joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802e8b30
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor edi, edi
lea rcx, [0x1804cb690]
call fcn.1802f7320
mov eax, 2
xchg dword [0x1804cb648], eax
cmp eax, 1
je 0x1802e8b7a
lea rcx, [0x1804cb690]
call fcn.1802f72f0
xor eax, eax
jmp 0x1802e8c64
xor r9d, r9d
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x30], rdi
lea rcx, str.conout_
mov qword [rsp + 0xa0], rbp
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
lea r8d, [r9 + 3]
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1802e8be2
lea rdx, [0x1804cb650]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1802e8be2
lock or dword [0x1804cb64c], 1
mov r14d, 1
mov dword [rsp + 0x50], 0xd0001
mov ebp, recv
mov word [rsp + 0x48], r14w
mov ecx, ebp
mov dword [rsp + 0x4c], r14d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rsi + 0x110]
lea r9, [rsp + 0x40]
mov r8d, r14d
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], bp
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x1802e8c4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x1802e8c5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x98]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x1802e9a10
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
btr ecx, 0xc
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x1802e9a58
test cl, 1
jne 0x1802e9a58
test cl, 4
je 0x1802e9a58
and eax, 0xfffffffb
mov dword [rbx + 0x58], eax
test al, 8
je 0x1802e9a58
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
bt eax, 0x10
jae 0x1802e9acd
bt eax, 0x19
jae 0x1802e9ab4
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov eax, reloc.WS2_32.dll_recv
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], ax
lea r8d, [rax - 0xf]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1802e9acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x50
pop rbx
ret
bt eax, 0x15
jb 0x1802e9acd
mov rcx, rbx
call fcn.1802e8b30
test eax, eax
jne 0x1802e9acf
or dword [rbx + 0x58], 0x200000
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x50
pop rbx
ret
Function at 0x1802efd10
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x1804cb6b0]
mov dword [0x1804cb6d8], eax
call fcn.1802f7240
test eax, eax
jne 0x1802efd6d
lea rax, [0x1807536e8]
mov edx, 0x100
lea rcx, [0x1804cb6e0]
xor r8d, r8d
nop
mov qword [rax], rcx
add rcx, 0x2880
mov qword [rax - 8], r8
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x1802efd50
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.1802fa210
int3

Function at 0x1802f2470
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
test rcx, rcx
jne 0x1802f24a5
mov eax, 0xfffff019
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x50
pop rsi
ret
mov qword [rsp + 0x48], rdi
mov r8, rsi
mov qword [rsp + 0x40], r14
xor edx, edx
xor r14d, r14d
mov ecx, 0xfde9
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9d, [r14 - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
test eax, eax
jne 0x1802f24e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1802fa2c0
jmp 0x1802f2616
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
lea rbp, [rdi + rdi]
mov rcx, rbp
call fcn.1802e7aa0
mov rbx, rax
test rax, rax
jne 0x1802f2511
mov eax, 0xfffff027
jmp 0x1802f260c
mov dword [rsp + 0x28], edi
mov r9d, 0xffffffff
mov r8, rsi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
test eax, eax
je 0x1802f2544
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1802f255b
mov rcx, rbx
call fcn.1802e78f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1802fa2c0
jmp 0x1802f260c
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp rsi, rdi
jbe 0x1802f2595
mov rcx, rbx
call fcn.1802e78f0
lea rcx, [rsi + rsi]
call fcn.1802e7aa0
mov rbx, rax
test rax, rax
je 0x1802f260a
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp word [rbx + rbp - 2], 0x5c
jne 0x1802f25b2
cmp rdi, 3
jne 0x1802f25aa
cmp word [rbx + 2], 0x3a
je 0x1802f25bf
dec rdi
mov word [rbx + rdi*2], r14w
cmp rdi, 2
jb 0x1802f2602
cmp word [rbx + 2], 0x3a
jne 0x1802f2602
movzx ecx, word [rbx]
lea eax, [rcx - 0x41]
cmp ax, 0x19
jbe 0x1802f25d8
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x1802f2602
sub cx, 0x20
test cx, cx
je 0x1802f2602
mov eax, 0x3d
mov word [rsp + 0x32], cx
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov rdx, rbx
mov dword [rsp + 0x34], 0x3a
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.1802e78f0
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x50
pop rsi
ret
Function at 0x1802f28f0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x30]
mov rdx, 0xffffffffffffffff
test eax, eax
cmove rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x78
ret

