ebp
mov rbx, qword [r14]
mov rax, rsi
sub rax, rbx
add r15, 8
sar rax, 3
cmp ebp, eax
jl 0x14006cc11
mov r15, qword [rsp + 0x60]
test r12b, r12b
je 0x14006cce5
cmp rbx, rsi
je 0x14006ccc2
nop dword [rax]
mov rcx, qword [rbx]
call fcn.14006d0b0
test al, al
jne 0x14006cc95
add rbx, 8
cmp rbx, rsi
jne 0x14006cc80
cmp rbx, rsi
je 0x14006ccc2
lea rdi, [rbx + 8]
cmp rdi, rsi
je 0x14006ccc2
mov rbp, qword [rdi]
mov rcx, rbp
call fcn.14006d0b0
test al, al
jne 0x14006ccb9
mov qword [rbx], rbp
add rbx, 8
add rdi, 8
cmp rdi, rsi
jne 0x14006cca3
mov rdi, qword [r14 + 8]
mov rcx, rbx
call fcn.140006c60
cmp rax, rdi
je 0x14006cce5
mov r8, rax
mov rdx, rdi
mov rcx, rdi
call fcn.140037110
mov qword [r14 + 8], rax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x14006d0c0
Capabilities:
Enumerate gui resources

Disassembly:
mov dword [rcx + 0x10], edx
mov rdx, rcx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r9
lea rcx, [0x14006d150]
jmp qword [sym.imp.USER32.dll_EnumWindows]

Function at 0x14007e76c
Capabilities:
Terminate process

Disassembly:
add esi, dword [rsi + rcx + 0x3a]
add dword [r9 + r9 + 0x33], esi
xor ecx, ecx

Function at 0x14007e87c
Capabilities:
Terminate process

Disassembly:
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14007e8a4
add rdi, rax
lea r9, [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov rdx, rdi
mov r8d, dword [0x1400cd554]
mov rcx, rbx
call rax
test eax, eax
jne fcn.14007e87c
cmp rdi, rsi
je 0x14007e953
mov edx, dword [rsi]
xor r8d, r8d
mov rax, qword [str._b__n_]
mov eax, dword [rax + r8]
add eax, edx
mov dword [r8 + rdi], eax
add r8, 4
cmp r8, 0x14
cmp eax, 0x14
jl 0x14007e8b2
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007e953
mov edx, dword [0x1400cd554]
xor ecx, ecx
mov r9d, dword [0x1400cd584]
mov r8d, 0x1000
call rax
mov rdx, qword [0x1400cd510]
mov r8, rax
mov r9, qword [0x1400cd534]
Function at 0x14007e8c8
Capabilities:
Terminate process

Disassembly:
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14007e8a4
add rdi, rax
lea r9, [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov rdx, rdi
mov r8d, dword [0x1400cd554]
mov rcx, rbx
call rax
test eax, eax
jne fcn.14007e87c
cmp rdi, rsi
je 0x14007e953
mov edx, dword [rsi]
xor r8d, r8d
mov rax, qword [str._b__n_]
mov eax, dword [rax + r8]
add eax, edx
mov dword [r8 + rdi], eax
add r8, 4
cmp r8, 0x14
cmp eax, 0x14
jl 0x14007e8b2
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007e953
mov edx, dword [0x1400cd554]
xor ecx, ecx
mov r9d, dword [0x1400cd584]
mov r8d, 0x1000
call rax
mov rdx, qword [0x1400cd510]
mov r8, rax
mov r9, qword [0x1400cd534]

Function at 0x14007eb08
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x1400cd534]
mov r10d, 0x13fe
mov edx, edx
add r9, rdx
lea rdx, [rax + 8]
mov ebx, dword [r9 + 4]
sub r9, rax
mov ecx, dword [r9 + rdx]
add ecx, ebx
mov dword [rdx], ecx
lea rdx, [rdx + 4]
sub r10, 1
jne 0x14007e91c
mov eax, dword [0x1400cd558]
mov ecx, dword [r8 + 0xc]
mov dword [r8 + 8], eax
