joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x38]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14004c613
test ecx, ecx
jne 0x14004c662
movzx r15d, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14004c620
test ecx, ecx
jne 0x14004c662
mov rcx, rdi
call fcn.14004c4c0
movzx r10d, al
test bl, bl
jne 0x14004c669
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x14004c656.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14004c7dc]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x14004c656.2
xor r10d, r10d
test bl, bl
je 0x14004c630
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14004c7be
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14004c69b
xor edi, edi
jmp 0x14004c718
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x14004c6e0
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14004c6fb
inc rsi
dec rax
cmp rsi, 1
jne 0x14004c6c0
jmp 0x14004c718
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14004c6fb
cmp ebx, 0x5c
je 0x14004c6fb
inc rsi
dec rax
cmp rsi, 1
jne 0x14004c6e0
jmp 0x14004c718
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14004c7cc
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x14004c742
mov al, 9
cmp rdx, 2
je 0x14004c746
cmp rdx, 1
jne 0x14004c756
cmp byte [r9], 0x2e
jne 0x14004c756
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14004c756
mov al, 0xa
jmp 0x14004c756
cmp byte [r9], 0x2e
jne 0x14004c756
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x14004c656.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x14004c656.2
mov esi, 2
jmp case.0x14004c656.2
lea r8, str.library_std_srcpath.rs
call fcn.140063250
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140063250
ud2
Function at 0x14005fed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14005ff4a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x14005ff40
cmp r10, rax
jb 0x14005ffdd
cmp r10, rdx
ja 0x14005fff1
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14005ff42
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x14005ff20
jmp 0x14005ffb2
ja 0x14005ff4a
mov rax, r10
cmp r11, r8
jne 0x14005fef0
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14005ffb6
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x14005ff90
mov rsi, rbx
sub ecx, edi
jns 0x14005ffa9
jmp 0x14005ffb8
cmp rbx, rdx
je 0x14005ffc3
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x14005ffb8
xor al, 1
cmp rsi, rdx
jne 0x14005ff70
jmp 0x14005ffb8
xor eax, eax
jmp 0x14005ffb8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140062ed0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.140063270
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140063260
ud2

Function at 0x140061be4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140061c2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140061c2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140061c2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140061c2e
cmp dword [rcx + 0x84], 0xe
jbe 0x140061c2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140061c30
xor al, al
add rsp, 0x28
ret
Function at 0x140002d24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002d70
xor al, al
add rsp, 0x28
ret
Function at 0x1802ac669
Capabilities:
Encode data using base64

Disassembly:
call fcn.1802ec9b1
mov edi, r11d
mov qword [rsp + rcx - 0xfb7], r8
xor dword [rsp + rbx - 0xc04], eax
movsx r8d, r11b
mov r8, qword [rsp + rbx - 0xc04]
movsxd rax, eax
dec rdx
add r10, rax
dec rdx
pop rdi
pop rdi
jge fcn.180307268

Function at 0x1802ae301
Capabilities:
Encode data using base64

Disassembly:
sub ecx, ebx
shr bx, 9
mov qword [rsp + rdx - 0x10a0cef], rbp
sub al, 0x8c
mov qword [rsp + rdx - 0x10a0ce7], rsi
mov qword [rsp + rdx - 0x10a0cff], rdx
xor dword [rsp + rdx*2 - 0x21419e6], ecx
shl rax, 0x70
mov rsi, qword [rsp + rdx*8 - 0x85067e0]
cwde
movsxd rcx, ecx
xchg bp, ax
cqo
adc r10, rcx
movzx edi, word [rsp + rdx]
sub dword [rsp + rdx*2 + 0x13], 0x60354f86
lea rdi, [rdx + 0x4c291aa0]
or bx, word [r8 + rdx]
lea r8, [r8 + rdx*8 + 2]
btr eax, edx
xor dx, word [rdx + r11]
xchg di, ax
lea r9, [rdi*2 + 0x4f0a959f]
xchg dword [rsp + rbp*2 + 0x14], ebp

