joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e3a0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42e646
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42e63a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x0061c112], 0
jne 0x42e402
xor edx, edx
xor ebx, ebx
nop
jmp 0x42e44a
xor edx, edx
jmp 0x42e42d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041dce0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42e406
add rax, 0x1260
call fcn.0042e260
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42e5d4
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42e447
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00412d80
test rax, rax
jne 0x42e4a2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42e447
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42e4e9
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e447
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42e62d
lea r10, [0x005ee550]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42e56f
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42e5a5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42e447
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42e625
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42e447
cmp rbx, 0x200
ja 0x42e618
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00423e60
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042e260
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.00462a60
mov rax, r8
call fcn.004629e0
mov rax, r8
mov ecx, 0x40
call fcn.00462a00
mov edx, 0x200
nop
call fcn.00462a40
nop
mov qword [rsp + 8], rax
call fcn.00464de0
mov rax, qword [rsp + 8]
jmp fcn.0042e3a0
Function at 0x4438c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443a2a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4438d8
cmp edx, ecx
jne 0x443a18
nop dword [rax]
test rsi, rsi
jne 0x443a18
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x443934
nop
call fcn.004643a0
xorps xmm15, xmm15
mov r14, qword [0x0061c2f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004437c0
mov rcx, qword [0x005c91d8]
mov rdx, qword [0x005c91d0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x443a13
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x443a08
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x005c9e10]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x005c9e10], rbx
nop
mov edx, 1
lea rsi, [0x005c9e18]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x4439f7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00505c46]
mov ebx, 0x28
call fcn.00435100
mov rcx, rax
mov rax, rsi
call fcn.004629e0
call fcn.00433620
lea rax, [0x00504e6b]
mov ebx, 0x23
call fcn.00435100
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004438c0
Function at 0x450300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450478
movzx edx, byte [rax]
nop
test edx, edx
jne 0x45033c
test r8b, r8b
jne 0x45033c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x45034f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x450438
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x450426
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x45041c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x4503a3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x4503e6
mov eax, 1
cmp rax, rbx
ja 0x4503d5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00462aa0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x450414
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x4503dd
mov r8d, eax
mov eax, r10d
jmp 0x4503a8
mov rcx, rbx
call fcn.004629e0
xor eax, eax
mov rcx, rax
call fcn.004629e0
mov eax, r8d
mov rcx, rbx
call fcn.00462aa0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45046e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x450431
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x450355
mov eax, edx
mov rcx, rbx
call fcn.004629e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004629e0
nop
int3
Function at 0x457e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x457f39
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00457f80]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460240
xorps xmm15, xmm15
mov r14, qword [0x0061c2f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00457e80
Function at 0x462420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4028cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409020
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460380
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4028a0
cmp byte [0x0061c111], 0
je 0x462435
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f480
jmp 0x4028a0

Function at 0x462440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0061c480]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0061c111], 0
je 0x462475
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0061c7c0]
aesenc xmm0, xmmword [0x0061c7d0]
aesenc xmm0, xmmword [0x0061c7e0]
movq rax, xmm0
ret
jmp 0x409220

Function at 0x462480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0061c480]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0061c111], 0
je 0x4624b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0061c7c0]
aesenc xmm0, xmmword [0x0061c7d0]
aesenc xmm0, xmmword [0x0061c7e0]
movq rax, xmm0
ret
jmp 0x409280

Function at 0x463ec0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0061c740]
mov qword [rsp + 8], rdx
lea r8d, [0x0061c12c]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00462360
add rsp, 0x30
ret

Function at 0x464400
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46442c
call fcn.00462360
shl rcx, 3
add rcx, 0x1480
mov qword [0x0061c2f8], rcx
ret
Function at 0x4b3580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b36db
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x005c82e8]
call fcn.004a6ac0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004b3700]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00402760
xorps xmm15, xmm15
mov r14, qword [0x0061c2f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4b369b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4b36d5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4b36ca
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00462aa0
call fcn.00462a20
nop
nop dword [rax + rax]
call fcn.00460380
jmp fcn.004b3580
Function at 0x4ce100
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4ce361
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4ce345
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4ce14d
xor ebx, ebx
xor ecx, ecx
jmp 0x4ce160
mov rax, rdx
call fcn.004c0260
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4ce278
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.004752a0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00525f20]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044cc20
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402760
xorps xmm15, xmm15
mov r14, qword [0x0061c2f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4ce23b
xor eax, eax
lea rbx, [0x004fd284]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x004fd2f3]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044cd00
jmp 0x4ce268
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00525f98]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044cc20
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.004752a0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402760
xorps xmm15, xmm15
mov r14, qword [0x0061c2f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4ce308
xor eax, eax
lea rbx, [0x004fd284]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x004fd2f3]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044cd00
jmp 0x4ce335
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00525f98]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044cc20
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x004fd624]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00460380
mov rax, qword [rsp + 8]
jmp fcn.004ce100
Function at 0x1400e5194
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
xadd qword [rsp + r9 - 0x501efff8], rdx
pop rax
mov qword [rsp + r9 - 0x501f0000], r10
adc r9w, r8w
lea r10, [r9 + r8*8 + 0x5a3559a1]
movzx eax, r10b
xor dword [rsp + r9 - 0x501f0000], ecx
mov ebp, r8d
bt bp, r9w
pop r10
movsxd rcx, ecx
jae 0x1402204f0
xor rdx, r9
sal r9b, 0xc3
adc rsi, rcx
or dl, dl
je 0x140289312
call fcn.14026cdda
add rsi, 8
push rcx
popfq
movzx r8d, bx
mov edx, dword [r8 + rbp - 0xb638]
lea r11, [rbx*8 - 0x6cea5efa]
jmp 0x14010ed95

