joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093128
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r11, [0x140172bc0]
lea r10, [0x1401735c0]
mov ebx, 0x100
lea rdi, [0x140000000]
movzx r9d, byte [r11 + 0x100]
mov ecx, r9d
mov eax, r9d
mov edx, r9d
shr edx, 1
shr eax, 2
and ecx, 3
movzx r8d, byte [rcx + rdi + 0x161dc0]
xor edx, r9d
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x161dc4]
shr edx, 1
xor edx, eax
xor r8d, r9d
xor edx, r9d
imul eax, edx, 0x10100
add eax, r8d
shl eax, 8
add eax, r9d
shl r9d, 0x10
mov dword [r10 - 0x800], eax
imul eax, edx, 0x1000100
add eax, r8d
add r9d, eax
mov dword [r10], r9d
movzx r9d, byte [r11]
inc r11
mov ecx, r9d
mov eax, r9d
mov edx, r9d
shr edx, 1
and ecx, 3
shr eax, 2
movzx r8d, byte [rcx + rdi + 0x161dc0]
xor edx, r9d
lea r10, [r10 + 4]
shr edx, 1
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x161dc4]
xor edx, eax
xor r8d, r9d
mov ecx, r9d
xor edx, r9d
shl ecx, 8
add ecx, r8d
shl ecx, 0x10
imul eax, edx, 0x101
shl edx, 8
add ecx, eax
add edx, r9d
mov dword [r10 - 0x404], ecx
imul eax, r8d, 0x1000001
shl edx, 8
add edx, eax
mov dword [r10 + 0x3fc], edx
dec rbx
jne 0x14009314c
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140093234
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor ebx, ebx
lea rdi, [0x140172cc0]
lea rsi, [0x140000000]
mov r11b, bl
mov r10b, bl
inc ebx
shr r11b, 4
and r10b, 0xf
movzx edx, r10b
movzx ecx, r11b
mov eax, ecx
movzx ecx, byte [rcx + rsi + 0x161dd8]
xor rax, rdx
movzx r8d, byte [rax + rsi + 0x161de8]
movzx eax, byte [rdx + rsi + 0x161dc8]
xor rcx, rax
mov r9d, r8d
movzx edx, byte [rcx + rsi + 0x161e08]
movzx ecx, byte [r8 + rsi + 0x161dd8]
movzx eax, byte [rdx + rsi + 0x161dc8]
xor r9, rdx
movzx edx, r10b
xor rcx, rax
mov al, byte [rcx + rsi + 0x161e48]
movzx ecx, r11b
shl al, 4
or al, byte [r9 + rsi + 0x161e28]
mov byte [rdi - 0x100], al
mov eax, ecx
movzx ecx, byte [rcx + rsi + 0x161dd8]
xor rax, rdx
movzx r8d, byte [rax + rsi + 0x161df8]
movzx eax, byte [rdx + rsi + 0x161dc8]
xor rcx, rax
mov r9d, r8d
movzx edx, byte [rcx + rsi + 0x161e18]
movzx ecx, byte [r8 + rsi + 0x161dd8]
movzx eax, byte [rdx + rsi + 0x161dc8]
xor r9, rdx
xor rcx, rax
mov al, byte [rcx + rsi + 0x161e58]
shl al, 4
or al, byte [r9 + rsi + 0x161e38]
mov byte [rdi], al
inc rdi
cmp ebx, 0x100
jb 0x140093253
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140094f14
Capabilities:
Decrypt data using aes via x86 extensions
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x1a0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r10, qword [rsp + 0x1d0]
mov r11, rdx
mov rbx, rcx
test r10b, 0xf
je 0x140094fe2
lea rax, [rsp]
lea rcx, [rsp]
mov edx, 2
neg rax
and eax, 0xf
add rcx, rax
mov rax, rcx
movups xmm0, xmmword [r10]
movups xmm1, xmmword [r10 + 0x10]
lea r10, [r10 + 0x80]
movups xmmword [rax], xmm0
movups xmm0, xmmword [r10 - 0x60]
movups xmmword [rax + 0x10], xmm1
lea rax, [rax + 0x80]
movups xmm1, xmmword [r10 - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [r10 - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [r10 - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [r10 - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [r10 - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
dec rdx
jne 0x140094f87
jmp 0x140094fe5
mov rcx, r10
movdqa xmm3, xmmword [rcx]
movdqa xmm4, xmmword [rcx + 0x10]
movdqa xmm5, xmmword [rcx + 0x20]
sar r8d, 4
movdqa xmm6, xmmword [rcx + 0x30]
movdqa xmm7, xmmword [rcx + 0x40]
movdqa xmm8, xmmword [rcx + 0x50]
movdqa xmm9, xmmword [rcx + 0x60]
movdqa xmm10, xmmword [rcx + 0x70]
movdqa xmm11, xmmword [rcx + 0x80]
movdqa xmm12, xmmword [rcx + 0x90]
movdqa xmm13, xmmword [rcx + 0xa0]
movdqu xmm2, xmmword [r9]
test r8d, r8d
jle 0x140095099
sub r11, rbx
mov eax, r8d
movdqu xmm1, xmmword [rbx]
movdqa xmm0, xmm1
pxor xmm0, xmm3
aesdec xmm0, xmm4
aesdec xmm0, xmm5
aesdec xmm0, xmm6
aesdec xmm0, xmm7
aesdec xmm0, xmm8
aesdec xmm0, xmm9
aesdec xmm0, xmm10
aesdec xmm0, xmm11
aesdec xmm0, xmm12
aesdeclast xmm0, xmm13
pxor xmm0, xmm2
movdqa xmm2, xmm1
movdqu xmmword [r11 + rbx], xmm0
lea rbx, [rbx + 0x10]
dec rax
jne 0x14009503e
movdqu xmmword [r9], xmm2
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x1a0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rbx
ret
Function at 0x140096eec
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov rcx, rdx
mov rbp, rdx
call fcn.1400a76ac
mov rsi, rax
test rax, rax
jne 0x140096f1f
lea eax, [rsi + 7]
jmp 0x140096fc1
call fcn.1400ae744
mov edi, 1
test eax, eax
je 0x140096f5a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140096f85
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
jne 0x140096f85
lea rcx, [rsp + 0x48]
call fcn.1400b6874
test eax, eax
jne 0x140096f2d
jmp 0x140096f85
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140096f85
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test eax, eax
jne 0x140096f85
lea rcx, [rsp + 0x48]
call fcn.1400b6874
test eax, eax
jne 0x140096f5a
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140096fae
lea rdx, str.winDelete
mov r9d, 0x85f9
mov r8, rbp
mov ecx, 0xa0a
call fcn.1400e5574
mov ebx, eax
jmp 0x140096fb7
mov ecx, dword [rsp + 0x48]
call fcn.1400af21c
mov rcx, rsi
call fcn.1400ea498
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14009d340
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rax, rdx
mov rdi, rcx
cmp dword [rcx + 0x38], ebx
jle 0x14009d36a
movsxd r8, dword [rcx + 0x38]
dec rax
add rax, r8
cqo
idiv r8
imul rax, r8
mov rdx, rax
call fcn.1400b6ce8
test eax, eax
je 0x14009d385
mov r9d, 0x802d
lea rdx, str.winTruncate1
jmp 0x14009d3a9
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009d3b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x8030
lea rdx, str.winTruncate2
mov dword [rdi + 0x20], eax
mov r8, qword [rdi + 0x30]
mov ecx, 0x60a
call fcn.1400e5574
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009d79c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14009d7f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14009d7f1
mov r8, qword [rbx + 0x30]
lea rdx, str.winFileSize
mov r9d, 0x808c
mov ecx, 0x70a
mov dword [rbx + 0x20], eax
call fcn.1400e5574
jmp 0x14009d801
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
add rcx, rdi
xor eax, eax
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ad5f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r9, qword [0x140173de8]
mov rbx, rdx
mov esi, ecx
test r9, r9
je 0x1400ad644
lea r8, [0x14011eb84]
lea rdx, [rsp + 0x20]
mov ecx, 0xe6
call fcn.14009bcb8
jmp 0x1400ad6ca
call fcn.1400ae744
mov ecx, 0xe6
test eax, eax
je 0x1400ad694
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp + 0x30]
call fcn.1400e1f88
mov rdi, rax
test rax, rax
jne 0x1400ad6a9
mov eax, 7
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp + 0x30]
call fcn.1400e129c
jmp 0x1400ad665
lea r8, [0x14011eb84]
lea rdx, [rsp + 0x20]
mov r9, rax
mov ecx, 0xe6
call fcn.14009bcb8
mov rcx, rdi
call fcn.1400ea498
mov r8b, byte [rsp + 0x20]
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
test r8b, r8b
je 0x1400ad6e6
inc rcx
cmp byte [rcx], 0
jne 0x1400ad6de
sub ecx, eax
lea rax, str.etilqs_
mov edi, 0x3fffffff
mov rdx, rax
and ecx, edi
inc rdx
cmp byte [rdx], 0
jne 0x1400ad6f9
sub edx, eax
add ecx, 0x11
and edx, edi
add ecx, edx
cmp ecx, esi
jl 0x1400ad718
mov eax, 1
jmp 0x1400ad672
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
test r8b, r8b
je 0x1400ad72f
inc rax
cmp byte [rax], 0
jne 0x1400ad727
sub eax, ecx
and eax, edi
movsxd rcx, eax
je 0x1400ad749
lea rax, [rsp + 0x20]
cmp byte [rax + rcx - 1], 0x5c
jne 0x1400ad749
dec rcx
jne 0x1400ad73d
cmp rcx, 0x105
jae 0x1400ad7ec
mov byte [rsp + rcx + 0x20], 0
lea r9, [rsp + 0x20]
lea r8, str._setilqs_
lea ecx, [rsi - 0x11]
mov rdx, rbx
call fcn.14009bcb8
mov rax, rbx
test rbx, rbx
je 0x1400ad78b
cmp byte [rbx], 0
je 0x1400ad787
inc rax
cmp byte [rax], 0
jne 0x1400ad77f
sub eax, ebx
and eax, edi
movsxd rdi, eax
mov esi, InitCommonControls
lea rdx, [rbx + rdi]
mov ecx, esi
call fcn.14009bfc0
lea r8, [rdi + rbx]
add rdi, rsi
movzx ecx, byte [r8]
movabs rax, 0x842108421084211
mul rcx
mov eax, ecx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov al, byte [rcx + rax]
mov byte [r8], al
inc r8
dec rsi
jne 0x1400ad7a5
mov byte [rbx + rdi], sil
xor eax, eax
jmp 0x1400ad672
call fcn.1400e9480
int3
Function at 0x1400c2904
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400c2a20
test rdx, rdx
je 0x1400c2a20
mov ecx, 0x800
test word [rdi + 2], cx
jne 0x1400c29af
movzx eax, word [rdx + 2]
test cx, ax
jne 0x1400c29af
xor al, byte [rdi + 2]
test al, 0x10
jne 0x1400c29af
mov al, byte [rdx]
cmp byte [rdi], al
jne 0x1400c29af
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.1400c2904
test eax, eax
jne 0x1400c29af
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1400c2904
test eax, eax
jne 0x1400c29af
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.1400c325c
test eax, eax
jne 0x1400c29af
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x1400c29af
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x1400c29af
movzx r8d, word [rdi + 2]
mov ecx, 0x400
test cx, r8w
je 0x1400c29b6
test word [rbx + 2], cx
je 0x1400c29af
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x1400c29ef
mov eax, 2
jmp 0x1400c2a2b
cmp byte [rdi], 0x98
je 0x1400c29ef
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400c29ef
test word [rbx + 2], cx
jne 0x1400c29af
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400c29af
sub rcx, rax
movzx edx, byte [rax]
movzx r9d, byte [rax + rcx]
sub edx, r9d
jne 0x1400c29eb
inc rax
test r9d, r9d
jne 0x1400c29d6
test edx, edx
jne 0x1400c29af
movzx ecx, word [rbx + 2]
mov edx, 0x100
and cx, dx
and r8w, dx
cmp r8w, cx
je 0x1400c2a0c
mov eax, 1
jmp 0x1400c2a2b
test r8w, r8w
je 0x1400c2a1c
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x1400c29af
xor eax, eax
jmp 0x1400c2a2b
sub rbx, rcx
neg rbx
sbb eax, eax
and eax, 2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c6694
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
mov r10, rcx
cmp qword [rcx + 0x10], rbx
je 0x1400c66e3
mov r9d, r8d
mov r11, rdx
mov eax, ebx
test r8d, r8d
jle 0x1400c66dc
movzx ecx, byte [r11]
lea rdx, [0x14011d810]
dec r9d
movzx edx, byte [rcx + rdx]
mov ecx, eax
inc r11
shl ecx, 3
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x1400c66b9
xor edx, edx
div dword [r10]
jmp 0x1400c66e5
mov edx, ebx
mov r9d, edx
mov rcx, r10
mov rdx, rdi
call fcn.1400aa614
test rax, rax
je 0x1400c66fc
mov rbx, qword [rax + 0x10]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1120
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, [0x140175da0]
lea r8d, [rdx + 0x30]
call fcn.1400ebf40
lea rcx, [0x140175da0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x1401630e0]
mov edx, 1
call fcn.14009a0ec
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400eb1ac
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1400f0d20
movzx ebx, ax
mov ecx, 2
call fcn.1400f6830
call fcn.1400f4f98
test eax, eax
jne 0x1400eb1ef
cmp dword [0x140175918], 1
jne 0x1400eb1db
call fcn.1400f6548
mov ecx, 0x1c
call fcn.1400f65bc
mov ecx, 0xff
call fcn.1400ee868
call fcn.1400f35a0
test eax, eax
jne 0x1400eb21a
cmp dword [0x140175918], 1
jne 0x1400eb206
call fcn.1400f6548
mov ecx, InitCommonControls
call fcn.1400f65bc
mov ecx, 0xff
call fcn.1400ee868
call fcn.1400f6924
nop
call fcn.1400f5a48
test eax, eax
jns 0x1400eb233
mov ecx, 0x1b
call fcn.1400eb2bc
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140176f28], rax
call fcn.1400f6994
mov qword [0x140174be8], rax
call fcn.1400f614c
test eax, eax
jns 0x1400eb25f
mov ecx, 8
call fcn.1400ee880
call fcn.1400f6408
test eax, eax
jns 0x1400eb272
mov ecx, 9
call fcn.1400ee880
mov ecx, 1
call fcn.1400ee8a8
test eax, eax
je 0x1400eb287
mov ecx, eax
call fcn.1400ee880
call fcn.1400f6a88
movzx r9d, bx
mov r8, rax
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000c478
mov dword [rsp + 0x20], eax
mov ecx, eax
call fcn.1400eebe4
nop
mov ecx, eax
call fcn.1400ee940
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400eebe4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400eea4c
Function at 0x14019f78f
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.1403608e4
