joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002004c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002007c
xor eax, eax
jmp 0x14002013f
mov rbp, rbx
cmp word [rax], si
je 0x1400200a1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140020088
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140020084
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001e780
movsxd r14, eax
test eax, eax
jne 0x1400200df
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140020075
mov rcx, r14
call fcn.140018544
mov rdi, rax
test rax, rax
jne 0x1400200f8
xor ecx, ecx
call fcn.140018508
jmp 0x1400200d4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001e780
test eax, eax
jne 0x140020129
mov rcx, rdi
call fcn.140018508
jmp 0x140020133
xor ecx, ecx
call fcn.140018508
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140026104
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000c83c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002618e
cmp byte [rbp - 0x21], r15b
je 0x140026189
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400261c4
call fcn.14001886c
test eax, eax
jne 0x1400261b0
cmp byte [rbp - 0x21], r15b
je 0x1400261a8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400261c4
cmp byte [rbp - 0x21], r15b
je 0x1400261c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c6c0
test eax, eax
jne 0x140026264
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000c83c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140026203
cmp byte [rbp - 0x21], r15b
je 0x140026238
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140026238
call fcn.14001886c
test eax, eax
jne 0x140026224
cmp byte [rbp - 0x21], r15b
je 0x14002621d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140026238
cmp byte [rbp - 0x21], r15b
je 0x140026235
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c6c0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140026264
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140026267
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140026275
mov rcx, rdi
call fcn.140018508
cmp byte [rbp + 0x3f], r15b
je 0x140026284
mov rcx, qword [rbp + 0x27]
call fcn.140018508
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1406aa0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406aa237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406aa0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa0c7
add dl, dl
jne 0x1406aa0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa14e
xor eax, eax
add dl, dl
jne 0x1406aa0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa205
add dl, dl
jne 0x1406aa10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406aa142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406aa0d6
mov eax, 1
add dl, dl
jne 0x1406aa15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa153
sub eax, ebx
mov ebx, 1
jne 0x1406aa1a4
mov ecx, 1
add dl, dl
jne 0x1406aa186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406aa193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406aa1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406aa1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa1b5
cmp eax, 0x7d00
jae 0x1406aa1f3
cmp eax, 0x500
jb 0x1406aa1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa0d6
cmp eax, 0x7f
ja 0x1406aa1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406aa22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406aa0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400ac76f
Capabilities:
Encode data using base64

Disassembly:
and ax, 0x8db4
movzx r9d, byte [r8 + rsi - 0xff]
mov qword [rsp + rsi - 0xff], r10
jbe 0x140115dba
mov r8d, 0xbc0ba48c
movzx ebx, r8b
push rbx
mov r11, qword [rsi + rbx - 0x8c]
movzx eax, byte [rsp + rbx - 0x89]
mov r10d, dword [rsi + rbx*2 - 0x110]
shl ax, 0xaf
lea rsi, [rsi + rbx*2 - 0x10c]
mov dword [r11 + rbx*2 - 0x118], r10d
call fcn.1401a8d9c
mov qword [rsp + rdx - 0x1b2558fa], r8
not rdx
xor dword [rsp + r9 - 0x74cc920c], r11d
mov r8, qword [rsp + rdx*2 + 0x364ab226]
btr edi, ecx
ror rdx, cl
movsxd r11, r11d
cdq
adc r10, r11
imul word [rsp + rcx*2 - 0x64911ca1]
jo 0x1401f9282
add r9b, sil
mul word [rsp + rsi - 0xfb]
rol r9b, 1
sub rcx, qword [rsp + rsi - 0xff]
imul dl
xor r11b, r9b
sar word [rsp + rsi*8 - 0x7f8], 0x25
cdqe
lea r9, [rsp + r9 + 8]
pop rax
cdq
bts ebp, 0xae
movzx bp, byte [r9 + rsi - 0xff]
btc cx, r10w
inc sil
lea rbx, [rbx + rsi*2 - 2]
rol esi, 0xed
mov word [rbx + rsi*2], bp
movzx ebp, cx
and si, r10w
inc ebp
jnp fcn.1400f23e6
mov r10d, 0x779adbbb
movzx ecx, r10b
movsx edx, cl
lea r8, [r8 + r10 - 0x779adbbf]
ror r10w, 0xa6
mov r9d, 0x5705c18a
mov r9d, dword [rcx + r8 - 0xbb]
movzx eax, dl
not dl
xor r9d, r11d
call fcn.14015e32f
xor r9b, r11b
lea rdx, [rax*2 + 0x38277b12]
and dword [rsp + rsi - 0xfe], 0x37a4eb27
sbb r9b, sil
mul cl
rol r9b, 1
add byte [rsp + rsi - 0xfd], 0x92
shl bpl, 0xe5
jns 0x1400b4e51
call fcn.14024cfce
mov qword [rsp + rdx*2 - 0x1ffb6], r10
ret 0x10