Function at 0x1802aef07
Capabilities:
Encode data using base64

Disassembly:
xor edi, 0x87ad3baa
mov r9d, ebx
lea edi, [rdi + rbx - 0x16a2d74b]
sal word [rsp + rbx*2 - 0x28], 5
lea rdx, [rcx + rax - 0x3edca3fe]
sar r9, cl
rol edi, 3
xchg rbp, rbx
mov qword [rsp + rbp - 0x1a], rax
not edi
xchg r9w, ax
jmp 0x1802f7837
xor edi, 0xb5b09836
inc edi
shr dword [rsp + rbp - 0xf], 0xd8
not byte [rsp + rbp - 0x1a]
shl ebp, cl
bswap edi
dec r9w
jne 0x1802f7f19
dec edi
jmp 0x180300aaf

Function at 0x1802b0d56
Capabilities:
Encode data using base64

Disassembly:
dec rbx
push 0x3939a684
jmp 0x1802d62d8
xor r11d, edx
mov qword [rsp], 0x4b90438c
mov qword [rsp + 0x20], 0xfffffffffba3c4bd
inc rcx
sar word [rsp + 0x16], 4
rol qword [rsp + 0x10], 0xc4
shl byte [rsp + 0x17], 0xc2
xor r11d, 0xc53cc1b2
jmp 0x1802ace0b

Function at 0x1802b61af
Capabilities:
Encode data using base64

Disassembly:
mov rsi, qword [rsp + rcx + 0x7da521ec]
or r9, 0xb8464bc
movsxd rbp, ebp
lea rax, [rdx*4 + 0x6739b297]
adc r10, rbp
mov rdi, qword [rcx + r8 + 0x7da521dc]
movsx ebp, al
pop r9
mov rdx, qword [rcx + r8 + 0x7da521e4]
mov qword [rsp + rbp*2 - 0x76], rcx
neg byte [rsp + rcx + 0x7da521e6]
or byte [rsp + rcx + 0x7da521eb], ah
lea r8, [rcx + r8 + 0x7da521e4]
not rdi
mov qword [rsp + rbp - 0x3f], 0xffffffffdd07a19a
sal rcx, 0x44
not rdx
jne 0x1802deac2
mov ebx, 0x291b8137
movsx eax, bl
movsx r11d, bl
mov edi, dword [rbp + rbx*2 - 0x5237026e]
call fcn.180309f32
mov r11d, 0x501cda85
mov edi, dword [r11 + rbp - 0x501cda85]
ror r11d, 0x9f
movsx edx, r11b
not edx
adc rbp, 3
lea rcx, [rdx*4 - 0x24662252]
xor edi, r8d
neg rdx
mov eax, 0xc428ec36
lea edi, [r11 + rdi + 0x32048b1a]
neg edi
mov ebx, edx
jmp 0x1802da0ac
movsx r9d, bx
ror edi, 3
rol ebx, 0x88
dec edi
not r9
sar ax, cl
rol edi, 3
sar rbx, 0xb
mul rbx
push r8
mul dl
xor rax, rbx
xor dword [rsp + rdx*2], edi
not edx
pop r8
movsxd rdi, edi
inc bl
add r10, rdi
and rdi, rdx
mov r9d, 0x792da52e
movzx ebx, word [rsp + rax - 0x6739b536]
sal ebx, 0x53
mov qword [rbp + r8 - 0x3f], rdi
movsx edi, word [rsp + rax - 0x6739b535]
mov edx, r9d
js 0x1802e937f
mov qword [rsp + rbp*2 - 0x7e], r10
ret 8
Function at 0x1802b8816
Capabilities:
Encode data using base64

