joyce8/EMBER2024-capa huggingface dataset:
Function at 0x212c51ad0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x212c570a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x212c57080]
test rbx, rbx
je 0x212c51b2c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x212c51b23
test eax, eax
jne 0x212c51b23
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x212c51b08
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x212c51d40
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x212c51d58
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x212c51d60
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x212c51d70
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x212c51dbd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x212c51db4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x212c51dbf
add rax, 0x28
cmp rax, r9
jne 0x212c51da0
xor eax, eax
ret

Function at 0x212c51dc0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x212c51e50
mov rdx, qword [0x212c54240]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x212c51e3e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x212c51e3e
cmp word [rax + 0x18], 0x20b
jne 0x212c51e3e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x212c51e50
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x212c51e29
add rbx, 0x28
cmp rbx, rdi
je 0x212c51e50
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x212c51e20
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x212c51e60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x212c54240]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x212c51e80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x212c51e88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x212c51e80
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x212c51edd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x212c51ed4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x212c51e80
add rax, 0x28
cmp rax, r9
jne 0x212c51ec0
xor eax, eax
ret
Function at 0x212c51ee0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x212c54240]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x212c51eff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x212c51f08
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x212c51eff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x212c51f20
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x212c54240]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x212c51f40
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x212c51f48
ret
cmp word [rdx + 0x18], 0x20b
jne 0x212c51f40
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x212c51f90
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x212c51f87
test rcx, rcx
je 0x212c51f40
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x212c51f78
xor eax, eax
ret

Function at 0x212c51fa0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x212c54240]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x212c51fbf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x212c51fc8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x212c51fe0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x212c54240]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x212c52000
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x212c52008
ret
cmp word [r8 + 0x18], 0x20b
jne 0x212c52000
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x212c52000
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x212c52054
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x212c52060
add rdx, 0x28
cmp rdx, r9
jne 0x212c52040
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x212c52070
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x212c54240]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x212c52092
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x212c520a0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x212c52092
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x212c52092
