joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140112138
Capabilities:
Encrypt data using chaskey
Parse pe header

Disassembly:
cmp r9, r11
mov qword [rsp], 0x4b22c312
push 0xffffffffc93b93af
lea rsp, [rsp + 0x10]
ja 0x140193b52
mov edx, 0x811f26a1
movsx eax, dx
mov rdx, rsp
jmp 0x14019ac62
bswap rsi
push rdi
bswap rsi
push rsi
xchg byte [rsp + rsi - 0x2134b9d6], sil
pushfq
pop rsi
mov qword [rsp], rsi
mov esi, 0x42372f9c
mov rsi, rdx
mov rdi, rax
jmp 0x14028fb18
mov r9d, dword [rbp + riz]
add ecx, ecx
adc rbp, 3
mov ebx, ecx
movzx r10d, cx
neg ax
xor r9d, r8d
lea rdx, [rbx + rax*8 - 0x1bc98ed5]
inc r9d
lea rsi, [r10*4 + 0x389da0b0]
shl eax, cl
cwd
xor r9d, 0xf69c198f
lea r9d, [rcx + r9 - 0x2412fd8]
xor eax, 0x4abb3696
bswap edx
sbb r10d, r10d
rol r9d, 3
not rax
lea r9d, [r9 + rax - 0x299a39d]
cqo
push r8
bt rbx, rdx
xor rdx, rax
xor dword [rsp + r10*2], r9d
btr r10d, 0xb
inc rdx
pop r8
movsxd r9, r9d
adc al, ah
add r11, r9
xchg rbx, rsi
mov si, word [rax + rdi + 0x641c0ea6]
inc ebx
lea rdi, [rdi + rax + 0x641c0ea8]
bt cx, 0xbb
setae dl
inc r10d
movzx ebx, byte [rbp + rdx - 0x641c0e01]
call fcn.140222fa4
mov r8d, 0x1ca78e08
mov edx, r8d
lea rbx, [rbx + r8 - 0x1ca78e0c]
not r8d
ror r8d, 0x3e
mov eax, dword [rbx + rdx*2 - 0x394f1c10]
movsx edi, dl
movzx esi, r8w
not r8d
xor eax, r11d
xchg esi, r8d
or r8, rdi
inc esi
ror eax, 2
ror rdx, 0x18
bswap eax
sbb eax, 0xa12d0e12
sal r8w, 0x4d
lea rcx, [rsi*4 + 0x3025a31a]
bswap eax
xchg si, dx
push r11
xor dword [rsp + r8*2 - 0x1c000], eax
lea r11, [r8*8 + 0x57256fb0]
bswap rdi
pop r11
shl di, 0x81
ror ecx, 0x81
movsxd rax, eax
adc rbp, rax
lea rbx, [r8 + rbx - 0xe002]
movzx esi, word [rbx + r8 - 0xe000]
lea rax, [rdx*4 - 0x28670dce]
xor si, r11w
xadd ax, r8w
neg rax
ja 0x1401cc744
xor si, 0x2900
movsx r9d, cx
or dil, dil
btc r8, r9
rol si, 1
add si, 0x1326
not si
jmp 0x14028d550
call fcn.14027d70e
movsx ecx, ax
lea ecx, [rcx - 0x2521]
sar rax, 0xe2
ja 0x140145889
movzx esi, ax
lea rax, [r9 + rax*2 - 0x80]
and rax, 0xfffffffffffffff0
xor esi, 0x26b93420
inc sil
sbb rax, rcx
bswap esi
mov rsp, rax
not sil
jmp 0x140127a1a
xor esi, r9d
neg r10b
call fcn.140239996
xor dx, r8w
sar eax, 0x4e
sbb si, 0x7d07
and dil, al
inc r8w
neg ax
xor r11w, si
dec ecx
lea r10, [r10 + r8*2 - 0xa572]
neg r9b
xor r8d, r8d
mov dword [r10 + r8], esi
push r9
sar qword [rsp + r8*8], cl
neg dword [rsp + r8 + 1]
pop rax
jle fcn.1401deef9
cld
call fcn.1402459ea
xor dword [rsp + rdi + 0x44019e9], eax
lea r9, [rcx + rdi*2 + 0x10336c8d]
mov r9, qword [rsp + rdi*2 + 0x88033ba]
movsxd rax, eax
xor di, r10w
adc rbp, rax
pop rdx
pop rsi
pop rdx
pop rax
jmp fcn.1402a4174