Function at 0x1400af40b
Capabilities:
Manually build aes constants

Disassembly:
or r10, rcx
not si
btr r10, rdx
sal r10w, cl
xor si, 0x5188
call fcn.14020b174
xor sil, cl
push r11
jp 0x14014be4e
xor dword [rsp + rsi*2 - 0x160], r9d
pop r11
xchg cl, dl
cdq
shr r10b, 0x85
movsxd r9, r9d
xor si, cx
cwde
adc rdi, r9
cqo
bt esi, eax
jae fcn.1400f23e6
mov esi, 0xef853885
movzx edx, sil
lea rbp, [rbp + rdx*2 - 0x10e]
mov ecx, dword [rbp + rdx*4 - 0x214]
xor ecx, r8d
or dx, 0xed90
sbb esi, esi
sbb ecx, 0x8382be18
mov edi, edx
bswap edi
neg ecx
bswap ecx
xchg di, si
btc esi, 0x89
sbb ecx, 0xeaba2792
push r8
lea r9, [rdx + rsi*4 - 0x6ccac745]
bts rdx, r9
movzx eax, si
xor dword [rsp + rsi*4 - 0x800], ecx
rol r9d, 0xa4
bt di, di
sbb al, sil
pop r8
not si
jbe 0x140157925
mov ecx, 0x7c2059ae
push rcx
mov eax, dword [rsp + rcx - 0x7c2059aa]
lea rbp, [rcx + rbp - 0x7c2059b2]
lea rbx, [rax + rax*8 + 0x6826213a]
mov edx, dword [rbp + rcx - 0x7c2059ae]
pop r10
neg r10w
xor edx, edi
rol edx, 3
mov qword [rsp + rax*2], r9
ret 0x20
jle 0x140202220
lea r11, [rsp + r11 + 0x18]
push rbx
cwde
add rdx, rbx
mov byte [r8 + r11 + 0x330ce080], cl
push r8
jno 0x1401c6b07
jne 0x1400be41c
jmp 0x14016faad
Function at 0x1400bccb7
Capabilities:
Encode data using base64

Disassembly:
bt eax, ecx
bswap edx
push rcx
mov qword [rsp + r11 - 0xde18], r8
add al, 0x91
jg 0x14019cdef
mov r8d, dword [rsp + rax*2 - 0x1cb36]
xor dword [rsp + rax - 0xe58d], edx
lea rsi, [r11*2 - 0x6ecab971]
sar word [rsp + rax - 0xe59c], 0x28
or bpl, bpl
mov r8, qword [rsp + rsi + 0x6ec8fd31]
bt rcx, 0x8b
shl r10b, 0xa3
shr r11w, 0xc5
movsxd rdx, edx
add rsi, qword [rsp + rax - 0xe59d]
add rbx, rdx
cbw
mov qword [rsp + rax*4 - 0x3fe6c], r10
pop rbp
pop rdx
pop rbp
jmp fcn.14009da8d