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x212c52092
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x212c520f5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x212c52108
add rdx, 0x28
cmp r10, rdx
jne 0x212c520e0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x212c52117
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x212c52127
mov edx, dword [rax + 0xc]
test edx, edx
je 0x212c520fe
test ecx, ecx
jg 0x212c52110
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x401ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00419624]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x401c94
mov rax, qword [0x00419628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401b2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401bb9
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401b10
mov rcx, rbx
call fcn.004027b0
test rax, rax
mov r12, rax
je 0x401cc9
mov rax, qword [0x00419628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.004028e0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00419628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401cac
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401bb2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401c34
add dword [0x00419624], 1
cmp edi, 8
jae 0x401bf0
test dil, 4
jne 0x401c80
test edi, edi
je 0x401bdc
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401c9b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x401bdc
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x401c20
jmp 0x401bdc
add rsi, qword [0x00419628]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401bb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040fdb0
nop dword [rax + rax]
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401bdc
xor esi, esi
jmp 0x401b37
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401bdc
mov rax, qword [0x00419628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call fcn.0040fdb0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0040fdb0
nop
nop dword [rax]
Function at 0x406120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x004113e0]
push r12
push rbp
push rdi
push rsi
push rbx
mov rdi, qword [rax]
mov rcx, qword [rdi + 0x510]
test rcx, rcx
je 0x4061f0
mov eax, dword [rdi + 0x4b8]
test eax, eax
jne 0x4061d3
movsxd rdx, dword [rcx + 0x3c]
mov edx, dword [rcx + rdx + 0x88]
add rdx, rcx
mov esi, dword [rdx + 0x24]
mov r8d, dword [rdx + 0x20]
mov ebp, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x18]
add rsi, rcx
test edx, edx
je 0x4061cd
lea ebx, [rdx - 1]
xor r9d, r9d
lea r11, [rcx + r8]
xor edx, edx
jmp 0x406183
mov rdx, r8
mov r8d, dword [r11 + rdx*4]
cmp word [rcx + r8], 0x775a
jne 0x4061c4
movzx r8d, word [rsi + rdx*2]
lea r8, [rcx + r8*4]
mov r8d, dword [r8 + rbp]
add r8, rcx
test r9, r9
je 0x4061e5
mov r12, r8
mov r10, r9
sub r12, r9
sub r10, r8
cmp r9, r8
mov r8d, r12d
cmova r8d, r10d
test eax, eax
je 0x4061e0
cmp r8d, eax
jb 0x4061e0
lea r8, [rdx + 1]
cmp rbx, rdx
jne 0x406180
mov dword [rdi + 0x4b8], eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, r8d
jmp 0x4061c4
mov r9, r8
jmp 0x4061c4
pop rbx
xor eax, eax
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x406970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x406aa1
test edx, edx
je 0x406aa1
movsxd r15, dword [rcx + 0x3c]
lea rax, [rcx + r15]
mov r14d, dword [rax + 0x88]
mov qword [rsp + 0x28], rax
add r14, rcx
mov eax, dword [r14 + 0x18]
mov r8d, dword [r14 + 0x20]
test eax, eax
je 0x406aa1
mov edi, edx
mov rsi, rcx
lea r13d, [rax - 1]
xor r15d, r15d
lea r12, [rcx + r8]
jmp 0x406a00
lea rax, [r15 + 1]
cmp r13, r15
je 0x406aa1
mov r15, rax
mov ebx, dword [r12 + r15*4]
add rbx, rsi
je 0x4069f0
xor edx, edx
mov r8d, 1
mov rcx, rbx
call fcn.004062d0
cmp edi, eax
jne 0x4069f0
mov rax, qword [rsp + 0x28]
lea rcx, [rsi + r15*2]
mov edx, dword [rax + 0x8c]
mov eax, dword [r14 + 0x24]
movzx ecx, word [rcx + rax]
mov eax, dword [r14 + 0x1c]
lea rcx, [rsi + rcx*4]
mov eax, dword [rcx + rax]
