joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009c80
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
xor edx, edx
call fcn.180009630
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.180009970

Function at 0x180009ca0
Capabilities:
Hash data with crc32
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x180009cc0
dec r8
cmp r8, 0xffffffffffffffff
jne 0x180009cdb
mov eax, 0xffffffff
jmp 0x180009d01
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.1800041a0
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x180031960]
xor eax, dword [rdx + rcx*4]
not eax
xor edx, edx
mov ecx, eax
call fcn.180009630
test rax, rax
jne 0x180009d19
mov rcx, rbx
call fcn.180009270
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180009970
Function at 0x18000b355
Capabilities:
Check os version
Execute syscall

Disassembly:
xor al, 0x5a
mov r10, qword gs:[0x60]
cmp word [r10 + 0x118], 0xa
je 0x18000b3a7
cmp word [r10 + 0x118], 6
je 0x18000b378
jmp 0x18000b3ce
cmp word [r10 + 0x11c], 3
je 0x18000b3a9
cmp word [r10 + 0x11c], 2
je 0x18000b3ab
cmp word [r10 + 0x11c], 1
jne 0x18000b3ce
cmp word [r10 + 0x120], 0x1db1
je 0x18000b3ad
jmp 0x18000b3ce
inc eax
inc eax
inc eax
cmp qword [0x1800910d8], 0
jne 0x18000b3c3
cmp eax, 0xc390050f
pop r10
mov r10, rcx
jne 0x18000b3b8
syscall
nop
ret
pop r10
mov r10, rcx
jmp qword [0x1800910d8]
ret
Function at 0x18001c334
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001c364
xor eax, eax
jmp 0x18001c427
mov rbp, rbx
cmp word [rax], si
je 0x18001c389
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001c370
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001c36c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001c284
movsxd r14, eax
test eax, eax
jne 0x18001c3c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001c35d
mov rcx, r14
call fcn.18001a028
mov rdi, rax
test rax, rax
jne 0x18001c3e0
xor ecx, ecx
call fcn.180019fec
jmp 0x18001c3bc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001c284
test eax, eax
jne 0x18001c411
mov rcx, rdi
call fcn.180019fec
jmp 0x18001c41b
xor ecx, ecx
call fcn.180019fec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180020a80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180020aa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180020aa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18000102c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
cmp byte [rax + 0x1d214], 0xe8
jne 0x180001133
cmp byte [rax + 0x1d215], 0xab
jne 0x180001133
mov dword [rbp - 0x18], 0x4b4d5669
mov dword [rbp - 0x14], 0x6f535e4a
mov dword [rbp - 0x10], 0x5a4b504d
mov word [rbp - 0xc], 0x4b5c
mov byte [rbp - 0xa], 0
lea rax, [rbp - 0x18]
mov ecx, 0xe
xor byte [rax], 0x3f
inc rax
dec rcx
jne 0x180001099
mov byte [rbp - 0x20], cl
mov dword [rbp - 0x28], 0x716d7a74
mov dword [rbp - 0x24], 0xd0c737a
mov ecx, 8
lea rax, [rbp - 0x28]
xor byte [rax], 0x3f
inc rax
dec rcx
jne 0x1800010be
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x10
lea r9, [rbp - 0x30]
lea r8d, [rdx + 0x30]
lea rcx, [rbx + 0x1d210]
mov rdi, rax
call rdi
test eax, eax
je 0x180001133
mov word [rbx + 0x1d210], 0xb848
lea rax, section..text
lea r9, [rbp - 0x30]
mov qword [rbx + 0x1d212], rax
mov word [rbx + 0x1d21a], 0xe0ff
mov r8d, dword [rbp - 0x30]
lea rcx, [rbx + 0x1d210]
mov edx, 0x10
call rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001190
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1800018b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1800011aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1800011a6
repz ret
ror rcx, 0x10
jmp 0x180001810
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001ab40]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18001ac38]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180001895
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001ab40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800018b7
mov rax, qword [rsp + 0x88]
mov qword [0x18001ac38], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001abd8], rax
mov rax, qword [0x18001ac38]
mov qword [0x18001aab0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001abc0], rax
mov dword [0x18001aaa0], 0xc0000409
mov dword [0x18001aaa4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180019008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001ab38], eax
mov ecx, 1
call fcn.180003964
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800162d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001ab38], 0
jne 0x18000193e
mov ecx, 1
call fcn.180003964
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180004c68
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800020b8
xor ebx, ebx
cmp qword [0x18001b9f0], rbx
mov rdi, rax
jne 0x180004d7b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180004e52
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004e52
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18001b9f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18001b9f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18001ba00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18001ba10], rax
test rax, rax
je 0x180004d72
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18001ba08], rax
jmp 0x180004d82
mov rax, qword [0x18001ba08]
jmp 0x180004d89
mov rax, qword [0x18001ba08]
mov r11, qword [0x18001ba10]
cmp rax, rdi
je 0x180004df0
cmp r11, rdi
je 0x180004df0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18001ba10]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180004df0
test rax, rax
je 0x180004df0
call rsi
test rax, rax
je 0x180004dea
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180004dea
test byte [rsp + 0x40], 1
jne 0x180004df0
bts ebp, 0x15
jmp 0x180004e30
mov rcx, qword [0x18001b9f8]
cmp rcx, rdi
je 0x180004e30
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180004e30
call rax
mov rbx, rax
test rax, rax
je 0x180004e30
mov rcx, qword [0x18001ba00]
cmp rcx, rdi
je 0x180004e30
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180004e30
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18001b9f0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180004e52
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180004e54
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001190
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18000624e
Capabilities:
Encode data using base64