Function at 0x1400f603e
Capabilities:
Encode data using base64

Disassembly:
lea r9, [r9 + rax - 0xff7c]
xor edx, r8d
add rcx, rsi
shl rax, 0x3c
push rbp
dec edx
xchg cx, ax
xchg byte [rsp + rax - 0xe514], bpl
rol edx, 1
shr al, 0xc1
mov r10d, 0xdc990398
inc edx
xor dword [rsp + rax*8 - 0x7285d], esi
call fcn.1400bccb7
mov r8w, word [rdx + r8 - 0x7105]
lea r10, [rsi + r11*2 - 0x397c377b]
mul rbx
jno fcn.1401bd3ff
add ecx, edi
neg eax
sal rsi, 0x35
setb dl
lea eax, [rax + rcx*2 + 0x71b3be98]
cmove si, r9w
mov qword [rsp + rcx*8 - 0x4d7f8], rdi
mov qword [rsp + rcx - 0x9aff], r8
js 0x140143d9b
xor dword [rsp + rcx*2 - 0x135fe], eax
neg rdx
shl cl, 0x27
pop r8
bts cx, 0x99
imul r9d, r11d
movsxd rax, eax
add r11w, 0xf915
add rbx, rax
call fcn.1401d2e39
mov edx, 0xb914de28
mov ecx, edx
movsx esi, dx
movzx r10d, word [r9 + riz]
movzx eax, si
bt si, 0x1b
sub rdx, 0xffffffffdcb83b3d
lea r9, [r9 + rax*8 - 0x6f13e]
movzx r11d, cx
and dl, sil
jns 0x140100640
mov edx, 0x17387101
jmp 0x1401b93e2
xor r10w, r8w
shr dl, 0x87
btr rsi, r11
cbw
dec r10w
not r10w
cdq
shl al, 0x84
movzx ebp, dx
dec r10w
neg r10w
xor r8w, r10w
lea rdi, [rdi + rdx*2 - 2]
jmp 0x14024fd6f
movzx esi, dx
mov ecx, dword [r9 + rdx - 0x17387101]
btc esi, edx
mov ebx, 0xf0819886
lea r11, [rdx - 0x479544]
lea r9, [r9 + rdx - 0x173870fd]
adc bl, sil
ror bl, 0xc5
js 0x1401bf1dc
xor ecx, ebp
btc rsi, r11
dec esi
dec ecx
jmp 0x1401f62d0
xchg esi, edx
rol rbx, 0x68
rol ecx, 1
bswap ecx
xor sil, 0x1a
bts dx, dx
inc ecx
sar rsi, 0xb4
ror ecx, 2
mov eax, esi
sub bx, bx
dec ecx
shr rsi, 0x6a
or r11w, 0xb826
adc r11d, esi
push rbp
lea rbp, [r11*4 - 0xf7d547]
bts si, dx
xor dword [rsp + rdx*4 - 0x1c418], ecx
pop rbp
xor esi, 0xc8afd189
movsxd rcx, ecx
dec dl
adc rdi, rcx
jmp 0x1400c6538
cbw
mov word [rdi + rdx*4], r10w
add edx, dword [r9 + rdx]
sar cl, 0x47
shr cx, 0xe5
jne 0x1400adc79

Function at 0x14010bc2f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
or r11w, 0x722e
shl cx, 0x41
xor bl, dil
dec r8w
je 0x14016235c
add bl, r8b
movsx r10d, dx
shl dl, 0xc1
rol bl, 1
neg bl
pop rcx
dec r11d
add bl, 0xa7
add byte [rsp + 0x15], r11b
mov qword [rsp], r10
rol bl, 1
movzx ecx, word [rsp + 0x1a]
pop rax
xor dil, bl
pop r11
lea rsi, [rsi + rcx*2 - 0x145c6]
cwde
btc eax, r8d
ror qword [rsp + rcx*8 - 0x5170f], 0xb6
mov word [rsi + rcx - 0xa2e2], bx
lea rbx, [r10 + 0x561e380a]
pop rcx
pop rdx
jae fcn.14014875a

Function at 0x1401250f9
Capabilities:
Parse pe header

Disassembly:
not al
sal bp, 2
mov qword [rsp + rbp*8 - 0x300], 0xfffffffff092cf08
xor al, 0x3e
push rcx
movsx edi, r9b
Function at 0x14015f271
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.1400e20ba
mov ecx, 0x588f124
lea rbp, [rcx + rcx*2 + 0x5f08cb9f]
movsx eax, cl
movzx r9d, byte [r11 + rcx*8 - 0x2c478920]
lea r11, [r11 + rax*2 - 0x47]
bt bp, 0x3f
xor r9b, sil
ror rax, 0x1a
jae 0x1401fe01c
inc r9b
not r9b
movzx r8d, cx
inc r9b
lea rdx, [r8*8 + 0x23b80a80]
neg r9b
lea rdi, [rax + rcx*4 - 0x1e67e442]
and edi, 0x602fe4b5
cmovae cx, dx
sbb r9b, 0x37
shl rdx, cl
shl rax, cl
xor sil, r9b
add r9, rsp
and edi, ebp
mov edi, dword [rcx + r9 - 0x58893a0]
lea r9, [rax*8 - 0x75c3bbd0]
jp 0x14025a8dd

Function at 0x14017c302
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
pop rbp
xor r10d, r11d
mov r9d, 0xb1182c23
sal al, 0x42
mov dword [rsp + rax + 0x774c4adc], ecx
neg r10d
movsx ebp, byte [rsp + rcx - 0x802e]
ror dword [rsp + rcx - 0x802d], 0xf6
or ebp, ecx
lea r10d, [r10 + rax - 0x70601ce7]
shl ax, 0xea
shl bpl, 1
xor cx, bp
xor r10d, edx
bt ebp, 0xa0
setb r9b
sbb r10d, edx
mov qword [rsp + rcx*4 - 0x1fe88], r11
xor dword [rsp + rcx - 0x7f96], r10d
call fcn.14022fc9e