Function at 0x1400edb45
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov r9, rdi
add edx, esi
mov qword [rsp], 0x572be88e
mov eax, 0xc0875b9e
pop rax
jbe 0x1401d20b1

Function at 0x1400edc14
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], rdi
call fcn.1401777cc

Function at 0x1400edf56
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
movsx ebx, si
xor ecx, edi
rol ecx, 1
mov qword [rsp + rbx - 0x6eb3], r11
inc qword [rsp + rbx*4 - 0x1bacc]
bswap ecx
movsx edx, word [rsp + rbx*8 - 0x37597]
rol ecx, 1
sub rdx, 0xffffffffba30d3a5
neg ecx
mov r9d, 0x30bf733d
xchg word [rsp + rbx - 0x6eae], ax
lea ecx, [rbx + rcx + 0x45a750fa]
mov qword [rsp + rbx - 0x6eb3], rdi
push r9
push rax
xor dword [rsp + rbx*8 - 0x37588], ecx
mul r9b
neg dword [rsp + rbx*2 - 0xdd5b]
mov rdi, qword [rsp + rbx - 0x6ea3]
mov qword [rsp + rbx*2 - 0xdd56], r11
jbe 0x140171bac
setb sil
mov esi, dword [rdi + rcx - 0x8750020]
lea rdi, [rcx + rdi - 0x875001c]
movzx r8d, bpl
xor esi, ebx
bswap esi
call fcn.1400d7bf7
Function at 0x1400f994a
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], r10
jmp 0x14024a4d4
xor r10d, 0xff196e07
not r10d
push r11
and bp, bp
xor dword [rsp + rax - 0x744a00ff], r10d
div cx
movsx r11d, bpl
pop r11
xor r9w, 0x2e08
movsxd r10, r10d
add rax, 0x6d3065b9
not ebx
adc rdi, r10
movzx r10d, bp
call fcn.14010c880
mov eax, 0xc5049892
mov r10d, dword [rsi + riz]
movzx ebx, ax
mul eax
movsx ecx, al
lea rsi, [rbx + rsi - 0x988e]
cbw
xor r10d, r11d
rol rax, 0x9c
movsx r9d, cx
bswap r10d
jae 0x14024ee6b
mov r10d, dword [rsi]
mov eax, 0xe1033638
mov eax, dword [rsi + riz + 4]
mov ecx, 0x4124c80a
bts rcx, rcx
shr cx, 0xee
lea rsi, [rsi + rcx - 0x4123ffff]
call fcn.1401241d4
push r14
call fcn.14014dd64
mov r10d, dword [rax + r8 - 0x744a0074]
lea r8, [r8 + rax - 0x744a0070]
and bl, bpl
xor r10d, r11d
mov r9d, 0x419e3fae
rol r10d, 1
idiv dl
lea rcx, [rax*8 - 0x7fd8124d]
lea r10d, [r10 + rax - 0x380de6ee]
and ebx, r9d
jg 0x140157c30
mov edx, 0x9522b8aa
movsx eax, dl
lea rcx, [rdx + rdx*4 + 0x7a9429b8]
mov rdi, qword [r9 + riz]
mov r8, qword [r9 + riz + 8]
mov cl, byte [r9 + riz + 0x10]
neg rax
adc r9, 9
shld rdi, r8, cl
mov qword [r9 + riz], rdi
or rax, rdx
call fcn.140220332
neg esi
lea r8, [rdx + r11*8 + 0x4cb8538b]
xchg dl, r8b
xadd dl, r8b
push rbx
lea r8, [rcx - 0x6d328dc]
shl rbp, 0x93
xor dword [rsp + rdx*2 - 0x721f6], esi
pop rbx
ror rcx, cl
imul bpl
movsxd rsi, esi
adc r9, rsi
call fcn.1401d2c06
call fcn.140148ea8
mov eax, 0xcdaaaf0b
