joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x140057c77
movzx edx, byte [rax]
test edx, edx
jne 0x140057b34
nop dword [rax]
test r8b, r8b
jne 0x140057b34
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x140057b47
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140057c37
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x140057c25
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x140057c17
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x140057b9d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x140057be0
mov eax, 1
cmp rax, rbx
ja 0x140057bcb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.14006cee0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x140057c0f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x140057bd3
mov rcx, r11
mov eax, r12d
jmp 0x140057ba2
mov rcx, rbx
call fcn.14006ce20
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.14006ce20
mov eax, r8d
mov rcx, rbx
call fcn.14006cee0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x140057c6d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x140057c30
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x140057b4d
mov eax, edx
mov rcx, rbx
call fcn.14006ce20
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.14006ce20
nop
int3

Function at 0x14005dc80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005dd35
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.14005b900
nop
test bl, bl
je 0x14005dd2f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x14005dd80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.14006aa00
xorps xmm15, xmm15
mov r14, qword [0x14075bd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006ab20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14005dc80
Function at 0x140060c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140060d2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x140060d80]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.14006aa00
xorps xmm15, xmm15
mov r14, qword [0x14075bd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006ab20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.140060c80
Function at 0x14028c980
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1406c2060]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14028c9a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14028c9a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14028c9a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14028c9f5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14028c9ec
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14028c9a0
add rax, 0x28
cmp rax, r9
jne 0x14028c9d8
xor eax, eax
ret

Function at 0x14028ca00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1406c2060]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14028ca20
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14028ca28
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14028ca20
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14028cab0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1406c2060]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14028cad0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14028cad8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x14000177c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
call fcn.1400014a0
xor r10d, r10d
test eax, eax
js 0x1400019ab
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x140001808
lea rdx, [rbx + 8]
lea rdx, [rdx + r9*4]
lea r8, [rbx + 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov eax, dword [rdx - 8]