Function at 0x1802f2940
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x28]
mov rdx, 0xffffffffffffffff
test eax, eax
cmove rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18031edb0
add rsp, 0x78
ret

Function at 0x1802f3650
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rdi, r8
mov rcx, qword [r8 + 0x70]
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
jne 0x1802f36d0
mov eax, dword [rdx + 0x58]
test al, 0x40
je 0x1802f3748
mov edx, eax
and edx, 0xffffffbf
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x1802f36a5
test dl, 1
jne 0x1802f36a5
test al, 4
je 0x1802f36a5
and eax, 0xffffffbb
mov dword [rbx + 0x58], eax
test al, 8
je 0x1802f36a5
mov rax, qword [rbx + 8]
dec dword [rax + 8]
cmp qword [rbx + 0x100], 0
je 0x1802f3748
mov ecx, dword [r8 + 0x40]
call fcn.1802fbac0
mov ecx, eax
call fcn.1802fa2c0
mov edx, eax
mov rcx, rbx
call qword [rbx + 0x100]
jmp 0x1802f3748
cmp dword [r8 + 0x40], 0
jl 0x1802f3725
lea r9, [rdx + 0x110]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1802f3725
mov rax, qword [rbx + 0x130]
mov qword [rdi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rdi
test rax, rax
je 0x1802f3748
xor edx, edx
mov rcx, rbx
call rax
jmp 0x1802f3748
mov rcx, qword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi + 0x70], 0xffffffffffffffff
test byte [rbx + 0x58], 0x40
je 0x1802f3748
mov rdx, rdi
mov rcx, rbx
call fcn.1802f4160
mov ecx, dword [rbx + 0x78]
mov eax, dword [rbx + 0x58]
dec ecx
mov dword [rbx + 0x78], ecx
test al, 1
je 0x1802f3771
test ecx, ecx
jne 0x1802f3771
test al, 0x20
jne 0x1802f3771
or eax, 0x20
mov dword [rbx + 0x58], eax
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18030f0b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x1804be628]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call fcn.18032ace4
mov rbx, rax
test rax, rax
je 0x18030f1b4
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, rax
mov dword [rsi + 0x350], 1
call fcn.1803396a8
mov edi, eax
test eax, eax
js 0x18030f1a4
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.18032f9c0
test eax, eax
jne 0x18030f19b
mov eax, dword [rsp + 0x34]
cmp eax, 0x10000
jg 0x18030f170
inc eax
movsxd rcx, eax
call fcn.18032acec
mov rbx, rax
test rax, rax
je 0x18030f15f
mov r8d, dword [rsp + 0x34]
mov rdx, rax
mov ecx, edi
call fcn.180336ee4
movsxd rcx, dword [rsp + 0x34]
cmp eax, ecx
jne 0x18030f15f
mov byte [rcx + rbx], 0
mov rdx, rbx
mov rcx, rsi
call fcn.18030f1d0
mov rcx, rbx
call fcn.18032a77c
mov ecx, edi
call fcn.180336818
jmp 0x18030f1af
call fcn.1802ff010
cmp eax, 2
jge 0x18030f19b
mov ecx, 2
call fcn.1803267d4
mov r9d, dword [rsp + 0x34]
lea rdx, str.hwloc_pci:_Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
mov r8, rbx
call fcn.180004160
mov ecx, edi
call fcn.180336818
jmp 0x18030f1af
mov rdx, rbx
mov rcx, rsi
call fcn.18030f1d0
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18031edb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
Function at 0x181a4e2e0
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffe48d5d26
lea rsp, [rsp + 0x20]
jmp 0x181a50946

Function at 0x181a4e34e
Capabilities:
Encode data using base64

Disassembly:
push 0xfffffffffa82b434
lea rsp, [rsp + 0x10]
jmp 0x181a50946

Function at 0x181a4e401
Capabilities:
Encode data using base64

Disassembly:
push 0x1b25d2a6
lea rsp, [rsp + 0x38]
jmp 0x181a50946

Function at 0x181a4e47e
Capabilities:
Encode data using base64

Disassembly:
jbe 0x181a5054d
lea rsp, [rsp + 0x10]
jmp 0x181a54f50
adc rsi, 0xb
mov qword [rsp], 0x69990836
mov dword ss:[rax], r8d
push 0x332c338e
jmp 0x181a5009b

Function at 0x181a4e63d
Capabilities:
Encode data using base64

Disassembly:
mov dword [r10 + 4], eax
jmp 0x181a56318
not dword [rsp + 0x12]
lea rsp, [rsp + 0x18]
jmp 0x181a50946

Function at 0x181a4e8db
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x181a50946

Function at 0x181a4e8e5
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x682cf2ae
jl 0x181a54d8a
mov edx, 0xc68feca5
jmp 0x181a51fb3

Function at 0x181a4e996
Capabilities:
Encode data using base64

Disassembly:
sub cx, 0x9815
xor bp, cx
lea rcx, [rsp + rcx + 0x20]
mov word [rcx], ax
lea rsp, [rsp + 0x20]
jmp 0x181a50946
mov r9d, 0xeb85dc3b
movzx r9d, byte [rdi + riz]
push 0x7ab44904
sal dword [rsp], 0x95
jns 0x181a51135
call fcn.181a4e70c
adc rdi, 0
xor r9b, bpl
not r9b
jmp 0x181a5848f
mov eax, 0x9e83c390
dec rax
setge al
movzx eax, byte [rbx + riz]
call fcn.181a55da7
sar word [rsp + 1], 0x43
xor r9b, 0xe
ror word [rsp + 1], 0xa5
push 0x632f55b8
jae 0x181a59180
jmp 0x181a5d629
inc r9b
neg r9b
not word [rsp + 2]
xor bpl, r9b
call fcn.181a56ff7
mov r9, qword [rsi]
mov r8d, 0xb498308a
not r8d
mov r8, qword [r9 + r8 - 0x4b67cf75]
mov qword [rsi], r8
push 0x598dcd89
lea rsp, [rsp + 8]
jmp 0x181a54f50
push 0xfffffffff990320d
ror qword [rsp], 0xc3
cmp ebx, 4
call fcn.181a58fa0
push 0x692a1d17
lea rsp, [rsp + 0x18]
jne 0x181a5a241
mov r8d, 0xfa205f2a
not r8d
not r8b
mov r8, rax
push 0x5b968c1b
lea rsp, [rsp + 8]
jmp 0x181a50acc

Function at 0x181a4e9b0
Capabilities:
Encode data using base64

Disassembly:
shr dword [rsp + 0x20], 0x4c
sbb r11w, 0x768d
dec dword [rsp + 0x1a]
rol qword [rsp + 0x20], 0xfe
ror r11w, 1
sar word [rsp + 0x23], 0x65
push 0xffffffffc20f7fb8
xor r10w, r11w
push 0x7caf753a
lea r11, [rsp + r11 + 0x38]
mov dword [r11], r9d
jmp 0x181a55e15
push 0xffffffffb9359a2e
lea rsp, [rsp + 0x40]
jmp 0x181a54f50

Function at 0x181a4ea67
Capabilities:
Encode data using base64

Disassembly:
and dl, bl
mov word [r10], dx
jmp 0x181a55f73
shl word [rsp + 0xc], 0xaf
adc r10, 2
push 0xffffffffd18cd817
sar qword [rsp], 0x73
not dl
push 0xffffffffeb188e1d
not bl
or qword [rsp + 2], 0x4a86c6a8
js 0x181a4e809
lea rsp, [rsp + 0x20]
jmp 0x181a50946

Function at 0x181a4eaae
Capabilities:
Encode data using base64

Disassembly:
mov word [r10], r9w
jmp 0x181a50268
jmp 0x181a532bf
jmp 0x181a562e2
lea rsp, [rsp + 8]
jmp 0x181a50946

Function at 0x181a4eb30
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsi], edx
jmp 0x181a57489
lea rsp, [rsp + 0x18]
jmp 0x181a54f50
Function at 0x181a4ebdf
Capabilities:
Encode data using base64

Disassembly:
jmp 0x181a594b5
lea rsp, [rsp + 0x28]
jmp 0x181a50946

Function at 0x181a4ec99
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x40]
jmp 0x181a55070

Function at 0x181a4ed7a
Capabilities:
Encode data using base64

Disassembly:
mov r9, qword [rsi]
add rsi, 8
movzx eax, word [rbx]
add rbx, 2
push 0x6215c416
xor ax, r10w
xor ax, 0x41ad
dec ax
push 0x25057433
shl word [rsp + 0xd], 0xe8
ror qword [rsp + 8], 0xa1
neg ax
dec ax
inc word [rsp + 0xc]
jno 0x181a590bb
jmp 0x181a55e96
push 0xffffffffaa223220
call fcn.181a5941a
pop r10
mov r10, qword [rsp + r14*2 - 0x7ec0]
mov qword [rsp + r14 - 0x3f74], 0x45060134
mov qword [rsp + r14 - 0x3f6c], r8
call fcn.181a5b1a9
movzx r11w, byte [rsi]
mov r8b, byte [rsi + 2]
call fcn.181a5b0fe
jmp 0x181a4e575
push 0x5299e997
lea rsp, [rsp + 8]
jmp 0x181a54f50
add rsi, 0xc
mov dword [r8], r11d
jmp 0x181a5319f
xor r10w, ax
lea rax, [rsp + rax + 0x10]
mov qword [rax], r9
lea rsp, [rsp + 0x10]
jmp 0x181a54f50
lea rax, [rsp + rax + 0x38]
jmp 0x181a4ed3f

Function at 0x181a4ed7f
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jmp 0x181a55070

Function at 0x181a4ed89
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x181a50946
Function at 0x181a4edb0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsi], rcx
call fcn.181a502cf
call rax
mov r10d, 0x96b0fdb0
call fcn.181a53a7d
mov r11d, 0x1483b10d
call fcn.181a502b4
call fcn.181a4f8f0
mov eax, 0xe9be961e
mov rax, qword [rsi + riz]
mov r11d, 0x8a0b5c9d
shl r11w, 0x6c
push r11
mov r11d, dword [rsi + riz + 8]
push 0xffffffffab3b0d25
adc rsi, 0xb
jmp 0x181a5b2b3
jb 0x181a52f23
mov word [rsi], r8w
call fcn.181a520ef
mov edx, 0x6d8d482a
movsx ecx, dx
add dx, dx
mov edx, dword [r10 + rdx - 0x6d8d9054]
push rcx
sar rcx, 0x83
mov cl, byte [r10 + rcx*2 - 0x1206]
ja 0x181a510fe
jmp 0x181a58a47
call fcn.181a546c6
adc r10, 2
jmp 0x181a5392f
call fcn.181a5ae58
js 0x181a4eda1
adc rsi, 3
push 0xffffffffcfb7452a
call fcn.181a58d92
lea rsp, [rsp + 0x10]
jmp 0x181a50946
push rax
jmp 0x181a5cade
push 0xffffffffa5164403
jmp 0x181a55eea
call fcn.181a57fc8
lea rsp, [rsp + 8]
jmp 0x181a50946
jmp 0x181a5321e
neg byte [rsp + 3]
sal edx, cl
jmp 0x181a532b0
push 0xffffffffc31f4812
jmp 0x181a4e374
mov eax, 0x6a921b0c
shl rax, 0x87
setns al
mov r10, rbx
movabs r9, 0
ror ax, 0x89
movzx ebp, al
sar al, 0x45
sbb r10, r9
cwde
lea rbp, [0x181a57760]
jne 0x181a5a38d
mov eax, 0xe294de20
mov rax, qword [rbp + riz]
push 0xffffffffac13d229
rol word [rsp + 4], 8
call fcn.181a4e7e9
push 0x578e6f1e
dec ebx
push 0xffffffffb98b3914
call fcn.181a50b65
lea rsp, [rsp + 0x30]
jmp 0x181a50946
lea rsp, [rsp + 0x30]
jmp 0x181a50946
mov eax, 0x8fa75e95
inc ax
mov rax, qword [rbp + rbx*8]
jns 0x181a4f2c3
mov qword [r10], rax
jmp 0x181a5a219
jmp 0x181a5cc49
dec ebx
jmp 0x181a55a86
mov dword [rax], r11d
call fcn.181a58680
mov ecx, 0x9c9362b2
push rcx
mov rcx, qword [r10 + riz]
add r10, 8
neg dword [rsp + 3]
mov r8d, dword [rsp + 2]
movzx ebx, r8b
mov rbx, rcx
movzx edx, byte [rsp + 3]
mov edi, r8d
mov r9d, dword [rsp + rdx - 0x61]
mov rsi, r10
pop rax
jbe 0x181a54f22
imul ecx
mov dword [rsi], edx
push 0xfffffffffdb5ee1a
call fcn.181a52b3e
mov word [rax], r8w
call fcn.181a4f3f7
mov eax, 0xb63877bb
movzx r9d, word [rbx + riz]
shl eax, 0x37
rol ax, 0x48
adc rbx, 2
sub eax, eax
dec eax
xor r9w, r10w
sar ax, 0xc2
sete al
rol r9w, 1
push rax
dec dword [rsp + 1]
dec rax
dec r9w
push rax
push rax
xor r9w, 0xa1bb
inc byte [rsp + 9]
add r9w, 0x4aa2
btr eax, 0x8c
add qword [rsp + 8], rax
xchg dword [rsp + 0xb], eax
not r9w
xchg dword [rsp + rax*8 - 0xfe6], eax
neg r9w
ror r9w, 1
not ax
rol al, 0x83
xor r10w, r9w
add ax, ax
jb 0x181a537a0
rol byte [rsp + rax*2 + 0x12], 0x85
lea r9, [rsp + r9 + 0x18]
dec eax
mov eax, dword [r9 + riz]
sets byte [rsp + 6]
sbb rsi, 3
mov dword [rsi], eax
jmp 0x181a52cb6

Function at 0x181a4ede0
Capabilities:
Encode data using base64

Disassembly:
jmp 0x181a5a5b2
mov qword [r10], rbx
lea rsp, [rsp + 0x18]
jmp 0x181a50946
jmp 0x181a5837e
Function at 0x181a4eded
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsi], rcx
call fcn.181a4f124
mov r9d, 0xcc81e58d
bswap r9
or r9w, r9w
movzx r9d, byte [rbx + riz]
mov eax, 0x8807f08a
bswap eax
adc rbx, 1
bts ax, ax
setae al
sal rax, 0x32
xor r9b, r10b
rol eax, 0x7b
not r9b
lea rax, [rax*8 - 0xb7efd63]
dec eax
adc r9b, 0x28
rol r9b, 1
inc r9b
jmp 0x181a5b591
jmp 0x181a585c3
push 0x7e8e253e
lea rsp, [rsp + 0x18]
jmp 0x181a55070
jmp 0x181a4ede5
sub rsi, 2
push 0xffffffff9014838d
push 0x1019fea4
mov word [rsi], ax
jmp 0x181a55d98
xor al, al
rol r9b, 1
rol rax, 0xe3
sub ax, ax
sal eax, 0x70
xor r10b, r9b
add r9, rsp
add eax, eax
sbb eax, eax
add al, byte [rax + r9]
jmp 0x181a5d43e
jmp 0x181a52619

Function at 0x181a4ee7a
Capabilities:
Encode data using base64

Disassembly:
jp 0x181a5d5a2
push 0xfffffffff6bf2c98
mov esi, dword [rsi]
push 0xffffffffc59fe3ac
jmp 0x181a5a67b
jp 0x181a4ee74
not qword [rsp + 0x14]
mov byte [rax], r11b
ja 0x181a56fb9
lea rsp, [rsp + 0x10]
jmp 0x181a55070
lea rsp, [rsp + 0x20]
jae 0x181a50946

Function at 0x181a4ee8b
Capabilities:
Encode data using base64

Disassembly:
adc rsi, 1
shr r9, cl
push 0x57be0039
mov word [rsp], 0xf12d
mov qword [rsi], r9
lea rsp, [rsp + 0x10]
jmp 0x181a54f50

Function at 0x181a4eed6
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x40]
jne 0x181a50946
mov r9d, 0x78bffe36
mov r9, qword [r10 + r9 - 0x78bffe36]
jmp 0x181a5d3dd

Function at 0x181a4ef9b
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffd086beb1
add edx, eax
mov dword [r10], edx
jmp 0x181a53917
lea rsp, [rsp + 0x18]
jmp 0x181a50946

Function at 0x181a4f0f6
Capabilities:
Encode data using base64

Disassembly:
mov word [r10], si
push 0x3e93b52d
lea rsp, [rsp + 0x18]
jmp 0x181a50946

Function at 0x181a4f133
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffd43935b8
jmp 0x181a5ce61

Function at 0x181a4f17a
Capabilities:
Encode data using base64

Disassembly:
push 0x43071f03
lea rsp, [rsp + 0x28]
jmp 0x181a55070

Function at 0x181a4f189
Capabilities:
Encode data using base64

Disassembly:
jmp 0x181a5660b
shr rdx, cl
push 0x7a22d817
mov qword [r10], rdx
push 0x49a6ea01
lea rsp, [rsp + 0x20]
jmp 0x181a50946

Function at 0x181a4f2a0
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x181a55070

Function at 0x181a4f2c8
Capabilities:
Encode data using base64

Disassembly:
jmp 0x181a58d39
lea rsp, [rsp + 0x40]
jmp 0x181a54f50

Function at 0x181a4f2d4
Capabilities:
Encode data using base64

Disassembly:
mov word [r10], r9w
lea rsp, [rsp + 0x18]
jmp 0x181a50946

Function at 0x181a4f32a
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsi + 4], eax
mov dword [rsi], edx
push 0x1126a736
jmp 0x181a50041
lea rsp, [rsp + 0x20]
jmp 0x181a55070

Function at 0x181a4f3f1
Capabilities:
Encode data using base64

Disassembly:
jg 0x181a571c3
add r10, 8
mov qword [rsp], 0xffffffff8f9c6035
sub dword [rsp + 5], 0xe48ca217
call fcn.181a54c23

Function at 0x181a4f3f7
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffff923a3537
lea rsp, [rsp + 0x20]
jmp 0x181a54f50
Function at 0x181a4f45c
Capabilities:
Encode data using base64

Disassembly:
mov byte [rsp + 0x32], 0x2f
lea rsp, [rsp + 0x38]
jmp 0x181a50946

Function at 0x181a4f5a0
Capabilities:
Encode data using base64

Disassembly:
add rsi, 0xa
mov word ss:[r11], ax
lea rsp, [rsp + 8]
jmp 0x181a54f50