bt rax, rax
mov ecx, 0xaa3ae72d
sbb rbp, 3
rol al, 0x61
mov ebx, ecx
mov edx, dword [rbp + riz]
xor edx, r10d
movzx esi, cl
or cx, 0xea86
jle 0x14025d9f7
lea rax, [rbx - 0x1863ebe6]
mov r9d, edx
pop r15
bswap rbp
cdqe
pop rax
push r11
mov r9, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
push rbx
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x18], 0xfffffffff6084ab8
push rdx
lea rdx, [rdx + rdx*2 + 0x79006d04]
mov rdx, qword [rsp + 0x30]
pop rcx
mov rcx, qword [rsp + 0x30]
pop r11
call fcn.14011bdae
mov cl, byte [rdi + 8]
mov eax, 0xab8baab7
mov r9d, eax
add rdi, 6
shl eax, 0x67
movzx edx, al
shrd r8d, ebx, cl
lea rcx, [rax + rdx*4 - 0x787d2d76]
mov dword [rdx + rdi - 0x80], r8d
lea r11, [rdx + r11 - 0x84]
neg edx
mov ecx, dword [r11 + rcx - 0x4d58300a]
lea r8, [rax + r9*4 + 0x589f54a8]
movzx ebx, r9w
xor ecx, r10d
add r9b, 0x94
push rdx
movsx ebp, bx
xor ecx, 0xfc319cb4
push r9
not ecx
and dword [rsp + rbx - 0xaab7], ebp
cdq
imul ebx, ebx
bswap ecx
xor ecx, 0x34bcc030
rol dword [rsp + rbx - 0x71d78ecd], 0x55
neg eax
xchg dword [rsp + rax - 0x3a2aa47a], r9d
xor ecx, edx
call fcn.14010c995
dec cx
cqo
neg cx
sub cx, 0x2236
or al, byte [rsp + rax - 0x16]
xor r11w, cx
not qword [rsp + rax*2 - 0x1f7]
lea rcx, [rsp + rcx + 0x18]
sar r9, 0x47
mov r10d, eax
or r10w, dx
mov byte [rcx + r9 - 0x18bd5ff], bpl
mov qword [rsp + r9*8 - 0xc5eaff8], rdi
ret 0x10
Function at 0x140102527
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov r8d, esi
mov qword [rsp + r8*8], rsi
shrd dx, di, cl
neg bx
inc byte [rsp + r8*2]
mov word [r9 + r8], dx
lea rbp, [rbp + r8*2 - 4]
mov edi, ebx
movzx edx, byte [rsp + r8 + 3]
xor r8d, dword [r8 + rbp]
not edx
xor r8d, r10d
jmp 0x14029badd
movzx r9d, r8b
mov edx, 0xae88ce2c
xor eax, r11d
xor r9b, 0xa9
lea eax, [r8 + rax + 0x30f80d9f]
rol r9w, 0x8b
xchg byte [rsp + r8 - 0x5eacd67f], dl
movsx ecx, r8w
not eax
inc eax
jmp 0x140127660
and di, 0x719f
shl qword [rsp], 0x29
neg r8d
xor r8d, edx
movzx ecx, word [rsp + 4]
sal dword [rsp + rcx - 0x1fd], 0xf7
dec rdi
ror r8d, 3
or rdi, rdx
jle 0x14017a69b
sbb r8d, edi
add qword [rsp + rcx - 0x200], rdi
setb dl
ror r8d, 3
sal dx, 5
lea r8d, [r8 + rcx*4 + 0x4017fa10]
xor r8d, 0x8caa8cac
push rsi
neg r8d
sub byte [rsp + rcx*4 - 0x7f8], bh
dec ecx
xor r8d, 0xb7a5743c
pop rcx
ror r8d, 1
btc di, 0x9e
imul rdi, rbx
setno bl
mov qword [rsp], r10
shl dl, 0xa1
xor dword [rsp], r8d
bts rdi, 0x18
pop r10
mov eax, ecx
movsxd r8, r8d
adc r11, r8
sub rdx, rdx
add rdx, r11
jmp rdx