Function at 0x140122b47
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r9 - 0x4bb3b7a0], 0x202b96b8
rol cx, 1
neg byte [rsp + r9 - 0x4bb3b79b]
add r9w, word [rsp + r11*2 - 0x16f3b]
lea rdi, [r9 + r9*8 + 0x631b4b1c]
not cx
and r11d, r9d
dec cx
movzx eax, di
ror cx, 1
xor si, cx
lea r8, [r9 + r8 - 0x4bb3b7a4]
rol al, 0xe4
mov dword [r8 + r9 - 0x4bb3b7a0], ecx
pop r11
jae 0x1401ffc8d
xor di, ax
lea r10, [r10 + r9 - 0x4bb3b7a4]
mov edx, dword [r10 + r9 - 0x4bb3b7a0]
ror r9w, 0x25
xor edi, eax
movsx ebx, r11b
xor edx, esi
cdqe
rol edx, 1
shl r9b, 0xc3
call fcn.14029a0ba
Function at 0x140130274
Capabilities:
Manually build aes constants
Parse pe header

Disassembly:
sbb ebp, 0x46800490
not eax
or rax, 0x708125ad
jno 0x1402ba60c
mov qword [rsp + rdx], rbp
lea r9, [rdx*2 + 0x7f058e9c]
lea r10, [r10 + rdx*2 - 4]
mov ebp, dword [r10 + rdx]
xor ebp, r11d
xchg qword [rsp + rdx*8], rax
pop rdx
ror ebp, cl
bts ax, 0x9f
lea ebp, [rbp + rbx*2 - 0x5d9503cc]
sal al, 0xc6
rol ecx, cl
ror ebp, 3
sub ecx, eax
jns 0x1402bd789
mov eax, 0x9d198830
push rax
lea rbp, [rax + rax*8 + 0x4b1d7ebf]
sub r10, 4
or byte [rsp + 2], ah
lea rsi, [rbp*4 - 0x14d0f6b]
mov edx, dword [r10 + riz]
xor edx, r11d
btc rax, 0x2c
movzx r9d, si
add sil, 0xaf
lea edx, [rdx + r9 - 0x682eac00]
neg edx
movzx ebx, si
push r9
xor edx, 0x9706ea14
mov ecx, eax
push rbp
inc edx
not r9w
lea rbp, [rax - 0x4deb445a]
mov qword [rsp + r9 - 0xed9e], r11
bts r9, rcx
xor dword [rsp + rbx - 0x11f0], edx
inc bl
mov r11, qword [rsp + rbx*8 - 0x8ff8]
cwde
setp cl
movsxd rdx, edx
sub byte [rsp + rbx*4 - 0x4803], 2
sub dword [rsp + rbx - 0x1201], 0x43a93e1c
adc rdi, rdx
mov word [rsp + rbx*2 - 0x23ff], 0xd41e
mov rax, qword [r8 + rbx*4 - 0x4804]
bswap rsi
movzx r9w, byte ss:[rax + rbx*4 - 0x4804]
sub bp, 0xa835
lea r8, [r8 + rbx*2 - 0x23fc]
movzx edx, word [rsp + rbx*2 - 0x23fa]
mov word [r8 + rbx*2 - 0x2402], r9w
adc byte [rsp + rbx*4 - 0x47fa], bpl
sbb cl, dl
mov qword [rsp + rbx - 0x1201], rdi
ret 0x10
push rdx
lea r10, [rdx + r10 - 0x890]
cwde
call fcn.14018237d
xor sil, 0x30
dec sil
xadd rax, rdx
sbb edx, r8d
xor r11b, sil
sal edi, 0x1f
jb 0x14026b10d
adc rsi, rsp
sub r9d, r8d
cwde
mov rcx, qword [rsi + rdi - 0x80000000]
lea rdi, [rdx + rdi - 0x37cdef75]
jno 0x140257bb4
push r11
call fcn.140123872
rol eax, 1
movzx r9d, word [rsp + rdx - 0xa49]
sub r9d, edi
xor eax, 0x5fa652a6
btr edx, edx
inc rdx
ror eax, 1
ror r9w, 0xc
lea rdi, [rsi + rdi + 0x5e8abebb]
mov qword [rsp + rdx - 0xa4b], r11
mov r8d, edx
movsx r11d, dil
and r9d, 0xa904ceb4
xor dword [rsp + rdx - 0xa4b], eax
movzx ecx, r8b
xadd r9w, r11w
pop r11
lea rdi, [rsi + rdx - 0x6a5cf8c5]
movsxd rax, eax
btc r9d, 0x80
add rbp, rax
bts r9w, 0x3a
lea rbx, [rdx + rbx - 0xa4c]
movzx esi, byte [rbx + rdx*4 - 0x292c]
movsx eax, cl
xor sil, r11b
ror r8b, 0xc2
sbb sil, 0x89
inc ecx
add ax, di
ror ecx, 0xa7
ror sil, 1
xadd r9w, r8w
and rax, rdi
jns 0x14027cc3c
jns 0x1400f3603
Function at 0x140155c25
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov qword [rsp + rbx*2 - 0x9318], 0x50b3029c
movabs r9, 0
cwde
movsx ecx, r10w
ror bl, 0x44
mov ebp, dword [rsp + rbx - 0x4950]
movzx r8d, r10w
btc r8w, 0x38
sbb ebp, 0xa3a87426
mov dword [rsp + rbx*8 - 0x24e40], ebx
not ebp
push rax
cdqe
bswap ebp
xchg r8w, ax
ror cx, 0x22
shl rbx, 0x91
lea ebp, [rax + rbp + 0x4941f9f]
adc dword [rsp + rax*4 - 0x628], 0x5601b318
mov qword [rsp + rax*2 - 0x310], r14
bts ecx, 0xbe
adc cx, word [rsp + rax - 0x189]
or r10, 0xffffffff9a93240f
adc rbp, r9
ror r10d, cl
cdq
mov qword [rsp + rax*4 - 0x630], rdi
xadd dl, bh
sub al, 0xa8
mov qword [rsp + rax - 0x1cc], r9
btc eax, ebx
bts dx, bx
adc r10d, eax
lea edx, [rax + 0x3fe1b]
sal rdx, 0xe
movsx edi, bl
jmp 0x140198049

