joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009fe46
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add byte [rsp + 0x48], 0x1e
jge 0x1400b1b2e
xchg qword [rsp + 0x68], rax
mov rcx, qword [rsp + r15*8 - 0x2fffe0]
shr r15d, 0xc7
not r15b
test word [rsp + r15 - 0xcb7], 0x1921
bswap r15d
mov r15, qword [rsp + 0x60]
jo 0x140098b90
neg r9
mov r9, qword [rsp + 0x18]
and byte [rsp + 0x48], 0xa5
jle 0x1400989b2

Function at 0x1400ad504
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
shl r11d, cl
call fcn.1400ae6a2
xor r11d, dword [rsp + 0x2a]
lea rsi, [rsi + 0x1db6f120]
cmp r14, qword [rsp + 0x18]
not r12b
setae r11b
call fcn.14009e148
jne 0x140094f47
movabs r9, 0x34817f34021db0be
movzx bx, r11b
add qword [rsp], 0x9ef
mov rax, r11
add r11d, 0xb39cecb6
jb 0x1400af21c
xor r11, 0xffffffffbb000420
push r11
call fcn.1400999b9

Function at 0x1400ad8c8
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
movabs rcx, 0x89111615a92985aa
pushfq
shr cl, cl
call fcn.1400af0a5
shr r9b, 2
movzx r14w, r14b
call fcn.1400ae702

Function at 0x1400ad8ea
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov r11, qword [rsp + 0x10]
mov dword [rsp + 0x20], 0xde0c509d
jge 0x14009d417

Function at 0x1400ad8fd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
neg r14d
cmp qword [rsp + r14*4 + 0x38], 0x781a030
mov rbp, qword [rsp + rsi*4 + 0x28]
mov rbp, qword [rbp + r14*2]
ja fcn.14009f898
or sil, 0x9f
and r14, rsi
call fcn.14009fdd8

Function at 0x1400ad92e
Capabilities:
Encrypt data using speck
Packed with generic packer

Disassembly:
lea rax, [rax + rdi*2 - 0x2ee9e67c]
test word [rsp + 0x18], r14w
push r9
call fcn.1400b13ea
Function at 0x1400ad943
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or rdx, 0xffffffffa40f4faa
jae 0x14009cbd3
mov qword [rsp + 0x20], r14
xchg qword [rsp + 0x58], rax
mov r14, qword [rsp + 0x10]
not r9d
test qword [rsp + r9*2 - 0x7ba42a2a], r9
ja 0x140097407
call fcn.140095cfd
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
ret 8
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], rdx
call fcn.1400b02dd
setge r9b
jl 0x1400999a2
call fcn.14009530a
pushfq
shr qword [rsp + 8], 0xe5
call fcn.140095576
push rdx
push r10
push r12
pushfq
movabs r10, 0x3fbef838f28b9917
shl r10d, 0x81
mov rdx, qword [rsp + 0x20]
not r10
movabs r12, 0x2ba98a3f5731852a
shr r10b, 0xe2
shr r10w, 0xb1
push r12
lea rdx, [rdx + 1]
sete r10b
shl r10w, 0x4b
push r11
mov qword [rsp + 0x30], rdx
js 0x1400ad88c
xor r10, qword [rsp + 8]
call fcn.1400b0221
lea rbx, [rbx*4 + 0x189b46a1]
jae 0x14009548e
mov r10, qword [rsp + r14 - 0x14]
mov r11, r14
ja 0x1400955e2
bswap rbx
jae 0x140095532
ja 0x140098bc7
bswap r15
mov r15, qword [rsp + 0x10]
call fcn.140096e14
mov qword [rsp + 0x10], 0x3d94cd1e
add qword [rsp + 0x10], 0x549687ba
cmp qword [rsp + 0x10], 0xffffffff8d3a6909
jo 0x1400aeecb
ja 0x1400958c6
xchg qword [rsp + 0x18], rdx
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
ret 8
setb byte [rsp + 0x28]
call fcn.14009d3dd

Function at 0x1400ada2f
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push r9
pushfq
movabs r9, 0x3719d31ff1847626
sub r9b, r9b
setbe r9b
xchg qword [rsp + 0x18], rsi
ja fcn.140097d32
not r9
push r8
push r13
seto r9b
mov r13, r9
neg r9
mov qword [rsp + 0x20], rsi
call fcn.14009631e