mov edx, dword [0x1400cd4e0]
add rdx, rcx
mov ecx, dword [0x1400cd4e0]
add rcx, r8
add rdx, r8
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x14007e900

Function at 0x140088b8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400889b8
Function at 0x14000dc00
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0
lea rsi, [rsp + 0x28]
mov rcx, rsi
call sub.USER32.dll_GetCursorPos
mov edi, dword [rsp + 0x28]
mov ebx, dword [rsp + 0x2c]
nop word cs:[rax + rax]
xor ecx, ecx
mov edx, 0x1dcd6500
call fcn.1401059a0
mov qword [rsp + 0x28], 0
mov rcx, rsi
call sub.USER32.dll_GetCursorPos
cmp edi, dword [rsp + 0x28]
jne 0x14000dc6c
cmp ebx, dword [rsp + 0x2c]
je 0x14000dc30
jmp 0x14000dc6c
xor ecx, ecx
mov edx, 0x1dcd6500
call fcn.1401059a0
call fcn.140009dd0
test al, al
je 0x14000dc60
call fcn.14000a3a0
test al, al
je 0x14000dc60
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140019840
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140019887
mov r15d, 8
sub r15, r11
cmp r8, r15
mov rax, r15
cmovb rax, r8
cmp rax, 3
jbe 0x14001988f
mov r14d, dword [rdx]
mov r10d, 4
mov rcx, r10
or rcx, 1
cmp rcx, rax
jb 0x1400198a1
jmp 0x1400198b8
xor r15d, r15d
jmp 0x140019943
xor r10d, r10d
xor r14d, r14d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x1400198b8
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x1400198cf
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x1400198ef
add r11, r8
jmp 0x140019a29
mov rdi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9]
add rax, rcx
rol rcx, 0xd
xor rdi, r14
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r9 + 8]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r9 + 0x18], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r9 + 0x10], rcx
mov qword [r9 + 8], rsi
xor rax, r14
mov qword [r9], rax
sub r8, r15
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r15, r8
jae 0x1400199c2
mov rax, qword [r9 + 0x18]
mov rsi, qword [r9]
mov rcx, qword [r9 + 8]
mov rdi, qword [r9 + 0x10]
nop word cs:[rax + rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x140019970
mov qword [r9 + 0x18], rax
mov qword [r9], rsi
mov qword [r9 + 0x10], rdi
mov qword [r9 + 8], rcx
cmp r11d, 3
jbe 0x1400199e0
mov esi, dword [rdx + r15]
mov r8d, 4
mov rax, r8
or rax, 1
cmp rax, r11
jb 0x1400199f1
jmp 0x140019a0b
xor r8d, r8d
xor esi, esi
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x140019a0b
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x140019a25
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001a7b0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov r15, qword [rcx + 0x10]
mov qword [rbp - 8], rcx
mov r13, qword [rcx + 0x18]
test r13, r13
je 0x14001a81f
xor edi, edi
mov rax, r13
shr rax, 0x3d
sete al
jne 0x14001a966
lea r12, [r13*4]
mov dil, al
shl rdi, 2
test r12, r12
je 0x14001a829
mov rcx, r12
mov rdx, rdi
call fcn.140001f20
mov rbx, rax
test rbx, rbx
jne 0x14001a835
jmp 0x14001a96d
mov ebx, 4
xor r12d, r12d
jmp 0x14001a835
mov rbx, rdi
test rbx, rbx