Disassembly:
push rbx
jp 0x1800081d6
mov bl, bl
jnp 0x1800081d6
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi

Function at 0x180006a3e
Capabilities:
Encode data using base64

Disassembly:
push rax
je 0x180012d21
mov rax, rax
jne 0x180012d21
mov rax, qword [rsp + 8]
Function at 0x180007ee1
Capabilities:
Encode data using base64

Disassembly:
push r11
jo 0x180008e6b
mov rsp, rsp
jno 0x180008e6b
push rcx
lea rcx, [0x18001a4d3]
jmp fcn.18000c703
mov r11, qword [rsp + 8]
ja 0x1800134ed
mov bp, bp
jbe 0x1800134ed
mov ecx, dword [rcx + rdi*4]
test r15, 0
call fcn.18001125a
sbb dword [rdi - 0x44], esp
fdivp st(7)
dec dword [rax - 0x75]
and al, 8
pushfq
jb 0x18000ceb9
mov rbx, rbx
jae 0x18000ceb9
movsxd r11, dword [r11]
js 0x18000b05b
mov r14, r14
jns 0x18000b05b

Function at 0x18000852c
Capabilities:
Encode data using base64

Disassembly:
push rbp
jp 0x1800123a2
mov ch, ch
jnp 0x1800123a2
Function at 0x1800093a6
Capabilities:
Encode data using base64

Disassembly:
push rbx
ja 0x18000e3a6
xchg rdi, rdi
jbe 0x18000e3a6
mov rbx, qword [rsp + 8]
jb 0x180008187
xchg r11, r11
jae 0x180008187
push rcx

Function at 0x180009e62
Capabilities:
Encode data using base64

Disassembly:
add eax, ebp
invalid
ret
push rdi
js 0x18000f5af
xchg dl, dl
jns 0x18000f5af
popfq
ja 0x180011845
nop
jbe 0x180011845
lea rcx, [rdi + 0x58]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
test r15, 0
jb 0x18000d331
call fcn.18000624e
adc eax, 0xff19ac74
invalid
pushfq
jmp 0x1800149f8
pushfq
jg 0x18000c9b5
mov rbx, rbx
jle 0x18000c9b5
pop r13
jmp 0x1800080fa
invalid
sub rsi, 0x330aa3d3
jp 0x180014684
xchg rbp, rbp
jnp 0x180014684
jo 0x1800074e5
cmp al, 0xf3
je 0x18000d775
je 0x18000e982
test ebx, 0
call fcn.18000f6cd
in eax, dx
add dword [rdi + rdx*8 - 0x8990001], esp
mov byte [rax], 0
jb 0x1800151bb
and dword [rbx + 8], 0
call fcn.18001360e
sub eax, 0xff14f025
jmp qword [rbp + 0x48]
invalid
mov rax, rbx
test ebx, 0
jne 0x18000e518
add rsp, 0x20
pop rbx
call int.180008f8b
ja 0x18000d7e7
invalid
mov eax, 0xf0d02a90
call fcn.18001421c
stosb byte [rdi], al
shr edx, 0xc7
invalid
fistp word [rdx]
add byte [rax], al
call fcn.18000a24d
add qword [r9 + 0x49ffff2c], rdx
mul eax
call fcn.18001524c
leave
cmp ebx, dword ss:[rsi]
invalid
mov rdi, qword [rsp + 8]
jo 0x1800115f2
mov ch, ch
jno 0x1800115f2
test rax, rax
call fcn.18000f242
lea esi, [rdx - 0x3924]
jne 0x180013199
jne 0x18000c7c8
movsxd rax, dword [rsi + 0x10]
call fcn.180014fcc
movsxd rdi, dword [rdi]
jb 0x18000a320
mov sp, sp
jae 0x18000a320
mov r12d, edx
mov rcx, rsi
call fcn.180011999
jae 0x180011647
mov dl, 0xc2
invalid
sub eax, 0x294cffff
jl 0x180011673
adc byte [rdi], cl
invalid
test byte [rsi], ah
xchg edi, eax
invalid
pop r10
jb 0x180013315
mov cx, cx
jae 0x180013315
mov edx, eax
call fcn.18000f2aa
or byte [rdx - 0xfd39], dh
movsxd rsi, dword [rsi]
jp 0x18000c25f
xchg dh, dh
jnp 0x18000c25f
ret
xor rdi, 0xe2f0304
jl 0x180010ea3
mov cx, cx
jge 0x180010ea3
test rsi, rsi
je 0x180013f35
call fcn.18000c75f
jne 0x180014a74
sub eax, ecx
invalid
invalid

Function at 0x18000a1df
Capabilities:
Encode data using base64

Disassembly:
push r11
jl 0x18000efc6
xchg r15, r15
jge 0x18000efc6
add qword [rsp + 0x10], r11
jg 0x18000f038
mov rsp, rsp
jle 0x18000f038
add r14, 0x3e7fc603
jo 0x18000b10c
mov bp, bp
mov ah, cl
mov ebp, 0xfce8ffff
push rdx
add byte [rax], al
pushfq
jb 0x1800130b9
mov r15, r15
jae 0x1800130b9
pushfq
jb 0x18000cd92
xchg cx, cx
jae 0x18000cd92
jmp fcn.18000c703
movsxd r11, dword [r11]
jl 0x18000e81d
mov di, di
jge 0x18000e81d
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call fcn.180012c9a
test di, 0
js 0x18000e1f9
call fcn.180010af4
invalid
mov r11, qword [rsp + 8]
jl 0x18000eb42
mov di, di
jge 0x18000eb42
add r11, 0x3101a45d
jb 0x18000c104
mov r8, r8
jae 0x18000c104
mov rcx, qword [rbp + 0x10]
mov rdx, rsi
call fcn.180006b62
test r14, 0
call fcn.180013ee2
sti
add al, byte [0x11e0130db]

Function at 0x18000a24d
Capabilities:
Encode data using base64

Disassembly:
push r15
je 0x1800074a6
xchg bl, bl
jne 0x1800074a6
Function at 0x18000aaaa
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push rdi
js 0x180012057
mov ax, ax
jns 0x180012057
test esi, 0
jb 0x18000dfee
add rsp, 0x38
call fcn.18001524c
invalid
adc eax, 0xc5bc
lock dec dword [rsi + 0x90]
lea rcx, [rsi + 0x68]
call qword [0x18001a722]
test eax, 0
jb 0x180008c48
call fcn.18000e5e8
cmpxchg edx, ecx
invalid

Function at 0x18000acad
Capabilities:
Encode data using base64

Disassembly:
movsxd r12, dword [r12]
jb 0x1800096d9
xchg rbx, rbx
jae 0x1800096d9
jb 0x18000becf
and qword [rsi], 0
call fcn.1800073e0
invalid
push r12
jb 0x1800124a1
xchg r10, r10
jae 0x1800124a1
sub rsp, 0x28
call fcn.180013ee2
xchg edx, eax
and byte [0x11d00acbb], al
mov dword [rsp + 8], ebx
call fcn.180007479
invalid
mov r12, qword [rsp + 8]
jmp 0x18000aa82

Function at 0x18000b829
Capabilities:
Encode data using base64

Disassembly:
xor r15, 0x8a4e73
jp 0x180010f1e
mov bp, bp
jnp 0x180010f1e
movzx eax, byte [r9]
inc r9
test esi, 0
call fcn.18000d2e3
movsd dword [rdi], dword [rsi]
cmp al, 0xc2
sub edi, edi
inc ebx
ret
jne 0x18000c06a
call fcn.1800122f5
cmp eax, 0xff1a8d14
push rsi
invalid
movsxd r15, dword [r15]
js 0x180011184
mov r14, r14
jns 0x180011184
popfq
ja 0x18001181d
xchg r9, r9
jbe 0x18001181d
lea rcx, str._4
jmp fcn.18000c703
invalid
mov esi, eax
call fcn.1800073e0
movabs al, byte [0xc48348fffffacca4]
and al, ch
invalid
push r15
jp 0x180011ebf
mov bx, bx
jnp 0x180011ebf
mov r8d, 0xab9113d8
call fcn.1800101ad
call fcn.18000e253
cmpsb byte [rsi], byte [rdi]
cmpsb byte [rsi], byte [rdi]
cmp al, 0xd9
invalid
test edx, 0x820f0000
pmuludq mm7, mm7
invalid
sub qword [rsp + 0x10], r15
jmp 0x180009a18
pushfq
jg 0x180006f89
mov r9, r9
jle 0x180006f89
jb 0x18000abaf
xor al, 0x3f
call fcn.180011e5f
or dl, byte [rdx + rcx*8 - 1]
invalid
pop r15
jb 0x18001277f
xchg sp, sp
jae 0x18001277f
jne 0x18000ddc1
jne 0x18000b40c
call fcn.1800072a2
invalid
mov r15, qword [rsp + 8]
ja 0x1800076f4
xchg cl, cl
jbe 0x1800076f4
Function at 0x18000b89a
Capabilities:
Authenticate hmac

Disassembly:
popfq
jl 0x18000ca1e
xchg r15, r15
jge 0x18000ca1e
mov edx, 0x104
call qword [0x180019f6c]
call fcn.18000e76f
movabs dword [0xff33cffff367836], eax
test bh, ah
insd dword [rdi], dx
add byte [rax], al
je 0x18000ea90
mov al, byte [rcx - 5]
test r8, 0
jo 0x18000913a
call fcn.1800134ff
invalid
ret
and bh, 0x2c
add byte [rax], al
call fcn.18001266e
pop rsi
and byte [rdi], ah
jmp 0x180009148
invalid
pushfq
jmp 0x180011957
mov byte [rcx - 0x17000025], dh
adc dword [rcx - 0x7ae0000], ebx
invalid
mov rcx, qword [rsp + 8]
jl 0x18000ecf1
nop
jge 0x18000ecf1
mov rcx, r14
call fcn.18000a119
mov rcx, r15
call fcn.18000f002
mov rcx, r15
call fcn.18000a119
call fcn.18000cef1
ja 0x180009cf3
ror byte [rax], cl
invalid
mov dword [r9 + r8*2], eax
test rcx, 0
jb 0x18000f502
test r10d, r10d
jne 0x18000cbb5
call fcn.18000ddf4
invalid
push rcx
js 0x180009d36
xchg r8, r8
jns 0x180009d36
pop rcx
js 0x1800077f3
mov r8, r8
jns 0x1800077f3
test cx, 0
js 0x18000b655
call fcn.1800111e0
fnstsw word [rdi - 0xcb35]
test ax, 0
call fcn.1800093a6
invalid
mov ebx, esi
adc eax, 0x10020000
call fcn.180012cb3
rcr dword [rsi], cl
jne 0x18000eaac
invalid
movsxd rcx, dword [rcx]
ja 0x180009502
xchg cl, cl
jbe 0x180009502
and al, 0x40
lea rax, [rsp + 0x40]
call fcn.18001125a
adc dword [rbx + rdi*4], ebp
fdivp st(7)
jmp qword [rsi - 9]
sub rcx, 0x2d40b93d
jmp 0x1800150f8
sub qword [rsp + 0x10], rcx
jmp 0x180006960

Function at 0x18000c69f
Capabilities:
Encode data using base64

Disassembly:
mov r13, qword [rsp + 8]
jb 0x18000c4ac
nop
jae 0x18000c4ac
movsxd r13, dword [r13]
jmp fcn.180010a4b
push r13
jb 0x180008586
xchg rbp, rbp
jae 0x180008586
test esi, 0

Function at 0x18000c75f
Capabilities:
Encode data using base64

Disassembly:
mov rsi, qword [rsp + 8]
ja 0x180010e84
push rsi
jp 0x18000a697
xchg r14, r14
jnp 0x18000a697
test bh, 0
jb 0x1800118c7
and dword [rbx + 8], 0
mov dword [rbx], eax
test rdi, 0
call fcn.180010b9d
pop rax
mov bl, 0xa
xor edi, edi
inc dword [rcx + 0x5e]
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000cef1
Capabilities:
Encode data using base64

Disassembly:
push r14
jb 0x1800107c7
xchg si, si
jae 0x1800107c7
ret
mov r14, qword [rsp + 8]
jl 0x18000b48d
mov dl, dl
jge 0x18000b48d
call fcn.180007ee1
xchg byte [rsi + 0x6e], cl
cld
invalid
Function at 0x18000d0ce
Capabilities:
Encode data using base64

Disassembly:
call fcn.180009d22
mov rsi, rax
call fcn.1800134ff
and dword [rdi - 0xdb29], esp
and al, 0x20
int 0
add byte [rax], al
call fcn.1800101ad
call fcn.18000dd8c
lahf
and esi, dword [rbx + 0x51ffff09]
lea rcx, str._4
call fcn.18001431b
invalid
push r15
jl 0x18000f786
xchg r13, r13
jge 0x18000f786
js 0x18000c14b
add ecx, edi
call fcn.1800141a6
outsd dx, dword [rsi]
test byte [rax - 0x6200003f], al
test ebp, 0
mov r15, qword [rsp + 8]
jo 0x18000af80
mov rsp, rsp
jno 0x18000af80
cmp qword [rax + 0xe18], 0
jne 0x180009e4f
jne 0x180014ed8
call fcn.18000d0ce
fincstp
stc
invalid
add esp, 0x20
pop r12
call fcn.180011ad2
loopne 0x180014ef6
mov bh, 0x11
invalid
test esp, 0
jne 0x18000f43a
sub rsp, 0x30
mov r8d, dword [rcx]
mov rbx, rcx
test bx, 0
call fcn.18001431b
add ch, bh
adc eax, 0x14cffff
pop rsp
and al, 0x10
jb 0x18000c379
xchg rdi, rdi
jae 0x18000c379
mov rax, qword [rsp + 8]
jl 0x180007656
xchg bl, bl
jge 0x180007656

Function at 0x18000d45e
Capabilities:
Encode data using base64

Disassembly:
push rbp
jg 0x18000b8da
mov rdi, rdi
jle 0x18000b8da

Function at 0x18000e5e8
Capabilities:
Encode data using base64

Disassembly:
push rdx
jl 0x180010c27
mov bh, bh
jge 0x180010c27
Function at 0x18000f6cd
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword [rsp + 8]
jb 0x180011973
xchg rsi, rsi
jae 0x180011973
mov rbx, r9
call fcn.18000d2a2
invalid
push rcx
jmp 0x18000663d

Function at 0x18000f90c
Capabilities:
Encode data using base64

Disassembly:
test al, al
lodsb al, byte [rsi]
add byte [rax], al
call fcn.18000b89a
shr dword [rbx], cl
sub esp, 0x110
push rdx
jb 0x18000b97b
xchg r10, r10
jae 0x18000b97b
js 0x18000f8a8
call fcn.18000bb63
mov cl, byte [0x18000bf01]
mov rcx, r12
call fcn.180011484
test bl, 0
jb 0x18000a5dc
test eax, eax
call fcn.180012d2b
shr dword [rdi], 1
std
invalid

Function at 0x18000fcac
Capabilities:
Encode data using base64

Disassembly:
pushfq
jb 0x180010209
xchg dh, dh
jae 0x180010209
lea eax, [rdx + 4]
mov dword [rbx], eax
test esi, 0
jne 0x180011a8a
call fcn.18000e76f
jno 0x180006e59
js 0x180006e68
invalid
invalid
add byte [rbp + 0x25], dl
adc byte [rax], dh
invalid
pushfq
popfq
jp 0x180008f6a
mov r11, r11
jnp 0x180008f6a
mov r9, qword [rsp + 8]
jmp 0x1800144f7
sub qword [rsp + 0x10], r8
jo 0x18000ab94
mov bh, bh
jno 0x18000ab94
push r8
je 0x1800132cf
xchg cx, cx
jne 0x1800132cf
lea ebp, [rax + 1]
mov eax, 2
movsxd rbx, ebp
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.18000dd05
mov rsi, rax
call fcn.18000a1df
xor dil, sil
invalid
sub r8, 0x39d91084
jo 0x18000bf1d
mov r11, r11
jno 0x18000bf1d
mov r8, qword [rsp + 8]
jmp 0x1800136a5
movsxd r8, dword [r8]
je 0x180006e09
mov bx, bx
jne 0x180006e09
add rbp, 0x2089d18a
js 0x180007db4
mov rsp, rsp
jns 0x180007db4
mov rcx, rax
call fcn.18000c35e
mov r13, rax
jmp 0x1800136e8
test r8, 0
call fcn.180011c76
pop rax
jp 0x180013707
in eax, dx
invalid
retf
movsxd r9, dword [r9]
jl 0x180009dc2
nop
jge 0x180009dc2

Function at 0x1800101ad
Capabilities:
Encode data using base64

Disassembly:
call fcn.18000e76f
jae 0x18001020d
ja 0x1800101ec
invalid
lea edi, [rsi]
stc
invalid
adc cl, bl
cmp dword [rdi], ecx
add byte [rdi], 0xbd
invalid

Function at 0x1800106d7
Capabilities:
Encode data using base64

Disassembly:
movsxd r8, dword [r8]
jb 0x180007192
xchg r13, r13
jae 0x180007192
or r9d, 0xffffffff
mov rdx, rdi
push r8
jb 0x180012fa3
xchg r9, r9
jae 0x180012fa3
js 0x1800122a5
call fcn.1800067a6
cmp bh, ch
pop rsp
sub al, 0xff
inc dword [rcx + 0xf]
mov dh, 0xc0
mov edx, 8
test r15, 0
jb 0x180013910
call fcn.1800067a6
pop rsp
sub al, 0xff
call [rbp - 0x49587df1]
invalid
mov edi, ecx
call fcn.18000f242
ror byte [rbx], 0xdc
invalid
mov r8, qword [rsp + 8]
jmp 0x18000b8ab
mov byte [rbp + 0x45000015], bh
xor esi, esi
Function at 0x180010c16
Capabilities:
Encode data using base64

Disassembly:
pushfq
mov r8, qword [rsp + 8]
jp 0x180013e2f
xchg dx, dx
jnp 0x180013e2f
pop rcx
jb 0x18000c189
xchg al, al
jae 0x18000c189
mov edx, 0x3c600d6
mov ecx, 0x32f87a98
call fcn.18000be99
sbb dword [rdx - 0xec95], esp
call r10
mov dword [rdi + 0x60], eax
jmp 0x180011f59
ret
sub r8, 0x1083f8bc
jl 0x1800135a1
xchg al, al
jge 0x1800135a1
popfq
jp 0x18000c118
xchg cx, cx
jnp 0x18000c118
pop r14
js 0x180010585
mov dh, dh
jns 0x180010585
call qword [0x18001a71a]
jmp 0x1800118c3
test edi, 0x820f0000
invalid
ret
push r8
jb 0x180008dc3
mov dx, dx
jae 0x180008dc3
mov rdx, qword [rsp + 8]
ja 0x180012458
xchg cx, cx
jbe 0x180012458
ret
test dl, 0
jb 0x18000f826
add rsp, 0x70
call fcn.18001426c
sbb eax, 0xff2feab3
dec dword [rax - 0x7f]
jmp 0x180011898
invalid
call qword [rsi + 0x98]
test bx, 0
call fcn.180012cb3
jle 0x180011f35
je 0x180011f79
invalid
invalid
movsxd rdx, dword [rdx]
ja 0x180007810
mov r9, r9
jbe 0x180007810
pushfq
jmp 0x18000f181
movsxd r8, dword [r8]
ja 0x1800129a7
mov r13, r13
jbe 0x1800129a7

Function at 0x180010f0e
Capabilities:
Encode data using base64

Disassembly:
movsxd r8, dword [r8]
ja 0x180014c51
xchg sp, sp
jbe 0x180014c51
mov rsi, rcx
call qword [0x18001a71a]
movzx r12d, word [rsp + 0x8a]
call fcn.180013e9d
ja 0x18000608d
int 0xc7
invalid
xor r8, 0x2d307a1f
jb 0x18000c4d8
xchg cx, cx
jae 0x18000c4d8
lea rcx, [rbp - 0x50]
mov edx, edi
call fcn.180014611
call fcn.1800082c4
cmp dword [rbp - 0x1388], esp
jne 0x18000a563
call fcn.18001201f
or dl, byte [rdi]
push rdx
invalid
mov esp, ebx
sub qword [rsp + 0x10], r8
jl 0x180014295
mov r10, r10
jge 0x180014295
ret
push r8
jl 0x180014e30
xchg bl, bl
jge 0x180014e30
popfq
ja 0x18001523b
mov bx, bx
jbe 0x18001523b
mov rcx, rbx
mov dword [rbp - 0x31], r11d
call fcn.18000acad
xlatb
or esp, dword [rsi - 0x9000027]
invalid
pushfq
ja 0x180006b02
xchg rsp, rsp
jbe 0x180006b02
push rdi
call fcn.18000a15f
lea eax, [rbx + rdx*8 + 0x41ffffcc]
push rdi
test ecx, 0
call fcn.18000aaaa
xchg ebx, eax
cmpsd dword [rsi], dword [rdi]
call qword [0x102114c81]
jno 0x180014c7e
invalid
invalid
mov r8, qword [rsp + 8]
jb 0x1800060ab
xchg rsi, rsi
jae 0x1800060ab
pushfq
js 0x1800117f8
mov rax, rax
jns 0x1800117f8
pop r8
jo 0x18000f33c
mov bp, bp
jno 0x18000f33c

Function at 0x1800116a0
Capabilities:
Encode data using base64

Disassembly:
mov r12, qword [rsp + 8]
jb 0x1800133c2
xchg bl, bl
jae 0x1800133c2
movzx eax, word [r15 + rdi*2]
mov edx, dword [r14 + rax*4]
call fcn.18000914a
lodsb al, byte [rsi]
mov byte [rcx + 0xc], dl
invalid
push r12
js 0x18000c1d2
xchg bp, bp
jns 0x18000c1d2
test rdi, 0
call fcn.1800093a6
retf