joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1410ab1bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx r8d, dx
bswap esi
and ecx, 0x705e61d
not r8d
lea esi, [rsi + rcx*2 + 0x62beb7f]
call fcn.1410fa324
bswap eax
movsx r9d, sil
mov qword [rsp + rcx - 0x77b3b0e8], r10
xor r9b, cl
jge 0x14108ee9e
sub r10, 4
mov ebp, 0x6127fe06
mov edi, dword [r10 + rbp - 0x6127fe06]
movzx ecx, bpl
push rbp
ror byte [rsp + rbp - 0x6127fe05], 2
xor edi, ebx
mov eax, ecx
lea edi, [rdi + rcx + 0x32bd6eaa]
ror qword [rsp + rbp - 0x6127fe06], cl
neg edi
dec byte [rsp + rbp - 0x6127fe01]
sal byte [rsp + rbp - 0x6127fdff], 0x84
bswap edi
pop rdx
lea edi, [rdi + rbp*2 + 0x26de39fd]
cmove dx, bp
push rbx
xor dword [rsp + rbp - 0x6127fe06], edi
sar rdx, cl
mov r9d, ebp
jp 0x1410a34f5
dec byte [rsp + rdx - 0x42bbda8c]
lea r10, [r10 + rdx - 0x42bbdaa3]
sub dword [rsp + rdx - 0x42bbda8e], 0x4387c902
sal rbp, 0xe9
mov word [r10 + rdx - 0x42bbdaa1], si
call fcn.141138655
movzx edi, al
xadd eax, r9d
ror r11d, 1
push rax
sar byte [rsp + r9 - 0xdcaee0], 0x64
dec r11d
push rdx
mov ecx, 0xa00bf690
not r11d
ror r11d, 1
not qword [rsp + r9*8 - 0x6e5772a]
xor r11d, 0xf33d6214
mov qword [rsp + r9 - 0xdcaed7], r10
shl dword [rsp + r9 - 0xdcaede], 0x62
ror al, 0xe6
sbb edx, ecx
xor dword [rsp + r9 - 0xdcaed7], r11d
xadd edx, edi
mov r10, qword [rsp + r9 - 0xdcaed7]
jg 0x1411af436
push 0x6b6283c
pop rbp
mov di, word [r8 + rbp*8 - 0x35b141e0]
lea rsi, [rbp + rbp*4 + 0x6aa3091a]
lea rdx, [rsi + rsi*2 + 0x6604acb7]
call fcn.1411a1258
sar r9b, 0xa1
not esi
sbb esi, 0xb7878291
and r9w, 0x4709
rol esi, 3
jmp 0x140ff4188
pop rbx
jb 0x141076a6f
sub bp, 0xe33c
neg esi
ror edx, 0x5b
mov qword [rsp + rdx - 0x645a4561], rdi
lea r9, [rbp - 0x387069e6]
xor dword [rsp + rdx - 0x645a4561], esi
add qword [rsp + rdx - 0x645a4571], 0x1ab833a9
mov rdi, qword [rsp + rdx - 0x645a4561]
movsxd rsi, esi
adc r11, rsi
lea r8, [rbp + 0x42bbebb3]
xadd r8d, edx
lea rbx, [rbx + rdx - 0x42bbdaa3]
mov qword [rsp + rdx - 0x42bbda9a], 0x36a93e99
movzx esi, byte [rbx + rdx - 0x42bbdaa2]
ror word [rsp + rdx - 0x42bbda99], 0x4c
xor sil, dil
lea rax, [r9 + rdx*4 + 0x2c188c14]
add sil, 0x32