add rax, rsi
mov qword [rsp + 0x38], rax
cmp rax, r14
jb 0x406aa3
add rdx, rsi
add r14, rdx
cmp rax, r14
jae 0x406aa3
mov rcx, rbx
call fcn.00409b70
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x40], ax
add eax, 1
mov word [rsp + 0x42], ax
mov rax, qword [0x004113e0]
mov rax, qword [rax]
mov rax, qword [rax + 0x68]
test rax, rax
je 0x406aa1
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
js 0x406aa1
mov rax, qword [rsp + 0x38]
jmp 0x406aa3
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x406da0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
lea rdi, [rax + 0x10]
cmp rdi, rbx
je 0x406e10
test ecx, ecx
mov esi, ecx
sete bpl
jmp 0x406dec
mov r8d, 1
call fcn.004062d0
cmp esi, eax
je 0x406dff
test bpl, bpl
jne 0x406dff
mov rbx, qword [rbx]
cmp rdi, rbx
je 0x406e10
mov rcx, qword [rbx + 0x60]
movzx edx, word [rbx + 0x58]
test rcx, rcx
jne 0x406dd0
xor eax, eax
cmp esi, eax
jne 0x406ddf
mov rax, qword [rbx + 0x30]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x40c910
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
xor eax, eax
mov r8, rcx
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x130
mov qword [rbp + 0x10], rcx
lea r9, [rsp + 0x10]
mov qword [rsp + 8], r9
nop dword [rax]
mov ecx, dword [r8 + rax + 8]
add rax, 4
mov dword [rax + r9 - 4], ecx
cmp rax, 0x20
jne 0x40c940
lea r10, [rsp + 0x30]
lea r9, [r10 + 0x40]
mov rcx, r10
movzx eax, byte [rdx]
movzx r8d, byte [rdx + 1]
add rcx, 4
add rdx, 4
shl r8d, 0x10
shl eax, 0x18
or eax, r8d
movzx r8d, byte [rdx - 1]
or eax, r8d
movzx r8d, byte [rdx - 2]
shl r8d, 8
or eax, r8d
mov dword [rcx - 4], eax
cmp r9, rcx
jne 0x40c960
lea r9, [r10 + 0xc0]
mov rcx, r10
mov eax, dword [rcx + 0x38]
mov r8d, dword [rcx + 4]
add rcx, 4
mov edx, eax
mov r11d, eax
shr eax, 0xa
rol r11d, 0xd
rol edx, 0xf
xor edx, r11d
mov r11d, r8d
xor edx, eax
mov eax, dword [rcx - 4]
add eax, dword [rcx + 0x20]
rol r11d, 0xe
add edx, eax
mov eax, r8d
shr r8d, 3
ror eax, 7
xor eax, r11d
xor eax, r8d
add eax, edx
mov dword [rcx + 0x3c], eax
cmp r9, rcx
jne 0x40c9a0
mov edx, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x20]
lea r12, [0x00411604]
lea r14, [r10 + 0x100]
mov ebx, dword [rsp + 0x28]
mov edi, dword [rsp + 0x24]
mov r15d, 0x428a2f98
mov r8d, dword [rsp + 0x10]
mov r11d, dword [rsp + 0x14]
mov esi, dword [rsp + 0x18]
mov r13d, dword [rsp + 0x1c]
jmp 0x40ca40
mov r15d, dword [r12]
mov edx, ebx
mov r13d, esi
mov ebx, edi
mov esi, r11d
mov edi, r9d
mov r11d, r8d
add r12, 4
mov r8d, eax
mov r9d, ecx
mov eax, r9d
mov ecx, r9d
add r10, 4
ror ecx, 0xb
ror eax, 6
xor eax, ecx
mov ecx, r9d
rol ecx, 7
xor ecx, eax
mov eax, ebx
xor eax, edi
and eax, r9d
xor eax, ebx
add eax, ecx
add eax, dword [r10 - 4]
add eax, edx
mov edx, r8d
add eax, r15d
ror edx, 2
mov r15d, r8d
lea ecx, [rax + r13]
mov r13d, r8d
and r15d, r11d
ror r13d, 0xd
xor edx, r13d
mov r13d, r8d
rol r13d, 0xa
xor edx, r13d
mov r13d, r8d
or r13d, r11d
and r13d, esi
or r13d, r15d
add edx, r13d
add eax, edx
cmp r14, r10
jne 0x40ca22
mov dword [rsp + 0x1c], esi
mov rsi, qword [rbp + 0x10]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 8]
mov dword [rsp + 0x14], r8d
lea rdx, [rsi + 8]
lea r8, [rsi + 0x28]
mov dword [rsp + 0x2c], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x24], r9d
mov dword [rsp + 0x10], eax
mov dword [rsp + 0x18], r11d
jmp 0x40cae4
mov eax, dword [rcx]
add dword [rdx], eax
add rdx, 4
add rcx, 4
cmp r8, rdx
jne 0x40cae2
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x40cf40
Capabilities:
Encode data using base64

Disassembly:
test rcx, rcx
je 0x40d060
mov eax, dword [rcx + 8]
test eax, eax
je 0x40d060
cmp qword [rcx], 0
je 0x40d060
add eax, 2
mov edx, 0xaaaaaaab
push r12
mul edx
push rbp
push rdi
push rsi
push rbx
shr edx, 1
mov rbx, rcx
lea esi, [rdx*4]
lea ecx, [rsi + 1]
sub rsp, 0x20
call fcn.00407ce0
mov rdi, rax
test rax, rax
je 0x40d063
mov ebp, dword [rbx + 8]
mov r11, qword [rbx]
mov r8, rax
xor r9d, r9d
lea rcx, [0x00415b00]