Function at 0x1401241d4
Capabilities:
Encode data using base64

Disassembly:
bswap eax
push rbp
inc eax
add qword [rsp + rbx - 6], r9
neg bx
js 0x140218bf9
adc cl, cl
movzx ebx, cx
not r10d
not eax
lea rbp, [rcx + rcx*2 + 0x431651af]
and r10d, eax
mov dword [rsi + rbx*2 - 0xc], r10d
mov r10d, ebp
mov eax, dword [r8 + rcx - 0x41240006]
add bpl, cl
lea r8, [r8 + rbx - 2]
mov qword [rsp + rbx*4 - 0x18], 0x5a3eba1d
movsx r9d, cl
ror byte [rsp + rbx - 5], cl
xor eax, r11d
dec word [rsp + rcx - 0x41240001]
jp 0x140120f28
mov eax, 0x549f2016
lea r10, [r10 + rax - 0x549f201a]
mov ebx, dword [r10 + rax - 0x549f2016]
lea rdx, [rax*4 + 0x6b25160e]
mul eax
xor ebx, edi
neg rdx
mov r11d, edx
ror ebx, 1
lea rcx, [rdx*4 - 0x44733261]
lea rsi, [rcx + r11*4 - 0x10dadd58]
ror r11w, cl
lea ebx, [rbx + rdx*4 - 0x5546ff4a]
btc ecx, r11d
not ebx
neg cl
bt ecx, r11d
lea ebx, [rbx + rdx*2 - 0x759fbe2f]
cdqe
lea r9, [rcx + rdx*8 - 0x7f5cef75]
bts esi, eax
push rdi
adc edx, eax
xchg rdx, r11
xor dword [rsp + rax - 0x4f5981e4], ebx
pop rdi
or ecx, r11d
not dx
not edx
movsxd rbx, ebx
btc rcx, rax
adc rbp, rbx
btc rcx, rsi
sal r9d, cl
mov rbx, qword [r8 + rax - 0x4f5981e4]
cdqe
call fcn.140136156
rol edx, 1
xor edx, 0xce2786ae
add cx, bp
mov qword [rsp + rcx*2 - 0x54324144], rbx
xor dword [rsp + rcx - 0x2a19209a], edx
mov rbx, qword [rsp + rcx - 0x2a19209a]
not r9w
add r11d, ebp
neg al
movsxd rdx, edx
adc rsi, rdx
mov qword [rsp + rcx - 0x2a19209a], rbp
cqo
sar edx, 0xad
pop rcx
pop r11
pop r9
jbe fcn.140149fd7
lea rsi, [rcx + rsi - 0x1b880411]
movsx r8d, dl
mov eax, edx
xor bl, r11b
jmp 0x14027d5b1
sar r8, 0xc
inc bl
ror bl, 1
neg bl
jmp 0x14025767b

Function at 0x14012b3f9
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
movzx ecx, word [rdi + rcx - 0x3b33e035]
call fcn.1400f3a75
Function at 0x14014dd64
Capabilities:
Encode data using base64

Disassembly:
call fcn.1402133b5
mov ecx, 0x4972230
movzx ebx, cx
lea r9, [rcx - 0x3f77ab55]
mov r9d, dword [r8 + rcx - 0x4972230]
ror rcx, 0x6d
lea r8, [r8 + rbx - 0x222c]
inc cx
mov ebp, ebx
mov eax, ecx
xor r9d, r11d
bts rax, rcx
cdq
or ax, 0xca82
dec r9d
bswap r9d
shl cl, 0x63
mov r10d, ebp
dec r9d
shr r10w, 0xd
push rbp
ror r9d, 1
add r10d, 0x1dab93be
mov qword [rsp + rbx - 0x2230], r11
bt edx, ecx
call fcn.1401971de

Function at 0x14014deda
Capabilities:
Encode data using base64

Disassembly:
shl r11b, cl
sar rcx, 0x99
neg r8d
mov qword [rsp + rcx - 0x7f], r9
neg cx
mov qword [rsp + rcx - 0xff81], rdi
jp 0x14029e0c5
sub r11, 4
mov ebx, dword [r11]
mov r8d, 0x55bba603
movsx ebp, r8w
movsx edx, bp
xor ebx, r10d
mov ecx, ebp
movsx eax, bpl
xor ebx, 0xe7beb2be
sal rbp, 0xa9
mov r9d, r8d
call fcn.1400dc710
mov eax, 0x54b117b1
mov r11d, dword [rbp + rax - 0x54b117b1]
cqo
lea rbp, [rbp + rax - 0x54b117ad]
xor r11d, edi
movzx r9d, ax
push rdx
xor r11d, 0x23b0f483
sar ax, 0xe5
call fcn.1402875a3
xor dword [rsp + rcx - 0xff81], r8d
movzx edi, r11b
pop rdi
dec r9d
movsxd r8, r8d
bt r11w, ax
jae 0x1401e7890