Disassembly:
jae 0x180303bcb
mov rax, qword [r8]
mov edx, 0xd63dee8f
add r8, 8
push rax
lea rcx, [rdx - 0x6eea715f]
popfq
mov ebp, dword [r11 + rcx - 0x67537d30]
lea r11, [r11 + rcx - 0x67537d2c]
mov eax, ecx
movzx r9d, cl
xor ebp, esi
neg ebp
neg r9b
mul dl
lea rdi, [rdx*8 + 0x188b2a3c]
lea ebp, [rbp + rax*2 - 0x49f98d06]
bts edx, 0x1f
neg ebp
mov ebx, edx
btr eax, ebx
sub eax, r9d
inc ebp
ror ebp, 1
lea rcx, [rbx + rdi*4 - 0x7c63b63]
imul edi
push rsi
xadd rcx, r9
or edx, ecx
xor dword [rsp + rax - 0x547a4800], ebp
jmp 0x180316e3c
push rax
sub ecx, 0xb4016686
xor qword [rsp + rax*2 - 0x1484c], rdi
neg dword [rsp + rax*8 - 0x52130]
xchg qword [rsp + rax - 0xa426], rdi
ror ecx, 2
xchg qword [rsp + rax - 0xa426], rbx
mov qword [rsp + rax - 0xa426], rsi
ror edi, 0xfa
lea rsi, [r9*4 - 0x6d6806e8]
xor dword [rsp + rax*2 - 0x1484c], ecx
shl r9w, 0x44
not ax
imul di, bx
pop rsi
bt di, r9w
neg dx
movsxd rcx, ecx
add r10, rcx
neg dx
shl bx, 0x8a
call fcn.1802b977f
movsx ecx, dx
mov cl, byte [rsi + rdx]
btr r9d, ebx
adc rsi, rdx
shl rdi, 1
shl r11b, cl
mov word [rsi + rdx - 2], r11w
btc r9, rdi
xor qword [rsp + rdx - 2], r10
ret 0x10
adc r10, rbp
shr bl, 5
lea rbp, [rdi + rdx - 0x71cc4a52]
jmp r10
mov word [rdi + r8 - 0x38000000], bp
pop rdx
jae fcn.18030a981
movsxd rdx, edx
sbb r9, 0x30bdd912
add r10, rdx
add word [rsp + r9 + 0x219de580], 0x49b7
xor r11b, byte [rsp + r9*2 + 0x433bcaf7]
mov edx, dword [rsi + r9 + 0x219de57a]
sbb r11d, r11d
mov eax, dword [r9 + rsi + 0x219de57e]
setge cl
mov qword [rsp + r11*8 + 8], rdi
adc r11d, dword [rbx + rsi - 0x6872f3c6]
call fcn.180315fe0
xor eax, 0x3724f1b9
movsx ebx, r9b
mov edx, 0x4dac18a5
mov r11d, edx
rol eax, 1
neg eax
movsx edi, r11w
lea eax, [rax + r9*2 - 0x6c280127]
push r8
or edx, edi
xor dword [rsp + rbx*2 - 0x4c], eax
mov r8d, ebx
lea r9, [r9*8 - 0x43cdaac8]
pop r8
movsxd rax, eax
sal r11, 0x72
neg r9d
movsx ecx, r11w
add r10, rax
movsx eax, bx
sar dx, 0xe1
mov edx, dword [rsi + rdx - 0x4dac0c52]
xadd r11, rcx
add r9, r11
jle 0x1802f884c
mov ebx, dword [rsi + rbx*8 - 0x12c]
bts r11d, r9d
shr edi, 0xa
push rcx
adc cl, byte [rsi + r11 - 0xfffff8]
shl edi, 0xba
lea rsi, [r11 + rsi - 0xfffffa]
add qword [rsp + r11 - 0x1000000], 0x4d2d6311
shld edx, ebx, cl
or r9, rax
mov dword [rsi + r11*2 - 0x2000000], edx
movsx edx, dil
mov qword [rsp + r11*4 - 0x4000000], r10
ret
ror cl, 0x21
lea rcx, [r9 + r9*2 - 0x44c265]
pop rsi
movsxd rbp, ebp
adc r9, 0x16270b38
xadd ecx, r9d
ja 0x1802f94a3
Function at 0x1802b957b
Capabilities:
Encode data using base64