Function at 0x1400adadb
Capabilities:
Encrypt data using speck

Disassembly:
or r8, 0xffffffffbb9bdabf
push r10
add qword [rsp + rdx + 0x4e177c3], 0xffffffffffff82ac
call fcn.14009c9ac

Function at 0x1400adb00
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
movzx r14, byte [rsp + 0x48]
mov edi, 0xe6a26da1
mov r14w, word [rsp + r14*4 - 0x2b8]
mov rdi, qword [rsp + r14*2 - 0x8330]
call fcn.14009888c
jbe 0x140094d6e
mov rcx, qword [rsp + 0x30]
add qword [rsp + 0x68], 0xffffffffc80cabac
and r9b, byte [rsp + 0x6d]
add qword [rsp + 0x10], 0xffffffffbff69469
neg byte [rsp + 0x40]
shr r9d, 0xb0
mov r9, qword [rsp + r9*8 - 0x19568]
shr dword [rsp + 0x68], 0xb5
mov qword [rsp + 0x68], 0x620fca32
jb 0x140094d8a
test byte [rsp + 0x68], 0x85
call fcn.140096905

Function at 0x1400adc04
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
cmp edi, 0x9f2c7439
call fcn.1400ae689

Function at 0x1400adc39
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or dword [rsp + r8 - 0x5d0d9201], 0xeaba55bc
jge 0x1400aea62
add qword [rsp + r8 - 0x5d0d9239], 0x119f
mov qword [rsp + r13*2 - 0x1428be40], r8
ret 8
jns 0x140099990
setbe r13b
not r13
shl rcx, cl
test rcx, 0xffffffff9eafafbe
call fcn.1400ae457
Function at 0x1400ae166
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
mov rsi, qword [rsp + 0x20]
mov rsi, qword [rsi]
movabs rcx, 0x7c14f5bbfc9f21be
neg cl
not rcx
not rcx
not cx
neg ecx
lea rsi, [rsi + rcx + 0x42a919ca]
sub cx, 0x2604
or cx, 0x69a0
jle 0x1400af56c

Function at 0x1400ae19d
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
mov ebx, r12d
mov rbx, qword [rsp + 0x38]
js 0x14009b4fc
jb 0x1400ae07b
ja 0x1400adac1

Function at 0x1400ae339
Capabilities:
Encrypt data using speck

Disassembly:
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]

Function at 0x1400ae729
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
neg rbp
setne r15b
add qword [rsp + 8], 0xffffffffbff6ae0d
mov r15, qword [rsp + 0x60]
not dword [rsp + 0x40]
neg byte [rsp + 0x40]
call fcn.14009e51b
cmova r15w, bp
jb 0x1400ad969
neg r15b
jno 0x14009807b

Function at 0x1400ae797
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
call fcn.140096472
call 0x1400ae797
call fcn.140096406
mov qword [rsp], 0x4405b0f7
call fcn.1400c9c24

Function at 0x1400ae93e
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], rcx
sub cl, 0x39
shl rcx, cl
lea rdi, [rdi + 0x199c14a6]
call fcn.140094d14

Function at 0x1400aed7d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jns fcn.14009a776
add qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x20]
not qword [rsp + 0x30]
call fcn.1400967c4

Function at 0x1400aedef
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
mov r12, qword [rsp + r12*4 - 0x7cc]
shr qword [rsp + 0x48], 0xcc
setb byte [rsp + 0x48]
or qword [rsp + 0x48], r15
xor r15d, dword [rsp + 0x4c]
call fcn.14009e56a
call fcn.1400af362

Function at 0x1400aeed5
Capabilities:
Encrypt data using speck

Disassembly:
add r14w, 0xe6be
push r12
lea rax, [rax - 0x584a8af3]
mov r12, r14
push rbp
movabs rbp, 0xeeb14895d7a0800b
setne r14b
jbe 0x14009f848
xchg qword [rsp + 0x30], rax
mov rbp, qword [rsp]
jns 0x14009ba0e
not r12w
sub r12, r12
setb r12b
test qword [rsp + r12*8 + 0x18], 0xffffffffd227ba36
mov r14, qword [rsp + 0x20]
jle 0x1400b1633
lea r12, [r12 + r12*8 + 0x20a953a5]
cmovs r12d, dword [rsp + r12 - 0x20a9538c]
sub qword [rsp + r12 - 0x20a9538d], 0xffffffffe3bb548e
lea r12, [r12*2 - 0x67e8ddff]
and r12, 0x372f0434
cmp byte [rsp + r12*4 - 0x44a3ffe8], 0x3a
mov qword [rsp + r12*4 - 0x44a3ffe8], 0x720e1aa7
mov r12, qword [rsp + r12 - 0x1128fff8]
call fcn.14009f893
xchg ebp, eax
shl dword [rdx + 0x16c3c60c], cl
invalid

Function at 0x1400af011
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], 0x4405b0f7
lea rsp, [rsp + 8]
call fcn.1400c9c24
Function at 0x1400af041
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
mov r9w, 0xc72c
mov qword [rsp + 0x48], r14
or r13d, 0xe40fa004
xchg qword [rsp + 0x58], rcx
mov r9, qword [rsp + 0x20]
movzx r15w, byte [rsp + 0x4c]
cmp r14, r15
jl 0x14009f3bf
shr r15, 0xd7

Function at 0x1400af09f
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
je 0x14009a938
movabs rcx, 0x5fa68180e1b04826
neg byte [rsp + 0x10]
mov rcx, qword [rsp + r11 - 0xb99]
lea rcx, [rcx + rsi - 0x6dde0dfe]
add qword [rsp + r11*2 - 0x1712], 0x359f
sub r11w, 0x2ca9
test esi, esi
jns 0x14009f63a
jns 0x14009451c

Function at 0x1400af1eb
Capabilities:
Encrypt data using speck

Disassembly:
movabs rdx, 0x6b10271959970ba1
or dword [rsp + 0x10], edx
lea rdx, [rdx*4 - 0x6860815f]
lea rax, [rax - 0x584a8af3]
jg 0x1400947af

Function at 0x1400af20e
Capabilities:
Encrypt data using speck

Disassembly:
lea rbx, [rbx + r10 - 0x5e0a49c5]
je 0x140094d68

Function at 0x1400af22a
Capabilities:
Encrypt data using speck

Disassembly:
xchg qword [rsp + 0x20], rbp
movabs r12, 0x8b9f849a208425ae
not word [rsp + 0x18]
neg r12
shl r12d, 0x45
jne 0x14009b303
mov r8w, word [rsp + 0x25]
je fcn.140098a18
seto byte [rsp + r8 - 0x5d0cffe0]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + r8 - 0x5d0cffd0]
mov qword [rsp + r8 - 0x5d0cffe0], 0x7f2eb329
neg qword [rsp + r8 - 0x5d0cffc8]
neg byte [rsp + r13*2 - 0x1428be28]
not r13d
call fcn.14009b958

Function at 0x1400af38a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push rbx
pushfq
movabs rbx, 0xcf1dba929c3372a5
call fcn.1400955c1

Function at 0x1400af54d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x28]
sub r15b, byte [rsp + 5]
lea r15, [r15*2 + 0x743c5430]
add qword [rsp + 0x10], 0xffffffffbff68c31
call fcn.14009704b
mov word [rsp + r8*2 - 0x22], r10w
xor r12b, 0x9a
neg r8d
mov bx, word [rsp + r12 - 0x7f75]
movzx r12d, byte [rsp + 0x3c]
add qword [rsp + r12*2 - 0x1b6], 0xffffffffb331788c
mov r8, qword [rsp + 0x58]
shl word [rsp + r12*4 - 0x3b4], 0x55
jne 0x14009592d
jne 0x140095dce
call fcn.1400af20e
jbe 0x14009cab8
lea rdi, [rdx + rdi*4 + 0x4f258eb2]
lea rdi, [rdx*2 - 0x10553842]
add qword [rsp + rdi - 0x55410f86], 0xffffffffbff63054
xchg qword [rsp + rdx*2 - 0x65964790], rsi
mov rdi, qword [rsp + rdx - 0x32cb23d4]
add qword [rsp + rdx*2 - 0x65964798], 0xffffffffbff4e4b3
neg dx
not dx
mov rdx, qword [rsp + rdx*2 - 0x659647be]
and qword [rsp + 0x18], 0x131ff228
xor qword [rsp + 0x28], 0x1a826d0b
ja 0x140099c2e
xor r11d, 0x90a151ad
and r11b, r11b
call fcn.1400956e4
setns byte [rsp + r12*8 - 0x3f970]
xchg qword [rsp + r12*8 - 0x3f928], rax
mov r11, qword [rsp + 0x88]
jne 0x14009c6ea
sub rcx, 0xffffffffa394cb19
jl 0x14009c8c1
xchg qword [rsp + rcx - 0x5fcc3076], rsi
mov rcx, qword [rsp + rcx - 0x5fcc309e]
jl 0x14009a720
add qword [rsp + 0x10], 0xffffffffbff6b7bd
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret 8
Function at 0x1400af656
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
not rdx
lea rdx, [rdx*8 + 0x108677bc]
jo 0x1400b17db
mov rdx, qword [rsp + 0x40]
jne 0x140096291