Function at 0x140157226
Capabilities:
Encode data using base64

Disassembly:
not r9d
mov qword [rsp + r11*8 - 0x80], rbx
mov qword [rsp + r11 - 0x11], rsi
push r14
push rcx

Function at 0x14016d2b8
Capabilities:
Parse pe header

Disassembly:
dec eax
mov edx, ecx
bswap eax
not eax
sal cl, 0xc3
mov qword [rsp + rcx - 0x31016b80], r11
dec si
jns 0x1401e886b
movzx r11d, dx
xor dword [rsp + rcx*2 - 0x6202d700], eax
pop r11
movsxd rax, eax
ror esi, 0x5a
movsx r8d, cx
mov r9d, esi
add rbp, rax
and edx, ecx
mov ecx, dword [rcx + r10 - 0x31016b80]
mov edx, dword [r8 + r10 - 0x6b7c]
lea r10, [r10 + r8*4 - 0x1adfc]
cmove r9, rsi
movzx edi, r8w
ror si, 0xe2
not ecx
bts r8w, r8w
lea rax, [r9 + rdi - 0x4753d7e3]
not si
not edx
or ecx, edx
movsx edx, di
mov dword [r10 + r8*8 - 0x35c08], ecx
call fcn.1401b2599
mov edx, 0xbe9aa20d
push rdx
mov rcx, qword [r10 + riz]
mov dx, word [r10 + riz + 8]
add r10, 0xa
sal word [rsp], 0xcd
push 0x734ceaf
jne 0x140105634
mov ebx, 0x3111713b
call fcn.1402a731f
mov r11d, 0x3636230c
mov r8d, r11d
mov ecx, dword [rbp + r11 - 0x3636230c]
sub r11, 0xfffffffffaa51f1a
lea rbp, [r11 + rbp - 0x3b9103ee]
lea r11, [r8 + r8*4 + 0x81c194]
movzx edx, r11w
movsx esi, dl
xor ecx, edi
not ecx
lea r9, [r11 + rsi + 0x75b452b2]
shl sil, 2
adc dx, dx
ror ecx, 1
neg ecx
jmp 0x140263feb
Function at 0x14016e1cf
Capabilities:
Manually build aes constants

Disassembly:
xor dword [rsp + rsi + 0x10010], r8d
shr ax, cl
ror rsi, 0xe5
mov r9, qword [rsp + 0x10]
pop rcx
movsxd r8, r8d
inc r10
jbe 0x140242619

Function at 0x14016fffc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add r8d, ecx
xor r8d, ecx
mov qword [rsp + 8], r10
call fcn.14016fcd7

Function at 0x1401809b8
Capabilities:
Parse pe header

Disassembly:
btc rdi, 0xe
bswap r10d
jb 0x1400cb201
shr rcx, 0xd0
cwde
dec r10d
not rcx
cbw
pop r9
not r10d
xor r10d, 0xa997730b
mov r9d, eax
jmp 0x1401e5774
push rbx
lea rbx, [rdi + rdi*2 - 0x4853d0eb]
push r8
sub al, dh
xor dword [rsp + rcx + 0xa249], r10d
rol dl, 0x44
bts r8, rdi
xadd byte [rsp + rcx*2 + 0x14486], dil
mov rbx, qword [rsp + rdi + 0x27d93908]
push rcx
mov qword [rsp + rcx + 0xa251], rdx
movsxd r10, r10d
add edi, dword [rsp + rcx + 0xa251]
dec ecx
setg al
adc rbp, r10
push r8
rol al, 0xa4
pop r10
pop r10
pop rax
pop rax
jae fcn.14029549e
sub rdi, 4
mov ecx, dword [rdi]
xor ecx, r10d
mov esi, 0x21ac971a
neg ecx
bts rsi, 2
movzx r11d, sil
xor ecx, 0x6419d908
sub r11d, esi
sbb r11b, r11b
inc ecx
movzx r8d, r11b
add r8d, 0x6a8bb623
neg ecx
movzx ebp, sil
push r10
movsx eax, si
xor dword [rsp + rsi - 0x21ac971e], ecx
lea r10, [rax + rsi*4 - 0x48db2fd0]
neg rbp
jp 0x14021511e
mov r8d, dword [rbx + rsi - 0x42821a0f]
lea rax, [rsi - 0x5cfac863]
lea r10, [rsi*4 + 0x3b3a035]
lea rdx, [r10 + rax*4 + 0x6411d4b6]
lea rbx, [rax + rbx + 0x1a78ae58]
xor r8d, r9d
lea rdi, [r10 + rsi*2 - 0x79f0e1f5]
shl dil, 1
push rdx
lea r8d, [r8 + rax*8 - 0x1a542f6e]
push rax
not r8d
rol r8d, 3
add dl, dl
rol dword [rsp + rsi - 0x42821a0b], 0xba
cdqe
dec r8d
add word [rsp + rax + 0x1a78ae5f], dx
sbb dword [rsp + rsi - 0x42821a0d], r10d
bswap r8d
cbw
neg r8d
cbw
and edx, esi
jge 0x14026eac6
pop r10
shr si, 0xa1
or bp, r11w
movsxd rcx, ecx
adc rbx, rcx
mov edx, 0x723b5a84
jmp 0x140130cd2
mov qword [rsp + rax*4 + 0x69e00158], r9
sbb byte [rsp + rsi - 0x42821a0e], 0x3a
shl r10b, 0xc6
xor dword [rsp + rsi - 0x42821a07], r8d
bts rax, 0xa2
shl qword [rsp + rax + 0x1a780054], 0x81
mov r9, qword [rsp + rsi - 0x42821a07]
or r10, 0xffffffffb497f71b
pop rax
sub dl, 0x93
movsxd r8, r8d
pop rdx
inc rsi
mov edx, 0x11a74610
add rbp, r8
movsx ecx, r10w
movzx eax, byte [rbx + rsi - 0x42821a10]
and r10w, cx
lea rbx, [rbx + rdx - 0x11a7460f]
movsx r8d, dl
add r10w, 0x40a6
inc r10
xor al, r9b
xor al, 7
xor r10, rdx
dec al
add edi, esi
not al
bswap rdi
xadd rdi, rcx
btr si, cx
ror al, 1
xor r9b, al
or r10, 0x718a4203
adc r10d, esi
add rax, rsp
xadd r10w, cx
shr di, 0xac
ror r8w, cl
mov r8w, word [rsi + rax - 0x42821a10]
lea r11, [r11 + rsi - 0x42821a12]
sub rsi, rdi
mov word [r11 + r10 - 0x401c6023], r8w
lea rax, [rsi + rdx*8 - 0x36d8eace]
bt edi, esi
jb fcn.1402a4174

Function at 0x14018e8cb
Capabilities:
Hash data using murmur3

Disassembly:
jbe 0x1402a9a9e
pop rdx
pop rax
js fcn.14029549e
Function at 0x1401958dc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], rbx
push rcx
xchg byte [rsp + 6], ch
mov byte [rsp + 2], ch
mov qword [rsp], rbp
lea rcx, [rcx*2 - 0x3d5eb6ce]
push r8
jmp 0x140240d88
push rcx
mov qword [rsp], rax
movzx ebx, cx
push r9
push r13
mov eax, ecx
push r15
xchg cx, ax
push r10
push rdx
push rbx
push rax
mov qword [rsp + rbx - 0x4984], r11
jmp 0x1401063f3

Function at 0x140199554
Capabilities:
Parse pe header

Disassembly:
movzx esi, al
mov qword [rsp + rsi*8 - 0x530], rcx
rol r10d, 1
jmp 0x1402b7d6e
call fcn.14024d57a
call fcn.1401961fd
mov edx, dword [r10 + rdx + 0x7543aad9]
mov ebp, 0x80817c97
xor edx, r11d
lea rax, [rbp*4 + 0x1a01aa3f]
movzx r9d, al
sal r9w, 0x22
sbb edx, 0xd8a7d4b3
movsx ebx, r9w
bswap rax
lea rcx, [rbx + r9*8 - 0xbc22165]
rol edx, 1
neg r9
dec edx
rol edx, 1
movsx esi, al
lea rbx, [rbp*8 + 0x79abbc1a]
not cx
push r11
bswap eax
xor dword [rsp + rax - 2], edx
jmp 0x14025052e

Function at 0x14019a6d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edx
btc ecx, eax
xchg r9, rcx
mov qword [rsp + r9*2 - 0x419b3b48], rsi
mov esi, 0xed2321aa
or esi, ebx
xor dword [rsp + rcx - 0x21013000], edx
sar r11d, 0x89
sbb ax, ax
pop rsi
btc r9, 0xb0
ror r11b, 0x81
bt edi, 0x12
movsxd rdx, edx
adc rbp, rdx
mov rdx, qword [rcx + r8 - 0x21013000]
not rax
bt rbx, r9
mov r9, qword [rax + r8 + 9]
call fcn.1400e4271

Function at 0x1401a14e0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r9d, 0x2cae7917
lea rcx, [r9*8 + 0x33a1cb3c]
mov r11d, dword [rdi + r9*2 - 0x595cf22e]
xor r11d, ebp
inc r11d
btr ecx, ecx
pop rbx
not r11d
sbb r11d, 0x5cbb1f09
movsx edx, r9b
xchg ecx, r9d
movzx eax, cl
rol r11d, 1
push rbp
xor dword [rsp + rcx - 0x2cae7917], r11d
pop rbp
bt rax, 0x8c
jae 0x1402840b6

Function at 0x1401ac6a0
Capabilities:
Encrypt data using chaskey

Disassembly:
xor dword [rsp + rax - 0x440d79b1], r10d
mov r9, qword [rsp + rdx + 8]
cqo
movsxd r10, r10d
mov qword [rsp + rdx*2], 0xffffffffe891b5a8
add rbp, r10
mov qword [rsp + rax - 0x440d79b1], rdi
sal rdx, 0xbf
pop r10
pop rdx
jp fcn.1402a4174
mov esi, 0x2e18d80e
call fcn.14019e467
Function at 0x1401ac6dc
Capabilities:
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
lea r10, [r10 + r8 - 0x88]
call fcn.14019952c
xor r11d, r10d
xor word [rsp + rax + 0x11], 0x259c
or dl, sil
bswap r11d
neg r11d
add bp, word [rsp + rax + 0xc]
ror r11d, 2
movsx r8d, cx
add r11d, ecx
or dword [rsp + rax*2 + 0x14], ebp
mov qword [rsp + rax*2 + 0x10], r10
sbb cx, 0x2194
ror r8w, cl
xor dword [rsp + rax + 0x10], r11d
xchg dword [rsp + rax + 5], eax
mov r10, qword [rsp + rax + 0x10]
not r8w
movsxd r11, r11d
add rbx, r11
or byte [rsp + rax*4 + 8], ah
sal rcx, 0x53
pop rsi
pop rbp
pop rax
jne fcn.140299ca5
neg r9d
ror r9d, 1
neg r9d
push rdi
inc r11d
sub r8, rax
xor dword [rsp + rdx - 0x2a003fa1], r9d
btr rsi, rax
pop rdi
movsxd r9, r9d
push rsi
sal word [rsp + rdx*2 - 0x54007f3d], 0xaf
adc rbx, r9
and word [rsp + rdx*2 - 0x54007f3c], r8w
ja 0x1400edab3
dec dword [rsp + rdx - 0x2a003f9e]
mov qword [rsp + rdx*2 - 0x54007f42], rbx
ret
cdq
mov r11d, dword [rax + rdi]
mov qword [rsp + rax*4], rax
jae 0x1401a7e63
mov eax, 0x18aefe3b
movsx ecx, ax
lea r10, [r10 + rax*4 - 0x62bbf8f0]
call fcn.14025310c