Disassembly:
lea r11, [rax + r11 - 0x95]
xor cl, sil
mov qword [rsp + rax*2 - 0x12c], r9
movzx edi, r9b
not cl
mov edx, eax
push r9
sub dx, word [rsp + rax*4 - 0x256]
sbb cl, 0xbd
xchg rdx, rax
rol cl, 1
pop rbx
dec cl
and byte [rsp + rax - 0x617a], bl
xor cl, 0xd
div r9w
xor sil, cl
neg qword [rsp + rax - 0xb0]
mov ebp, edi
jle 0x1803173ef
lea r11, [rdx + r11 - 0x92]
idiv rbx
shr dx, 0x87
rol ax, 0xa7
xor r9d, esi
lea r9d, [rcx + r9 - 0x73e28c9d]
xchg rdx, rax
sar ecx, 0x29
ror r9d, 2
ror al, 0x46
mov ebp, edi
add bl, bpl
bswap r9d
ror r9d, 3
call fcn.1802ea81d
lea rcx, [rsp + rcx + 8]
lea rax, [rdi + rdi*4 - 0x7ee41172]
sub ebx, ebp
mov bpl, byte [rax + rcx + 0x7ee40e84]
pop rdx
lea r8, [r8 + rax + 0x7ee40e82]
xadd edi, edx
mov word [r8 + rax + 0x7ee40e84], bp
lea rcx, [rbx - 0x5544c567]
mov r9d, dword [r11 + rax + 0x7ee40e84]
btr rdx, 0xb8
jae 0x1802cf214
mov eax, 0xdbb59f92
lea rdx, [rax - 0x367aaa5b]
mov ecx, dword [r11]
movsx ebx, dx
add r11, 4
shr rbx, 0xdd
bts rax, rax
xor ecx, esi
movsx edi, bl
cwde
movzx ebp, dil
lea ecx, [rcx + rax - 0x6bc9c909]
not al
or dx, ax
rol ecx, 3
ror ax, 7
lea ecx, [rcx + rbx*4 + 0x237be07]
xadd ebp, edx
shr rax, 0x27
add eax, 0xccb71706
rol ecx, 3
dec ecx
not rdi
push rsi
add dil, al
xor dword [rsp + rbx - 7], ecx
pop rsi
call fcn.1802d414f
ror dil, 1
sub dil, 0x28
sub bx, 0xc4a8
rol dil, 1
not dil
lea rax, [r9 + r9*2 + 0x721e9e03]
bswap eax
xor r8b, dil
dec dx
inc bx
add rdi, rsp
push rdx
mov word [rdi + rbx*2 - 0x14190b16], r11w
movsx r11d, al
xor edx, dword [rbp + rbx*2 - 0x14190b16]
dec rax
not r9b
lea rbp, [rbp + r9*4 - 0x28312bf8]
push r9
seto byte [rsp + rbx - 0xa0c857d]
xor edx, r8d
jmp 0x18030c34e

Function at 0x1802b96fc
Capabilities:
Encode data using base64

Disassembly:
sar di, 0xe1
not r11d
xor r11d, 0x4b9e1d31
mov qword [rsp + rbx - 0xa019], 0x280f7406
imul ecx
jae 0x1802aecae

Function at 0x1802ba0c2
Capabilities:
Encode data using base64

Disassembly:
movsxd r9, r9d
add r10, r9
mov qword [rsp + rdx], rax
movzx edi, word [r11 + rdx]
lea r9, [rdx + rbx - 0x43d6e1cc]
mov qword [rsp + rdx*4 + 0x10], rbx
shr edx, 0x9b
lea r11, [rdx + r11 + 2]
neg qword [rsp + rdx*8 + 0x10]
neg bl
xor di, si
add bpl, dl
not dword [rsp + rdx + 8]
sal dl, 0x85
not di
mov byte [rsp + rdx*4 + 8], bl
sar r9, 0x46
xor di, 0xd9b
dec bpl
cdqe
dec byte [rsp + rdx*4 + 0x15]
add di, 0xae35
sub al, bpl
btc ecx, 0x8d
add bl, 3
ror di, 1
not rbx
neg di
btr r9w, 0x97
dec rbx
rol bx, 0x65
xor si, di
lea rdi, [rsp + rdi + 0x18]
ror cx, 0x49
add dl, byte [rdi + rcx - 0x10]
xor rbx, rax
sbb r8, rax
mov word [r8 + rcx - 0x10], dx
btr r9w, bp
sal dword [rsp + rcx*8 - 0x7f], cl
pop rbp
pop rbp
pop rcx
je fcn.18030a981
call fcn.1802d9bd1
Function at 0x1802bb2be
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rdi, [rdi + rdi*2 + 0x2e241b0b]
mov qword [rsp + rdi - 0x49271b4e], rsi
pushfq
pop rsi
mov qword [rsp + rdi - 0x49271b56], rsi
and edi, edi
mov rsi, rbx
not di
dec rdi
bswap rdi
mov rdi, rax
cld
push 0x7ab6d00e
shr dword [rsp + 4], 0xa4
je 0x1802cc3ba
dec di
movsx r8d, bl
pop r8
btc bx, bx
movsxd rdx, edx
xor eax, r9d
adc r10, rdx
jmp r10
rep movsb byte [rdi], byte [rsi]
push qword [rsp + 8]
popfq
mov esi, 0xf19a9d9e
call fcn.1802ae8e0
mov edx, 0x7895d33a
lea r9, [rdx - 0x26789759]
mov dx, word [rdx + rsi - 0x7895d33a]
mov eax, r9d
lea rdi, [r9 + r9*8 - 0x658f5d2]
mov cl, byte [r9 + rsi - 0x521d3bdf]
push rax
lea rsi, [rsi + rax - 0x521d3bdf]
movsx r11d, word [rsp + rax - 0x521d3bdf]
sal dx, cl
xor r9, 0xffffffffa6947c3c
mov word [rsi + r9 + 0xb76b823], dx
xor qword [rsp + r9*8 + 0x5bb5c118], rax
lea rbx, [r9 + r9 - 0x367fe2eb]
mov edx, dword [r9 + rbp + 0xb76b823]
lea rbp, [rbp + r9*4 + 0x2ddae090]
xor edx, r8d
xor byte [rsp + r9*8 + 0x5bb5c11e], bl
rol byte [rsp + r9*4 + 0x2ddae08e], 1
not edx
lea edx, [rdx + r9 - 0x453e947f]
not edx
cbw
dec edx
rol dword [rsp + r9*2 + 0x16ed7046], 0x33
sal r11, 0xf9
mov qword [rsp + r9 + 0xb76b823], r8
xor dword [rsp + r9*2 + 0x16ed7046], edx
jmp 0x1802c3711
Function at 0x1802be909
Capabilities:
Encode data using base64