sub r9, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
lea r8, [r8 + 0x10]
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
lea rdx, [rdx - 0x10]
mov ecx, dword [r8 - 0xc]
mov dword [r8 - 0xc], eax
mov dword [rdx + 0x14], ecx
cmp r10, r9
jl 0x1400017b9
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x1400019a9
lea r10, [rbx + 2]
lea rdi, [0x140000000]
lea r10, [r10 + 0x10]
inc r11d
mov r8d, dword [r10 - 2]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0x10a2b0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x109ab0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x1096b0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
xor r9d, dword [rdi + rcx*4 + 0x109eb0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 + 3]
mov r8d, dword [rdi + rdx*4 + 0x10a2b0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x109ab0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x109eb0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x1096b0]
movzx edx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 + 7]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x10a2b0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x109ab0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x109eb0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x1096b0]
movzx edx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 + 0xb]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x10a2b0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, byte [r10 + 0xc]
xor r8d, dword [rdi + rcx*4 + 0x109ab0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x109eb0]
movzx ecx, byte [rdi + rax*4 + 0x10a6b0]
xor r8d, dword [rdi + rcx*4 + 0x1096b0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x140001822
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400028ec
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.1400acb10
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x140004840
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
mov r15, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x69], ebx
mov r13d, 0xb6
call fcn.140004148
mov dword [rbp - 0x69], 1
mov dword [rbp - 0x22], 0x615a5958
mov dword [rbp - 0x33], 0x4a494847
mov dword [rbp - 0x1c], 0x67666564
mov word [rbp - 3], 0x3332
mov dword [rbp - 0xc], 0x77767574
mov word [rbp - 0x28], 0x5352
mov dword [rbp - 0x2d], 0x504f4e4d
mov dword [rbp - 0x18], 0x6b6a6968
mov dword [rbp + 4], 0x2f2b39
mov dword [rbp - 0x11], 0x7271706f
mov dword [rbp - 8], 0x307a7978
mov dword [rbp - 1], 0x37363534
mov dword [rbp - 0x26], 0x57565554
mov byte [rbp - 0x29], 0x51
mov byte [rbp - 4], 0x31
mov dword [rbp - 0x39], 0x44434241
mov word [rbp - 0x35], 0x4645
mov word [rbp - 0x14], 0x6d6c
mov word [rbp - 0x1e], 0x6362
mov word [rbp - 0x2f], 0x4c4b
mov byte [rbp + 3], 0x38
mov byte [rbp - 0xd], 0x73
mov byte [rbp - 0x12], 0x6e
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x61]
call fcn.14000410c
nop
mov edi, ebx
mov ecx, ebx
lea esi, [rbx + 3]
jmp 0x140004926
mov r15, qword [rbp + 0x6f]
dec r13d
mov al, byte [r15]
mov byte [rbp + rcx + 0x77], al
inc edi
inc rcx
inc r15
mov qword [rbp + 0x6f], r15
mov dl, byte [rbp + 0x79]
mov r15b, byte [rbp + 0x78]
mov r12b, byte [rbp + 0x77]
cmp rcx, rsi
jne 0x1400049b8
mov al, r12b
shr al, 2
mov byte [rbp + 0x7f], al
mov cl, r12b
and cl, sil
shl cl, 4
mov al, r15b
shr al, 4
add cl, al
mov byte [rbp + 0x80], cl
mov cl, r15b
and cl, 0xf
shl cl, 2
mov al, dl
shr al, 6
add cl, al
mov byte [rbp + 0x81], cl
mov al, dl
and al, 0x3f
mov byte [rbp + 0x82], al
mov rdi, rbx
movzx edx, byte [rbp + rdi + 0x7f]
lea rcx, [rbp - 0x61]
call fcn.140004a94
mov dl, byte [rax]
mov rcx, r14
call fcn.140004aac
inc rdi
cmp rdi, 4
jl 0x14000498f
mov edi, ebx
mov rcx, rbx
mov dl, byte [rbp + 0x79]
test r13d, r13d
jne 0x140004922
test edi, edi
je 0x140004a73
cmp edi, esi
jge 0x1400049f0
mov eax, esi
sub eax, edi
movsxd r8, eax
movsxd rax, edi
lea rcx, [rbp + 0x77]
add rcx, rax
xor edx, edx
call fcn.1400acb10
mov dl, byte [rbp + 0x79]
mov r15b, byte [rbp + 0x78]
mov r12b, byte [rbp + 0x77]
mov al, r12b
shr al, 2
mov byte [rbp + 0x7f], al
and r12b, sil
shl r12b, 4
mov al, r15b
shr al, 4
add r12b, al
mov byte [rbp + 0x80], r12b
and r15b, 0xf
shl r15b, 2
mov al, dl
shr al, 6
add r15b, al
mov byte [rbp + 0x81], r15b
and dl, 0x3f
mov byte [rbp + 0x82], dl
lea eax, [rdi + 1]
movsxd r15, eax
test eax, eax
jle 0x140004a5a
movzx edx, byte [rbp + rbx + 0x7f]
lea rcx, [rbp - 0x61]
call fcn.140004a94
mov dl, byte [rax]
mov rcx, r14
call fcn.140004aac
inc rbx
cmp rbx, r15
jl 0x140004a3a
cmp edi, esi
jge 0x140004a73
sub esi, edi
movsxd rbx, esi
mov dl, 0x3d
mov rcx, r14
call fcn.140004aac
sub rbx, 1
jne 0x140004a63
lea rcx, [rbp - 0x61]
call fcn.140004200
mov rax, r14
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140004c68
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x140004c9e
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x140004c7d
inc r8
mov al, byte [r8]
test al, al
jne 0x140004c72
not edx
mov eax, edx
ret
Function at 0x14000da0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x20]
call fcn.1400108e4
nop
mov edx, 0x400
mov dword [rbp + 0x28], edx
mov dword [rbp + 0x30], 0x6e65704f
xor edi, edi
mov byte [rbp + 0x34], dil
lea rcx, [rbp - 0x20]
call fcn.14001095c
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
mov r8, rbx
call fcn.14003bbc4
lea rcx, [rbp - 0x20]
call fcn.140010908
lea rcx, [rbp - 0x20]
call fcn.140010430
mov dword [rbp - 0x17], 0x46455249
mov byte [rbp - 0x18], 0x46
mov word [rbp - 0x12], 0x58
mov byte [rbp - 0x13], 0x4f
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.140010474
test eax, eax
js 0x14000da9e
mov edi, 2
jmp 0x14000db3a
mov dword [rbp + 0x3a], 0x454c474f
mov word [rbp + 0x38], 0x4f47
mov byte [rbp + 0x3e], dil
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.140010474
test eax, eax
js 0x14000dae9
mov dword [rbp - 0x2e], 0x454d4f52
mov word [rbp - 0x30], 0x4843
mov byte [rbp - 0x2a], dil
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140010474
test eax, eax
js 0x14000dae9
mov edi, 1
jmp 0x14000db3a
mov dword [rbp - 0xb], 0x45524f
mov dword [rbp - 0xf], 0x4c505845
mov byte [rbp - 0x10], 0x49
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call fcn.140010474
test eax, eax
js 0x14000db13
mov edi, 3
jmp 0x14000db3a
mov dword [rbp - 0x27], 0x47444553
mov byte [rbp - 0x28], 0x4d
mov word [rbp - 0x23], 0x45
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.140010474
test eax, eax
js 0x14000db3a
mov edi, 4
lea rcx, [rbp - 0x20]
call fcn.140010874
mov eax, edi
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400380d0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov r15d, r8d
mov r12, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x49], ebx
mov dword [rbp - 0x2c], 0x51504f4e
mov word [rbp - 0x32], 0x4948
mov word [rbp - 0x35], 0x4645
mov dword [rbp - 0x30], 0x4d4c4b4a
mov dword [rbp - 0x11], 0x7271706f
mov word [rbp - 0x38], 0x4342
mov dword [rbp - 0x17], 0x6c6b6a69
mov dword [rbp - 6], 0x3231307a
mov dword [rbp - 0x1e], 0x65646362
mov word [rbp - 0x19], 0x6867