Function at 0x1400af672
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push rax
push r15
movabs r15, 0x70882a3ac21cac8a
lea r15, [r15 + r15 - 0x13c6d466]
push rsi
mov rax, qword [rsp + 0x18]
pushfq

Function at 0x1400afd34
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
push rdx
push r15
movabs r15, 0xb43f62b974835f2f
mov r15w, 0x5896
pushfq
test r15d, 0x78b2bc35
call fcn.140098460

Function at 0x1400afd6c
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
mov r9, qword [rsp + 0x88]
mov r14, qword [rsp + 0x38]
shr r11d, 0xfd
xor r9b, 0xa1
call fcn.1400998cb

Function at 0x1400afeac
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + r8*4 + 0x542e0c80], rcx
mov r8, qword [rsp + r8 + 0x150b8334]
call fcn.14009dc4c

Function at 0x1400b008c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or qword [rsp + rbx - 0x69ff9be9], 0x211ebb1c
mov rbx, qword [rsp + rbx - 0x69ff9bc1]
mov rbx, qword [rbx]
jbe 0x14009e4b7
lea rbx, [rbx + 0x6ab65f2f]
add word [rsp + 0x18], 0x3f3e
and dword [rsp + 0x18], 0x489d0232
xor byte [rsp + 0x18], 0x1d
test byte [rsp + 0x18], 0x3c
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
ret 0x20

Function at 0x1400b0276
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
je 0x140094552
call fcn.140057f00

Function at 0x1400b03fc
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer

Disassembly:
push r8
jb fcn.14009c97e
jle 0x140094f4f

Function at 0x1400b120d
Capabilities:
Encrypt data using speck
Packed with generic packer

Disassembly:
sub r13, 0xffffffffdf3f5c3f
shr r13, 0x10
lea rax, [rax + 0x199c14a6]
mov qword [rsp + 0x20], r13
or dword [rsp + 0x20], r13d
movzx r13, r13w
shr r13, 0x11
add r13, qword [rsp + r13*4 + 0x20]
xchg qword [rsp + 0x28], rax
mov r13, qword [rsp + 8]
or dword [rsp + 0x20], 0xa9b9db37
not dword [rsp + 0x20]
jae 0x140094d6e

Function at 0x1400b131d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r13
mov rbx, qword [rsp + r14 - 0x6e6f802d]
mov rbx, qword [rbx]
xor r14w, 0x2987
movabs r13, 0xe0107489808e160d
mov qword [rsp + 8], rdi
or dil, 0x19
push rbp
mov rbp, qword [rsp + r14 - 0x6e6fa9a2]
push r14
lea rbx, [rbx + 0x73820c82]
push rcx
mov rcx, qword [rsp + 8]
xor r14, 0x35806f91
cmp r14w, 0x5097
bswap r14d
jne 0x14009578f
add qword [rsp], 0xffffffffffff8b75
mov rbx, rdi
and di, 0x25a9
jns 0x14009ba8f
Function at 0x1400b1669
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
bswap r11d
not byte [rsp + r11 - 0x410004bd]
neg word [rsp + r11 - 0x410004bd]
add r11w, 0x16b0
setg byte [rsp + r11 - 0x41001b85]
sete byte [rsp + r11 - 0x41001b85]
movzx r11, r11w
call fcn.14009b532
or word [rsp + 0x20], 0x6b81
mov r10, qword [rsp + 0x38]
not byte [rsp + 0x18]
call fcn.1400b040a
jb 0x1400963c9
movzx r11w, r11b
mov r8, qword [rsp + r8 - 0x5d0dead9]
jne 0x140096338

Function at 0x1400b1682
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
and ecx, 0xbea3ed86
mov qword [rsp + 0x10], rdx
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
and r13, qword [rsp + 0x10]
mov qword [rsp + 0x18], r13
jne 0x1400966d9
or bh, byte [rax]
xchg esi, eax
jmp 0x1400b16cb
add dword [rax], eax
add byte [rax - 0x73], cl
invalid
invalid
xchg edx, eax
invalid

Function at 0x1400b16ad
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
pop rsi
push rdx
pushfq
movabs rdx, 0x84ae7504cd0d389b
test dl, 0x2b
jne 0x14009b779
call fcn.1400966cb
ja 0x1400b1846
call fcn.1400adc74

Function at 0x1400b1793
Capabilities:
Encrypt data using speck

Disassembly:
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
call fcn.14009735c
mov qword [rsp + 0x10], rbx
call fcn.140094b96
shr r11b, 0x1e
movabs r14, 0xd1b2f6a3572f6b01
mov r11, qword [rsp + r11 - 0x11d0]
mov qword [rsp + 0x30], rcx
mov r15, r14
jl 0x14009c164
mov r10, qword [rsp + 0x10]
not bl
setns bl
je 0x14009cc9a
xor rbx, 0x7083c421
cmp dword [rsp + 0x38], ebx
mov rbx, qword [rsp + 0x28]
jo 0x14009a6e9
add word [rsp + 0x38], 0x582b
call fcn.1400b0234

Function at 0x1400b1949
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add r9, r9
push rbx
xchg qword [rsp + 0x20], rsi
shr r9, 0x6f
mov rbx, r9
not rbx
je 0x1400af3aa
invalid
add qword [rsp + rbx*4 + 0x703e8], 0xa3c5
mov r9, qword [rsp + rbx + 0x1c110]

Function at 0x1400b1994
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rsi, qword [rsp + r14*4 + 0xb790]
mov rsi, qword [rsi + r14*4 + 0xb740]
setns r12b
or word [rsp + rdi*2 + 0x48], 0x4389
movabs r9, 0x7f0eec3b670cd306
sub byte [rsp + 0x48], 0xbd
bswap ebp
jbe fcn.1400b0bbf
lea rsi, [rsi + rbp*8 + 0x6597a6c7]
setl bpl
lea r9, [r12 + 0x8014308]
call fcn.140098246

Function at 0x1400b4628
Capabilities:
Manually build aes constants

Disassembly:
sub r10, 4
mov qword [rsp], 0x44b0fbb8
mov eax, dword [r10]
xor eax, ebx
mov edi, dword [rsp + 2]
push rdi
movzx r9d, dil
inc eax
rol eax, 2
inc eax
jmp 0x1400c719f
call fcn.1400ef831

Function at 0x1400b618b
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 0x58]
jmp 0x14009b35b
Function at 0x1400bbbd2
Capabilities:
Authenticate hmac
Encrypt data using speck
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
call fcn.1400b12eb
lea rsp, [rsp + 8]
jmp 0x1400b0485
jmp 0x1400bab31

Function at 0x1400c2817
Capabilities:
Manually build aes constants

Disassembly:
xor r8d, 0x2b80918e
bswap r8d
bt rdi, 0xa2
rol r8d, 3
lea rdx, [rdi + rdi*4 + 0x5aa04fb4]
movsx eax, dx
lea r8d, [rdi + r8 - 0x5f579cf0]
mov qword [rsp + rax - 0x2f9d], rbx
lea rbx, [rdi*4 - 0x6a5ae867]
xor dword [rsp + rax - 0x2f9d], r8d
pop rbx
movsxd r8, r8d
add rsi, r8
mov r8d, eax
mov r9, qword [r11 + rax*2 - 0x5f3a]
mov r8w, word [r11 + rax - 0x2f95]
cdq
movzx ebp, di
lea r11, [r11 + rdx*4 + 0xa]
call fcn.1400e981e
Function at 0x1400c28ed
Capabilities:
Manually build aes constants