Disassembly:
add r9, 0xfffffffffffd2b72
jmp r9
mov r8, qword [rsp + rdx - 0x1e35e82c]
movsxd r11, r11d
add byte [rsp + rdx*4 - 0x78d7a0cc], 0xe
adc r10, r11
rol r9w, 0x4c
not qword [rsp + rdx - 0x1e35e834]
jae 0x1802c42c9
mov eax, dword [rsi + rdx*2 - 0x3c6bd068]
setae bl
mov r11d, ebx
dec rdx
mov r11d, dword [rsi + r9*2 - 0x9d02]
shr di, 0xa7
and ebx, 0x540808ae
lea rsi, [rsi + rdx - 0x1e35e82f]
mov qword [rsp + rbx - 0x7f8], 0x638b5a04
or eax, r11d
not eax
mov dword [rsi + r9 - 0x4e83], eax
pop rcx
mov qword [rsp + rdx - 0x1e35e833], r10
ret
jmp 0x1802fa4e3
push 0xfffffffff82c733e
lea rsp, [rsp + 8]
jmp r10
lea rsp, [rsp + 0x18]
jne 0x1802e5785
mov ecx, 0x7783733f
not cl
call fcn.1802c2f1c
xor rbx, r8
mov edx, ecx
dec dil
dec rbx
imul r9
xor rbx, 0x37162402
xchg ecx, r9d
btr r11d, r9d
lea rdi, [r9 + rdx + 0x290ebb25]
not rbx
or r9w, r9w
lea rdx, [r11 + rcx*8 + 0x6fb2651f]
shl rax, 0xbd
ror rbx, 5
jmp 0x1802b519d
xor r8b, cl
lea rcx, [rsp + rcx + 8]
xor dx, word [rcx + r11*8]
pop rcx
mov edi, ebx
xor r11w, bx
lea rsi, [rsi + r11*2 - 0x1551c]
mov word [rsi + r11*4 - 0x2aa34], dx
mov eax, dword [rbp + r11*8 - 0x55468]
movzx edx, r11b
lea rbp, [rbp + r11 - 0xaa89]
and edi, r9d
call fcn.1803085c4
mov ecx, 0xfda418a1
lea ecx, [rdi - 0x3badc99e]
mov eax, edi
lea rax, [rsi + rdi*2 - 0x775b968c]
and rax, 0xfffffffffffffff0
shr di, 0xcb
and rdi, 0xffffffff8d11973d
sbb rax, rcx
mov rsp, rax
push rdi
call fcn.1802bb2be
xor r9w, cx
shr bx, 0x21
xor eax, 0x9c0f8a80
movsx edi, bl
push r8
xor r9b, bl
jg 0x1802e8afe
call fcn.1802e3cdb
push 0x78086993
mov edx, 0x1e35e834
movzx r9d, dx
mov r11d, dword [rdx + rbp - 0x1e35e834]
push r9
add dword [rsp + rdx - 0x1e35e831], edx
jnp 0x1802f2125
push r8
sar ebx, 0x31
movzx r8d, cx
xor dword [rsp + rdi - 0x29360000], edx
pop r8
mov r11d, r9d
xor r11w, 0xe3b1
movsxd rdx, edx
adc r10, rdx
or r9w, 0x43a8
sal rdi, 0x55
mov rbx, qword [rbp + rax - 0x3629]
btr rcx, r9
inc r11b
lea rbp, [rax + rbp - 0x3621]
jle 0x1802c1433
lea rsp, [rsp + 8]
ja 0x1802ba440
mov edi, 0x3badd3b0
sub di, 0x8aa
mov rbx, rsp
jl 0x1802d24d8
jo 0x1802aef57
xor dword [rsp + rbx*4 - 0x7830], eax
sal r9w, 0x67
rol r9d, 0x15
bswap ebx
pop r8
setb bl
sub dl, dh
shr r9b, 0xa2
movsxd rax, eax
movzx r11d, di
adc r10, rax
xchg ecx, r11d
add r11, r10
jmp r11
lea rbp, [rbp + rdx - 0x1e35e830]
movzx edi, word [rsp + rdx - 0x1e35e82c]
inc word [rsp + rdx*2 - 0x3c6bd064]
shr dil, 0xe1
xor r11d, r8d
mov qword [rsp + rdx - 0x1e35e82c], 0xffffffff92bff596
or dword [rsp + rdx - 0x1e35e831], r9d
xor r11d, 0x1da58911
neg word [rsp + r9*2 - 0x1d05c]
or di, word [rsp + rdx - 0x1e35e829]
inc r11d
ror r11d, 2
not dword [rsp + rdx - 0x1e35e82b]
bswap edi
movzx ebx, word [rsp + rdx*2 - 0x3c6bd068]
xor r11d, 0xd865d86
dec r11d
pop rax
inc dil
sub edi, ebx
mov qword [rsp + rdx - 0x1e35e834], r8
mov ecx, r9d
lea r8, [r9*4 - 0x7c48f7e7]
btc bx, 0x1f
xor dword [rsp + rdx - 0x1e35e834], r11d
push r9
jmp 0x1802b4bcc
xor r8, rbx
and dl, 0x10
xchg ecx, r9d
xor edi, r11d
lea rsi, [rax + rsi - 8]
sar r11, 0xf3
call fcn.1802b29b8
Function at 0x1802c06a8
Capabilities:
Encode data using base64