sal qword [rsp + rdx - 0x42bbda9a], 0xf1
dec r8w
not sil
neg sil
dec bp
dec dword [rsp + rdx - 0x42bbda9d]
dec edx
inc sil
neg byte [rsp + rdx - 0x42bbda94]
jge 0x14118ab32
sub r9, 8
mov r11d, 0xe016b7ab
push r11
mov r11, qword [r9]
xor r11, rbx
shr dword [rsp + 1], 0x3d
neg r11
jmp 0x141064386
lea rsi, [rcx + rcx*2 - 0x797e37c2]
lea r9, [rcx + r9 - 0x19b5335]
mov qword [rsp + rcx - 0x19b5331], 0x2fa17fbb
add dword [rsp + rcx*2 - 0x336a662], esi
adc rcx, rcx
mov ecx, dword [r9 + rcx - 0x336a662]
xor ecx, ebx
call fcn.140fced9f
inc ecx
not eax
dec eax
push rcx
and byte [rsp + rdx - 0x77fffffb], cl
jl 0x14100d971
mov ecx, 0xa608c53a
mov rsp, r9
lea rbx, [rcx + rcx - 0x475e1a47]
call fcn.14106327f
not sil
mov qword [rsp + rdx - 0x42bbda91], r8
xor dil, sil
jmp 0x141037d43
Function at 0x1410b4727
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor edx, 0x492acbb7
pop r11
sal esi, cl
not al
rol edx, 1
xor edx, 0x8339037
mov r10d, 0xf498f8a0
ror r11, cl
xor r10, r8
push rbx
sub ecx, r11d
lea r10, [rax + rax - 0x275eb459]
setb sil
xor dword [rsp + r8*8 - 0x441c8], edx
not ecx
call fcn.14100c416
neg r8w
adc rcx, rsp
mov byte [rcx + rax*8 - 0x1c5e0], r9b
not rbp
lea r10, [rax + r10 - 0x38c0]
movzx r9d, dil
mov r8d, dword [rax + r10 - 0x38bc]
jmp 0x1410ada6d
sbb qword [rsp + r8*2 - 0x11072], rsi
cmovno rcx, rsi
xor edx, ebx
ror edx, 1
jmp 0x140fb804a
jmp 0x14116d3c7
lea r10, [r10 + r8 - 0x6c86c683]
movsx eax, dx
mov qword [rsp + rax - 0x2f0e], 0xffffffff89a386b9
movzx ecx, word [r8 + r10 - 0x6c86c681]
rol ax, 0x8a
xor cx, bx
rol r8, 0x51
movsx ebp, ax
not cx
and al, bpl
mov edi, edx
neg cx
xor cx, 0x84ad
inc dword [rsp + rax - 0x38b8]
inc qword [rsp + rax - 0x38bc]
dec cx
pop rdi
xor bx, cx
jmp 0x141079552
xor r8d, ebx
mov ecx, 0x9017f3d
lea r8d, [r8 + rdi + 0x6462cff9]
sal r9, cl
not eax
bswap r8d
not r9d
lea r8d, [r8 + rbp - 0x323a676a]
rol r8d, 2
push rbx
bswap rax
or eax, 0x778396a0
or ecx, edx
xor dword [rsp + rax - 0x778396a0], r8d
pop rbx
lea r9, [rcx*4 + 0x44872e1d]
movsxd r8, r8d
xor dl, 0x31
lea rbp, [r9 + rdx*4 + 0x4686019c]
adc rsi, r8
mov r8d, ecx
call fcn.14118f3a2
xor byte [rsp + rdx - 2], 0x88
mov edx, dword [r9 + rdx*2 - 0x12]
jno 0x14109b759