Disassembly:
xor word [rsp], dx
mov dword [r11 + riz], edi
cdqe
shl ecx, 0x38
push rax
lea r10, [rcx + r10 - 0x3a000004]
xadd al, bpl
sub byte [rsp + rcx - 0x39fffff2], cl
movsx r9d, word [rsp + rcx*2 - 0x73fffffc]
mov ecx, dword [rax + r10 + 0xba17]
not r8w
push rdx
xor ecx, ebx
neg dword [rsp + rax + 0xba2b]
sub ecx, r9d
cqo
not r9b
rol ecx, 1
imul rax
shl r8w, 3
not ecx
mov edi, dword [rsp + rdx + 0x11]
ror r8, 0xd2
neg ecx
lea rax, [rdi*8 - 0x5b636546]
shr bp, 0xad
lea ecx, [rcx + rdx*2 + 0x268d1039]
xor ecx, 0x80b366a5
mov qword [rsp + rdx*4 + 0x10], rbx
shr di, 0x43
jns 0x1400e43f3
mov ecx, 0x571cefbe
xor rcx, 0xffffffff9204c085
lea r10, [r10 + rcx + 0x3ae7d0c4]
movsx ebp, cx
movzx ecx, byte [r10 + rbp*2 - 0x5e76]
mov edi, ebp
movzx edx, di
xor cl, bl
call fcn.1400d1fdd
sub r10, 4
mov edx, dword [r10]
mov ecx, 0x6691513d
mov r9d, ecx
movsx eax, cl
xor edx, ebx
sub edx, 0xa3ad4a36
xadd rax, r9
mov ebp, 0x15093307
jge 0x1400e8246
neg r9b
jg 0x1400d18b2
movsxd rdx, edx
jo 0x1400ecba2
mov qword [rsp + rcx*2 - 0x3fc04], 0xffffffffb097eeae
push r9
adc rsi, rdx
sal rbp, cl
mov qword [rsp + rcx*2 - 0x3fc04], rsi
ret 0x20
bswap rdi
xor eax, ebx
movzx r9d, di
bswap eax
sub eax, edi
btc rbp, 0x82
xor rcx, rbp
rol r9d, cl
xor eax, 0x7a0976b7
ror rcx, cl
neg eax
push rcx
mov qword [rsp + rcx*8 + 0x416b3b80], rbx
inc r9d
js 0x1400bc6dd
bswap ebp
xor dword [rsp + rcx*2 + 0x105acee0], eax
pop rdx
xor dword [rsp + 8], ecx
add r8b, 0xf
mov rbx, qword [rsp + 8]
movsxd rcx, ecx
rol dx, 0x43
add rsi, rcx
pop rdx
mov qword [rsp + rdx*4 + 0x2eb70], r9
mov qword [rsp + rdx + 0xbadc], rsi
ret
not edx
inc edx
shr cx, 0x64
bswap edx
lea edx, [rdx + r9*2 - 0x3aa8bc22]
movsx edi, r9b
not r9b
rol rax, 0x3a
neg edx
shr r9, 0x7d
neg r9b
sbb ebp, r9d
push rbx
lea r8, [r9 + 0x2fa85722]
ror cl, 0x82
sar r9w, 0x4f
xor dword [rsp + rcx - 0x669105c4], edx
pop rbx
ror rdi, 0x48
cmovae r9d, ebp
push rbp
movsxd rdx, edx
and r8w, 0x1719
adc rcx, 0xffffffffa3a13bbf
dec word [rsp + rcx - 0xa32417d]
add rsi, rdx
bswap eax
mov edx, dword [rsp + rcx - 0xa324180]
sub cl, 0x14
mov r8w, word [r11 + rcx*2 - 0x146482de]
sal bpl, 0x42
mov cl, byte [r11 + rcx*2 - 0x146482dc]
xor r9d, 0xb3ad2cab
call fcn.1400cc67e
mov ebp, 0xef0839b6
movzx ecx, bp
mov r8, qword [r11 + rcx*2 - 0x736c]
sal bp, 0xa9
lea r9, [rcx*4 + 0x61860caa]
movsx eax, bp
mov rax, qword [r11 + rcx - 0x39ae]
or bpl, 0xba
bts rcx, rbp
lea rdi, [rcx*2 + 0x2035f5ae]
lea r11, [r11 + r9 - 0x6186f37a]
imul rcx, rcx
sbb r9b, cl
add rdi, 0xbba2b2e
or r8, rax
xor rdi, rdi
imul ecx, ebp
push rbp
not r8
jo 0x1400b6f8c
Function at 0x1400ca38c
Capabilities:
Manually build aes constants