Function at 0x181a4f61b
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffb3111e88
add rdi, 2
dec word [rsp + 4]
js 0x181a582d7
call fcn.181a5464c
xor ax, bp
mov qword [rsp + 8], 0x30956037
push 0x7bae0a1f
rol ax, 1
inc word [rsp + 0x10]
dec qword [rsp + 0x10]
not ax
jp 0x181a55c42
push 0xffffffffb22cdc3e
ror ax, 1
ror word [rsp + 0x15], 0xc8
mov word [rsp + 7], 0x2206
not ax
call fcn.181a56cd0

Function at 0x181a4f632
Capabilities:
Encode data using base64

Disassembly:
mov qword [r10], rbx
push 0x6c803323
lea rsp, [rsp + 0x10]
jmp 0x181a50946

Function at 0x181a4f64a
Capabilities:
Encode data using base64

Disassembly:
adc r10, 1
shr r11w, cl
push 0xffffffffcd0c9c88
push 0x468cb186
push 0x27243f37
mov word [r10], r11w
push 0xffffffffe3028728
jmp 0x181a56076
lea rsp, [rsp + 0x28]
jmp 0x181a50946

Function at 0x181a4f766
Capabilities:
Encode data using base64

Disassembly:
push 0x228c91a4
lea rsp, [rsp + 0x20]
jmp 0x181a54f50

Function at 0x181a4f775
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsi + 8], rax
lea rsp, [rsp + 0x10]
jmp 0x181a54f50

Function at 0x181a4f8ff
Capabilities:
Encode data using base64

Disassembly:
mov qword [r10], rsi
jmp 0x181a58eaf
lea rsp, [rsp + 0x18]
jmp 0x181a50946

Function at 0x181a4fa45
Capabilities:
Encode data using base64

Disassembly:
mov word [rsi], cx
lea rsp, [rsp + 0x20]
jmp 0x181a54f50

Function at 0x181a4fa5c
Capabilities:
Encode data using base64

Disassembly:
mov dword [r11], ebx
lea rsp, [rsp + 0x10]
jmp 0x181a50946

Function at 0x181a4fa73
Capabilities:
Encode data using base64

Disassembly:
mov rdx, qword [r10 + rdx - 0x651f9c2b]
mov r9, qword [r10 + 8]
mov qword [rsp], 0xfffffffff910c63f
ror dword [rsp + 4], 0xa6
setb byte [rsp + 6]
adc r10, 0xf
mov qword ss:[rdx], r9
push 0xfffffffff33fbcbd
lea rsp, [rsp + 0x10]
jmp 0x181a50946

Function at 0x181a4fbd9
Capabilities:
Encode data using base64

Disassembly:
adc rbx, 2
jmp 0x181a5301e
push 0x54a75e97
push 0xffffffffd7a0d73b
xor cx, r10w
shl dword [rsp + 0xa], 0x66
push 0xffffffffb3082e26
adc cx, 0x75b8
mov dword [rsp + 0x13], 0xe32ed096
call fcn.181a51dd1

Function at 0x181a4fd1d
Capabilities:
Encode data using base64

Disassembly:
mov r11d, 0x25060088
movsx r9d, r11b
mov r11, qword [r11 + rsi - 0x25060088]
rol r9w, 0x2d
mov r9, qword [rsi + riz + 8]
jb 0x181a4e28b
mov r9d, 0x868662a6
jmp 0x181a502e6
lea r9, [r9 + r9*8 + 0x34b80cb4]
mov r9, qword [rsi + riz]
call fcn.181a56440
mov ecx, 0xd2b9bb4
lea r11, [rcx*4 - 0x1e772200]
ror r11d, cl
mov r11, qword [r10 + rcx - 0xd2b9bb4]
movzx cx, byte [r11 + rcx*4 - 0x34ae6ed0]
jae 0x181a55ca8
mov cl, byte [rsi + riz + 4]
push 0x1418bf92
adc rsi, 3
jmp 0x181a55ddb

Function at 0x181a4fd54
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x181a50946