Function at 0x1410b4e71
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [rsi + rdx + 0x7d93e11b]
bswap edx
or rdi, rbp
sbb edx, 0xb6be83aa
not eax
xor sil, cl
shr bp, 5
mov qword [rsp + rbx + 0x30], r11
movsx r11d, bp
xor dword [rsp + rsi*2 - 0x60a0], edx
call fcn.1411ae72c

Function at 0x1410c5d67
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdx*2 - 0x1a43caae], rdx
call fcn.141131c18

Function at 0x1410ca5b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror ebp, 1
lea rax, [r9*2 + 0x74099c16]
mov qword [rsp + r8 - 0x5291bd12], rcx
bswap ebp
mov qword [rsp + r8 - 0x5291bd0a], 0xffffffffd89c6a81
sar qword [rsp + r8 - 0x5291bd0a], cl
lea ebp, [r8 + rbp + 0x6e14c9fd]
add word [rsp + r8 - 0x5291bd0f], dx
xor ebp, 0xabb6c237
or cl, ah
sub r8d, r9d
bswap ebp
xadd r9b, dl
inc r8b
rol ebp, 1
push rax
xadd word [rsp + r8 - 0x52927a17], cx
xor ebp, 0x81b57f02
call fcn.14107ddee

Function at 0x1410d741e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea edx, [rdx + r10 - 0x63c43234]
bswap edx
shl ebp, 0x21
setb byte [rsp + rcx + 0x10]
lea r11, [rbp + rbx + 0x68864eaf]
ror edx, 2
bswap r10d
bswap rbx
sub edx, 0xf23b522b
neg r11b
mov qword [rsp + rcx*2 + 8], 0xffffffffc082cc21
neg edx
mov qword [rsp + rcx*8 + 0x10], rdi
movzx eax, bp
sub r10, 0x763ad309
xor dword [rsp + rcx + 0x10], edx
and rcx, rax
mov qword [rsp + rcx], rax
mov rdi, qword [rsp + rcx*8 + 0x10]
call fcn.140fe2e32

Function at 0x1410df253
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx], rdi
rol ax, 0x4e
xadd rdx, rcx
inc dl
xor dword [rsp + rdx - 0x37229], ebx
jmp 0x14117eaed
Function at 0x1410ef3f0
Capabilities:
Encode data using base64

Disassembly:
lea rsi, [rbx + rbx*2 - 0x6dfd6dd9]
pop r8
mov r10b, byte [rcx + r9 - 0x15ff8]
not rbx
neg r8w
lea r9, [r9 + rcx*2 - 0x2bff6]
call fcn.14112b0c1
pop r11
lea r11, [r10*8 - 0x60c71b64]
xor dword [rsp + rcx*8 - 0xb0000], eax
mov edx, 0x2a15029f
xchg r10w, r11w
and r10w, 0xcc25
pop r11
movsxd rax, eax
jle 0x1410795b5
not r10d
dec r10d
adc rbp, rax
push rcx
mov rax, qword [rcx + r9 - 0x16000]
jmp 0x1410dc4ee

Function at 0x1411121b3
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
xchg si, bp
shr bpl, 0xe4
mov word [rbp + r10 - 0x4b6ab0e], cx
ror sil, 0xa1
movzx edx, bp
movsx r8d, bp
lea rbx, [rbx + rbp*4 - 0x12daac3c]
mov ecx, dword [rbx + rbp - 0x4b6ab0e]
dec al
xor ecx, edi
xor rsi, r8
lea r9, [rax + 0x6030e4be]
xor ecx, 0xad2c3723
lea ecx, [rcx + rsi - 0x1fd220c]
sar bp, 1
neg ecx
neg r9w
sbb r8w, si
rol ecx, 3
dec ecx
add r9b, 0x89
xchg r8d, edx
push rdi
call fcn.1410bee45
jmp 0x141143dd4
cmp ebx, 3
jmp 0x14114f9c4
lea rsi, [rax*2 - 0x6b5b1d5e]
lea r10, [r10 + rbp - 0x4b664a0]
jmp 0x140fbb406
jmp 0x1410bcf2d
call fcn.141087e72
mov ebp, 0x4b664a6
mov rax, qword [r10 + rbp - 0x4b664a6]
mov cx, word ss:[rax + rbp*2 - 0x96cc94c]
movsx eax, bp
jmp 0x141107eeb
lea rsp, [rsp + 8]
jne 0x140fc5864
mov r8d, 0x3231a391
bswap r8
mov r8, rax
push 0xffffffffdf356689
lea rsp, [rsp + 8]
jmp 0x141051b6d

Function at 0x141113d01
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea rsp, [rsp + 8]
jne 0x140fa5f4d
mov rdx, rax
push 0xffffffff958c3581
call fcn.140fd79a3

Function at 0x14111da2d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r10d, 0xcc1cb407
sub rdi, 4
call fcn.141194c98
mov edx, 0xe885c606
mov eax, edx
inc al
mov edx, dword [rbp + riz]
add rbp, 4
jmp 0x141152825
bswap ecx
mov qword [rsp + rax*4 - 0x200], rdi
jne 0x141139c72
mov r11d, 0x609a8839
mov edx, r11d
movzx r10w, byte [r11 + rbp - 0x609a8839]
mov r11b, byte [rbp + r11 - 0x609a8837]
movsx ecx, dx
lea rbp, [rbp + rdx - 0x609a8837]
movsx esi, dx
shl edx, cl
movzx r8d, si
not r10b
movzx eax, r8w
sar edx, cl
not r11b
sar cx, 0x8f
sal eax, 0x9d
or r10b, r11b
jmp 0x1411be085
lea ecx, [rcx + rax - 0x3802eaa1]
jge 0x1410ef598
jmp 0x141014c83
setnp r9b
xor dword [rsp + rdx*2 - 0x49c554fe], ecx
call fcn.1410b1864

Function at 0x14112279e
Capabilities:
Hash data using murmur3

Disassembly:
lea rsp, [rsp + 8]
call rax
mov ecx, 0xdb2fb92c
mov rsp, qword [rbp + riz - 0x10]
movsx edx, cx
call fcn.1411936ee
jmp 0x140fd51fb

Function at 0x14112a8fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r8*2 - 0x3c], rbx
call fcn.14112647d

Function at 0x14112cf03
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea rsp, [rsp + 8]
add rsp, rcx
push 0xffffffff9611f814
test ebx, ebx
lea rsp, [rsp + 8]
je 0x1410d747f
Function at 0x14114cb86
Capabilities:
Parse pe header

Disassembly:
neg edx
neg bpl
bswap edx
xor bp, 0x5722
xchg r8b, sil
inc r8d
xor edx, eax
shl ax, 0x46
push rdi
cmovae esi, ebp
inc r8
xor dword [rsp + rcx - 0x5000], edx
bswap rsi
xor rsi, r8
sbb rax, rbp
pop rdi
or ax, ax
jne 0x141111adc
jl 0x1410cd9d5
movsxd rdx, edx
adc r11, rdx
jmp fcn.1410ed3be
mov qword [rsp + rdi - 0x389ee183], rdi
mov bx, word [r8 + rdi - 0x389ee183]
sal dword [rsp + rdi - 0x389ee180], 0x8e
movsx r11d, di
lea rax, [r11 + r11*2 - 0x7b7a4879]
lea r8, [r8 + rdi*2 - 0x713dc304]
rol qword [rsp + rdi - 0x389ee183], 0x8d
movzx r11d, byte [rbp + rdi*2 - 0x713dc306]
lea rbp, [rbp + rdi - 0x389ee182]
mov edx, 0xa8152631
xchg byte [rsp + rdi - 0x389ee181], dh
xor r11b, r10b
dec al
movzx ecx, dx
dec r11b
rol r11b, 1
pop rdx
sub r11b, 0x2c
ror r11b, 1
call fcn.141155ab4
xor di, cx
movsx edx, sil
pop rax
lea rcx, [rsp + rcx + 8]
mov qword [rsp], rdx
shl r8b, 0xa1
mov r8w, word [rcx]
movzx ecx, word [rsp]
sar dl, 0x47
lea r10, [r10 + rcx*2 - 0x1ff16]
adc byte [rsp + rcx*2 - 0x1ff14], 0xb1
shl cx, 0x6b
setp byte [rsp + rcx*2 - 0xa000]
mov word [r10 + rcx*2 - 0xa000], r8w
setnp dl
lea rbx, [rbx + rcx - 0x5004]
or sil, 0x35
pop rbp
mov edx, dword [rbx + rcx*8 - 0x28000]
mov r8d, eax
xor edx, edi
neg r8d
sar eax, 0xdf
lea edx, [rcx + rdx - 0x1f153113]
jp 0x140fd876f

Function at 0x14114cc68
Capabilities:
Parse pe header

Disassembly:
lea ecx, [rbx - 4]
lea rsp, [rsp + 8]
sal ecx, 3
mov eax, 0x6a07f8b
sub al, 0x22
sal edx, 3
call fcn.140fc458c
mov edx, 0x3486f227
mov edi, dword [rdx + r8 - 0x3486f227]
neg dx
mov cl, byte [rdx + r8 - 0x34860dd5]
movsx esi, dl
jno 0x141166818

Function at 0x14114f003
Capabilities:
Encode data using base64

Disassembly:
sub r11d, 0xe1b15e1d
lea rbp, [rbx + 0x31bf302b]
xor r11d, ebx
movzx ecx, dl
ror dword [rsp + rdx - 0x3a2722ff], 0x9e
jb 0x14119ab9c
mov qword [rsp + rdx - 0x3a2722fd], rsi
rol rbx, cl
jae 0x1411746f6
dec r11d
xadd ebp, eax
mov qword [rsp + rbp - 0x360a1b8f], rax
rol r11d, 1
xchg word [rsp + rdx*2 - 0x744efff7], dx
xor r11d, 0xcc332b17
jmp 0x14113ba33
xor dword [rsp + rdx*2 - 0x744e4602], r11d
mov rsi, qword [rsp + rax - 0x12d20dc]
call fcn.14101bd63

Function at 0x141156ff9
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x140ff48cb

Function at 0x141157185
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + r9 - 0x4c77aa33], 0x2f3cd50c
neg ebp
call fcn.141080716
xor r10d, ebx
bswap r10d
inc r10d
movzx eax, r11w
xor rdx, rdx
bswap r10d
lea rcx, [r11 + rsi - 0x58c197d1]
not r10d
inc cl
neg si
push rbx
xor dword [rsp + r11*4 - 0x2f4], r10d
call fcn.141101989
not r8
xor ecx, r8d
shr sil, 0x67
lea rax, [rsi*2 + 0x7262130]
jae 0x141007f61
call fcn.14117c8d1

Function at 0x14115bbe9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov word [rdi + r8*2 - 0x14be6], cx
call fcn.1411231e8
Function at 0x14117cfd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rbp, [rsp + rbp + 0x18]
sal rcx, 0xf9
mov rax, qword [rbp + riz]
mov qword [rsp + 8], r8
mov ebp, 0x58bdc2ad
sar qword [rsp + rbp - 0x58bdc29d], 0x92
lea rbx, [rbx + rbp - 0x58bdc2b5]
mov qword [rsp + rbp - 0x58bdc2ad], 0xffffffffda0ad5bb
call fcn.14110c045

Function at 0x14117e320
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr r8d, 0xf7
mov qword [rsp + rcx*2 - 0x1c], r11
and cl, r10b
movsx eax, cx
push r8
xor dword [rsp + rcx*2 + 8], edx
add qword [rsp + rcx], r10
mov r11, qword [rsp + rcx*4 + 8]
sal cx, 0x2f
je 0x1410f4973
mov dword [r9 + rcx], edx
xchg r8w, cx
xadd word [rsp + rcx - 0x170d], cx
pop rsi
pop r10
pop rbx
jns fcn.141101a6b
movsx r10d, r11b
ror eax, 1
not eax
lea eax, [rax + rsi - 0x4205ff5d]
sub r11b, r8b
neg eax
shr sil, 0x26
lea rdx, [r8*2 - 0x61c4d0c2]
push rbx
and r11w, r11w
xor dword [rsp + rcx - 0xfd15], eax
xchg dl, r10b
lea rbx, [r11 + r11*8 + 0x287ef04]
xadd r11b, bl
pop rbx
xchg r11b, cl
xchg r10, r8
movsxd rax, eax
adc rdi, rax
bswap rcx
lea r9, [r9 + r8 - 0x6a]
lea rax, [r10 + rcx*8 - 0x3d445255]
rol rdx, 0x58
xor rax, rsi
movzx eax, word [r9 + r8 - 0x68]
shl esi, 0x9d
xor ax, bx
ror ax, 1
or rcx, 0x548813ac
adc dl, 0x1c
shl cx, cl
adc ax, 0xd529
shr r10, 0xc
ror ax, 1
xor r8w, dx
xor rsi, 0xffffffffc4942e9f
adc ax, 0xc41c
jmp 0x1411558b0
mov qword [rsp + rcx*2 + 8], r8
movsxd rdx, edx
sbb r8, rsi
add rbp, rdx
rdtsc
sal rsi, 0xac
adc r8w, si
lea r9, [r9 + rcx - 8]
rol dword [rsp + rcx + 7], 0x84
push rcx
ror cl, 0x25
mov dword [r9 + rcx*2 + 4], eax
jp 0x1410a3f7e
sal r10, cl
rol edx, 1
neg edx
movzx r8d, byte [rsp + rcx*8 - 0x6f]
rol edx, 2
sar qword [rsp + rcx - 0xe], cl
mov esi, 0x511e99c
adc edx, 0xeb299e84
bswap r8d
jmp 0x140fb1306
call fcn.1410d12dc
mov qword [rsp], r10
mov edx, dword [rdi]
xor word [rsp + 4], r10w
movsx ecx, r10b
xor edx, r11d
jmp 0x1411097ca

Function at 0x14118192d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx - 0x7622], r8
sar byte [rsp + r9*2 - 0x733913b8], 0x22
neg ecx
ror ecx, 3
sar bpl, 0x44
sbb byte [rsp + r9 - 0x399c89d6], r8b
call fcn.1410ba883

Function at 0x14118ad69
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1411610e0
mov ebp, dword [r9]
mov cl, byte [r9 + 4]
add r9, 2
mov r10d, 0xda0d1b5
mov eax, r10d
lea r11, [rax + rax*2 - 0x63995a]
shr ebp, cl
push r10
bswap r10d
mov dword [r9 + rax*4 - 0x368346d4], ebp
mov ebp, r11d
xadd byte [rsp + rax - 0xda0d1b5], bpl
lea rsi, [rsi + rax - 0xda0d1b9]
mov r10d, dword [rsi + rax - 0xda0d1b5]
xor r10d, edi
jmp 0x1411ae81b

Function at 0x141190af7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r11, [rdx*8 - 0x4ae5e77b]
mov qword [rsp], 0xffffffffc22b1183
xor ebp, esi
shr r10w, 0x2c
bswap ebp
neg ebp
or dword [rsp + 2], 0x53126d9a
dec ebp
mov qword [rsp + 8], 0x1b4ee85
sar byte [rsp + 9], cl
bswap ebp
cmovns cx, r10w
mov qword [rsp + 0x18], rsi
not qword [rsp + 0x10]
xor dword [rsp + 0x18], ebp
mov rsi, qword [rsp + 0x18]
push r10
movsxd rbp, ebp
call fcn.14105963a
Function at 0x1411935ac
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov ebp, dword [r10]
xor ebp, ebx
not ebp
mov eax, 0x67ba1b18
movzx r8d, al
bswap ebp
mov qword [rsp + rax - 0x67ba1b18], r8
rol ebp, 3
xor ebp, 0xd15f02b
inc ebp
call fcn.1410a55c3

Function at 0x141199c5e
Capabilities:
Encode data using base64

Disassembly:
movsxd rdx, edx
adc rbp, rdx
mov qword [rsp + rbx*4 - 0x4b79e624], rbx
neg r8d
push rbx
mov qword [rsp + rbx - 0x12de7989], rbp
ret 0x10
mov r11, qword [rsp + rbx - 0x12de7981]
mov qword [rsp + rbx*4 - 0x4b79e61c], 0xffffffff94148db9
shl r8w, 0xa8
jp 0x141108db4

Function at 0x1411b2254
Capabilities:
Parse pe header

Disassembly:
xor dword [rsp + 8], edi
lea r9, [rdx*4 + 0x612f6f80]
mov r10, qword [rsp + 8]
movsxd rdi, edi
call fcn.1411bcbaa

Function at 0x1411b7994
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
xchg r11b, dl
lea rbp, [r11 + rbp - 0xbb]
sub r11w, r11w
shr esi, cl
movzx ecx, r11w
mov dword [rbp + r11], esi
add cl, dh
jle 0x141195758
lea r9, [r11 + r9 - 4]
lea r8, [r11*2 + 0x2b09a681]
mov edx, dword [r9 + r11*2]
xor edx, ebx
lea rax, [rcx + rcx*8 - 0x11d9e7d7]
xadd r11w, r8w
call fcn.14101944a
neg esi
bswap r8d
setp sil
sbb r8d, esi
neg bl
xor r8d, 0xaa98a4ab
call fcn.1411c9eb1
jp 0x1410caa83
mov r10, qword [r9 + r10 - 0x6f9553a9]
mov r11, qword [r9 + 8]
push 0x553f95be
add r9, 0xc
xor edx, edx
test r11, r11
push 0x4e923123
lea rsp, [rsp + 0x10]
je 0x140fdca8b
mov ebx, 0x69282b30
push r8
jmp 0x140fdca29

Function at 0x1411c6a67
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.1411121b3
lea rdx, [rsi + rcx*8 + 0x76a89828]
lea rbp, [rbp + r9*2 - 0x62242080]
xor byte [rsp + r9 - 0x3112103a], cl
mov word [r9 + r8 - 0x31121045], ax
shl si, cl
add cx, 0xc816
movzx r8d, byte [rsp + r9 - 0x31121042]
mov qword [rsp + r9*2 - 0x6224208a], rdi
ret 8
xor r8d, r10d
mov qword [rsp + rcx - 0x103d], rcx
lea rax, [r9*4 - 0x5dcdb6ef]
not byte [rsp + r9*2 - 0x6224207d]
bswap r8d
not r8d
lea rsi, [rcx + rax*2 + 0x6ca93a1c]
ror r8d, 1
inc r8d
add dword [rsp + r9*2 - 0x62242081], r9d
mov qword [rsp + r9*2 - 0x6224208a], rsi
mov qword [rsp + rax - 0x667a8a1d], r10
xor dword [rsp + r9 - 0x3112103d], r8d
mov r10, qword [rsp + rcx - 0x103d]
mov qword [rsp + r9*2 - 0x62242082], rcx
movsxd r8, r8d
add rdi, r8
dec qword [rsp + r9 - 0x3112103e]
mov r8, qword [rbp + rax - 0x667a8a25]
mov ax, word [rbp + r9 - 0x3112103d]
jne 0x1411af80f
lea rsp, [rsp + 8]
jne 0x140ff4e45
jmp 0x14116e53d
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14042ef70]
mov dword [rax], 1
mov rax, qword [0x14042ef80]
mov dword [rax], 1
mov rax, qword [0x14042ef90]
mov dword [rax], 1
mov rax, qword [0x14042eef0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1403a3c70
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140405270
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x1403a3d35
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1404160f2
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1403a3d16
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1403a3d08
test rsi, rsi
je 0x1404160f2
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1403a3cc8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1403a3d64
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1403a3d80
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x1403a3e3d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1404160f8
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1403a3e1e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1403a3e10
test rsi, rsi
je 0x1404160f8
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1403a3dd0
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403ba990
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x14045f218]
mov rsi, rcx
test rbx, rbx
je 0x1403baa10
mov rax, qword [0x14042f0c0]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x1403baa00
mov rdx, qword [0x14045f448]
test rdx, rdx
je 0x1403bab08
mov rcx, rbx
mov rbx, qword [sym.imp.python38.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python38.dll_PyNumber_InPlaceAdd]
jmp 0x1403ba9e1
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.1403a3c70
test rax, rax
je 0x1403bab28
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python38.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1404161a0
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x1403baaae
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1403baaa0
test rbx, rbx
je 0x1404161a0
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x1403baa60
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python38.dll__PyRuntime]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rax + 0x510]
call fcn.1403ba8d0
mov rbx, rax
mov qword [0x14045f218], rbx
jmp 0x1403ba9b2
lea rcx, [0x14042b6c0]
call qword [sym.imp.python38.dll_PyUnicode_FromString]
mov qword [0x14045f448], rax
mov rdx, rax
jmp 0x1403ba9d2
mov rbx, qword [0x14045f230]
test rbx, rbx
jne 0x1403baaf6
cmp byte [0x14045f442], 0
je 0x1403bab66
mov rdx, 0xffffffffffffffff
lea rcx, [0x14045f240]
call qword [sym.imp.python38.dll_PyUnicode_FromWideChar]
mov qword [0x14045f230], rax
mov rbx, rax
test rax, rax
je 0x1403bab72
add qword [rax], 1
jmp 0x1403baaf6
mov ecx, 1
call fcn.1403a48e0
jmp 0x1403bab3d
call qword [sym.imp.python38.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop
call sub.msvcrt.dll_abort
nop