Disassembly:
lea edx, [rdx + rbp - 0x464af8bb]
ror r8, cl
xor edx, 0xec2f3d06
mov qword [rsp + r9 - 0x4597acf5], 0xffffffffb80dbe20
ror bp, 0x4a
xchg qword [rsp + rcx*4 - 0x2001a858], r9
mov qword [rsp + rcx*2 - 0x1000d42c], rbx
jae fcn.1400b9925
shl r9w, 0x8b
lea rdi, [rbp + rdi - 0x7349d2fd]
xor dword [rsp + r9 + 0x47f30000], edx
lea rbp, [rbp + rdi - 0x13d91dd9]
neg r8
pop rbx
lea rax, [rdi + r9*2 + 0x4fb7811c]
not cl
rol cx, 0xa1
movsxd rdx, edx
push rdi
rol rax, 0x2e
adc rsi, rdx
sal r8d, 0xa1
mov edx, 0x6c34f2a7
ror r9w, 0x2d
mov r9, qword [r9 + r11 + 0x47f30002]
inc byte [rsp + rcx - 0x800d5cc]
shr ecx, 0x34
call fcn.1400d65a6
mov edx, 0x490eb3be
lea rbp, [rdx + rdx*8 + 0x428f4632]
lea r10, [r10 + rdx - 0x490eb3c2]
mov r8d, dword [r10 + rdx - 0x490eb3be]
lea rbp, [rbp + rdx*4 - 0x416cbcd2]
push rdx
xor r8d, ebx
pop rcx
rol dx, 0x4a
inc r8d
movsx eax, bpl
dec al
ror dl, 0x42
not r8d
movzx edi, bpl
call fcn.1400c9a6d

Function at 0x1400d7f99
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov r9d, 0x3a0020ba
xchg r9b, dil
sal dword [rsp + rdx - 0x1be19fe7], 0xf8
rol eax, 3
add dword [rsp + rdi - 0x233500ad], 0xf5003892
not eax
and dl, byte [rsp + r8 + 0x60002fc2]
mov qword [rsp + rdi - 0x23350092], rbx
xor dword [rsp + rdi - 0x23350092], eax
bt ecx, 0xbc
mov rbx, qword [rsp + r8 + 0x60002fbb]
add ecx, dword [rsp + r8 + 0x60002f9b]
mov qword [rsp + rdi - 0x23350092], 0x272caa1b
imul r8d, edi
movsxd rax, eax
add r8b, byte [rsp + rdx - 0x1be19fd9]
not word [rsp + rdi - 0x23350099]
call fcn.1400ed6f5
imul esp, dword [rdi + 0x31e21dfd], 0xffffffcd
sbb dl, byte [rbp + 0xc139c8b]
sbb eax, 0xbe7b14ac
cmp dword [rax - 0x1b], esi
sub byte [rcx], cl
ja 0x1400d7fba
test byte [rsi + rbp*2], bh
dec edx
fmul qword [rdi]
mov edx, 0x8b4abce1
pushfq
add al, 0xbb
invalid
rol byte [rdx + rax - 0x7c], 0x14
invalid
xchg edx, eax
pop rax
jle 0x1400d8037
add al, 0x68
jns 0x1400d80ac
xchg ebp, eax
jne 0x1400d7ff9
in al, dx
add eax, dword [rbp - 0x3f]
wait
mov ecx, 0x2f02c814
and al, 0xcf
jne 0x1400d7fcd
mov cl, 0xab
jmp 0x1400d805f
fisubr dword [rcx]
xbegin 0xcfcd99b4
test byte [rax - 0x37], 0x16
invalid
int3

Function at 0x1400db68b
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
mov qword [rsp + rdi*2 - 0x53378802], rcx
mov dword [r11 + rdi - 0x299bc3fd], eax
inc cx
mov dword [r11 + rdi*2 - 0x53378802], edx
sar rcx, 0x43
pop rax
pop rax
jp fcn.1400b6e87