joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029b060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov r11, qword [rcx]
mov rsi, rdx
mov r10, qword [rcx + 8]
mov rbx, rcx
mov r9, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov rax, qword [rcx + 0x20]
shl r11, 0x38
cmp dword [rcx + 0x30], 0
je 0x14029b29f
test r8, r8
je 0x14029b29f
mov r14d, dword [rcx + 0x2c]
cmp r8, r14
jne 0x14029b29f
mov ecx, dword [rcx + 0x28]
dec ecx
cmp ecx, 6
ja case.default.0x14029b0cd
lea r8, [0x140000000]
mov edx, dword [r8 + rcx*4 + 0x29b2b8]
add rdx, r8
jmp rdx
movzx ecx, byte [rbx + 0x3e]
shl rcx, 0x30
or r11, rcx
movzx ecx, byte [rbx + 0x3d]
shl rcx, 0x28
or r11, rcx
movzx ecx, byte [rbx + 0x3c]
shl rcx, 0x20
or r11, rcx
movzx ecx, byte [rbx + 0x3b]
shl rcx, 0x18
or r11, rcx
movzx ecx, byte [rbx + 0x3a]
shl rcx, 0x10
or r11, rcx
movzx ecx, byte [rbx + 0x39]
shl rcx, 8
or r11, rcx
movzx ecx, byte [rbx + 0x38]
or r11, rcx
xor rax, r11
cmp dword [rbx + 0x30], 0
jbe 0x14029b166
mov ecx, dword [rbx + 0x30]
nop dword [rax]
nop dword [rax + rax]
add r10, r9
add rdi, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, rdi
rol r10, 0x20
add rdi, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, rdi
xor rax, r10
rol rdi, 0x20
sub rcx, 1
jne 0x14029b130
xor r10, r11
mov ecx, 0xff
cmp r14d, 0x10
mov r8d, 0xee
cmovne r8d, ecx
mov ecx, dword [rbx + 0x34]
xor r8, rdi
test ecx, ecx
je 0x14029b1c6
nop word [rax + rax]
add r10, r9
add r8, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r8
rol r10, 0x20
add r8, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r8
xor rax, r10
rol r8, 0x20
sub rcx, 1
jne 0x14029b190
mov rdx, rax
xor rdx, r8
xor rdx, r9
xor rdx, r10
mov ecx, edx
mov byte [rsi], dl
shr ecx, 8
mov byte [rsi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rsi + 2], cl
mov ecx, edx
shr ecx, 0x18
shr rdx, 0x20
mov byte [rsi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [rsi + 5], cl
mov ecx, edx
mov byte [rsi + 4], dl
shr ecx, 0x10
shr edx, 0x18
mov byte [rsi + 6], cl
mov byte [rsi + 7], dl
cmp dword [rbx + 0x2c], 8
je 0x14029b298
mov ecx, dword [rbx + 0x34]
xor r9, 0xdd
test ecx, ecx
je 0x14029b257
add r10, r9
add r8, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r8
rol r10, 0x20
add r8, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r8
xor rax, r10
rol r8, 0x20
sub rcx, 1
jne 0x14029b221
xor rax, r8
xor rax, r9
xor rax, r10
mov ecx, eax
mov byte [rsi + 8], al
shr ecx, 8
mov byte [rsi + 9], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xa], cl
mov ecx, eax
shr ecx, 0x18
shr rax, 0x20
mov byte [rsi + 0xb], cl
mov ecx, eax
shr ecx, 8
mov byte [rsi + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xc], al
shr eax, 0x18
mov byte [rsi + 0xf], al
mov byte [rsi + 0xe], cl
mov eax, 1
jmp 0x14029b2a1
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x1402a7150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1402ae840
sub rsp, rax
mov r14, qword [rsp + 0xa8]
lea r10, [rax - 0x51]
mov rbp, qword [rsp + 0xb0]
xor r11d, r11d
cmp r14, 1
mov eax, r11d
mov r13, r9
mov r12, r8
mov r9, qword [rcx]
setne al
add rax, rbp
mov rsi, rcx
cmp rax, r9
jbe 0x1402a71ae
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
cmp r14, 1
je 0x1402a72b3
lea r10, [r8 - 1]
add r10, r9
movzx ebx, byte [r10]
cmp dword [rsp + 0xb8], r11d
je 0x1402a71eb
sub r9, rbx
mov eax, 1
sub r9, rbp
dec r9
mov qword [rcx], r9
jmp 0x1402a72ea
lea rcx, [rbx + rax]
mov qword [rsp + 0x98], r15
mov r15d, 0x100
mov r8, r9
sub r8, rcx
mov rax, r9
xor r8, rcx
xor rax, rcx
or r8, rax
xor r8, r9
shr r8, 0x3f
dec r8
cmp r9, r15
cmovb r15, r9
test r15, r15
je 0x1402a728d
mov qword [rsp + 0x90], rdi
mov rdi, rbx
shr rdi, 0x3f
nop dword [rax]
nop dword [rax + rax]
mov rax, r11
lea r10, [r10 - 1]
shr rax, 0x3f
mov rcx, rbx
sub rcx, r11
inc r11
shr rcx, 0x3f
xor cl, al
xor al, dil
or cl, al
xor cl, dil
dec cl
movzx edx, cl
movzx ecx, byte [r10 + 1]
xor rcx, rbx
and rdx, rcx
not rdx
and r8, rdx
cmp r11, r15
jb 0x1402a7240
mov rdx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
lea rax, [rbx + 1]
not r8
movzx r10d, r8b
dec r10
shr r10, 0x3f
neg r10
and rax, r10
sub r9, rax
mov qword [rsi], r9
mov rax, qword [rsp + 0xc0]
mov r9, r13
mov qword [rsp + 0x40], rax
mov r8, r12
mov rax, qword [rsp + 0xa0]
mov rcx, rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1402a6d80
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1402a7830
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.1402ae840
sub rsp, rax
mov rax, qword [0x1403ffe78]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x1402a7974
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor r8d, r8d
psrldq xmm0, 8
xor edx, edx
movd eax, xmm0
mov rcx, r15
mov dword [rsp + 0x30], edi
and al, 0x7f
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.1401a0320
test eax, eax
je 0x1402a7974
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.1401a1070
test eax, eax
je 0x1402a7974
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.1402a7e90
test eax, eax
je 0x1402a7974
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x1402a7949
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x1402a7949
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x1402a7930
jmp 0x1402a795d
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x1402a7990
mov rdx, rdi
mov rcx, rbp
call fcn.140004400
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402adb70
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x1402a7976