Function at 0x1401890c5
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + r9 + 0x45], 0xffffffffe621f61d
mov cx, word [rdx + rax - 0x3ba6176]
sal dword [rsp + rdx - 0x3ba6176], 0xe8
xadd r9, r8
lea r10, [r10 + rdx - 0x3ba6178]
bswap r9
mov word [r10 + rdx - 0x3ba6176], cx
mov ecx, r8d
mov edi, dword [r11 + rdx - 0x3ba6176]
pop rcx
lea r11, [rdx + r11 - 0x3ba6172]
xor edi, esi
movzx eax, r8b
xor edi, 0x59badb8e
sar cl, 0x42
not edi
sar rax, 0xa3
jae 0x1400f2936
Function at 0x1401b972d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x7f87bf09], rdi
xor dword [rsp + rbx - 0x7f87bf09], r11d
bswap r10
pop rdi
dec rbx
jno 0x14013cc35
mov r8w, word [r10]
mov ecx, 0x48e3539
movzx r9d, cl
mov dx, word [r10 + rcx - 0x48e3537]
sal cx, 0xd
sar cx, 0xad
movsx edi, cl
mov cl, byte [r10 + rcx*2 - 0x91bfffe]
lea r10, [r10 + r9 - 0x35]
shrd r8w, dx, cl
mov word [rdi + r10 - 1], r8w
btr r9d, edi
mov ebp, dword [r11 + r9 - 0x39]
lea r11, [r11 + r9 - 0x35]
add edi, r9d
movsx eax, dil
xor ebp, esi
xor ebp, 0x35302424
movzx ecx, r9w
lea r8, [rcx*2 + 0x318fd001]
lea ebp, [rbp + r8*2 + 0x2e80d22f]
lea rcx, [rdi + rdi*2 + 0x51365a01]
shr rdi, 0xf9
neg ebp
cwde
lea r8, [rcx + r9*8 + 0x1528c73b]
div cl
dec ebp
neg al
push rsi
rol cx, 0x2b
bswap r9d
xor dword [rsp + r9 - 0x39000000], ebp
bt r8d, r9d
mov edx, 0x97a2d3b0
pop rsi
movsxd rbp, ebp
adc rbx, rbp
xadd di, dx
adc cl, dil
sal dil, cl
jmp rbx
neg edx
xadd ecx, r10d
ror edx, 1
xor edx, 0xd10a3c81
xadd ecx, r10d
and rbp, rbp
not edx
inc edx
add rsi, rsi
sal cx, 0x24
push r8
xor dword [rsp + rsi*8 - 0xfcbd0], edx
pop r8
lea rax, [rcx + rcx + 0xdb705bc]
movsxd rdx, edx
sar eax, 0x9d
and r10w, 0x613e
rol ebp, 0x92
add rbx, rdx
call fcn.140127859
lea rbp, [rbp + rbx - 0x7f87bf0d]
mov r11d, dword [rbp + rbx - 0x7f87bf09]
movzx r10d, bl
movzx edx, bx
xor r11d, edi
xor r11d, 0x9eb07a80
movsx eax, dl
lea r8, [r10*2 - 0x7be0215c]
ror r10, 0xe1
lea r11d, [r11 + rbx*2 - 0xdf1aad4]
cqo
push r8
not r11d
bswap r11d
jae 0x140095c1a
jmp fcn.14014875a
not bl
dec r11d
xor ecx, ecx
sal eax, 0x45
bswap r11d
mov qword [rsp + rcx + 0x10], rbp
xor dword [rsp + rcx*2 + 0x10], r11d
mov qword [rsp + rcx + 8], rbx
sar cl, 0x86
mov rbp, qword [rsp + rcx + 0x10]
pop rdx
movsx r10d, al
lea r10, [rbx*8 + 0x5d0807ac]
movsxd r11, r11d
sar r10, 0x15
pop rdx
sub ecx, esi
add rdi, r11
movzx ebx, byte [rbx + r9 - 0x8c7f]
sar ax, 0xe9
lea rdx, [r10*8 + 0x70153a05]
lea r9, [rsi + r9 - 0x55362f23]
xor bl, bpl
not si
sub bl, 0xad
mov qword [rsp + r10*2 - 0x5d0], r10
xchg cx, r10w
not bl
or byte [rsp + r10*4 - 0x3436d], 0x38
dec bl
xadd dword [rsp + r10*2 - 0x1a1b6], eax
cdqe
sub rsi, 0x38078919
neg bl
xor bpl, bl
call fcn.140144fa4
mov si, word [rdi]
mov cl, byte [rdi + 2]
mov r11d, 0xfe828a1f
lea rdx, [r11 + r11*8 - 0x4d79f8c9]
add rdi, 2
lea rbp, [rdx*8 + 0x75977abb]
and bpl, 0x26
shr si, cl
lea rbp, [r11 + r11 - 0x77cee56c]
mov word [rdi + riz], si
lea r10, [r11 + r11*8 + 0xe1b1982]
lea rcx, [rbp - 0x3ded0b5b]
movzx esi, r11w
mov edx, dword [r9 + rsi - 0x8a1f]
sar rsi, 0x33
lea r9, [r9 + rsi*4 + 4]
or r10d, 0xa71658b5
shr rsi, 0x2a
lea r11, [rcx + r10*4 + 0x5ebcb829]
xor edx, r8d
xchg r10w, si
lea rbp, [rcx + r11*2 + 0x12a8333a]
jmp 0x140187b3b

Function at 0x1401e370e
Capabilities:
Parse pe header

Disassembly:
sar r11w, 0x29
add r11d, dword [r11 + r9]
call fcn.14022311b
Function at 0x140210c5e
Capabilities:
Encode data using base64

Disassembly:
and al, bpl
rol ecx, 1
sal rdi, 0xf1
xor ecx, 0x9b382e0b
inc r8
setle bpl
lea ecx, [rcx + rdx - 0x46e01d95]
mov qword [rsp + rdi*2], 0xffffffffe0ae91a7
mov qword [rsp + r8 - 0x955b], rbx
movsx ebx, al
xor dword [rsp + rdi*4], ecx
sub rbp, 0x5d13508f
pop rbx
sbb di, 0x7a2f
inc r11d
movsxd rcx, ecx
push r11
and bpl, byte [rsp + rdi*4 - 0x2173c]
adc r9, rcx
sar rdi, 0xd8
mov ebp, dword [rsi + rdi*2]
bts r11w, r11w
bswap eax
add edi, dword [rsi + rdi + 4]
cdqe
lea rsi, [rsi + r8*4 - 0x25568]
imul r8d, r11d
setno byte [rsp + rax - 0xe884c5]
lea rcx, [rax*8 + 0x3619d3a2]
and ebp, edi
sub qword [rsp + rax*4 - 0x3a21320], r8
sal cx, 0xc1
pop rdi
not ebp
shr rax, 0x19
jns 0x140216426
xor dword [rsp + r9], esi
pop r11
mov eax, ecx
movsxd rsi, esi
movzx r10d, dl
rol cl, 0xc2
push r10
adc rdi, rsi
add al, 0xbe
lea r8, [r8 + rcx - 0x60900001]
movzx eax, byte [r8 + rcx - 0x60900000]
push r9
mov qword [rsp + r9*4 + 8], rdx
xor al, r11b
movzx esi, r9b
movsx ebp, word [rsp + r9*4 + 0xc]
rol al, 1
shl ebp, 0x35
adc al, 0x94
xor al, 0xb5
xadd r9d, ecx
xchg qword [rsp + rcx + 6], r10
not al
xor r11b, al
dec bp
imul ebp, esi
dec rbp
lea rax, [rsp + rax + 0x10]
adc dword [rsp + rcx + 0xc], 0xb71e8da3
setge bpl
add si, word [rax + rcx*8]
btr dx, 0xa1
lea rbx, [rbx + rcx - 2]
jae 0x14022c839
mov dword [rsi + rax], ebp
sub edx, 0x3f035ab8
imul r11w, r8w
xor rax, r9
jmp rax
push rdx
not dx
mov word [rbx + rcx*4], si
pop rbp
pop rax
pop r9
jae fcn.1400f23e6
mov edx, 0x3d299b97
lea r11, [rdx + rdx*4 + 0x770e1a95]
mov r11, qword [rsi + rdx*2 - 0x7a53372e]
movsx eax, dl
movsx r10d, dx
lea rsi, [rdx + rsi - 0x3d299b8f]
cwde
mov r9, r11
movsx ebx, dx
mov r8, rsi
movsx ecx, bx
ror rcx, cl
call fcn.14015cb24