Function at 0x1401aec26
Capabilities:
Parse pe header

Disassembly:
neg r9b
mov r11, qword [rsp + r9*2 - 0xbffff8]
sal r8b, 6
ror dil, 0xa6
movsxd rax, eax
mov qword [rsp + r9 - 0x5ffff8], 0x551aec2a
mov qword [rsp + r9 - 0x600000], 0xffffffff9d1fdb9a
adc rbp, rax
btr r9w, r9w
jae 0x14028d95c
xadd r8, rdi
lea r10, [r9 + r10 - 0x5ffffe]
cdq
shr si, cl
mov word [r9 + r10 - 0x600000], si
lea rcx, [rdx + r8*4 + 0x16afddbf]
mov qword [rsp + r9 - 0x600000], rbp
ret 8
mov si, word [r10 + r9*4 - 0x1800000]
mov cl, byte [r10 + r9*4 - 0x17ffffe]
movsx eax, byte [rsp + r9*2 - 0xbffff7]
jae 0x1401d000c

Function at 0x1401be96b
Capabilities:
Manually build aes constants

Disassembly:
call fcn.14029663e
shr byte [rsp + rcx*2 - 0x4af77e], cl
mov qword [r9 + rcx*4 - 0x95ef10], r11
pop rax
pop rdx
jns fcn.140299ca5
mov r9d, 0xe182f91
movsx ecx, r9w
sar cl, 0x27
mov bx, word [r9 + r8 - 0xe182f91]
movzx edx, r9w
mov bp, word [r9 + r8 - 0xe182f8f]
movsx esi, cl
shl rsi, cl
mov cl, byte [r9 + r8 - 0xe182f8d]
bts r9, rsi
lea r8, [r9 + r8 - 0xe182f8d]
shrd bx, bp, cl
lea rsi, [rdx*4 - 0x1047de60]
and edx, esi
mov word [r8 + r9*8 - 0x70c17c88], bx
movzx ebx, dl
bswap rsi
adc sil, 0xb8
lea r10, [r10 + r9 - 0xe182f95]
mov r9d, dword [r10 + r9 - 0xe182f91]
xor rbx, 0x530a6bbd
xor r9d, r11d
inc r9d
neg r9d
movzx eax, sil
dec edx
xadd edx, ebx
dec r9d
call fcn.140232ce2
add rbp, r8
inc dword [rsp + rax*4 - 0x19c]
movzx r8d, cl
mov qword [rsp + rax - 0x6a], 0xffffffffe509ebb3
mov r8w, word [r11 + rax - 0x6a]
xor dx, word [r11 + rax*2 - 0xd2]
mov cl, byte [rax + r11 - 0x66]
neg dword [rsp + rax*2 - 0xc2]
lea r11, [rax + r11 - 0x66]
mov qword [rsp + rax - 0x52], rdi
jp 0x14019ecdb
ror r8d, 0xb5
xor esi, r11d
and cx, r8w
rol esi, 2
movsx eax, r8b
lea rdx, [r8 - 0x4fd1f86f]
call fcn.14028cda5
Function at 0x1401d6f1c
Capabilities:
Encode data using base64

Disassembly:
ja 0x140200e7b
movsx r11d, word [rsp + rdx - 0x10]
inc r8d
sub rdx, r11
sete byte [rsp + rdx - 0x11]
dec edx
xor r8d, 0x69a25011
mov ecx, r9d
xor r9d, 0xf1a4958b
pop rcx
not r8d
sub rax, r11
push rdi
cbw
xor dword [rsp + r9 - 0x46b20ba9], r8d
mov edi, ecx
bt rdx, r11
pop rdi
movsxd r8, r8d
xadd r9, rdx
btr r9, r9
adc rbx, r8
cdq
or rdx, rcx
or r11d, dword [r10 + r9 - 0x46b20bb9]
mov esi, dword [r10 + rax*8 - 0x10c]
sub rax, rdx
xor al, dh
shr rdx, 0xb3
lea r10, [r10 + r9 - 0x46b20bb5]
rol r9, 0x93
setae al
adc r11d, esi
lea rsi, [rcx + rdx - 0x6ae0edf5]
mov dword [rdx + r10], r11d
xor rdx, rbx
jmp rdx
mov qword [rsp + rcx*2], 0xffffffffd20bec13
xor r8w, r9w
mov qword [rsp + rdx + 0x10], r10
xchg byte [rsp + rcx + 0xd], dl
neg r8w
rol dx, 0xed
jae 0x14027bb7a
dec dil
rol r8w, 1
xor qword [rsp + rdx*4 + 6], rax
shl dword [rsp + rcx + 5], 0x96
mov qword [rsp + rcx + 0x20], r10
xor r8w, r10w
rol r8w, 1
mov byte [rsp + rcx + 0x24], dil
xor r9w, r8w
inc qword [rsp + rcx + 0xb]
lea r8, [rsp + r8 + 0x28]
shl r10d, 0xeb
shr dl, 0x65
or r10d, 0x6431a383
mov edi, dword [r8 + rcx*4]
lea r11, [r11 + rcx*2 - 4]
jne 0x1401b9e34

Function at 0x1401f3c4e
Capabilities:
Parse pe header

Disassembly:
shl rdi, 0xb7
lea rsi, [rsi + r8 - 0x7eb80107]
adc r8, 0x26ac8e1f
xor edx, dword [rsi + rdx*2]
neg dword [rsp + r10 - 0x74bb5d3c]
xadd edi, r10d
lea r9, [r8*4 + 0x5ba64510]
xor edx, ebx
lea edx, [rdx + r10*2 - 0x4faee716]
ror edx, 3
dec di
jno 0x1401fbdcd
not r10d
movzx edi, word [rsp + r8 - 0x7eb80103]
lea rsi, [r8 + rsi - 0x7eb80105]
movzx ecx, word [rsi + rdx*2 - 0x206]
jmp 0x140245d3a
mov r9d, dword [r11 + r8 - 0x7eb80103]
lea r10, [r8 + r8 + 0xc8c2929]
movsx edx, r8w
mov qword [rsp + rdx - 0x103], rdx
lea r11, [r11 + r8 - 0x7eb800ff]
jmp 0x1401e52dd
or r8b, byte [rsp + r8 - 0x7eb80101]
or r8w, word [rsp + r8 - 0x7eb800ff]
xor cx, bx
push r10
and r10b, r10b
adc r10d, r8d
not cx
adc cx, 0xcfa3
sub word [rsp + r8 - 0x7eb800f7], 0x3c3a
shl dx, 0xc1
shl di, 0xa9
xor cx, 0xa1a
sub word [rsp + r8 - 0x7eb800fb], r10w
movzx eax, word [rsp + rdi*8 - 0x2ffa]
sbb qword [rsp + rdx*2 - 0x404], rdi
not cx
ror r10w, 0x4d
lea rdi, [rdx + rax*8 + 0x5c8df427]
cdq
adc cx, 0x971b
dec rax
xor bx, cx
bts rdx, rax
dec rdi
lea rcx, [rsp + rcx + 0x10]
ror word [rsp + r8 - 0x7eb80101], 0xab
rol r10w, 0x41
js fcn.14012ec8a
mov dword [rcx + r8 - 0x7eb80103], r9d
push r10
jle 0x1401adc6c
rol r8b, 0x23
add rbx, rax
call fcn.14017053e
Function at 0x140217eeb
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
lea r10, [rax + r10 - 0x149aa297]
xor edx, dword [r10 + rax*2 - 0x29354526]
xor edx, esi
pop rdi
inc edx
lea r11, [rax + rax - 0x3ad823da]
bswap edx
lea edx, [rdx + r11*8 + 0x3194f0f3]
neg word [rsp + r11 + 0x11a2deb9]
pop rdi
sbb di, word [rsp + rax*2 - 0x29354523]
neg edx
mov qword [rsp + rax - 0x149aa293], rsi
mov r9d, edi
xor dword [rsp + rax - 0x149aa293], edx
pop rsi
btc ax, 0x1c
jb 0x1401b74eb
jae 0x14025a7e8
mov ecx, 0xfea821af
sub r10, 4
mov eax, 0x4c319b8f
movsx ebx, al
mov ebp, dword [rax + r10 - 0x4c319b8f]
xor ebp, r11d
xor rax, rbx
ror ebp, 1
inc ebp
ror rcx, 0x20
xor ebp, 0xa69f77bc
lea ebp, [rbp + rbx - 0x6f638485]
bts eax, 0x35
bswap ebp
lea rdx, [rbx + rbx*4 + 0x678d7f30]
movzx r9d, bx
not ebp
sub ax, cx
push r11
mov esi, 0xaab02f94
dec bl
push rdx
xor dword [rsp + r9 - 0xff87], ebp
mov word [rsp + r9*2 - 0x1ff19], 0x2634
sub rsi, r9
mov r11, qword [rsp + r9*2 - 0x1ff16]
sbb ebx, edx
jg 0x1401ece75
movsxd rbp, ebp
or cx, r9w
adc rdi, rbp
shl ax, 0xa8
pop rax
mov rbx, r8
jnp 0x1402c2de1
not r9d
neg ecx
sbb r8, 1
xadd si, r9w
mov word [r8 + riz], bx
mov qword [rsp], rax
call fcn.140231701
movsxd rdx, edx
setb al
adc rbp, rdx
movsx edx, r9w
sub al, dl
jmp rbp

Function at 0x14022e476
Capabilities:
Hash data using murmur3

Disassembly:
pop rdx
pop r9
pop rax
pop r9
jnp fcn.14029549e

Function at 0x140237b75
Capabilities:
Encode data using base64

Disassembly:
lea rcx, [rdi*8 - 0x44fb95ca]
lea r11, [rsp + 8]
mov qword [rsp], rcx
mov eax, ecx
btr di, 0x9e
mov ecx, 0x180
cmovb edi, eax
lea rax, [r8 + riz - 0x80]
and rax, 0xfffffffffffffff0
sub rdi, rdi
sbb rax, rcx
pop rdi
push rdi
bswap edi
mov rsp, rax
push rdi
not edi
mov qword [rsp + rdi - 0x49d98d1f], rsi
pushfq
mov rsi, r11
dec edi
push rdi

Function at 0x14025106f
Capabilities:
Parse pe header

Disassembly:
bts ecx, 0x1f
mov qword [rsp + 0x10], rbx
setb cl
cqo
xor dword [rsp + rdx + 0x10], edi
xadd r10b, al
mov rbx, qword [rsp + rdx*2 + 0x10]
lea r8, [rdx*4 + 0x41194993]
ror r8d, 0x37
mov qword [rsp + rdx*8 + 0x10], rdx
lea r11, [r11 + rdx*8 - 4]
and dl, 0xa3
inc al
jge 0x140295c50
mov ecx, 0x31a17291
mov rdx, qword [r8 + rcx - 0x31a17291]
mov bl, byte [r8 + rcx - 0x31a17289]
mov edi, ecx
lea r9, [rdi*8 - 0x47e2f7]
shr dil, 0x23
lea r8, [r8 + rdi*2 - 0x6342e41a]
push rdi
rol dword [rsp + rdi - 0x31a1720e], cl
and byte [rsp + rdi - 0x31a17210], 0x2a
mov byte es:[rcx + rdx - 0x31a17291], bl
shl qword [rsp + rcx*2 - 0x6342e522], 0x12
lea rax, [rcx*4 + 0x12b918bc]
lea r10, [rcx + r10 - 0x31a17295]
mov edx, dword [rdi + r10 - 0x31a17212]
shr rcx, cl
shr ecx, cl
xchg byte [rsp + rcx + 4], r9b
xor edx, esi
rol edx, 3
rol dil, 0x84
mov r11d, 0xca0b5331
bt r11w, r11w
lea edx, [rdx + r11 + 0x2991bc57]
not edx
sbb byte [rsp + rcx + 5], al
inc edx
mov qword [rsp + rcx*2], rsi
xor dword [rsp + rcx*2], edx
pop rsi
push rcx
xadd qword [rsp + rcx], r11
movsxd rdx, edx
adc rbp, rdx
jmp 0x1402adc0c
Function at 0x14026716b
Capabilities:
Hash data using murmur3

Disassembly:
bswap rdx
pop r9
not rdx
push r8
cbw
xor rdx, 0x1fb1560d
bswap r10
lea r9, [rax + rdi*2 + 0x1102bf2a]
pop r9
xor rbx, rdx
xchg r10, rcx
rol eax, 0xf
lea r11, [r11 + rax - 0xc0048]
sub cl, r8b
adc edi, r10d
mov qword [r11 + rax*2 - 0x180080], rdx
movzx edx, dil
shr rax, 0xa6
not r9
jns fcn.14029549e

Function at 0x140269767
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
neg dx
xchg r10, rdi
rol dx, 1
or rdi, 0x689a629a
neg eax
adc dx, 0x911e
neg dx
xor bx, dx
btr rdi, r9
lea rdx, [rsp + rdx + 0x10]
setb r9b
mov qword [rsp + r10 - 0x1217f3a3], rcx
neg r10d
mov byte [rdx + rdi - 0x689a62bb], r8b
lea rdx, [r9 + r10 + 0x3c82c9ac]
ror ax, 0x89
lea rsi, [rsi + rax*4 - 0xba04]
sal byte [rsp + rax*2 - 0x5cff], cl
mov ecx, dword [rdi + rsi - 0x689a62bb]
mov qword [rsp + rdi - 0x689a62b3], rdx
xor ecx, ebx
bts rax, 0x8d
cwd
not ecx
xor r10b, dl
shr rdi, 0x6b
bswap r9d
bswap ecx
btr edx, 0x2f
sbb ecx, 0x89a4eca1
cwd
rol di, 0xcd
bswap ecx
rol ecx, 2
jmp 0x14027ac2a