je 0x14001a96d
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], rbx
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.1401230d0
mov qword [rbp - 0x10], r13
mov r9, qword [r14 + 0x138]
movzx ecx, byte [r14 + 0x108]
shr r9, cl
test r9, r9
mov r8, qword [rbp - 8]
je 0x14001a8d4
xor edi, edi
jmp 0x14001a87f
mov rax, qword [r8 + 0x10]
mov dword [rax + rdi*4], esi
inc rdi
cmp rdi, r9
je 0x14001a8d4
mov rcx, qword [r8]
and ecx, 0x3f
mov rax, rdi
shl rax, cl
cmp rdi, r13
je 0x14001a952
mov edx, dword [rbx + rdi*4]
cmp edx, eax
je 0x14001a877
nop dword [rax + rax]
mov esi, edx
mov edx, edx
shr rdx, cl
cmp rdx, r13
jae 0x14001a93e
mov edx, dword [rbx + rdx*4]
cmp edx, eax
jne 0x14001a8a0
mov rdx, qword [r8 + 0x18]
cmp rdi, rdx
jb 0x14001a870
lea r8, str.PS__
mov rcx, rdi
call fcn.14013c000
jmp 0x14001a978
lea rdi, [r8 + 8]
mov rcx, r14
mov rdx, rdi
call fcn.14005ef90
test r13, r13
je 0x14001a8fd
shl r13, 2
mov r8d, 4
mov rcx, rbx
mov rdx, r13
call fcn.140001f30
mov rdx, qword [rdi]
test rdx, rdx
mov rax, qword [rbp - 8]
je 0x14001a92c
mov rcx, qword [rax + 0x10]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140001f30
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x1402053f0]
mov rcx, rdx
mov rdx, r13
call fcn.14013c000
jmp 0x14001a978
lea r8, [0x1402053d8]
mov rcx, r13
mov rdx, r13
call fcn.14013c000
jmp 0x14001a978
call fcn.140119360
jmp 0x14001a978
mov rcx, r12
mov rdx, rdi
call fcn.14013bd90
ud2
Function at 0x1400511b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
movzx eax, dx
cmp eax, 0x7f
jg case.default.0x1400511d9
mov edx, 0x3600
xor esi, esi
dec eax
lea rbx, [0x140051344]
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
movzx eax, byte [rcx]
test rax, rax
je 0x140051216
lea ecx, [rax - 1]
mov edx, 1
xor edi, edi
shld rdi, rdx, cl
mov ebx, ecx
shr bl, 7
movzx ebx, bl
xor esi, esi
shl rdx, cl
test cl, 0x40
cmovne rdi, rdx
cmovne rdx, rsi
shl rbx, 4
or qword [r8 + rbx], rdx
or qword [r8 + rbx + 8], rdi
mov edx, 1
xor esi, esi
mov ecx, eax
shld rsi, rdx, cl
xor ebx, ebx
shl rdx, cl
test al, 0x40
cmovne rsi, rdx
cmovne rdx, rbx
shr rax, 3
and eax, 0xfffffff0
add r8, rax
or qword [r8], rdx
or qword [r8 + 8], rsi
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp eax, 0x80
je case.0x1400511d9.63
cmp eax, 0x200
xor r9d, r9d
mov r10d, 1
lea r14, [0x14020c180]
xor r11d, r11d
jmp 0x1400512ab
xor eax, eax
mov ecx, esi
shld rax, r10, cl
shr cl, 7
movzx edx, cl
mov edi, 1
mov ecx, esi
shl rdi, cl
test sil, 0x40
cmovne rax, rdi
cmovne rdi, r9
shl rdx, 4
or qword [r8 + rdx], rdi
or qword [r8 + rdx + 8], rax
movzx eax, bp
cmp eax, 0xff
jae case.0x1400511d9.0
mov ecx, r11d
movzx eax, r11w
cmp eax, 0x100
mov ebp, 0xff
cmovae ebp, eax
movzx edi, al
mov r11d, ebp
inc r11d
mov ebx, ecx
nop word [rax + rax]
cmp bp, bx
je 0x140051300
mov esi, ebx
lea ebx, [rsi + 1]
movzx edx, bl
cmp byte [rdi + r14], 0
sete al
cmp byte [rdx + r14], 0
setne dl
xor dl, al
jne 0x1400512d0
mov ebp, esi
mov r11d, ebx
test cl, cl
jne 0x14005130c
jmp 0x140051270
mov si, 0xff
test cl, cl
je 0x140051270
dec cl
xor eax, eax
shld rax, r10, cl
mov edx, ecx
shr dl, 7
movzx edx, dl
mov edi, 1
shl rdi, cl
test cl, 0x40
cmovne rax, rdi
cmovne rdi, r9
shl rdx, 4
or qword [r8 + rdx], rdi
or qword [r8 + rdx + 8], rax
jmp 0x140051270
ud2
Function at 0x1400799b0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov r15, qword [rcx + 0x10]
mov qword [rbp - 8], rcx
mov r13, qword [rcx + 0x18]
test r13, r13
je 0x140079a1f
xor edi, edi
mov rax, r13
shr rax, 0x3d
sete al
jne 0x140079b66
lea r12, [r13*4]
mov dil, al
shl rdi, 2
test r12, r12
je 0x140079a29
mov rcx, r12
mov rdx, rdi
call fcn.140001f20
mov rbx, rax
test rbx, rbx
jne 0x140079a35
jmp 0x140079b6d
mov ebx, 4
xor r12d, r12d
jmp 0x140079a35
mov rbx, rdi
test rbx, rbx
je 0x140079b6d
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], rbx
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.1401230d0
mov qword [rbp - 0x10], r13
mov r9, qword [r14 + 0x148]
test r9, r9
mov r8, qword [rbp - 8]
je 0x140079ad4
xor edi, edi
jmp 0x140079a7f
mov rax, qword [r8 + 0x10]
mov dword [rax + rdi*4], esi
inc rdi
cmp rdi, r9
je 0x140079ad4
mov rcx, qword [r8]
and ecx, 0x3f
mov rax, rdi
shl rax, cl
cmp rdi, r13
je 0x140079b52
mov edx, dword [rbx + rdi*4]
cmp edx, eax
je 0x140079a77
nop dword [rax + rax]
mov esi, edx
mov edx, edx
shr rdx, cl
cmp rdx, r13
jae 0x140079b3e
mov edx, dword [rbx + rdx*4]
cmp edx, eax
jne 0x140079aa0
mov rdx, qword [r8 + 0x18]
cmp rdi, rdx
jb 0x140079a70
lea r8, [0x140211478]
mov rcx, rdi
call fcn.14013c000
jmp 0x140079b78
lea rdi, [r8 + 8]
mov rcx, r14
mov rdx, rdi
call fcn.14007cf90
test r13, r13
je 0x140079afd
shl r13, 2
mov r8d, 4
mov rcx, rbx
mov rdx, r13
call fcn.140001f30
mov rdx, qword [rdi]
test rdx, rdx
mov rax, qword [rbp - 8]
je 0x140079b2c
mov rcx, qword [rax + 0x10]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140001f30
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x140211460]
mov rcx, rdx
mov rdx, r13
call fcn.14013c000
jmp 0x140079b78
lea r8, [0x140211448]
mov rcx, r13
mov rdx, r13
call fcn.14013c000
jmp 0x140079b78
call fcn.140119360
jmp 0x140079b78
mov rcx, r12
mov rdx, rdi
call fcn.14013bd90
ud2
Function at 0x1400ce1d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x98
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp], xmm7
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
mov ecx, 0x200
mov edx, 4
call fcn.140001f20
test rax, rax
je 0x1400ce34f
mov ecx, 2
lea rdx, [0x14022e378]
movdqa xmm0, xmmword [0x140209700]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx + rcx*8 - 0x10]
movdqu xmm2, xmmword [rdx + rcx*8]
pshufd xmm3, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm4, xmm3
pxor xmm4, xmm0
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm5
pcmpgtd xmm6, xmm4
movdqa xmm7, xmm3
pand xmm7, xmm6
pandn xmm6, xmm1
por xmm6, xmm7
pcmpgtd xmm4, xmm5
pand xmm3, xmm4
pandn xmm4, xmm1
por xmm4, xmm3
punpckldq xmm6, xmm4
movdqu xmmword [rax + rcx*8 - 0x10], xmm6
pshufd xmm1, xmm2, 0xe8
pshufd xmm2, xmm2, 0xed
movdqa xmm3, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm1
pand xmm6, xmm5
pandn xmm5, xmm2
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
punpckldq xmm5, xmm3
movdqu xmmword [rax + rcx*8], xmm5
add rcx, 4
cmp rcx, 0x42
jne 0x1400ce230
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x40], 0x40
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x40]
call fcn.1400d0b90
mov rax, qword [rbp - 0x48]
test rax, rax
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
sete byte [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.1400d9ea0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
movaps xmm7, xmmword [rbp]
add rsp, 0x98
pop rsi
pop rbp
ret
mov ecx, 0x200
mov edx, 4
call fcn.14013bd90
ud2
Function at 0x1400d3b20
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm6
mov r14, rcx
mov rbx, rdx
sub rbx, r8
shr rbx, 3
mov r15, rdx
sub r15, r8
je 0x1400d3b99
movabs rax, 0x7ffffffffffffff9
xor esi, esi
cmp r15, rax
setb al
jae 0x1400d3d4a
mov rdi, r8
mov r12, rdx
mov sil, al
shl rsi, 2
mov rcx, r15
mov rdx, rsi
call fcn.140001f20
test rax, rax
je 0x1400d3d51
mov qword [r14], rbx
mov qword [r14 + 8], rax
add r15, 0xfffffffffffffff8
cmp r15, 8
jae 0x1400d3bab
xor ecx, ecx
jmp 0x1400d3d00
mov qword [r14], rbx
mov qword [r14 + 8], 4
xor ecx, ecx
jmp 0x1400d3d22
shr r15, 3
inc r15
mov rcx, r15
and rcx, 0xfffffffffffffffe
lea rdx, [rcx - 2]
mov r8, rdx
shr r8, 1
inc r8
test rdx, rdx
je 0x1400d3d3c
mov rsi, r8
and rsi, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x140209700]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + rdx*8], xmm5
movdqu xmm1, xmmword [rdi + rdx*8 + 0x10]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
movdqa xmm5, xmm4
pcmpgtd xmm5, xmm3
movdqa xmm6, xmm2
pand xmm6, xmm5
pandn xmm5, xmm1
por xmm5, xmm6
pcmpgtd xmm3, xmm4
pand xmm2, xmm3
pandn xmm3, xmm1
por xmm3, xmm2
punpckldq xmm5, xmm3
movdqu xmmword [rax + rdx*8 + 0x10], xmm5
add rdx, 4
add rsi, 0xfffffffffffffffe
jne 0x1400d3be0
test r8b, 1
je 0x1400d3cea
movdqu xmm0, xmmword [rdi + rdx*8]
pshufd xmm1, xmm0, 0xe8
pshufd xmm0, xmm0, 0xed
movdqa xmm2, xmmword [0x140209700]
movdqa xmm3, xmm1
pxor xmm3, xmm2
pxor xmm2, xmm0
movdqa xmm4, xmm2
pcmpgtd xmm4, xmm3
movdqa xmm5, xmm1
pand xmm5, xmm4
pandn xmm4, xmm0
por xmm4, xmm5
pcmpgtd xmm3, xmm2
pand xmm1, xmm3
pandn xmm3, xmm0
por xmm3, xmm1
punpckldq xmm4, xmm3
movdqu xmmword [rax + rdx*8], xmm4
cmp r15, rcx
je 0x1400d3d22
lea rdi, [rdi + rcx*8]
nop word cs:[rax + rax]
mov edx, dword [rdi]
mov ebx, dword [rdi + 4]
cmp edx, ebx
mov esi, ebx
cmovb esi, edx
cmova ebx, edx
mov dword [rax + rcx*8], esi
mov dword [rax + rcx*8 + 4], ebx
inc rcx
add rdi, 8
cmp rdi, r12
jne 0x1400d3d00
mov qword [r14 + 0x10], rcx
mov rax, r14
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor edx, edx
test r8b, 1
jne 0x1400d3c96
jmp 0x1400d3cea
call fcn.140119360
ud2
mov rcx, r15
mov rdx, rsi
call fcn.14013bd90
ud2