Function at 0x1402b96a0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1402b9180
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402b96df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140320638]
jmp 0x1402b96e9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1402f2180
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x1402f84d0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1402f84fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1402d6210
mov eax, 0xffffffff
jmp 0x1402f84fe
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004e00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004e4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004e4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004e4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004e4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140004e4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004e4c
xor al, al
add rsp, 0x28
ret

Function at 0x1400050f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000512a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000512f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140005178
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400064f0]
cmp byte [rcx + rax], 0
je 0x140005178
dec r8
sub rdx, 1
jne 0x14000515e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180001b20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rbx, r9
mov esi, r8d
mov r13, rdx
mov r14, rcx
test r8b, 0xf
jne 0x180001c79
mov ecx, esi
call fcn.18025a170
mov r12, rax
mov ecx, dword [r14 + 4]
inc ecx
shl ecx, 4
call fcn.18025a170
mov rbp, rax
mov r8, rax
mov rdx, rbx
mov rcx, r14
call fcn.180001cc0
mov rcx, qword [rsp + 0xd0]
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x20], xmm0
xor r15d, r15d
test esi, esi
je 0x180001c4d
nop dword [rax]
lea rbx, [r15 + r12]
lea rdi, [r15 + r13]
mov r9, rbp
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.180001710
movzx eax, byte [rsp + 0x20]
xor byte [rbx], al
movzx eax, byte [rsp + 0x21]
xor byte [rbx + 1], al
movzx eax, byte [rsp + 0x22]
xor byte [rbx + 2], al
movzx eax, byte [rsp + 0x23]
xor byte [rbx + 3], al
movzx eax, byte [rsp + 0x24]
xor byte [rbx + 4], al
movzx eax, byte [rsp + 0x25]
xor byte [rbx + 5], al
movzx eax, byte [rsp + 0x26]
xor byte [rbx + 6], al
movzx eax, byte [rsp + 0x27]
xor byte [rbx + 7], al
movzx eax, byte [rsp + 0x28]
xor byte [rbx + 8], al
movzx eax, byte [rsp + 0x29]
xor byte [rbx + 9], al
movzx eax, byte [rsp + 0x2a]
xor byte [rbx + 0xa], al
movzx eax, byte [rsp + 0x2b]
xor byte [rbx + 0xb], al
movzx eax, byte [rsp + 0x2c]
xor byte [rbx + 0xc], al
movzx eax, byte [rsp + 0x2d]
xor byte [rbx + 0xd], al
movzx eax, byte [rsp + 0x2e]
xor byte [rbx + 0xe], al
movzx eax, byte [rsp + 0x2f]
xor byte [rbx + 0xf], al
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x20], xmm0
add r15d, 0x10
cmp r15d, esi
jb 0x180001ba0
mov rcx, rbp
call fcn.18025a168
mov rax, r12
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, 0x10
lea rcx, [rsp + 0x38]
call fcn.180001ed0
nop
mov r8, rax
lea rdx, str.Plaintext_length_must_be_divisible_by
lea rcx, [rsp + 0x58]
call fcn.180001140
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800015a0
lea rdx, [0x18025d020]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400019d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a1c
xor al, al
add rsp, 0x28
ret
Function at 0x140122558
Capabilities:
Authenticate hmac

Disassembly:
or rbp, rsi
shr ax, cl
mov qword [rsp + rdx - 0x788eb170], 0xffffffff9610868a
not rbp
ja 0x14014fabc
mov ebp, dword [rax + r9 - 0x5a7c9401]
call fcn.140131647
mov r10d, 0xad3e6694
mov rcx, qword [rbx + 8]
sal r10w, 0x27
movzx esi, r10b
lea rbp, [r10*4 - 0x6155f8cc]
or rdx, rcx
lea rdi, [r10 - 0x1edaa847]
add r10w, si
movsx eax, si
not rdx
adc edi, 0x2f076e80
push r10
movzx ecx, si
adc rcx, rdx
not r10d
pop rax
mov edx, ebp
or rsi, qword [r10 + rbx - 0x52c1b5ef]
xadd bpl, r10b
jne 0x140137573
mov sil, byte [rbx + rsi*4 - 0x1c42c]
xchg dil, al
lea rbx, [rbx + rcx - 0x5ffa]
sub dword [rsp + rcx - 0x6009], eax
xor dword [rsp + rdi*4 - 0x4e7f515], 0xa9bf3535
movsx ebp, word [rsp + rcx*4 - 0x1802d]
mov byte [rdx + rcx*2 - 0xc018], sil
mov qword [rsp + rcx*8 - 0x30060], r8
ret
ror eax, 0x1f
or rcx, rsi
not rcx
shl edx, 0x8f
xor dl, bpl
mov qword [rax + rbx - 0x5a7c93f1], rcx
add dx, bp
ror ebp, 0x61
movzx ecx, dx
lea rbx, [r10 + rbx - 0x52c1b524]
sbb rcx, rdi
jbe 0x1401264eb
adc rcx, rax
xor dword [rsp + rsi - 0x7108], ebp
pop r11
xadd al, cl
sar r10d, 0x11
adc sil, 6
movsxd rbp, ebp
movzx edi, si
dec rcx
adc r8, rbp
sub ecx, 0x9c358d0e
neg rcx
push rax
mov rdx, qword [rbx + rsi*4 - 0x1c434]
or rdi, 0x139bcb8
and rcx, rsi
jno 0x140135305
mov edi, 0xab2b031d
jmp 0x140115fe4
call fcn.1401264b4
mov rdi, qword [rbx]
mov ebp, 0x632d5027
movzx edx, bp
mov rcx, qword [rbp + rbx - 0x632d501f]
or ebp, 0x5b9f1132
lea rbx, [rbx + rdx*2 - 0xa046]
mov eax, 0x3f91438a
movsx esi, bp
not rdi
not rcx
xor rdx, rbp
adc ebp, eax
sbb edx, 0xf0adae82
and rdi, rcx
lea rcx, [rax*2 - 0x28469fef]
mov qword [rbx + rax - 0x3f91438a], rdi
neg cl
setae al
mov r10d, dword [r9 + rax*2 - 0x7f228600]
adc eax, eax
rol sil, 0xc6
lea r9, [r9 + rax - 0x7f2285fd]
shl cl, 0x42
jnp 0x14012b00c
xor r10d, r11d
dec ecx
ror r10d, 1
shl rax, cl
xadd ecx, ebp
mov edi, 0xf4afc609
bswap r10d
inc r10d
ror r10d, 3
xor r10d, 0x77244cbe
or si, cx
sar bp, cl
push r11
xor dword [rsp + rbp - 0x56dbfffe], r10d
pop r11
movsxd r10, r10d
dec edx
call fcn.14014c08a
xadd eax, ecx
push r11
ja 0x140146723
mov rdx, qword [rbx]
jmp 0x140131c6f

Function at 0x140124776
Capabilities:
Encode data using base64

Disassembly:
sar dword [rsp + rax*2 - 0x16cf], cl
add word [rsp + rax*2 - 0x16ca], si
sbb dil, 0xa8
call fcn.1401283fd

Function at 0x140131c26
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
and rsp, 0xfffffffffffffff0
push 0x72366b5
lea rsp, [rsp + 8]
add rsp, rcx
test ebx, ebx
je 0x140149efe
Function at 0x14013bf9a
Capabilities:
Manually build aes constants

Disassembly:
xor esi, r11d
not esi
sub cl, 0xa9
dec esi
not rdx
neg esi
xor r10, rbp
call fcn.140153fbe
lea r9, [rsi + r9 - 0x8e]
mov qword [rsp + rsi*4 - 0x23c], rbp
inc word [rsp + rsi*4 - 0x237]
xor edi, ebp
xor cl, r11b
sub qword [rsp + rsi - 0x8f], 0x24af5a98
mov r10d, ebp
push r10
neg cl
or rdi, r10
ror cl, 1
lea rdx, [r10*2 - 0x1cf4027a]
pop rax
sub cl, 0x1b
xor byte [rsp + rsi - 0x8c], bpl
shr sil, 0x63
neg cl
xor r11b, cl
lea rcx, [rsp + rcx + 8]
sub si, word [rsp + rsi*4 - 0x3e]
mov r10w, word [rsi + rcx - 0x11]
lea rbx, [rbx + rsi*4 - 0x46]
mov word [rsi + rbx - 0x11], r10w
jl 0x14011e94f
inc dword [rsp + rsi - 0xe]
pop rdi
jne fcn.1401439d8
mov edx, 0xf9363c05
mov eax, dword [r9]
add r9, 4
push rdx
xchg qword [rsp], rdx
mov ebp, dword [rsp + 4]
xor eax, r11d
ror eax, 1
mov r10d, ebp
lea rcx, [rdx + 0x218e2c3b]
neg eax
jmp 0x14012afcb
mov si, word [r10 + rbp - 0x303e056a]
rol r10w, 0xca
setb byte [rsp + rdi*2 - 0xc28867e]
rol edi, 0x77
lea rbx, [rbx + rcx - 0x42]
lea rbp, [rcx*4 + 0x2815d882]
inc dword [rsp + r10*2 - 0x607d5026]
push rcx
mov word [rbx + r10 - 0x303ea815], si
mov esi, dword [r9 + r10*2 - 0x607d502a]
ror qword [rsp + rcx - 0x38], 0x2b
pop rdi
sets dil
lea r9, [r9 + r10 - 0x303ea811]
jae 0x14010f95a
xor rdx, 0x2b2dc312
dec rdx
mov qword [rsp], rdi
rol word [rsp + 2], cl
movsx esi, cx
bswap rdx
xor r11, rdx
sub rbx, 8
neg byte [rsp + 2]
shl qword [rsp], cl
jp 0x14011a9df
bswap eax
movzx edi, byte [rsp + rbp + 4]
not eax
not word [rsp + rbp + 5]
lea rsi, [rdx*4 - 0x66c1acfc]
neg eax
rol edi, 2
lea rsi, [r10 + rbp + 0x26006db1]
jae 0x140159d1e
lea r11, [rdx*8 + 0x3bbd4134]
sub r11w, ax
xor dword [rsp + rdx*2 - 0xcc00], ecx
sal r11w, 0x27
dec r11b
jne 0x140134206
inc ebp
shl dword [rsp + r10 - 0x1867], 0x3c
inc rdx
lea rcx, [rax + rax*8 + 0x3137b312]
not ebp
mov qword [rsp + rdx*4 - 0x8e06ea4], r11
call fcn.140158fe4
mov qword ss:[rcx + rdx - 0x3173], rdi
js 0x14014654e
xor r10d, 0xec800c1b
movsx ecx, dil
inc edi
neg r10d
call fcn.14011af40
pop r11
dec dl
sar sil, 0xa3
movzx r10d, bp
movsxd rcx, ecx
add bpl, bpl
and dx, si
adc r8, rcx
or bpl, 0x3c
movzx ecx, r10b
mov bx, word [rax + rbx - 0x6c00000]
and dl, 0x89
and sil, al
lea rdi, [rcx*4 + 0x421d97bf]
jae fcn.1401439d8
rol cl, 1
sub cl, 0x8f
ror edx, 0x5c
rol cl, 1
sal si, 0x68
neg cl
xchg qword [rsp + rsi + 0x5e09301f], rdi
push rsi
xor r11b, cl
lea rcx, [rsp + rcx + 0x30]
mov eax, dword [rsi + rcx + 0x5e093000]
shl rbp, 0x18
shl r10w, 0x45
mov dword [rdi + rbx - 0x8805], eax
movzx eax, byte [rsp + rsi + 0x5e093024]
or r10d, 0x44011213
pop rcx
lea rbx, [rbx + rsi + 0x5e092ffa]
shl r10, 0x2a
neg cx
pop rbp
pop rdx
pop rcx
pop r10
pop rdx
jbe fcn.1401439d8
ror bp, cl
dec cx
mov qword [rsp + r10*2 - 0x607c0ad4], rsi
xor r11w, bp
lea rbp, [rsp + rbp + 8]
rol dl, 0xa5
jb 0x140119e10
mov edx, 0xfba15f02
movzx ecx, dl
mov edi, dword [rcx + r9 - 2]
push rdx
call fcn.14010f835
ror ax, 0xa
jmp r8
Function at 0x140149ef3
Capabilities:
Encode data using base64

Disassembly:
jmp 0x14012254d
cmp ebx, 1
jmp 0x140141067
mov eax, 0xa1258fb0
lea rax, [rax*4 - 0x4c760dff]
shr rax, 0xb5
add rax, qword [rbp + rbx*8]
jmp 0x14011d849
push 0x78ab7ab0
cmp ebx, 3
call fcn.140146e8b
mov eax, 0xbb814d0f
mov rax, qword [rbp + rbx*8]
call fcn.1401581ed
jne 0x140151951
mov rcx, rax
jmp 0x140142c52
jmp 0x140159c66
mov rax, qword [rbp + riz]
call fcn.140111dec
mov ecx, dword [rbx]
mov esi, 0xd418742a
lea rdi, [rsi + rsi*8 - 0x115fc6f7]
sub rsi, rdi
mov r10d, dword [rbx + 4]
js 0x140123070
lea rsp, [rsp + 0x18]
jne 0x140131c47
mov eax, 0x4da0be0d
or rax, 0x3093f533
mov rax, qword [rbp + rax - 0x7db3ff3f]
sbb rsp, 0x20
push 0xffffffffe61cb30a
lea rsp, [rsp + 8]
call rax
mov rsp, qword [rbp + riz - 0x10]
mov edi, 0xea23b531
mov r8d, edi
mov rbp, qword [rbp + riz - 8]
mov ebx, 0x54957ea2
movsx r9d, di
call fcn.14015898e
lea rsp, [rsp + 8]
jmp 0x140159c66
push 0x5b077323
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0x1401319fc
mov rdx, rax
call 0x140149f45
dec ebx
jne 0x1401225d6
mov eax, 0xca38bf80
jmp 0x140147f84

