joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800beb90
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.1800b8e40
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x1800bed34
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.1800b8e40
cmp rax, 0xffffffffffffffff
je 0x1800bed34
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x1800becb3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x1800bec39
call fcn.18009b570
mov dword [rax], 0xc
call fcn.18009b570
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.1800bed50
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.1800b20d0
cmp eax, 0xffffffff
je 0x1800bec75
cdqe
sub rbx, rax
test rbx, rbx
jg 0x1800bec50
jmp 0x1800bec8e
call fcn.18009b5a0
cmp dword [rax], 5
jne 0x1800bec8a
call fcn.18009b570
mov dword [rax], 0xd
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.1800bed50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x1800bed0c
test rbx, rbx
jns 0x1800bed16
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.1800b8e40
cmp rax, 0xffffffffffffffff
je 0x1800bec1a
mov ecx, esi
call fcn.1800bb150
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x1800bed16
call fcn.18009b570
mov dword [rax], 0xd
call fcn.18009b5a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x1800bec1a
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.1800b8e40
cmp rax, 0xffffffffffffffff
je 0x1800bec1a
xor eax, eax
jmp 0x1800bec21
call fcn.18009b570
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x1400005d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov r13d, 0xf
mov qword [rcx + 0x18], r13
mov byte [rcx], 0
lea rsi, [rcx + 0x20]
movups xmmword [rsi], xmm0
lea r15, [rsi + 0x10]
and qword [r15], 0
mov qword [rsi + 0x18], r13
mov byte [rsi], 0
movdqa xmm0, xmmword [0x140003710]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140003720]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x140003730]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [str.wxyz0123456789________.__:_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv_]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x140003700]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x403f3e3d
mov dword [rbp - 0xc], 0x5e5d5c5b
lea edx, [r13 + 0x4f]
mov dword [rbp - 8], 0x7c7b605f
mov word [rbp - 4], 0x7e7d
cmp qword [rcx + 0x18], rdx
jb 0x1400006b8
mov rbx, qword [rcx]
mov qword [rcx + 0x10], rdx
mov r8d, edx
lea rdx, [rbp - 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x5e], 0
jmp 0x1400006c1
lea r9, [rbp - 0x60]
call fcn.140001e54
cmp rsi, rdi
je 0x14000070a
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400006d3
mov r9, qword [rdi]
mov rbx, qword [rdi + 0x10]
cmp rbx, qword [rsi + 0x18]
ja 0x1400006fe
cmp qword [rsi + 0x18], 0x10
jb 0x1400006e7
mov rsi, qword [rsi]
mov qword [r15], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x14000070a
mov rdx, rbx
mov rcx, rsi
call fcn.140001e54
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140000740
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000073b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000076b
mov rcx, r8
call fcn.14000251c
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], r13
mov byte [rdi], 0
mov rax, r14
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140002b30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b7c
xor al, al
add rsp, 0x28
ret
Function at 0x1400077d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x210
mov rax, qword [0x140017010]
xor rax, rsp
mov qword [rsp + 0x200], rax
xor r9d, r9d
mov edi, edx
mov r10, r8
mov eax, r9d
mov r8d, dword [0x140017954]
mov rbx, rcx
nop dword [rax]
nop dword [rax + rax]
mov byte [rsp + rax], al
inc rax
cmp rax, 0x100
jb 0x140007810
test r8d, r8d
je 0x1400078a1
mov rcx, r9
mov rdx, r9
nop dword [rax]
movzx eax, byte [rcx + r10]
inc rcx
cmp rcx, r8
mov byte [rsp + rdx + 0x100], al
cmovae rcx, r9
movzx eax, byte [rcx + r10]
inc rcx
cmp rcx, r8
mov byte [rsp + rdx + 0x101], al
cmovae rcx, r9
add rdx, 2
cmp rdx, 0x100
jb 0x140007830
mov r10, r9
mov r8, r9
nop
movzx edx, byte [rsp + r8]
movzx ecx, byte [rsp + r8 + 0x100]
add rcx, r10
add rcx, rdx
movzx r10d, cl
movzx eax, byte [rsp + r10]
mov byte [rsp + r8], al
inc r8
mov byte [rsp + r10], dl
cmp r8, 0x100
jb 0x140007870
mov r11, r9
mov r10, rdi
test edi, edi
je 0x1400078ef
mov r8, rbx
nop
lea rax, [r9 + 1]
movzx r9d, al
lea r8, [r8 + 1]
movzx edx, byte [rsp + r9]
lea rax, [rdx + r11]
movzx r11d, al
movzx ecx, byte [rsp + r11]
mov byte [rsp + r9], cl
mov byte [rsp + r11], dl
movzx ecx, byte [rsp + r9]
add rcx, rdx
movzx ecx, cl
movzx edx, byte [rsp + rcx]
xor byte [r8 - 1], dl
sub r10, 1
jne 0x1400078b0
mov rax, rbx
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140010100
mov rbx, qword [rsp + 0x228]
add rsp, 0x210
pop rdi
ret