Disassembly:
jmp 0x18030b3cf
push 0x5d378121
lea rsp, [rsp + 0x10]
jne 0x180315c2a

Function at 0x1802c279a
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffa3387c0c
push 0x723e3986
dec ebx
push 0x4859c87
lea rsp, [rsp + 0x20]
jne 0x1802e133a

Function at 0x1802c2f1c
Capabilities:
Encode data using base64

Disassembly:
mov rcx, rax
lea rsp, [rsp + 8]
jmp 0x1802e74e7

Function at 0x1802c31ab
Capabilities:
Encode data using base64

Disassembly:
movsxd rdx, edx
xor dword [rsp + rax - 0x3c31], ecx
adc r10, rdx
or ebp, 0x1c98f7a2
mov eax, dword [r8 + rax*4 - 0xf0e8]
ror r9, 0xd1
adc cl, byte [rsp + rbx*2 - 0xd6]
mov ecx, dword [r8 + rbx*2 - 0xe6]
cpuid
sbb r8, 8
not qword [rsp + 0x10]
bt rdi, r9
mov dword [r8 + 0xc], eax
mov qword [rsp + 0x18], 0xffffffffe594cf00
lea r9, [r9 + r9 - 0x36d43556]
mov dword [r8 + 8], ebx
mov dword [r8 + 4], ecx
mov dword [r8], edx
xadd byte [rsp + 0x10], bpl
adc dword [rsp + 0x1c], 0x7e0f1e14
jp 0x1802ff019
mov ecx, 0x7c2314aa
movzx r9d, cx
movzx bx, byte [rsi + r9 - 0x14aa]
movsx eax, r9b
movzx edi, cl
mov cl, byte [rsi + r9*4 - 0x52a6]
xor r9b, al
lea rsi, [rsi + r9 - 0x13fe]
ror r9d, 0x8b
call fcn.18030679f