mov dword [rbp + 4], 0x2f2b39
mov dword [rbp - 0x24], 0x59585756
mov word [rbp - 0xd], 0x7473
mov dword [rbp - 0xa], 0x79787776
mov byte [rbp - 0x1a], 0x66
mov word [rbp + 1], 0x3736
mov byte [rbp - 0x36], 0x44
mov word [rbp - 0x13], 0x6e6d
mov word [rbp - 0x27], 0x5453
mov word [rbp - 2], 0x3433
mov byte [rbp - 0x28], 0x52
mov byte [rbp - 0x33], 0x47
mov byte [rbp - 0xb], 0x75
mov word [rbp - 0x20], 0x615a
mov byte [rbp], 0x35
mov byte [rbp + 3], 0x38
mov byte [rbp - 0x39], 0x41
mov byte [rbp - 0x25], 0x55
call fcn.140004148
mov dword [rbp - 0x49], 1
mov edi, ebx
test r15d, r15d
je 0x1400382fc
mov ecx, ebx
lea esi, [rbx + 3]
jmp 0x1400381bc
mov r12, qword [rbp + 0x6f]
dec r15d
mov al, byte [r12]
mov byte [rbp + rcx + 0x77], al
inc edi
inc rcx
inc r12
mov qword [rbp + 0x6f], r12
mov dl, byte [rbp + 0x79]
mov r12b, byte [rbp + 0x78]
mov r13b, byte [rbp + 0x77]
cmp rcx, rsi
jne 0x140038248
mov al, r13b
shr al, 2
mov byte [rbp + 0x7f], al
mov cl, r13b
and cl, sil
shl cl, 4
mov al, r12b
shr al, 4
add cl, al
mov byte [rbp + 0x80], cl
mov cl, r12b
and cl, 0xf
shl cl, 2
mov al, dl
shr al, 6
add cl, al
mov byte [rbp + 0x81], cl
mov al, dl
and al, 0x3f
mov byte [rbp + 0x82], al
mov rdi, rbx
movzx eax, byte [rbp + rdi + 0x7f]
mov dl, byte [rbp + rax - 0x39]
mov rcx, r14
call fcn.140004aac
inc rdi
cmp rdi, 4
jl 0x140038226
mov edi, ebx
mov rcx, rbx
mov dl, byte [rbp + 0x79]
test r15d, r15d
jne 0x1400381b8
test edi, edi
je 0x1400382fc
cmp edi, esi
jge 0x140038280
mov eax, esi
sub eax, edi
movsxd r8, eax
movsxd rax, edi
lea rcx, [rbp + 0x77]
add rcx, rax
xor edx, edx
call fcn.1400acb10
mov dl, byte [rbp + 0x79]
mov r12b, byte [rbp + 0x78]
mov r13b, byte [rbp + 0x77]
mov al, r13b
shr al, 2
mov byte [rbp + 0x7f], al
and r13b, sil
shl r13b, 4
mov al, r12b
shr al, 4
add r13b, al
mov byte [rbp + 0x80], r13b
and r12b, 0xf
shl r12b, 2
mov al, dl
shr al, 6
add r12b, al
mov byte [rbp + 0x81], r12b
and dl, 0x3f
mov byte [rbp + 0x82], dl
lea eax, [rdi + 1]
movsxd r15, eax
test eax, eax
jle 0x1400382e3
movzx eax, byte [rbp + rbx + 0x7f]
mov dl, byte [rbp + rax - 0x39]
mov rcx, r14
call fcn.140004aac
inc rbx
cmp rbx, r15
jl 0x1400382ca
cmp edi, esi
jge 0x1400382fc
sub esi, edi
movsxd rbx, esi
mov dl, 0x3d
mov rcx, r14
call fcn.140004aac
sub rbx, 1
jne 0x1400382ec
mov rax, r14
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140038314
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.1400aaa40
sub rsp, rax
mov rbx, rcx
lea rcx, [rbp - 0x80]
call fcn.14000410c
nop
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140037e94
nop
lea rcx, [rbp - 0x80]
call fcn.140004200
mov edi, 0x400
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x820]
call fcn.1400acb10
xor r9d, r9d
lea rcx, [rsp + 0x58]
call fcn.1400386bc
test rax, rax
je 0x1400383b1
xor edx, edx
lea r8, [rbp + 0x820]
lea rcx, [rsp + 0x58]
call fcn.1400386e8
mov cl, byte [rax]
mov byte [r8], cl
inc r9d
inc r8
movsxd rdx, r9d
lea rcx, [rsp + 0x58]
call fcn.1400386bc
cmp rdx, rax
jb 0x14003838a
mov r8, rdi
xor edx, edx
lea rcx, [rbp + 0xc20]
call fcn.1400acb10
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov r8, rdi
xor edx, edx
lea rcx, [rbp + 0x420]
call fcn.1400acb10
mov dword [rsp + 0x37], 0x41324443
mov word [rsp + 0x3b], 0x4537
mov dword [rsp + 0x47], 0x46434243
mov dword [rsp + 0x30], 0x37383843
mov word [rsp + 0x3e], 0x3646
mov word [rsp + 0x4f], 0x39
mov word [rsp + 0x34], 0x3444
mov dword [rsp + 0x43], 0x42413436
mov word [rsp + 0x4c], 0x4638
mov word [rsp + 0x41], 0x4232
mov byte [rsp + 0x4e], 0x39