Function at 0x140008a60
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140017010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], 0x67452301
mov dword [rsp + 0x4c], 0xefcdab89
mov dword [rsp + 0x50], 0x98badcfe
mov dword [rsp + 0x54], 0x10325476
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140008abf
mov rax, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140008750
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.140008860
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
mov dword [rsp + 0x30], 1
mov edx, 0x10
mov r9d, edx
mov rcx, rbx
call fcn.140008e90
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140008b19
mov r8, qword [rbx]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.140009190
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140010100
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x14000a130
Capabilities:
Read file via mapping

Disassembly:
mov rcx, qword [0x140017a10]
jmp 0x14000a1d0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rdx]
test rcx, rcx
je 0x14000a1fa
lea edx, [rdi + 1]
call fcn.140010120
mov qword [rsi], rdi
test rbx, rbx
je 0x14000a25b
mov qword [rsp + 0x20], 0x8000
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000a25b
mov ecx, 0x8000
call fcn.1400103f8
mov qword [rsi], rax
mov r8d, 0x8000
mov rdx, rbx
mov rcx, rax
call fcn.14001127a
jmp 0x14000a24d
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000a140
Capabilities:
Read file via mapping

Disassembly:
mov rcx, qword [0x140017a10]
jmp 0x14000a270
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rdx
xor edi, edi
test rcx, rcx
je 0x14000a2de
test r8d, r8d
je 0x14000a2de
mov esi, r8d
mov r14d, r9d
lea rax, [r14 + rsi]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a2de
lea rcx, [r14 + rax]
mov r8d, esi
mov rdx, r15
call fcn.14001127a
jmp 0x14000a2d3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14000a150
Capabilities:
Read file via mapping

Disassembly:
mov edx, dword [0x140017a38]
mov rcx, qword [0x140017a10]
jmp 0x14000a300
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
test rcx, rcx
je 0x14000a35c
test edx, edx
je 0x14000a35c
mov esi, edx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000a35c
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14000a351
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000a1d0
Capabilities:
Read file via mapping

Disassembly:
mov rcx, qword [0x140017a10]
jmp 0x14000a1d0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rdx]
test rcx, rcx
je 0x14000a1fa
lea edx, [rdi + 1]
call fcn.140010120
mov qword [rsi], rdi
test rbx, rbx
je 0x14000a25b
mov qword [rsp + 0x20], 0x8000
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000a25b
mov ecx, 0x8000
call fcn.1400103f8
mov qword [rsi], rax
mov r8d, 0x8000
mov rdx, rbx
mov rcx, rax
call fcn.14001127a
jmp 0x14000a24d
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000a270
Capabilities:
Read file via mapping

Disassembly:
mov rcx, qword [0x140017a10]
jmp 0x14000a270
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, rdx
xor edi, edi
test rcx, rcx
je 0x14000a2de
test r8d, r8d
je 0x14000a2de
mov esi, r8d
mov r14d, r9d
lea rax, [r14 + rsi]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a2de
lea rcx, [r14 + rax]
mov r8d, esi
mov rdx, r15
call fcn.14001127a
jmp 0x14000a2d3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14000a300
Capabilities:
Read file via mapping

Disassembly:
mov edx, dword [0x140017a38]
mov rcx, qword [0x140017a10]
jmp 0x14000a300
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
test rcx, rcx
je 0x14000a35c
test edx, edx
je 0x14000a35c
mov esi, edx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000a35c
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14000a351
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000b580
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x140017010]
xor rax, rsp
mov qword [rbp + 7], rax
mov r12d, r9d
mov esi, r8d
mov rbx, rcx
mov dword [rbp - 0x69], edx
call fcn.14000b2c0
lea rcx, [rbx + 8]
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x29]
call fcn.14000c820
mov rcx, qword [rax]
mov r15, qword [rcx + 0x18]
mov r8d, r12d
mov edx, esi
call fcn.14000b570
mov edi, eax
mov dword [rbp - 0x49], eax
mov r10, qword [r15 + 0x50]
lea rcx, [rbp - 0x49]
call fcn.14000d380
mov rdx, qword [r15 + 0x78]
and rdx, rax
add rdx, rdx
mov rcx, qword [r15 + 0x60]
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, r10
je 0x14000b631
mov rcx, qword [rcx + rdx*8]
cmp edi, dword [rax + 0x10]
je 0x14000b61e
nop dword [rax]
cmp rax, rcx
je 0x14000b631
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x14000b610
test rax, rax
cmove rax, r10
cmp rax, r10
je 0x14000b631
mov al, 1
jmp 0x14000b76f
xor r13d, r13d
mov qword [rbp - 0x19], r13
mov qword [rbp - 9], r13
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], r13b
xor r8d, r8d
lea rdx, [0x140012733]
lea rcx, [rbp - 0x19]
call fcn.140007980
nop
lea r9, [rbp - 0x19]
mov r8d, r12d
mov edx, esi
mov ecx, dword [rbp - 0x69]
call fcn.14000acb0
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rcx, qword [rbp - 0x19]
lea rdx, [0x140012778]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
mov dword [rbp - 0x61], 0x4d4d4150
mov dword [rbp - 0x5d], 7
mov qword [rbp - 0x59], 4
and byte [rbp - 0x51], 0xfe
mov r9, rax
lea edx, [r13 + 0x14]
lea r8d, [r13 + 1]
lea rcx, [rbp - 0x61]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, dword [rbp - 0x55]
call fcn.140001060
mov rsi, rax
mov edx, dword [rbp - 0x55]
mov r9, rbx
lea r8d, [r13 + 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbp - 0x49], r13
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
mov r8d, dword [rbp - 0x55]
mov rdx, rsi
mov rcx, qword [r15]
call fcn.1400032a0
shr eax, 0x1f
test al, al
je 0x14000b710
mov rcx, rsi
call fcn.140001070
xor bl, bl
jmp 0x14000b72e
mov dword [rbp - 0x39], edi
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x49]
lea rcx, [r15 + 0x48]
call fcn.14000d0f0
mov bl, 1
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14000b76c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b767
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b767
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010120
movzx eax, bl
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140010100
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000d380
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, rcx
jmp 0x14000d390
movzx ecx, byte [rdx + 2]
movabs r9, 0x100000001b3
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 3]
imul rax, r9
xor rax, rcx
imul rax, r9
ret

Function at 0x140019eab
Capabilities:
Authenticate hmac

Disassembly:
shl qword [rsp + r10 - 0x5f7d0034], 0xaf
lea rcx, [rcx + r10 - 0xdacaf2f]
add qword [rsp + r10 - 0x5f7d0044], 0xffffffffbffd85b2
shl word [rsp + r10 - 0x5f7d0034], 0xda
mov qword [rsp + r10 - 0x5f7d002c], r10
call fcn.1400daa55

Function at 0x140019f0e
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x68], r14
bswap rcx
add r11, 0x4136673d
test byte [rsp + 0x68], r14b
jbe 0x1400dc2e7
jns 0x1401423b1
add qword [rsp + 0x10], 0xffffffffbfd835d3
lea rcx, [rcx + rcx*4 + 0x67850f74]
or cx, 0x61a4
shl ecx, 0x36
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
je 0x1400ffc9f
call fcn.140297eb3

Function at 0x14001e9f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r8
push rcx
neg dx
jb 0x1401dc485
movabs r8, 0x4ecd38b440e9137a
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rdi, 0x3f2b3b8d6f9b0883
Function at 0x140024850
Capabilities:
Authenticate hmac

Disassembly:
add bp, bp
shr rbp, 0xd8
push rdi
mov rdi, rbp
add qword [rsp + 8], 0xffffffffbffd059b
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
call fcn.140033732

Function at 0x140115ae9
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + r8*2 - 0x7ffffc0], rbp
mov r8, qword [rsp + r13*2 - 0x8d2d868]
or r13b, r13b
ja 0x1402b4d33
adc bh, byte [rsi + rsi*8]
xor dword [rdx - 0x58], esi
and ecx, dword [rsp + rbx]
pop rbx
fimul word [rax + 0x63d79c12]
mov esi, 0xdd90e3fb
xchg esi, eax
int1
invalid

Function at 0x140120133
Capabilities:
Packed with generic packer

Disassembly:
lea rsi, [rsi + 0x5f07140b]
jo 0x140024893
movabs r8, 0x37cb1d1f0ec66c9b
mov dword [rsp + 0x40], 0x6723616f
add qword [rsp + 0x20], 0xffffffffbfd9c634
mov qword [rsp + 0x48], r11
call fcn.14018038b
jno 0x1400193b0
cli
adc dword [rbp - 0x40], 0xffffffe5
invalid

Function at 0x14013bb44
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 0x30]
popfq
mov r13, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov r11, qword [rsp]
lea rsp, [rsp + 0x38]
ret
invalid
in eax, 0x1b
jne 0x1400ccbbe
clc
clc
invalid
xor al, 0x25
jnp 0x1400ccbb8
imul esp, dword [rsi], 0x1bf06c64
jp 0x1400ccb9a
movabs byte [0x41a1f7249222b9f3], al
and edi, dword [rdx + 0xc]
pushfq
and bh, byte [rdx + rsi*2]
adc ecx, dword [rdi + 0xe5c6eb6]
fistp dword [rsi]
mov ebx, 0x8148b362
xor rbx, 0x51a21ca3
add rbx, 0x5d4d52a4
neg bx
mov qword [rsp + 0x38], rax
shl bl, 0xe4
xor bx, bx
sub bx, bx
seto bl
push rdi
movabs rdi, 0x18a7407f4c7f0ed9
add qword [rsp + 0x10], 0xfffffffffffa7bcd
sub bl, 0x99
jg 0x140120111
cld
jle 0x1400ccbcd
invalid
add qword [rsp + 0x18], 0xffffffffbffccc10
test edi, edi
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
movabs rbx, 0x58a83e6731827a1d
call fcn.1400eec00
push r13
movabs r13, 0x40d50a9279dc29af
mov qword [rsp + 0x30], rbx
and r13b, 0x90
or r13d, 0x769b676b
or r13d, r13d
seta r13b
neg r13d
add r13d, 0x1de179c1
and r13d, 0x15a81c55
add qword [rsp + 8], 0x105699
movabs rbx, 0x492e658030fc011b
add qword [rsp + r13*2 - 0x28001070], 0xffffffffbfd16781
cmp r13w, bx
push rcx
push rdx
push r11
not r13d
cmove r13d, ebx
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
movabs r11, 0x249b4cf121cf3c42
cmp r11, 0x778f086d
mov r11w, 0xb86
movabs rdx, 0x6d64225c0d7e43aa
js 0x1400ccc17
lea rbx, [rbx + 0x6e5720d7]
mov rcx, r13
jg 0x14000fe34
push rbp
push r8
pushfq
movabs r8, 0x42bd3fff0e4a1be1
shl r8b, 0x85
test r8b, r8b
call fcn.1402ed596
invalid

Function at 0x14016018d
Capabilities:
Packed with generic packer

Disassembly:
jne 0x14028db10
test byte [rsp + 8], r12b
call fcn.14018e6da

Function at 0x140160193
Capabilities:
Packed with generic packer

Disassembly:
setg byte [rsp + 0x28]
mov qword [rsp + 0x28], rdi
movabs r10, 0x7898494b71aa7452
movabs rcx, 0x7308652b68de6925
movsxd rcx, r10d
movzx r10w, cl
jge 0x1401cbeee
add qword [rsp + 0x20], 0x25caf3
sub r10b, 0x79
bswap ecx
jne 0x14001e9e7
push 0x1fc73f82
pushfq
test byte [rsp + 8], 0xb3
mov qword [rsp + 0x10], 0x3d6fda0e
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.14036316f
Function at 0x14018bcdf
Capabilities:
Authenticate hmac

Disassembly:
shr r12d, 0xd1
jne 0x140246360
out dx, eax
sbb al, byte es:[rcx]
sbb dword [rax], ecx
add byte [rcx], bl
or byte fs:[rax], al
sbb dword [rdi + rax], edx
sbb dword [rsi + rax], esi
add byte [rcx], bl
xor dl, byte [0x12fc5c373]
pop rbp
invalid
lea rbp, [rbp + r12 - 0x29d5]
and r13w, 0x56bd
jo 0x1402e81db
and r12, r12
add r12, 0x5fbf29dc
ja 0x14002446e
mov r12, qword [rsp + r11 - 0x7fffffc7]
bswap r12d
not r12w
mov r13d, r11d

Function at 0x1401ae4a3
Capabilities:
Authenticate hmac

Disassembly:
mov r14, qword [rsp + r14 - 0x70069c19]
call 0x1401131fc
pop rdx
push 0x6bd6de1
pushfq
shl byte [rsp + 8], 0x6f
cmp word [rsp + 8], 0x7cfb
jae 0x1402a0e69

Function at 0x1401b96af
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp], 0x3f1c2406
call fcn.14040a830

Function at 0x1401b96bd
Capabilities:
Packed with generic packer

Disassembly:
jl fcn.1402d0c22
call fcn.1401b0d9c
call fcn.1400edbde
call fcn.14020fcb3
push r14
call fcn.1402d9ba5
invalid

Function at 0x1401e25c1
Capabilities:
Packed with generic packer

Disassembly:
push r15
and edx, 0x41b1723f
mov rdx, qword [rsp + rdx - 0x412151ed]
mov qword [rsp + 0x30], rbx
jge 0x140021570
adc byte [rax], al
mov es, word [rdi + 0x71]
cmpsb byte [rsi], byte [rdi]
cdq
xchg dword [rbx], ebx
invalid
Function at 0x140223b06
Capabilities:
Encode data using xor

Disassembly:
push r15
pushfq
movabs rdx, 0xf3b690f5b58005f
mov r15, rdx
call fcn.14002f8a0
call fcn.1401bdba4
int3
shr rdx, 0x25
lea rdx, [rdx*8 + 0x134b7c24]
mov dl, 0x53
mov qword [rsp + 0x20], rax
je 0x1401e155b
je 0x1400333fb
add edx, 0x2fe22d2a
push rdi
jns 0x1401d42f5
add qword [rsp + 0x10], 0x79c1e
movabs rax, 0x747c70a428461181
xor edx, 0x34511e85
mov rdi, rax
sub rdx, 0xa2e0a1c
jbe 0x140293d19
lea rdi, [rax + rdx + 0x6776484d]
add qword [rsp + 0x18], 0xffffffffbffbe566
shr dx, 0x7f
jns 0x1401c6445
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
lea rdi, [rdi + riz + 0x5ae866b4]
js fcn.1401fa7da
sub edi, 0x784216e1
shl di, 0xf2
movzx rdx, di
shr di, 0x9a
neg edi
lea rax, [rax + 0x33e86c3b]
mov qword [rsp + rdx*2 + 0x10], rdx
call fcn.14024a428
push rbx
cmp r15b, 0x2c
mov rbx, r15
add qword [rsp + 0x10], 0xe3bd3
movabs rax, 0xdee4a8d666c3785
shr ax, 0x25
shl rax, 0x7d
cmp r15, 0x3d754c29
push rsi
mov rax, qword [rsp + rbx*4 - 0xb446840]
mov rax, qword [rax + rbx - 0x2d11a16]
call fcn.14001eaf0
mov qword [rsp + rdx - 0xcafffea], 0x1645a5e
seto r13b
or dx, word [rsp + rdx*4 - 0x32bfffd4]
mov qword [rsp + 0x18], r13
cmp byte [rsp + 0x10], 0x3a
lea r9, [r13 + r9*4 + 0x5b8476a]
js 0x140272065
xchg qword [rsp + 0x38], rbp
mov r13, qword [rsp + rdx - 0xcafffda]
not word [rsp + rdx - 0xcafffe2]
not qword [rsp + rdx - 0xcafffea]
shr byte [rsp + rdx - 0xcafffe2], 0xb6
mov r9, qword [rsp + 8]
and rdx, 0x6e6e019a
add rdx, 0x22323be0
mov byte [rsp + rdx - 0x2e603d62], 0x40
add dx, dx
jb 0x1400ff626
lea r15, [r15*4 + 0x341a69f0]
mov qword [rsp + 0x28], rdi
lea r8, [r8*2 + 0x38702e21]
push r11
jbe 0x140028e1c
call fcn.1401a6233
movabs rdx, 0xa4f51f82a2b2f3d
xchg qword [rsp + 0x20], rax
pushfq
sub dx, dx
not rdx
neg dl
js 0x1402ebb13
jne 0x1401a5939
call fcn.140220afc
shl qword [rsp + rdi - 0x4a24cd65], 0x2d
xchg qword [rsp + 0x50], rax
mov rcx, qword [rsp + r13 - 0x5a00559f]
jb 0x14002f9c9
retf
push r10
mov r10, rdx
xchg qword [rsp + 0x20], rbx
add rdx, 0x3b245518
call fcn.1402677c4
mov rax, qword [rax]
movsx r8, di
mov dil, 0xe2
setg r8b
lea rax, [rax + 0x5f07140b]
jns 0x14026c3ac
shr dword [rcx], 1
sbb bh, byte [rax]
mov ah, 0x2a
cmp edx, dword [rcx]
mov eax, 0xdfb06948
invalid

Function at 0x14022a1a4
Capabilities:
Packed with generic packer

Disassembly:
push rdx
mov rdx, qword [rsp + 0x10]
xor r13w, 0x7903
nop
call fcn.1402a0525

Function at 0x14022a1ed
Capabilities:
Packed with generic packer

Disassembly:
seta cl
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x18], 0xf0
neg qword [rsp + 0x18]
xchg qword [rsp + 0x38], rdx
mov rcx, qword [rsp + 0x20]
jno 0x140201cad

Function at 0x14025767f
Capabilities:
Authenticate hmac

Disassembly:
jo 0x140145a92
mov r14, qword [rsp + 0x60]
call fcn.140248607
invalid