Function at 0x1802c4fa6
Capabilities:
Encode data using base64

Disassembly:
mov rsi, qword [rsp + rcx*4 - 0x3264001c]
mov qword [rsp + rcx*2 - 0x19320012], rdi
cdqe
movsxd r9, r9d
add r10, r9
or word [rsp + rcx*8 - 0x64c80046], ax
mov r8, qword [r8 + rcx*2 - 0x19320012]
sal word [rsp + rcx*2 - 0x1932000e], 0xa2
and bpl, byte [rsp + rcx - 0xc990003]
pop r9
pop rbx
jp fcn.18030a981

Function at 0x1802c4fe8
Capabilities:
Encode data using base64

Disassembly:
cwd
rol r11d, 1
mov qword [rsp + rdx*2 + 8], r8
mov qword [rsp + rdx*4], rcx
xor ecx, 0xab92a320
shr word [rsp + rdx + 4], 0xd
xor dword [rsp + rdx*2 + 8], r11d
lea r8, [rcx + rdx*4 - 0x445b2152]
not r8w
imul cx
mov r8, qword [rsp + rdx - 0xfcfa]
dec dil
inc di
call fcn.1802ddfe6
lea rbp, [rbp + rdi*2 - 0x1e202]
neg rbx
xor eax, r8d
bswap rbx
ror dl, cl
xor eax, ebx
lea eax, [rax + r11*2 + 0xc1401e1]
rol r11w, 0x4a
or r11b, dil
xor eax, ebx
add di, r9w
not bx
and r11, 0xffffffffe4b7e18f
dec eax
rol cl, 0x85
not rdi
add rbx, 0xffffffffa414be09
push r8
xor dword [rsp + r11 - 0x4036003], eax
not rbx
neg r11
rol r11b, 0x45
pop r8
movsxd rax, eax
imul rdx, r11
neg r11d
and cl, 0x3a
adc r10, rax
sal r9d, 0xd1
jb fcn.180307268
sar r11, 0x92
push rbx
or di, cx
sar al, 0xe2
bts r9d, 0xbb
mov word [rsi + rbx*4 - 0x100], di
adc r11b, al
adc dl, byte [rsp + rbx - 0x3b]
push rbx
mov qword [rsp + rbx*4 - 0x100], r10
ret 8
Function at 0x1802c5307
Capabilities:
Encode data using base64

Disassembly:
dec byte [rsp + rdx*2 - 0x746f2fac]
movsx r9d, byte [rsp + rdx*2 - 0x746f2fae]
not rdi
setne r9b
ror rdi, 5
xor r8, rdi
and byte [rsp + rdx - 0x3a3797ca], cl
lea r11, [rdx*8 - 0x2559d34d]
lea rsi, [rsi + rdx - 0x3a3797df]
xor r9b, r9b
mov qword [rsi + r9], rdi
and cx, r11w
adc r9d, dword [rbp + rdx - 0x3a3797d7]
lea rdi, [rdx + rax*4 + 0x7f337ab4]
add ecx, 0x43bbc589
lea rbp, [rbp + rdx*2 - 0x746f2faa]
xor r9d, r8d
ror edi, 0xc6
not byte [rsp + rdx*2 - 0x746f2fae]
rol r9d, 2
sar ax, 0xe5
not rdi
mul r11b
lea r9d, [r9 + rdx*2 + 0x481e4b71]
rol r9d, 3
lea rdx, [rbx*8 - 0x3243fdf5]
shl rbx, cl
not r9d
bswap r9d
or dword [rsp + rdi*8 + 0x6cdab30a], ebx
mov qword [rsp + rdi*2 + 0x1b36acca], r8
setae dl
xor dword [rsp + rdi + 0xd9b5669], r9d
mov r8, qword [rsp + rdi*4 + 0x366d598c]
and rcx, rbx
movsxd r9, r9d
jle 0x1802ef3b7
ror rbx, 0xd3
xor eax, esi
mov edi, 0xeb8828ba
sub eax, 0xc8175084
xor eax, 0xc9a4c0bf
sub eax, 0xb4016686
push rbx
neg bl
ror eax, 2
mov qword [rsp + rdx*2 - 0x6e], rsi
mov ebp, r9d
btr rbp, r9
xor dword [rsp + rdx*8 - 0x1b8], eax
pop rsi
xchg dx, bp
movsxd rax, eax
add bx, di
xchg r9b, bpl
not dl
adc r10, rax
shl dx, 0xea
sal rdx, 8
movsx eax, dil
mov rbx, r8
not bp
dec ax
dec ax
lea r8, [r8 + rdx - 0xb80004]
mov dword [r8 + rdx*8 - 0x5c00000], ebx
movzx ecx, dl
jl fcn.18030a981
xor rdi, r8
not qword [rsp + rdx - 0x3a3797cf]
lea rax, [rcx + rcx*4 + 0x1ba53bb9]
mov qword [rsp + rdx*2 - 0x746f2fae], rcx
dec rdi
ror qword [rsp + rdx - 0x3a3797d7], cl
rol qword [rsp + rdx - 0x3a3797cf], 0x30
xor rdi, 0x37162402
jmp 0x1802ada89

Function at 0x1802c8061
Capabilities:
Encode data using base64

Disassembly:
lea r8, [r8 + rbp*2 - 0x2514]
xor dx, word [rbp + r11 - 0x128e]
push rbx
ror qword [rsp + rbp*4 - 0x4a32], 0x47
bts edi, 0xa4
lea r11, [r11 + rbp*4 - 0x4a36]
movzx r9d, bl
jae 0x1802b65da
xor dx, si
xchg di, bp
or r9, rdi
xor dx, 0x6d30
or rbp, rdi
call fcn.1802e40ba
btr rax, 0xc
not r9d
sub ax, dx
lea r9d, [r9 + rax*2 - 0x36bf61a5]
mov qword [rsp + rdi*8 - 0x9238], rdi
not r9d
jnp 0x180316450
and qword [rsp + rdi - 0x1247], rax
xchg word [rsp + rdi*2 - 0x248d], dx
ror r9d, 1
mul rbp
cwde
mov qword [rsp + rax - 0x1f34], rsi
push rbp
add qword [rsp + rax - 0x1f34], 0x50392cb3
ror byte [rsp + rax*2 - 0x3e63], 0xc7
xor dword [rsp + rax*2 - 0x3e60], r9d
mov rsi, qword [rsp + rax*2 - 0x3e60]
btc bx, di
add bpl, bpl
movsxd r9, r9d
inc word [rsp + rax*2 - 0x3e67]
lea rax, [rdx + rax*8 - 0x7fdc20d2]
adc r10, r9
mov qword [rsp + rax + 0x7fdb273a], rdi
lea rdi, [rax*4 - 0x34edff4f]
mov rax, qword [rbp + r8 - 0x128e]
rol di, 0x81
jo 0x1802c235d
Function at 0x1802c8fca
Capabilities:
Encode data using base64

Disassembly:
pop r13
mov r12, qword [rsp + rcx + 0x27]
call fcn.1802bce26

Function at 0x1802cb5a5
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffcea8f7ba
dec r11
call fcn.1802ac774
xor edx, 0x42060a17
shr qword [rsp + 8], 0xe7
jne 0x1802b23bc

Function at 0x1802cc1dd
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r9 - 0x8e8], rdx
mov r8, qword [rsp + r9 - 0x8e0]
movsxd rbx, ebx
lea rax, [r11 + rdx*4 - 0x44fa7e61]
add r10, rbx
shl ax, 0xa5
shl al, 0x46
mov qword [rsp + r9*4 - 0x23b0], r11
pop rcx
pop rax
pop rdi
jae fcn.180307268

Function at 0x1802cc213
Capabilities:
Encode data using base64

Disassembly:
not r11d
lea r11d, [rdx + r11 - 0x11a46baa]
ror r11d, 1
mov qword [rsp + rdx - 0x8110000], r8
add cl, 0x98
lea r8, [rcx + rcx*2 - 0x1766cefd]
call fcn.1802f18a2

Function at 0x1802cca80
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xa0df8b4
lea rsp, [rsp + 8]
add rsp, rcx
test ebx, ebx
je 0x1803074f9

Function at 0x1802cce3b
Capabilities:
Encode data using base64

Disassembly:
mov r10, qword [rsp + rax - 0x8f38]
call fcn.1802d6e7a