mov byte [rsp + 0x36], 0x32
mov byte [rsp + 0x4b], 0x36
mov byte [rsp + 0x3d], 0x39
mov byte [rsp + 0x40], 0x44
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rbp + 0x420]
call fcn.1400ba6b4
lea rcx, [rbp - 0x60]
call fcn.14006d8ac
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x60]
call fcn.14006d900
lea rcx, [rsp + 0x58]
call fcn.1400386bc
mov r9, rax
lea r8, [rbp + 0xc20]
lea rdx, [rbp + 0x820]
lea rcx, [rbp - 0x60]
call fcn.14006ee30
lea rdx, [rbp + 0xc30]
mov rcx, rbx
call fcn.14000410c
nop
lea rcx, [rbp - 0x60]
call fcn.14006d8f4
nop
lea rcx, [rsp + 0x58]
call fcn.140038760
mov rax, rbx
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14006d4ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
and dword [rbp - 0x30], 0
lea rdx, [rbp - 0x28]
call fcn.14006d5a4
mov rcx, rdi
call fcn.140004148
mov dword [rbp - 0x30], 1
mov rcx, rdi
call fcn.14006d6b0
xor esi, esi
mov dword [rbp - 0xd], 0x65646362
mov dword [rbp - 0x18], 0x33323130
mov word [rbp - 9], 0x66
mov word [rbp - 0x10], 0x3938
mov word [rbp - 0x13], 0x3635
mov byte [rbp - 0x11], 0x37
mov byte [rbp - 0xe], 0x61
mov byte [rbp - 0x14], 0x34
movzx ebx, byte [rbp + rsi - 0x28]
mov eax, ebx
shr rax, 4
mov dl, byte [rbp + rax - 0x18]
mov rcx, rdi
call fcn.140004aac
and ebx, 0xf
mov dl, byte [rbp + rbx - 0x18]
mov rcx, rdi
call fcn.140004aac
inc rsi
cmp rsi, 0x10
jl 0x14006d530
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14006d854
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
cmp byte [rcx + 8], r9b
je 0x14006d887
cmp dword [rcx + 0x3d0], r9d
jle 0x14006d882
sub r8, rdx
mov al, byte [r8 + rdx]
inc r9d
xor byte [rdx], al
inc rdx
cmp r9d, dword [rcx + 0x3d0]
jl 0x14006d86d
add rsp, 0x48
ret
lea rdx, str.Object_not_Initialized
lea rcx, [rsp + 0x20]
call fcn.1400124a0
lea rdx, [0x14011d630]
lea rcx, [rsp + 0x20]
call fcn.1400ad1f0
int3
Function at 0x14006ef50
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x140070494
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
movups xmm0, xmmword [rcx]
mov rdi, rdx
mov rbx, rcx
movups xmm1, xmmword [rcx + 0x10]
mov word [rbp - 0x36], 0x3433
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp - 0x2c], 0x666564
movups xmmword [rbp + 0x47], xmm1
mov word [rbp - 0x39], 0x3130
mov word [rbp - 0x31], 0x3938
mov word [rbp - 0x2e], 0x6362
mov word [rbp - 0x33], 0x3736
mov byte [rbp - 0x2f], 0x61
mov byte [rbp - 0x37], 0x32
mov byte [rbp - 0x34], 0x35
call fcn.140070360
xor ecx, ecx
lea r8, [rbp + 0x37]
sub r8, rbx
lea r9d, [rcx + 8]
mov edx, dword [rbx]
lea rcx, [rcx + 8]
mov eax, edx
shr rax, 0x1c
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x21], al
mov eax, edx
shr rax, 0x18
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x20], al
mov eax, edx
shr rax, 0x14
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1f], al
mov eax, edx
shr rax, 0x10
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1e], al
mov eax, edx
shr rax, 0xc
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1d], al
mov eax, edx
shr rax, 8
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1c], al
mov eax, edx
shr rax, 4
and edx, 0xf
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1b], al
mov al, byte [rbp + rdx - 0x39]
mov byte [rbp + rcx - 0x1a], al
mov eax, dword [r8 + rbx]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub r9, 1
jne 0x140070503
mov byte [rbp + rcx - 0x19], r9b
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.14000410c
lea r11, [rsp + 0xb0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret