joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6780
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4f6805
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4f6966
cmp rcx, 0xe
jne 0x4f6880
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4f6966
cmp rcx, 0xf
jne 0x4f68f7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4f6966
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4fc7c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc8a5
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
cmp rsi, 8
je 0x4fc858
test rbx, rbx
je 0x4fc858
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
cmp rsi, 8
sbb edx, edx
mov byte [rsp + 0x1f], dl
lea rax, [0x0056f8c0]
mov rcx, rbx
call fcn.0044ae80
mov rdx, qword [rsp + 0x38]
movzx esi, byte [rdx]
mov rcx, qword [rsp + 0x28]
shr sil, cl
movzx edi, byte [rsp + 0x1f]
and esi, edi
mov byte [rax], sil
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8d, 1
jmp 0x4fc897
add rsp, 0x40
pop rbp
ret
movzx r9d, byte [r8 + rdx - 1]
mov r10, rcx
mov rcx, rsi
shl r9d, cl
lea r11, [r8 + 1]
cmp rcx, 0x20
sbb r12d, r12d
and r9d, r12d
mov byte [rax + r8], r9b
movzx r12d, byte [rdx + r8]
mov rcx, r10
shr r12b, cl
and r12d, edi
or r9d, r12d
mov byte [rax + r8], r9b
mov r8, r11
cmp rbx, r8
jg 0x4fc85e
mov rcx, rbx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004fc7c0

Function at 0x510740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51088e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006e3130]
call fcn.004b8120
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x005108a0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403ce0
xorps xmm15, xmm15
mov r14, qword [0x00748488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x510852
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x510888
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x51087d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465480
call fcn.00465400
nop
call fcn.00463140
jmp fcn.00510740
Function at 0x529d20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x529f69
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x529f54
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x529d62
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x529d7c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.0051d320
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x529e91
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.00479dc0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f4978]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044eda0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403ce0
xorps xmm15, xmm15
mov r14, qword [0x00748488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x529e5b
xor eax, eax
lea rbx, [0x005a15da]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005a15f3]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044ee60
jmp 0x529e88
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005f49a0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044eda0
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.00479dc0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403ce0
xorps xmm15, xmm15
mov r14, qword [0x00748488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x529f1e
xor eax, eax
lea rbx, [0x005a15da]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005a15f3]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044ee60
jmp 0x529f4b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f49a0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044eda0
add rsp, 0xa8
pop rbp
ret
lea rax, [0x005a1921]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00463140
mov rax, qword [rsp + 8]
jmp fcn.00529d20
Function at 0x52da20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52dc2b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x52db44
cmp rdx, 0x40
ja 0x52dc1d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x52dab4
mov rax, rdx
mov rcx, rsi
call fcn.00465dc0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x52db20
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0052de80
xorps xmm15, xmm15
mov r14, qword [0x00748488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x52dc15
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x52db47
mov r8, rcx
cmp r8, 0x40
jl 0x52dbc5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.0052de80
xorps xmm15, xmm15
mov r14, qword [0x00748488]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x52dc08
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x52dc04
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00465dc0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.00465480
mov rax, rdx
mov ecx, 0x40
call fcn.00465480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00463140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0052da20
Function at 0x554b40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x554c15
movdqa xmm0, xmmword [0x005f5fc0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x554b81
movdqa xmm0, xmmword [0x005f5fd0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x554c97
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x554c6b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005f5d60]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x005f5fe0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x140006f40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x200
mov rax, qword [0x1400550c8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov dword [rsp + 0x20], 0
lea rdx, [0x14004e879]
lea rcx, [rsp + 0x1d0]
call fcn.1400084a0
nop
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x140006ff9
lea rdx, [0x14004e87a]
mov rcx, qword [rsp + 0x218]
call fcn.1400084a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x1d0]
call fcn.140008350
mov rax, qword [rsp + 0x218]
jmp 0x14000718c
mov dword [rsp + 0xa0], 0x130
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32First]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140007066
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14004e87b]
mov rcx, qword [rsp + 0x218]
call fcn.1400084a0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x1d0]
call fcn.140008350
mov rax, qword [rsp + 0x218]
jmp 0x14000718c
mov edx, dword [rsp + 0xa8]
lea rcx, [rsp + 0x58]
call fcn.1400061e0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x1d0]
call fcn.140008320
nop
lea rcx, [rsp + 0x58]
call fcn.140008350
lea rdx, [0x14004eee4]
lea rcx, [rsp + 0x1d0]
call fcn.1400082f0
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
call fcn.1400061e0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x1d0]
call fcn.140008320
nop
lea rcx, [rsp + 0x78]
call fcn.140008350
lea rdx, [0x14004ef3c]
lea rcx, [rsp + 0x1d0]
call fcn.1400082f0
lea rdx, [rsp + 0xcc]
lea rcx, [rsp + 0x1d0]
call fcn.1400082f0
lea rdx, [0x14004ef54]
lea rcx, [rsp + 0x1d0]
call fcn.1400082f0
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140007066
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x218]
call fcn.140008380
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x1d0]
call fcn.140008350
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14001a9c0
add rsp, 0x200
pop rdi
ret
Function at 0x1400192d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400192fd
xor eax, eax
jmp 0x1400193fa
cmp qword [rcx + 0x68], 0
je 0x14001930e
call fcn.140019418
jmp 0x1400193fa
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140019325
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140019327
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001935c
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14001cb80
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400193f4
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140019397
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x1400193cf
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1400235a4
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140019413
cmp rbp, r15
ja 0x1400193a5
mov r8, rbx
test rbx, rbx
je 0x1400193f4
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.1400235a4
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x1400193f7

Function at 0x1400281c8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140027ff4
Function at 0x1409ae00e
Capabilities:
Authenticate hmac

Disassembly:
dec bl
mov qword [rsp + rax*2 - 0x1ff90], rdx
rol r10d, 1
inc qword [rsp + rax*2 - 0x1ff8f]
mov qword [rsp + rax*2 - 0x1ff88], rbp
xor dword [rsp + rax*4 - 0x3ff20], r10d
call fcn.1409ff5c7
ror al, 1
sub al, 0xa2
jmp 0x1409cb7fc
not byte [rsp + 1]
not al
sal dl, 0x23
add al, 0x91
ror rdx, 0xe7
xor bpl, al
sar qword [rsp + 2], 0x23
lea rax, [rsp + rax + 0x18]
mov dword [rax], r10d
mov ecx, dword [rsp + 0xb]
mov r10d, dword [rsi + rcx - 6]
jns 0x140a2c6f1
movsx r8d, cl
lea rsi, [rsi + rcx - 6]
xor r10d, ebp
movzx eax, word [rsp + rcx + 0x10]
rol r10d, 1
call fcn.1409fa7bf

Function at 0x1409b2534
Capabilities:
Encode data using base64

Disassembly:
or bl, r8b
not bl
call fcn.1409bbd43

Function at 0x1409bfc8a
Capabilities:
Encode data using base64

Disassembly:
or eax, 0xfb0ba585
mov qword [rsp + 8], rbp
xor dword [rsp + 8], r8d
lea r10, [rax + rax - 0x4f46ff4f]
lea r9, [rax*8 + 0x38b3ef9d]
mov rbp, qword [rsp + 8]
mov qword [rsp], rbx
or qword [rsp], 0xfffffffff33ef8a6
mov qword [rsp + 8], rcx
movsxd r8, r8d
adc r11, r8
call fcn.140a258a9

Function at 0x1409c0aba
Capabilities:
Authenticate hmac

Disassembly:
neg r10d
lea r9, [rcx + rcx*4 - 0x3172b7f7]
sar r9b, 6
lea r10d, [r10 + r9*4 - 0x134c7838]
not r10d
movsx eax, dx
ja 0x140a57b51
not qword [rsp + rdx + 0x12]
add r10d, 0xc083ae3d
mov rbx, qword [rsp + 0x10]
add rbx, 0xfffffffffff81d52
jmp rbx
Function at 0x1409d487b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc r9w
lea rsi, [rsi + rcx*8 - 0x1ec]
jl 0x140a406ad
xor edx, ebp
not edx
neg edx
call fcn.1409bd0d4
xor r9d, ebp
movzx eax, word [rsp + r10 - 0x74]
sub r9d, 0xe48b6d06
not ebx
dec ecx
ror r9d, 1
lea r9d, [r9 + rcx + 0x6d934e95]
dec ax
xor r9d, 0xdd309dac
mov qword [rsp + r10*8 - 0x3a0], rbp
xchg bl, r10b
xor dword [rsp + r10 - 0xe6], r9d
pop rbp
and rdx, rbx
jns 0x140a5dba7
xor r11, 0xffffffff85340b30
sar al, 0xa6
lea r11, [r11 + rsi*4 + 0x2fd195f2]
jae 0x140a2a422
xor bl, bpl
lea r10, [rcx*2 + 0x153c9837]
lea r8, [r10 + rcx*2 + 0x32803437]
jmp 0x1409db8de
mov eax, 0x3da7379d
xor r10d, ebp
xor r10d, 0xfe908189
shr byte [rsp + rcx*4 - 0xf1], 0x81
not r10d
ror r10d, 1
lea rdx, [rdx + rdx*4 + 0x1c99d22e]
xor dx, word [rsp + rcx - 0x34]
not r10d
mov qword [rsp + rcx - 0x35], rbp
xor dword [rsp + rcx*4 - 0xec], r10d
mov rbp, qword [rsp + rcx*4 - 0xec]
mov qword [rsp + rcx - 0x35], 0x6e9e3c3a
sar qword [rsp + rcx*2 - 0x72], 0x8e
movsxd r10, r10d
add r11, r10
movzx ebx, word [rsp + rcx - 0x31]
mov qword [rsp + rcx*2 - 0x7a], r11
ret 8
rol r11, 7
rol r10b, 0xc6
xor rbp, r11
mov qword [r9 + rsi*8 - 0x10001e], r11
neg qword [rsp + rsi - 0x1ffef]
lea r9, [rsi + r9 - 0x20010]
mov qword [rsp + rsi*2 - 0x40004], r10
pop rbx
pop r11
pop rcx
pop rdx
pop rdx
jg fcn.1409b5b64
rol r10w, 0x65
movsxd r11, r11d
neg dl
ror dx, 0x4f
pop rsi
add rdi, r11
movzx edx, byte [r8 + rax*2 - 0x2c1fae14]
jmp 0x140a45d68
movsx edx, byte [rsp + rcx*2 - 0x72]
mov r10d, dword [rsi + rcx*2 - 0x7a]
jle 0x140a0a601
add rdi, r10
push rsi
ror r11d, 0x79
and ecx, esi
mov r10, qword [r9 + rdx*2 + 0x48]
shr bl, 0x27
ror qword [rsp + rdx*2 + 0x56], cl
mov eax, 0xf13a479a
mov ax, word es:[r10 + rdx + 0x24]
adc dl, bh
mov r10d, 0x9cbba58b
lea r9, [r9 + rdx*4 + 0x1f6]
mov qword [rsp + rdx*2 + 0x118], r11
add dword [rsp + rdx + 0x85], r10d
mov word [r9 + rdx + 0x7c], ax
neg rdx
mov qword [rsp + rdx*4 - 0x1f0], rdi
ret 0x20
lea r8, [r8 + rax - 0x160fd709]
xor dl, bpl
pop rcx
neg dl
not r10
inc dl
push r10
rol dl, 1
neg sil
or rbx, rbx
ja 0x140a5dc21
sal r10d, 0xb2
movsxd r9, r9d
rol r10d, 0x41
call fcn.140a40068
mov r9d, 0x8e31bf3d
lea r8, [r9*4 + 0x6b055b8d]
mov rdx, qword [rdi]
mov cl, byte [rdi + 8]
add rdi, 2
ror r8b, 0xa7
push r9
shr rdx, cl
push r9
movsx ecx, r9b
mov qword [rcx + rdi - 0x3d], rdx
lea r10, [r8*8 + 0x510f1b2e]
jmp 0x14099d249
xor dl, 0xa7
push r10
movsx r11d, ax
add qword [rsp + rax*2 - 0x2c1fae13], r10
xor bpl, dl
mov ecx, 0xe4bd353e
add byte [rsp + rax*2 - 0x2c1fae0b], 0x12
lea rdx, [rsp + rdx + 0x10]
mov ebx, dword [rdx + rax*2 - 0x2c1fae14]
xchg qword [rsp + rax - 0x160fd709], rax
sbb r9, 4
shr r10, 0xd0
mov dword [r9], ebx
inc rcx
and cx, cx
pop rsi
pop rdx
jne fcn.1409b5b64
mov r9d, 0xb1b84a01
sub rsi, 4
mov edx, dword [rsi]
movzx r8d, r9b
jmp 0x1409c0225

Function at 0x1409d5cbc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbx*2 - 0x6d3ab850], rax
je 0x1409be010
not ecx
inc byte [rsp + rbx - 0x369d5c25]
not edx
call fcn.140a16eea
Function at 0x1409e5d5f
Capabilities:
Authenticate hmac

Disassembly:
sbb bx, r9w
xor edx, ebp
mov eax, ebx
rol edx, 1
lea edx, [rdx + r9*2 - 0x54c978df]
inc r9b
inc r8w
bswap edx
sar cl, 1
adc r9b, 0x81
neg edx
and r8d, ecx

Function at 0x1409e7ec2
Capabilities:
Authenticate hmac

Disassembly:
neg ebx
sub ebx, 0xd9175838
call fcn.1409d8c3c
mov rax, qword [r9]
movzx edx, word [r8]
mov esi, 0xb91abb4
xor dx, bp
jmp 0x1409e9093
movsx r10d, sil
neg dx
sal r10w, 0xc7
mov ebx, r10d
rol dx, 1
sub dx, 0xea92
not dx
or rsi, rsi
movzx ecx, r10w
xchg si, bx
xor bp, dx
add rdx, rsp
mov qword [rsi + rdx - 0xb91da00], rax
dec r10w
rol rbx, 0xb6
mov rbx, qword [rsi + r9 - 0xb91d9f8]
shr sil, 0x41
add r10b, r10b
rol cx, 0xc2
lea r9, [r9 + rsi*2 - 0x1723b3f0]
lea r11, [rsi + rcx*4 - 0x7d45484e]
sbb cx, si
movzx esi, byte [r8 + rsi*8 - 0x5c8ecffe]
mov edx, r11d
sar r11, 0xc
xor sil, bpl
not rdx
inc sil
neg sil
or dl, 0x30
ja 0x1409a2584

Function at 0x1409ee61d
Capabilities:
Manually build aes constants

Disassembly:
mov rbp, qword [rsp + 0x10]
movsxd rdx, edx
jp 0x140a3e6e8
mov eax, 0x55048d2f
call fcn.140a4ed01
movzx r8w, byte [rdi]
mov ecx, 0xb404d5ba
mov ebx, 0x5fb4ec23
mov r10b, byte [rdi + rbx - 0x5fb4ec21]
movzx eax, bl
ror ebx, cl
or r8b, r10b
movzx r10d, cx
rol dword [rbx + rcx*4 - 0x37], 1
jnp 0x140a64a0b
adc r11, rdx
mov qword [rsp + 8], r10
mov qword [rsp + 0x10], 0xffffffffda094b16
pop r8
pop r10
pop r9
jmp r11

Function at 0x1409f25a5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor dword [rsp + r10 - 0x2632c021], r11d
rol ebx, 0x36
xadd al, dh
pop rbp
jne 0x1409c1adb
jns fcn.1409b5b64
movsxd r11, r11d
add rdi, r11
shl ecx, cl
and dl, 0x22
mov r10, r9
and eax, eax
lea r9, [rax + r9 - 0x29dd044]
jp 0x140a0abbb
push rbp
movzx ebx, r10w
jp 0x1409ac1b9
xor ebx, ebp
call fcn.140a0c6b5
mov r11d, dword [r8]
add r8, 4
mov r10d, 0x263eec21
lea rsi, [r10 + r10*4 - 0x226f8377]
lea rax, [r10*2 - 0x49e007f2]
xor r11d, ebp
lea r11d, [r10 + r11 + 0x4bd45c82]
mov ecx, r10d
rol r11d, cl
lea r11d, [rsi + r11 + 0xfd462f7]
mov edx, r10d
bswap r11d
and r10, 0xffffffffa633c3bb
xor ecx, 0x42896a93
jne 0x1409df03e
sbb r10d, 0xe58daf8a
lea rdx, [rdx*8 + 0x3d3cca12]
push rbp
xor dword [rsp + rsi - 0x3f2ad081], r10d
pop rbp
inc sil
movsxd r10, r10d
add rdi, r10
xadd rdx, rcx
jmp rdi
mov qword [r9 + rax*8 - 0x14ee81e0], r10
jae 0x1409b8670
sal r11, cl
call fcn.1409be467