Function at 0x14021cd65
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea ecx, [rcx + rdx - 0x7aa45088]
add dil, al
rol ecx, 2
shr byte [rsp + rdx*4 + 0x15], 0x46
call fcn.1400bcbb1

Function at 0x14022c78c
Capabilities:
Encode data using base64

Disassembly:
inc dx
not r11d
jns 0x1401e65f7
mov ebx, 0xed10b003
movzx r10d, bx
movsx ecx, r10b
mov eax, dword [r9 + r10 - 0xb003]
lea r9, [r10 + r9 - 0xafff]
neg ecx
shr rcx, 0xc7
movsx esi, r10w
xor eax, ebp
inc eax
movsx edx, bx
btc rsi, 0xe
neg eax
call fcn.140226864
lea eax, [rax + rsi + 0x60c09d22]
shr rcx, 0x72
shl sil, 0x61
ror eax, 1
not eax
movsx edi, dx
push rcx
call fcn.1401c0b6b
Function at 0x1401602df
Capabilities:
Reference sql statements

Disassembly:
jmp 0x1401f6d00
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, reloc.WS2_32.dll_accept
call fcn.14016a9fb
mov r9d, dword [rbp + 0x100]
lea r8, [0x1404f3dd4]
lea rdx, str.SELECT__merc_id____arch_calls____arch_faith____spear_calls____spear_faith____sword_calls____sword_faith__FROM___s__WHERE__char_id____d
mov rcx, qword [0x1404f6de0]
call fcn.140164cae
cmp eax, 0xffffffff
jne 0x1401f6d87
mov eax, dword [reloc.WS2_32.dll_send]
add eax, 5
mov r8d, eax
lea rdx, str.C:GAMES_ro_offline_2022_20231219T050943Z_00201_emulator4cram_4th_jobs_srccharint_mercenary.cpp
mov rcx, qword [0x1404f6de0]
call fcn.1401647b8
xor al, al
jmp 0x1401f6ef4
mov rcx, qword [0x1404f6de0]
call fcn.140161626
test eax, eax
je 0x1401f6daa
mov rcx, qword [0x1404f6de0]
call fcn.140160e74
xor al, al
jmp 0x1401f6ef4
xor r9d, r9d
lea r8, [rbp + 8]
xor edx, edx
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x74], eax
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 1
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x88], eax
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 2
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x84], eax
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 3
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x90], eax
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 4
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x8c], eax
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 5
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x98], eax
xor r9d, r9d
lea r8, [rbp + 8]
mov edx, 6
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 8]
call fcn.140161abd
mov rcx, qword [rbp + 0x108]
mov dword [rcx + 0x94], eax
mov rcx, qword [0x1404f6de0]
call fcn.140160e74
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.140168bb0
mov rax, rdi
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140160785
Capabilities:
Reference sql statements

Disassembly:
jmp 0x1401eceb0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x1404ee780]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.14016a9fb
mov edx, 0x18
mov rcx, qword [rbp + 0x170]
call fcn.1401631fb
mov r9, rax
mov r8, qword [rbp + 0x170]
lea rdx, [rbp + 0x28]
mov rcx, qword [0x1404f6de0]
call fcn.140167314
lea r9, [rbp + 0x28]
lea r8, [0x1404f2ad4]
lea rdx, str.SELECT_guild_id_FROM___s__WHERE_name_s
mov rcx, qword [0x1404f6de0]
call fcn.140164cae
cmp eax, 0xffffffff
jne 0x1401ecf6d
mov eax, dword [0x1404edee4]
add eax, 8
mov r8d, eax
lea rdx, str.C:GAMES_ro_offline_2022_20231219T050943Z_00201_emulator4cram_4th_jobs_srccharint_guild.cpp
mov rcx, qword [0x1404f6de0]
call fcn.1401647b8
mov eax, 0xffffffff
jmp 0x1401ecfb6
mov rcx, qword [0x1404f6de0]
call fcn.140161626
test eax, eax
jne 0x1401ecfa0
xor r9d, r9d
lea r8, [rbp + 0x78]
xor edx, edx
mov rcx, qword [0x1404f6de0]
call fcn.140162594
mov rcx, qword [rbp + 0x78]
call fcn.140161abd
mov dword [rbp + 4], eax
jmp 0x1401ecfa7
mov dword [rbp + 4], 0
mov rcx, qword [0x1404f6de0]
call fcn.140160e74
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_bind
call fcn.140168bb0
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.140165226
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret