joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cf60
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14008f8a0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x14002cff6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.1400418a0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14002d000
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x14008f8a0]
vmovss xmm3, dword [rcx + 0x110]
vmovss xmm4, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
vmovss xmm0, dword [rdx]
vmovss xmm2, dword [rdx + 4]
vsubss xmm1, xmm0, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
vmovss dword [rsp], xmm1
movzx eax, byte [rsp]
xor rcx, rax
movzx eax, byte [rsp + 1]
vmovss xmm1, dword [rdx + 8]
vsubss xmm0, xmm2, xmm4
vmovss dword [rsp + 4], xmm0
xor r8d, dword [r9 + rcx*4]
vmovss xmm0, dword [rdx + 0xc]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 8], xmm2
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
vsubss xmm1, xmm0, xmm4
vmovss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140039fb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a6040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140110278]
mov edi, ecx
cmp byte [rbx + 0x4a9d], 0
jne 0x14003a011
cmp byte [rbx + 0x4a9e], 0
jne 0x14003a011
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140027fd0
test dil, 1
je 0x14003a13f
jmp 0x14003a099
vmovss xmm1, dword [rbx + 0x389c]
vmovss xmm0, dword [0x1400978c4]
vfmadd213ss xmm0, xmm1, dword [rbx + 0xe0c]
vmovss xmm2, dword [0x1400978e4]
vfmadd213ss xmm2, xmm1, dword [rbx + 0xe08]
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
xor eax, eax
mov dword [rbx + 0x47d4], 1
vmovss dword [rbx + 0x47e0], xmm2
vmovss dword [rbx + 0x47e4], xmm0
mov qword [rbx + 0x47e8], rax
lea rcx, [rsp + 0x20]
vmovss xmm0, dword [rbx + 0x3904]
vmulss xmm1, xmm0, dword [0x140097758]
or dword [rbx + 0x47d0], 0x41
lea edx, [rax + 0x10]
vmovss dword [rbx + 0x4830], xmm1
call fcn.140027fd0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14003a0f0
lea r11, [0x14008f8a0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14003a0d3
cmp byte [r8], r9b
jne 0x14003a0d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14003a0c0
not ecx
call fcn.140030f60
test rax, rax
je 0x14003a13f
cmp byte [rax + 0xb6], 0
je 0x14003a13f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bc2]
movsx r9d, word [rbx + 0x5bc2]
call fcn.140027fd0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140033710
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140083320
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400400b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca8], 0
lea rbx, [rcx + 0x5cb0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140040157
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14004010a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140042600
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140028b20
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14010825d]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14004015f
mov rcx, rbx
call fcn.140028b20
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400405d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140110278]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140040633
mov qword [rsp], rbx
lea rbx, [0x14008f8a0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140040613
cmp byte [r8], r9b
jne 0x140040613
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140040600
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c20]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140040667
mov r10, qword [r10 + 0x5c28]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14004066e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140040654
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14007a210
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400a6040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edx, dword [0x140106eac]
mov rbx, rcx
add rdx, qword [rcx + 0x40]
mov rcx, qword [0x140111e68]
test rcx, rcx
je 0x14007a42b
cmp dword [0x140111e70], 0
je 0x14007a42b
mov qword [rsp + 0x88], rdi
lea r8, [rsp + 0x54]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14007a423
mov eax, dword [rsp + 0x54]
cmp eax, 0xffffffff
je 0x14007a423
shr eax, 9
lea ecx, [rdi + 8]
vpxor xmm0, xmm0, xmm0
mov dword [rsp + 0x34], edi
vmovdqu xmmword [rsp + 0x38], xmm0
lea eax, [rax*8 + 0x10]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x30], eax
call fcn.140083340
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [rax + 8]
mov qword [rsp + 0x48], rdx
mov qword [rax], rcx
mov qword [rsp + 0x40], rdx
mov rdx, qword [0x140111ea8]
call fcn.14001c9e0
test rax, rax
je 0x14007a423
mov ecx, dword [rsp + 0x54]
and ecx, 0x1ff
imul edx, ecx, 0x78
mov rcx, qword [0x140111e68]
add rdx, rax
test rcx, rcx
je 0x14007a423
cmp dword [0x140111e70], edi
je 0x14007a423
lea r9d, [rdi + 8]
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14007a423
lea rdx, [rsp + 0x58]
lea rcx, [0x140106d60]
call fcn.14001cca0
test al, al
je 0x14007a423
cmp byte [0x140111270], dil
je 0x14007a387
mov rcx, qword [0x140111e68]
test rcx, rcx
je 0x14007a37c
cmp dword [0x140111e70], edi
je 0x14007a37c
mov edx, dword [0x140106e70]
lea r9d, [rdi + 1]
add rdx, qword [rbx + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rsp + 0x50], dil
je 0x14007a423
cmp byte [0x140111660], dil
jne 0x14007a3a2
mov eax, dword [0x140106e34]
cmp dword [rbx + 0xd4], eax
je 0x14007a423
cmp dword [0x140106e30], edi
jle 0x14007a423
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
sub rax, qword [0x140112020]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, rax
vmulsd xmm1, xmm0, qword [0x140097760]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, dword [0x14011126c]
vcomisd xmm1, xmm0
jb 0x14007a423
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14007a423
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov qword [0x140112020], rax
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140083320
add rsp, 0x70
pop rbx
ret
Function at 0x14008296c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400829a6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400829ab
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400829f4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14008dec0]
cmp byte [rcx + rax], 0
je 0x1400829f4
dec r8
sub rdx, 1
jne 0x1400829da
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140084024
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008406e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008406e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008406e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008406e
cmp dword [rcx + 0x84], 0xe
jbe 0x14008406e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140084070
xor al, al
add rsp, 0x28
ret

Function at 0x14000193c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001986
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001986
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001986
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001986
cmp dword [rcx + 0x84], 0xe
jbe 0x140001986
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001988
xor al, al
add rsp, 0x28
ret
Function at 0x140002fe0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
test byte [rcx], 1
je 0x140002ffa
mov rcx, qword [rcx + 0x10]
jmp 0x140002ffe
add rcx, 2
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
xor r14d, r14d
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000306d
mov rbx, rax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r14d, dword [rsp + 0x44]
mov eax, r14d
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140030f20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xor edi, edi
cmp qword [rcx + 0x78], 0
je 0x140031066
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x1400310ea
mov eax, dword [rsi + 0x94]
test al, 0x10
jne 0x140030f82
test al, 8
je 0x140031066
mov eax, dword [rsi + 0x8c]
mov dword [rsp + 0x2c], eax
cmp byte [rsi + 0x9a], 0
je 0x140031022
mov rbx, qword [rsi + 0x20]
sub rbx, qword [rsi + 0x18]
jmp 0x140031048
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x140030fa8
mov rax, qword [rsi]
mov edi, 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x68]
cmp eax, 0xffffffff
je 0x140031066
lea rdi, [rsi + 0x88]
lea r15, [rsp + 0x30]
nop word cs:[rax + rax]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [rax + 0x28]
mov ebx, eax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sub.msvcrt.dll_fwrite
cmp rax, r14
jne 0x140031061
cmp ebx, 1
je 0x140030fc0
cmp ebx, 2
je 0x140031061
mov rcx, qword [rsi + 0x78]
call sub.msvcrt.dll_fflush
mov edi, 0
test eax, eax
jne 0x140031061
jmp 0x140031066
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r9, qword [rsi + 0x48]
mov rbx, qword [rsi + 0x50]
sub rbx, r9
test eax, eax
jle 0x1400310ab
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rbx, rcx
xor ebp, ebp
mov rcx, qword [rsi + 0x78]
neg ebx
mov edx, ebx
mov r8d, 1
call fcn.14009ace0
test eax, eax
je 0x140031075
mov edi, 0xffffffff
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test bpl, bpl
je 0x140031084
mov eax, dword [rsp + 0x2c]
mov dword [rsi + 0x88], eax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x94], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
jmp 0x140031066
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x140031048
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x2c]
call qword [r10 + 0x40]
mov eax, eax
add rbx, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rbx, rax
mov bpl, 1
jmp 0x14003104a
call fcn.1400315d0
int3
Function at 0x140035b40
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
jne 0x140035c63
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140035bab
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
lea r14, [rcx + rax]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rdx
sub rcx, r14
mov r8, rbx
sub r8, rdx
call sub.msvcrt.dll_memmove
sub rbx, r14
mov qword [rsi + 0x10], rbx
sub qword [rsi + 8], r14
jmp 0x140035c63
mov rcx, rbx
sub rcx, rax
sar rcx, 2
cmp rbx, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x140035ccd
mov r14, rbx
shr r14, 2
lea rcx, [rbx*8]
call fcn.14006fb50
lea rdx, [rax + r14*8]
mov rcx, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
mov r10, r9
sub r10, rcx
lea r8, [rax + rbx*8]
mov rbx, rdx
sub r9, rcx
je 0x140035c43
and r10, 0xfffffffffffffff8
mov rbx, r10
add rbx, rdx
add r9, 0xfffffffffffffff8
cmp r9, 0x68
jb 0x140035c21
lea r10, [rax + r14*8]
sub r10, rcx
cmp r10, 0x20
jae 0x140035c7c
mov r10, rdx
mov r11, rcx
nop word [rax + rax]
mov rcx, qword [r11]
mov qword [r10], rcx
add r10, 8
add r11, 8
cmp r10, rbx
jne 0x140035c30
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r8
test rcx, rcx
je 0x140035c63
call fcn.14006fbd0
mov rbx, qword [rsi + 0x10]
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shr r9, 3
inc r9
shl r14, 3
mov r15, r9
and r15, 0xfffffffffffffffc
lea r10, [rdx + r15*8]
lea r11, [rcx + r15*8]
add r14, rax
add r14, 0x10
xor r12d, r12d
movups xmm0, xmmword [rcx + r12*8]
movups xmm1, xmmword [rcx + r12*8 + 0x10]
movups xmmword [r14 + r12*8 - 0x10], xmm0
movups xmmword [r14 + r12*8], xmm1
add r12, 4
cmp r15, r12
jne 0x140035ca0
cmp r9, r15
jne 0x140035c30
jmp 0x140035c43
call fcn.140002f60
int3
Function at 0x140035ce0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
jne 0x140035e03
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140035d4d
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shl r14, 2
and r14, 0xfffffffffffffff8
lea rbx, [r8 + r14]
sub r8, rdx
sub rbx, r8
mov rcx, rbx
call sub.msvcrt.dll_memmove
mov qword [rsi + 8], rbx
add qword [rsi + 0x10], r14
mov rdx, rbx
jmp 0x140035e03
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140035e7d
lea rbx, [r14 + 3]
shr rbx, 2
lea rcx, [r14*8]
call fcn.14006fb50
lea rdx, [rax + rbx*8]
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
mov r11, r10
sub r11, rcx
lea r8, [rax + r14*8]
mov r9, rdx
sub r10, rcx
je 0x140035de3
and r11, 0xfffffffffffffff8
mov r9, r11
add r9, rdx
add r10, 0xfffffffffffffff8
cmp r10, 0x68
jb 0x140035dc5
lea r11, [rax + rbx*8]
sub r11, rcx
cmp r11, 0x20
jae 0x140035e1d
mov r11, rdx
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [r14]
mov qword [r11], rcx
add r11, 8
add r14, 8
cmp r11, r9
jne 0x140035dd0
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rcx, rcx
je 0x140035e03
call fcn.14006fbd0
mov rdx, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [rdx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shr r10, 3
inc r10
shl rbx, 3
mov r15, r10
and r15, 0xfffffffffffffffc
lea r11, [rdx + r15*8]
lea r14, [rcx + r15*8]
add rbx, rax
add rbx, 0x10
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + r12*8]
movups xmm1, xmmword [rcx + r12*8 + 0x10]
movups xmmword [rbx + r12*8 - 0x10], xmm0
movups xmmword [rbx + r12*8], xmm1
add r12, 4
cmp r15, r12
jne 0x140035e50
cmp r10, r15
jne 0x140035dd0
jmp 0x140035de3
call fcn.140002f60
int3
Function at 0x140035e90
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
jne 0x140035fb3
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140035efd
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shl r14, 2
and r14, 0xfffffffffffffff8
lea rbx, [r8 + r14]
sub r8, rdx
sub rbx, r8
mov rcx, rbx
call sub.msvcrt.dll_memmove
mov qword [rsi + 8], rbx
add qword [rsi + 0x10], r14
mov rdx, rbx
jmp 0x140035fb3
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x14003602d
lea rbx, [r14 + 3]
shr rbx, 2
lea rcx, [r14*8]
call fcn.14006fb50
lea rdx, [rax + rbx*8]
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
mov r11, r10
sub r11, rcx
lea r8, [rax + r14*8]
mov r9, rdx
sub r10, rcx
je 0x140035f93
and r11, 0xfffffffffffffff8
mov r9, r11
add r9, rdx
add r10, 0xfffffffffffffff8
cmp r10, 0x68
jb 0x140035f75
lea r11, [rax + rbx*8]
sub r11, rcx
cmp r11, 0x20
jae 0x140035fcd
mov r11, rdx
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [r14]
mov qword [r11], rcx
add r11, 8
add r14, 8
cmp r11, r9
jne 0x140035f80
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rcx, rcx
je 0x140035fb3
call fcn.14006fbd0
mov rdx, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [rdx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shr r10, 3
inc r10
shl rbx, 3
mov r15, r10
and r15, 0xfffffffffffffffc
lea r11, [rdx + r15*8]
lea r14, [rcx + r15*8]
add rbx, rax
add rbx, 0x10
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + r12*8]
movups xmm1, xmmword [rcx + r12*8 + 0x10]
movups xmmword [rbx + r12*8 - 0x10], xmm0
movups xmmword [rbx + r12*8], xmm1
add r12, 4
cmp r15, r12
jne 0x140036000
cmp r10, r15
jne 0x140035f80
jmp 0x140035f93
call fcn.140002f60
int3
Function at 0x140036420
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
jne 0x140036543
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x14003648d
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shl r14, 2
and r14, 0xfffffffffffffff8
lea rbx, [r8 + r14]
sub r8, rdx
sub rbx, r8
mov rcx, rbx
call sub.msvcrt.dll_memmove
mov qword [rsi + 8], rbx
add qword [rsi + 0x10], r14
mov rdx, rbx
jmp 0x140036543
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x1400365bd
lea rbx, [r14 + 3]
shr rbx, 2
lea rcx, [r14*8]
call fcn.14006fb50
lea rdx, [rax + rbx*8]
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
mov r11, r10
sub r11, rcx
lea r8, [rax + r14*8]
mov r9, rdx
sub r10, rcx
je 0x140036523
and r11, 0xfffffffffffffff8
mov r9, r11
add r9, rdx
add r10, 0xfffffffffffffff8
cmp r10, 0x68
jb 0x140036505
lea r11, [rax + rbx*8]
sub r11, rcx
cmp r11, 0x20
jae 0x14003655d
mov r11, rdx
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [r14]
mov qword [r11], rcx
add r11, 8
add r14, 8
cmp r11, r9
jne 0x140036510
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rcx, rcx
je 0x140036543
call fcn.14006fbd0
mov rdx, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [rdx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shr r10, 3
inc r10
shl rbx, 3
mov r15, r10
and r15, 0xfffffffffffffffc
lea r11, [rdx + r15*8]
lea r14, [rcx + r15*8]
add rbx, rax
add rbx, 0x10
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rcx + r12*8]
movups xmm1, xmmword [rcx + r12*8 + 0x10]
movups xmmword [rbx + r12*8 - 0x10], xmm0
movups xmmword [rbx + r12*8], xmm1
add r12, 4
cmp r15, r12
jne 0x140036590
cmp r10, r15
jne 0x140036510
jmp 0x140036523
call fcn.140002f60
int3