joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008feb0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, str._u__
mov qword [rcx], rax
add rcx, 8
call fcn.140189370
lea rcx, [rsi + 0x10]
call fcn.140189370
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140189370
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x140384a6c]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1400f53b0
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.1400ed1f0
lea rcx, [rsi + 0x318]
xor edx, edx
call fcn.1400ed1f0
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.1400ed1f0
movups xmmword [rsi + 0x328], xmm6
movups xmmword [rsi + 0x338], xmm6
mov dword [rsi + 0x348], ebp
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x360], xmm6
movups xmmword [rsi + 0x370], xmm6
mov byte [rsi + 0x380], bl
mov dword [rsi + 0x384], edi
mov byte [rsi + 0x388], bl
movups xmmword [rsi + 0x390], xmm6
movups xmmword [rsi + 0x3a0], xmm6
call fcn.140039ae0
call fcn.1400eac30
mov dword [rsi + 0x1a8], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400900e0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400900cb
call fcn.1400f4c40
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400f4cf0
mov qword [0x1403b8f38], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x1403db008]
jmp 0x140090099
Function at 0x1401317e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1403c0a10]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140131847
cmp rdi, rsi
je 0x14013183b
mov eax, 0xffffffff
lea rcx, [0x1403c0610]
movzx edx, byte [rdi]
movzx ebx, al
xor ebx, edx
shr eax, 8
xor eax, dword [rcx + rbx*4]
inc rdi
cmp rdi, rsi
jne 0x140131821
not eax
jmp 0x14013183d
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1403c0a10]
call fcn.1401cfee0
cmp dword [0x1403c0a10], 0xffffffff
jne 0x140131810
lea r14, [0x1403c0610]
mov r8d, 0x400
mov rcx, r14
mov dl, 0xaa
call fcn.1401d34c0
xor eax, eax
mov r8d, 0xedb88320
mov edx, eax
shr edx, 1
mov ecx, eax
and ecx, 1
neg ecx
and ecx, r8d
xor ecx, edx
mov edx, ecx
shr edx, 1
bt eax, 1
mov ebx, 0
sbb ebx, ebx
and ebx, r8d
xor ebx, edx
mov edx, ebx
shr edx, 1
bt ecx, 1
mov ecx, 0
sbb ecx, ecx
and ecx, r8d
xor ecx, edx
mov edx, ecx
shr edx, 1
bt ebx, 1
mov ebx, 0
sbb ebx, ebx
and ebx, r8d
xor ebx, edx
mov edx, ebx
shr edx, 1
bt ecx, 1
mov ecx, 0
sbb ecx, ecx
and ecx, r8d
xor ecx, edx
mov edx, ecx
shr edx, 1
bt ebx, 1
mov ebx, 0
sbb ebx, ebx
and ebx, r8d
xor ebx, edx
bt ecx, 1
mov ecx, 0
sbb ecx, ecx
and ecx, r8d
mov edx, ebx
shr edx, 2
shr ecx, 1
xor ecx, edx
bt ebx, 1
mov edx, 0
sbb edx, edx
and edx, r8d
xor edx, ecx
mov dword [r14], edx
inc rax
add r14, 4
cmp rax, 0x100
jne 0x14013187b
lea rcx, [0x1403c0a10]
call fcn.1401cff78
jmp 0x140131810
Function at 0x140133080
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov rbp, qword [rcx + 0x10]
cmp rbp, qword [rcx + 0x18]
jne 0x1401331a7
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x140133110
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r12, rbx
sub r12, rax
mov r15, rbp
sub r15, rbx
je 0x1401330f2
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1401d2e10
mov rbp, qword [rsi + 8]
add r12, r15
mov qword [rsi + 0x10], r12
lea rax, [r13*8]
add rax, rbp
mov qword [rsi + 8], rax
mov rbp, r12
jmp 0x1401331a7
mov rax, rbp
sub rax, r15
sar rax, 2
cmp rbp, r15
mov edi, 1
cmovne rdi, rax
mov rax, rdi
shr rax, 0x3d
jne 0x1401331c4
mov r12, rdi
shr r12, 2
lea rcx, [rdi*8]
call fcn.1401cfd80
lea r9, [rax + r12*8]
lea r8, [rax + rdi*8]
mov r10, r9
sub rbp, rbx
je 0x140133184
mov rdi, rbp
sar rdi, 3
and rbp, 0xfffffffffffffff8
mov r10, rbp
add r10, r9
shl rdi, 3
lea rbp, [rax + r12*8]
xor edx, edx
mov rcx, qword [rbx + rdx]
mov qword [rbp + rdx], rcx
add rdx, 8
cmp rdi, rdx
jne 0x140133172
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbp, r10
test r15, r15
je 0x1401331a7
mov rcx, r15
call fcn.1401cfdbc
mov rbp, qword [rsi + 0x10]
mov rax, qword [r14]
mov qword [rbp], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1401e9f10
int3

Function at 0x1401331d0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1401331f7
mov r14, rbx
jmp 0x1401332e7
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x14013324c
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r14, [r15 + r12*8]
sub r15, rbx
je 0x14013323b
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401d2e10
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r14
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1401332e7
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x140133304
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.1401cfd80
lea r14, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, r14
sub r15, rbx
je 0x1401332c7
mov r10, rdi
mov rcx, r15
sar rcx, 3
and r15, 0xfffffffffffffff8
mov r9, r15
add r9, r14
shl rcx, 3
lea rdx, [rax + r12*8]
xor edi, edi
mov rbp, qword [rbx + rdi]
mov qword [rdx + rdi], rbp
add rdi, 8
cmp rcx, rdi
jne 0x1401332b3
mov rdi, r10
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x1401332e7
mov rcx, rbx
call fcn.1401cfdbc
mov r14, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [r14 - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1401e9f10
int3
Function at 0x14018c190
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.140189400
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [0x1403979d0]
movsd xmm0, qword [0x1403b8b28]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14018c1ed
jnp 0x14018c252
ucomisd xmm0, xmm6
jne 0x14018c1f9
jnp 0x14018c37c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x14033d860]
subpd xmm1, xmmword [0x14033d870]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x140346250]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [0x1403976a0]
call rbx
mov rcx, rax
call qword [0x140397818]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [0x140397b00]
mov eax, dword [0x1403b8b38]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14018c383
mov eax, dword [0x1403b8b48]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14018c3bd
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [0x1403979c0]
mov rbp, qword [rbx]
call qword [0x1403976a0]
mov rcx, rax
mov edx, r12d
call qword [0x140397b00]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [0x1403979c8]
sub rbp, qword [0x1403b8b40]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x14033d860]
subpd xmm1, xmmword [0x14033d870]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x140346248]
ucomisd xmm2, xmm1
ja 0x14018c1ed
shl r15, 0x20
or r14, r15
sub r14, qword [0x1403b8b30]
movq xmm0, r14
punpckldq xmm0, xmmword [0x14033d860]
subpd xmm0, xmmword [0x14033d870]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1403b8b28], xmm0
jmp 0x14018c1ed
xor eax, eax
jmp 0x14018c22b
lea rcx, [0x1403b8b38]
call fcn.1401cfee0
cmp dword [0x1403b8b38], 0xffffffff
jne 0x14018c29c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1403b8b30], rdx
lea rcx, [0x1403b8b38]
call fcn.1401cff78
jmp 0x14018c29c
lea rcx, [0x1403b8b48]
call fcn.1401cfee0
cmp dword [0x1403b8b48], 0xffffffff
jne 0x14018c2c1
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [0x1403979c0]
mov rax, qword [rbx]
mov qword [0x1403b8b40], rax
lea rcx, [0x1403b8b48]
call fcn.1401cff78
jmp 0x14018c2c1
Function at 0x1401908c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14019092e
xor r11d, r11d
mov r14, qword [r8 + r11*8]
mov r15, qword [rcx + r11*8]
mov rbx, r15
xor rbx, r14
mov edi, eax
lea rax, [rbx - 1]
mov rsi, r15
sub rsi, r14
xor rsi, r15
or rsi, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor rsi, r15
sar rsi, 0x3f
mov rbx, rsi
not rsi
and esi, 1
or rsi, rbx
mov rbx, rax
and edi, ebx
not rax
and rax, rsi
or rax, rdi
inc r11
cmp r10, r11
jne 0x1401908db
cmp rdx, r9
jb 0x14019093d
ja 0x140190969
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x14019093f
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x140190935
xor esi, esi
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14019096b
mov rcx, rsi
not rcx
dec rsi
and rsi, rcx
sar rsi, 0x3f
mov rcx, rsi
and ecx, eax
not rsi
and esi, 1
or esi, ecx
mov eax, esi
jmp 0x140190935

Function at 0x140190be0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x140190cd3
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rax, rdi
jne 0x140190c00
test rsi, rsi
je 0x140190cd3
test eax, eax
jle 0x140190cf8
mov rax, qword [rdx]
test byte [rax], 1
je 0x140190cf8
cmp dword [rdx + 0x10], 0
jne 0x140190d31
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.140099340
test rax, rax
je 0x140190d51
mov eax, dword [r14 + 0x20]
test eax, eax
jle 0x140190d18
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x140190c4c
inc ecx
mov dword [r14 + 0x20], ecx
mov rax, qword [rdi]
mov r9, qword [rax]
mov ebx, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov esi, ebx
and esi, 1
neg rsi
mov rax, r9
and rax, rsi
mov rdi, rax
xor rdi, rbx
shr rdi, 1
and rax, rbx
add rax, rdi
and rsi, r8
shr rcx, 1
or rcx, rsi
mov rbx, rax
dec rdx
jne 0x140190c88
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rsp + 0x20], 0xa5
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1402b48b0
jmp 0x140190cc7
mov dword [rsp + 0x20], 0xa9
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x140190cf1
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x140190c6c
mov dword [r14 + 0x28], 0
jmp 0x140190c6c
mov dword [rsp + 0x20], 0xad
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x140190cf1
mov dword [rsp + 0x20], 0xb3
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x140190cf1
Function at 0x140191590
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x1401916ec
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x14033b990]
lea r14, [rsp + 0x40]
movaps xmmword [r14], xmm0
movaps xmmword [r14 - 0x10], xmm0
movaps xmmword [r14 - 0x20], xmm0
lea r12, [rsp + 0x30]
lea r15, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, r15
mov r8, rsi
call qword [0x1403db008]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, r15
mov rdx, r12
mov r8, rsi
call qword [0x1403db008]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, r15
mov rdx, r14
mov r8, rsi
call qword [0x1403db008]
test rdi, rdi
je 0x140191680
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rdi, rax
jne 0x140191670
lea rdi, [rsi + 0xf8]
mov eax, dword [0x1403befd4]
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x1401916f0
call fcn.140003260
lea rax, [0x140001d60]
test rdi, rdi
je 0x1401916bb
lea rcx, section..text
mov qword [rdi], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [r14]
movups xmmword [r15], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x1401916cf
bt eax, 9
jae 0x140191710
call fcn.140004450
lea rax, [0x140004920]
test rdi, rdi
je 0x1401916bb
lea rcx, [0x140004620]
jmp 0x1401916b8
call fcn.140248e60
lea rax, [0x140249680]
test rdi, rdi
je 0x1401916bb
lea rcx, [0x140248d40]
jmp 0x1401916b8

Function at 0x140199a10
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
test r8, r8
je 0x140199a3b
xor ecx, ecx
lea r9, [0x140383770]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc rcx
cmp r8, rcx
jne 0x140199a20
ret
Function at 0x1401a1210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x1401a12f3
test rax, rax
jne 0x1401a12e2
cmp dword [rsi + 0x50], 0
jne 0x1401a12e2
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x1401a1333
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.14017a420
cmp rax, 0xffffffffffffffff
jne 0x1401a1321
cmp dword [rsi + 0x58], 1
je 0x1401a12fc
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x1401a1339
movabs r14, 0x100003600
nop dword [rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.14017a420
cmp rax, 0xffffffffffffffff
jne 0x1401a1339
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x1401a12d1
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x1401a12a0
jmp 0x1401a1339
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x1401a12c2
bt r14, rcx
jae 0x1401a12c2
jmp 0x1401a1339
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1402b19b0
mov rax, qword [rsi + 0x40]
jmp 0x1401a1228
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x1401a127f
movabs rcx, 0x100003600
bt rcx, rax
jae 0x1401a127f
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x1401a1255
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1401a4700
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401a4729
xor r9d, r9d
xor eax, eax
nop word [rax + rax]
movzx r10d, byte [rdx + r9]
xor r10b, byte [rcx + r9]
movzx r10d, r10b
or eax, r10d
inc r9
cmp r8, r9
jne 0x1401a4710
ret
xor eax, eax
ret

Function at 0x1401e3714
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401e3868
Function at 0x140209680
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1402096b2
call fcn.1401e6a8c
mov dword [rax], 0x16
call fcn.1401e8640
jmp 0x1402097d1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1402097d1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1402097d1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1402096e1
lock or dword [rcx + 0x14], 0x10
jmp 0x1402097d1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1402096f5
call fcn.14020b44c
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1401e6ea0
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1401e936c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1402097bf
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14020978a
mov rcx, rsi
call fcn.1401e6ea0
cmp eax, edi
je 0x140209775
mov rcx, rsi
call fcn.1401e6ea0
cmp eax, 0xfffffffe
je 0x140209775
mov rcx, rsi
call fcn.1401e6ea0
movsxd rbx, eax
lea r14, [0x1403b34a0]
mov rcx, rsi
sar rbx, 6
call fcn.1401e6ea0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14020977c
lea rdx, [0x1403a7520]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14020978a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1402097ae
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1402097ae
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1402097ae
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1402097d4
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140214d80
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov rbp, qword [rcx + 0x10]
cmp rbp, qword [rcx + 0x18]
je 0x140214dbd
mov rax, qword [r14]
mov qword [rbp], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x140214e29
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r12, rbx
sub r12, rax
mov r15, rbp
sub r15, rbx
je 0x140214e0b
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1401d2e10
mov rbp, qword [rsi + 8]
add r12, r15
mov qword [rsi + 0x10], r12
lea rax, [r13*8]
add rax, rbp
mov qword [rsi + 8], rax
mov rbp, r12
jmp 0x140214da0
mov rax, rbp
sub rax, r15
sar rax, 2
cmp rbp, r15
mov edi, 1
cmovne rdi, rax
mov rax, rdi
shr rax, 0x3d
jne 0x140214ec5
mov r12, rdi
shr r12, 2
lea rcx, [rdi*8]
call fcn.1401cfd80
lea r9, [rax + r12*8]
lea r8, [rax + rdi*8]
mov r10, r9
sub rbp, rbx
je 0x140214e99
mov rdi, rbp
sar rdi, 3
and rbp, 0xfffffffffffffff8
mov r10, rbp
add r10, r9
shl rdi, 3
lea rbp, [rax + r12*8]
xor edx, edx
mov rcx, qword [rbx + rdx]
mov qword [rbp + rdx], rcx
add rdx, 8
cmp rdi, rdx
jne 0x140214e87
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbp, r10
test r15, r15
je 0x140214da0
mov rcx, r15
call fcn.1401cfdbc
mov rbp, qword [rsi + 0x10]
jmp 0x140214da0
call fcn.1401e9f10
int3

Function at 0x140214ed0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x140214f0f
mov r14, rbx
mov rax, qword [rdi]
mov qword [r14 - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x140214f61
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r14, [r15 + r12*8]
sub r15, rbx
je 0x140214f53
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401d2e10
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r14
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x140214ef2
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x140215005
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.1401cfd80
lea r14, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, r14
sub r15, rbx
je 0x140214fdc
mov r10, rdi
mov rcx, r15
sar rcx, 3
and r15, 0xfffffffffffffff8
mov r9, r15
add r9, r14
shl rcx, 3
lea rdx, [rax + r12*8]
xor edi, edi
mov rbp, qword [rbx + rdi]
mov qword [rdx + rdi], rbp
add rdi, 8
cmp rcx, rdi
jne 0x140214fc8
mov rdi, r10
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x140214ef2
mov rcx, rbx
call fcn.1401cfdbc
mov r14, qword [rsi + 8]
jmp 0x140214ef2
call fcn.1401e9f10
int3