test ebp, ebp
jne 0x40d033
jmp 0x40d0c4
movsxd r10, r10d
lea edx, [r9 + 2]
movzx r10d, byte [r11 + r10]
shl r10d, 8
mov r12d, r10d
cmp edx, ebp
jae 0x40d0e8
movsxd rdx, edx
add r9d, 3
movzx r10d, byte [r11 + rdx]
mov edx, r9d
add r10d, r12d
shl eax, 0x10
add r8, 4
add eax, r10d
mov r10d, eax
shr r10d, 0x12
movzx r10d, byte [rcx + r10]
mov byte [r8 - 4], r10b
mov r10d, eax
shr r10d, 0xc
and r10d, 0x3f
movzx r10d, byte [rcx + r10]
mov byte [r8 - 3], r10b
mov r10d, eax
and eax, 0x3f
shr r10d, 6
movzx eax, byte [rcx + rax]
and r10d, 0x3f
movzx r10d, byte [rcx + r10]
mov byte [r8 - 1], al
mov byte [r8 - 2], r10b
mov ebp, dword [rbx + 8]
cmp ebp, edx
jbe 0x40d070
lea r10d, [r9 + 1]
movsxd rax, r9d
movzx eax, byte [r11 + rax]
mov edx, r10d
cmp r10d, ebp
jb 0x40cfb2
mov r9d, r10d
xor r12d, r12d
xor r10d, r10d
jmp 0x40cfdc
xor eax, eax
ret
add rsp, 0x20
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebp
mov r10d, 0xaaaaaaab
mov ecx, ebp
mul r10d
lea r9, [0x00416080]
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
mov eax, dword [r9 + rcx*4]
test eax, eax
jle 0x40d0c4
lea r11d, [rsi - 1]
xor ecx, ecx
nop dword [rax]
mov eax, r11d
sub eax, ecx
add ecx, 1
mov byte [rdi + rax], 0x3d
mov r8d, dword [rbx + 8]
mov eax, r8d
mul r10d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r8d, eax
cmp dword [r9 + r8*4], ecx
jg 0x40d0a0
mov eax, esi
mov byte [rdi + rax], 0
mov rcx, qword [rbx]
call fcn.00407d00
mov qword [rbx], rdi
mov eax, 1
mov dword [rbx + 8], esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, edx
xor r10d, r10d
jmp 0x40cfdc
Function at 0x40d4c0
Capabilities:
Encode data using base64

Disassembly:
push r12
push rbp
push rdi
mov rdi, r8
push rsi
mov rsi, rcx
movabs rcx, 0xaaaaaaaaaaaaaaab
push rbx
mov rbx, rdx
add rdx, 2
mov rax, rdx
mul rcx
sub rsp, 0x20
shr rdx, 1
lea rcx, [rdx*4]
mov qword [r8], rcx
add ecx, 1
call fcn.00407ce0
mov r8, rax
test rax, rax
je 0x40d612
test rbx, rbx
je 0x40d60a
mov rcx, rax
xor r11d, r11d
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
xor edx, edx
jmp 0x40d5a0
movzx r10d, byte [rsi + rdx]
lea r12d, [r11 + 2]
movsxd rdx, r12d
shl r10d, 8
mov ebp, r10d
cmp rdx, rbx
jae 0x40d620
add r11d, 3
movzx r10d, byte [rsi + rdx]
movsxd rdx, r11d
add r10d, ebp
shl eax, 0x10
add rcx, 4
add eax, r10d
mov r10d, eax
shr r10d, 0x12
movzx r10d, byte [r9 + r10]
mov byte [rcx - 4], r10b
mov r10d, eax
shr r10d, 0xc
and r10d, 0x3f
movzx r10d, byte [r9 + r10]
mov byte [rcx - 3], r10b
mov r10d, eax
and eax, 0x3f
shr r10d, 6
movzx eax, byte [r9 + rax]
and r10d, 0x3f
movzx r10d, byte [r9 + r10]
mov byte [rcx - 1], al
mov byte [rcx - 2], r10b
cmp rbx, rdx
jbe 0x40d5c0
lea r10d, [r11 + 1]
movzx eax, byte [rsi + rdx]
movsxd rdx, r10d
cmp rdx, rbx
jb 0x40d523
mov r11d, r10d
xor ebp, ebp
xor r10d, r10d
jmp 0x40d54b
movabs rdx, 0xaaaaaaaaaaaaaaab
mov rax, rbx
mul rdx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
lea rax, [0x00416080]
mov eax, dword [rax + rbx*4]
test eax, eax
jle 0x40d60a
lea ecx, [rax - 1]
xor edx, edx
jmp 0x40d5f3
mov rdx, rax
mov rax, rdx
not rax
add rax, qword [rdi]
mov byte [r8 + rax], 0x3d
lea rax, [rdx + 1]
cmp rdx, rcx
jne 0x40d5f0
mov rax, qword [rdi]
mov byte [r8 + rax], 0
add rsp, 0x20
mov rax, r8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r11d, r12d
xor r10d, r10d
jmp 0x40d54b
Function at 0x40eb30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
mov r14, r9
push r13
mov r13, r8
mov r8d, 0x40
push r12
mov r12, rdx
xor edx, edx
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x170
mov qword [rbp + 0x10], rcx
lea rbx, [rsp + 0x40]
lea r15, [rsp + 0x80]
mov rcx, rbx
lea rdi, [rsp + 0xc0]
call fcn.00407cc0
mov r8d, 0x40
mov edx, 0x36
mov rcx, r15
call fcn.00407cc0
mov r8d, 0x40
mov edx, 0x5c
mov rcx, rdi
call fcn.00407cc0
cmp r12, 0x40
jbe 0x40ec6f
lea rsi, [rsp + 0x100]
mov rcx, rsi
call fcn.00409310
mov rdx, qword [rbp + 0x10]
mov r8d, r12d
mov rcx, rsi
lea r12, [rsp + 0x20]
call fcn.00409360
mov rdx, r12
mov rcx, rsi
call fcn.00409210
mov r8d, 0x20
mov rdx, r12
mov rcx, rbx
call fcn.00407c90
mov rax, r15
mov rdx, rdi
lea r8, [r15 + 0x40]
nop word cs:[rax + rax]
movzx ecx, byte [rbx]
xor byte [rax], cl
add rax, 1
add rbx, 1
xor byte [rdx], cl
add rdx, 1
cmp rax, r8
jne 0x40ec00
mov r9, r12
mov r8, r14
mov rdx, r13
mov rcx, r15
call fcn.00406200
mov r9, rsi
mov rdx, r12
mov rcx, rdi
mov r8d, 0x20
mov ebx, 0x20
call fcn.00406200
cmp qword [rbp + 0x38], 0x20
cmovbe rbx, qword [rbp + 0x38]
mov rdx, rsi
mov rcx, qword [rbp + 0x30]
mov r8, rbx
call fcn.00407c90
lea rsp, [rbp - 0x38]
mov rax, rbx
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rdx, qword [rbp + 0x10]
mov r8, r12
mov rcx, rbx
lea rsi, [rsp + 0x100]
lea r12, [rsp + 0x20]
call fcn.00407c90
jmp 0x40ebec

Function at 0x40fdb0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402b00
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
mov r8d, 0x1b
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402b00
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400032b0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
jmp 0x1400032d8
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x14000333f
mov dword [rsp + 0x34], 0
jmp 0x1400032f4
mov eax, dword [rsp + 0x34]
add eax, 1
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x100
jge 0x14000333d
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x400
lea r9, [0x1400e8fe0]
add r9, rax
movsxd r8, dword [rsp + 0x34]
movsxd rcx, dword [rsp + 0x20]
imul rcx, rcx, 0x400
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rcx + 0x48]
movsxd rcx, dword [rsp + 0x34]
mov eax, dword [r9 + r8*4]
mov dword [rdx + rcx*4], eax
jmp 0x1400032e9
jmp 0x1400032cd
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x20], 0
jmp 0x14000335c
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x12
jge 0x1400033ee
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 0
jmp 0x140003384
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 4
jge 0x1400033c7
mov edx, dword [rsp + 0x30]
shl edx, 8
movsxd rcx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + rcx]
mov eax, edx
or eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x34]
add eax, 1
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x34], eax
jl 0x1400033c5
mov dword [rsp + 0x34], 0
jmp 0x140003379
movsxd rdx, dword [rsp + 0x20]
lea rcx, [0x1400e8f90]
mov eax, dword [rsp + 0x30]
mov edx, dword [rcx + rdx*4]
xor edx, eax
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov dword [rax + rcx*4], edx
jmp 0x140003351
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
jmp 0x140003413
mov eax, dword [rsp + 0x20]
add eax, 2
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x12
jge 0x140003458
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140002ff0
movsxd r11, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x28]
mov dword [rcx + r11*4], eax
mov eax, dword [rsp + 0x20]
add eax, 1
movsxd rdx, eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x24]
mov dword [rcx + rdx*4], eax
jmp 0x140003408
mov dword [rsp + 0x20], 0
jmp 0x14000346d
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x1400034fb
mov dword [rsp + 0x34], 0
jmp 0x14000348d
mov eax, dword [rsp + 0x34]
add eax, 2
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x100
jge 0x1400034f6
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140002ff0
movsxd rcx, dword [rsp + 0x20]
imul rcx, rcx, 0x400
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rcx + 0x48]
movsxd rcx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
movsxd rcx, dword [rsp + 0x20]
imul rcx, rcx, 0x400
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rcx + 0x48]
mov eax, dword [rsp + 0x34]
add eax, 1
movsxd rcx, eax
mov eax, dword [rsp + 0x24]
mov dword [rdx + rcx*4], eax
jmp 0x140003482
jmp 0x140003462
add rsp, 0x48
ret
Function at 0x1400087b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400087e4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400087d0
ret