Function at 0x140149f45
Capabilities:
Encode data using base64

Disassembly:
jmp 0x14012254d
cmp ebx, 1
jmp 0x140141067
mov eax, 0xa1258fb0
lea rax, [rax*4 - 0x4c760dff]
shr rax, 0xb5
add rax, qword [rbp + rbx*8]
jmp 0x14011d849
push 0x78ab7ab0
cmp ebx, 3
call fcn.140146e8b
mov eax, 0xbb814d0f
mov rax, qword [rbp + rbx*8]
call fcn.1401581ed
jne 0x140151951
mov rcx, rax
jmp 0x140142c52
jmp 0x140159c66
mov rax, qword [rbp + riz]
call fcn.140111dec
mov ecx, dword [rbx]
mov esi, 0xd418742a
lea rdi, [rsi + rsi*8 - 0x115fc6f7]
sub rsi, rdi
mov r10d, dword [rbx + 4]
js 0x140123070
lea rsp, [rsp + 0x18]
jne 0x140131c47
mov eax, 0x4da0be0d
or rax, 0x3093f533
mov rax, qword [rbp + rax - 0x7db3ff3f]
sbb rsp, 0x20
push 0xffffffffe61cb30a
lea rsp, [rsp + 8]
call rax
mov rsp, qword [rbp + riz - 0x10]
mov edi, 0xea23b531
mov r8d, edi
mov rbp, qword [rbp + riz - 8]
mov ebx, 0x54957ea2
movsx r9d, di
call fcn.14015898e
lea rsp, [rsp + 8]
jmp 0x140159c66
push 0x5b077323
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0x1401319fc
mov rdx, rax
call 0x140149f45
dec ebx
jne 0x1401225d6
mov eax, 0xca38bf80
jmp 0x140147f84
Function at 0x14014c2a6
Capabilities:
Manually build aes constants

Disassembly:
sub qword [rsp + r10 + 5], 0xffffffff939a008b
bswap ebp
movsx edx, byte [rsp + rcx - 0x4938cc0f]
mov eax, edi
rol ebp, 3
not rdi
pop r10
sal byte [rsp + rcx - 0x4938cc10], 0xe3
xor ebp, 0xbe084c30
not al
add edx, 0x47bd3cb0
lea ebp, [rcx + rbp - 0x7947941c]
dec byte [rsp + rdx - 0x47bd3cac]
lea r10, [rsi + rdi - 0x2263ade4]
or qword [rsp + r10 + 0x22639c0d], rcx
bswap ebp
not dword [rsp + rcx - 0x4938cc11]
neg rcx
neg ebp
dec word [rsp + rcx + 0x4938cc13]
setno al
xadd rdi, rax
not ebp
neg word [rsp + rdi*4 + 0xa8]
or dword [rsp + rdi + 0x2c], 0x35b8da36
mov qword [rsp + rcx + 0x4938cc13], r11
sal r10b, 0xe6
seta dl
xor dword [rsp + rcx + 0x4938cc13], ebp
shl al, 0xe1
call fcn.14012ba3c
mov qword [rsp + rdi - 0x368a], r11
xor dword [rsp + rdi - 0x368a], esi
mov r11, qword [rsp + rdi - 0x368a]
call fcn.1401419f3
cpuid
sbb rsi, 0xc
shl dil, 0xc1
mov dword [rsp + 3], 0xf7bc953b
mov dword [rsi + 0xc], eax
shr r10b, 1
mov dword [rsi + 8], ebx
sal r10b, 0x41
xor dword [rsp + 1], ebp
mov dword [rsi + 4], ecx
mov dword [rsi], edx
mov rbx, qword [rsp + 8]
neg edi
mov qword [rsp + rdi*2 - 0x3d8], rdi
mov rbx, rsi
pop rbp
pop rsi
jp fcn.1401439d8
mov edx, dword [r9]
mov r10d, 0x56aa0f1b
movzx eax, r10b
lea r9, [r9 + rax*2 - 0x32]
mov esi, 0x5129a29c
lea r10, [rax*2 + 0x67063917]
sal al, 0xe1
xor edx, r11d
xor edx, 0xa5190c1c
jmp 0x140155946
mov rdx, qword [rcx + rax - 0x4938cc13]
movsx esi, di
mov ebp, 0xa780cd02
mov qword [rbx + rcx - 0x4938cc1b], rdx
movzx r10d, bpl
xadd bpl, dil
adc di, 0xee27
mov ebp, dword [r9 + r10 - 1]
mov qword [rsp + rcx - 0x4938cc13], 0x5e81bf36
lea r9, [r9 + r10*8 - 0xb]
xor ebp, r11d
dec word [rsp + r10 - 2]
jle 0x14011ace7
movzx ecx, sil
rol edx, 2
mov ebp, esi
and rax, r10
sbb rcx, rcx
xor edx, 0xd9a9442c
xor ax, 0xd792
dec r10d
ror edx, 3
push r10
lea rdi, [rsi*2 - 0x18fe4652]
not edx
pop r10
push r11
xchg rsi, rax
xor dword [rsp + rax - 0x5129a29c], edx
shr r10, 0x7e
pop r11
add dil, bpl
and rcx, rcx
movsxd rdx, edx
adc r8, rdx
movzx edx, byte [r9 + r10*2]
and bp, ax
dec r10b
call fcn.14010c5e5
mov dword [rax + rbx - 8], ebp
push rax
add word [rsp + rdx - 0x400], 0x6039
mov qword [rsp + rdx*2 - 0x800], r8
ret
Function at 0x14014c2f0
Capabilities:
Manually build aes constants

Disassembly:
jmp 0x1401142de
dec ebx
jne 0x140142007
mov eax, 0x17900689
call fcn.14010d671
cmp ebx, 3
jne 0x14015a3fd
mov r8d, 0x78332204
lea r8, [r8 + r8*4 - 0x12f18ff2]
mov r8, rax
push 0xffffffffe7bbb9b4
push 0x428b0b2a
lea rsp, [rsp + 0x10]
jmp 0x140130d77
jmp 0x140110d63
mov eax, 0xfba49000
mov rax, qword [rbp + rbx*8]
call fcn.14010ba84
xor ecx, ecx
mov qword [rsp], 0xffffffffaa0da49a
test rbp, rbp
call fcn.14013339f
mov edi, 0xa73255a8
movzx ecx, byte [r9]
mov esi, 0xe524e4ac
xor cl, r11b
movzx r10d, di
lea rbp, [rsi*8 - 0x31ea46d3]
neg cl
ror cl, 1
sub cl, 0x1b
rol di, 0xc3
shl di, 0xe3
neg cl
movsx edx, r10b
xor r11b, cl
add rcx, rsp
mov ax, word [rcx + r10*2 - 0xab50]
xchg si, di
rol dil, 0x66
xor rbp, rbp
mov word [r10 + rbx - 0x55aa], ax
mov eax, dword [r9 + r10 - 0x55a7]
push rdx
lea r9, [r9 + r10*2 - 0xab4b]
shl bpl, 0x63
movzx ecx, word [rsp + r10*2 - 0xab4d]
pop r10
xor eax, r11d
xor r10w, 0x9b3d
not eax
sub dil, 0x3d
ror r10w, 0x47
sete dl
lea eax, [rax + rbp*4 + 0x593c9e82]
inc r10w
sub di, bp
xor eax, 0x941ba880
neg r10w
bswap eax
xchg si, r10w
adc cx, di
call fcn.14013bf44
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0x14010cf68
push 0x271eee8f
mov rdx, rax
lea rsp, [rsp + 8]
jmp 0x140130d77
mov eax, 0xb63396a0
mov rax, qword [rbp + rbx*8 + 0x20]
call fcn.140127314
push 0x178fdc1f
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x14015a1f7
mov r9, rax
jmp 0x140130d77

Function at 0x140150251
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rbp + riz]
sub rsp, 0x18
call fcn.1401150a7

Function at 0x14015390e
Capabilities:
Encode data using base64

Disassembly:
pop rax
bswap rax
push r12
call fcn.140152c38
push 0x1a1aff33
push 0xffffffffd0a54f25
mov qword [rsp + 8], rax
jmp 0x14013aa99