mov byte [rsi + 0x68], 0xa9
xor esp, dword [rdx]
push rsp
out 0xbf, eax
sahf
loopne 0x14019f793
call 0x16b9fb796
movsd dword [rdi], dword [rsi]
in al, 0xbf
rcr bl, 0x2d
in al, 0xbf
enter 0x65f3, 0x2e
in al, 0xbf
clc
push rdi
stosb byte [rdi], al
sbb byte [rax - 0x1e], al
and al, 0x16
xchg edi, eax
insd dword [rdi], dx
sbb al, byte [rax - 0x39]
insb byte [rdi], dx
invalid

Function at 0x14030ed38
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1403608e4

Function at 0x140344509
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r11 - 0x511d0001], 0x9a5861b
mov r11, qword [r10 + rdx*8 - 8]
sub bx, dx
adc rdx, qword [r10 + rdx*8]
xchg byte [rsp + rbp - 0x54008fcd], ah
or r11, rdx
call fcn.1403a8d86
mov r11d, 0xad99f9b8
xor r11w, r11w
movsx ebx, r11w
mov r11, qword [r10 + rbx]
movzx edx, bl
movzx ebp, bx
adc rbp, qword [r11 + rbx*8]
lea rax, [rbx + rbx*2 - 0x4ae9c662]
xor al, 0x33
mov qword [rbx + r10], rbp
mov r9d, 0xf92a99ab
mov ecx, dword [rsi + rbx*2]
xor ecx, edi
not ecx
bswap ecx
btr dx, r9w
and ax, r9w
inc ecx
bt dx, 0x19
neg ecx
movsx r11d, dx
push rdi
bswap r11
movzx ebp, r9b
xor dword [rsp + rbx*2], ecx
sal bx, 0xe7
or r11b, r11b
sal ax, 0xec
pop rdi
xchg r11w, ax
sub rbx, r11
movsxd rcx, ecx
div r9w
shl bx, 0x61
idiv eax
add r8, rcx
sub ax, r9w
and r11b, r11b
jbe 0x140367de0
mov eax, 0x3992f0a7
mov ebp, dword [rsi + rax*2 - 0x7325e14e]
lea rsi, [rax + rsi - 0x3992f0a3]
movzx r9d, ax
jmp 0x1403a27c8
movzx edx, byte [rbx + rsi + 0x2004]
sbb eax, r11d
shl r11d, 0xfb
lea rsi, [rsi + rbx*4 + 0x8005]
mov ecx, 0xe2b7cd30
bswap ebx
bswap r11
xor dl, dil
jmp 0x1403951a6
xor ebp, edi
movzx ebx, r9w
inc r9b
Function at 0x140345e0a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov qword [rsp + rbp - 0x73d3137d], rax
lea rsi, [rsi + rbp - 0x73d31379]
call fcn.14038977d
lea rbp, [rsp + rbp + 8]
xchg dword [rsp + rdx*2 - 0xcb74], r9d
mov ecx, dword [rbp + rdx*4 - 0x196ec]
add rbx, r11
adc r11w, word [rsp + rdx*2 - 0xcb71]
mul rbx
mov dword [r10 + r11 - 0x4e93e505], ecx
movsx ecx, byte [rsp + r11 - 0x4e93e4f6]
rol eax, cl
lea r10, [r10 + rcx*2 - 0x6a]
jae 0x1403899f7
sbb dx, ax
movsx ebp, bx
mov r9d, dword [r11 + rsi - 0x4e93e4ef]
neg cx
cmovge rcx, qword [rsp + r11 - 0x4e93e4f9]
inc byte [rsp + r11 - 0x4e93e4f8]
lea rsi, [rsi + r11 - 0x4e93e4eb]
inc ebp
ja 0x140378f5d
setge bpl
xor r9d, edi
inc r9d
shr bx, 0x8e
neg r9d
not r9d
mul qword [rsp + rcx*2 - 0x1ffa2]
adc qword [rsp + rdx*2 - 0x1489c], rbp
lea r9d, [r9 + rdx + 0x11a254df]
rol ax, 0xcb
jne 0x14039387e
mov ebp, 0x14b0b7a7
rol rbp, 0x6f
btr ebp, 0x14
mov ebp, dword [rsi + rbp - 0xa58]
adc rsi, 4
mov ecx, 0x6923601
xor ebp, edi
movzx ebx, cx
mov r11d, ebx
movsx eax, r11b
neg ebp
cqo
add ebp, 0xef0fb9a0
call fcn.140367473
imul rcx, rbx
mov qword [rsp + rdx*4 - 0x29138], rdi
ror ebp, cl
lea rdi, [rcx + 0x6610d782]
xor dword [rsp + rdx - 0xa44e], r9d
xadd di, bx
pop rdi
adc bp, 0x1da8
movsxd r9, r9d
add r8, r9
neg bl
jle fcn.140358f58
mov rax, qword [r10]
mov ecx, 0x7bab921d
lea r11, [rcx + rcx*2 - 0xd5c17b]
lea rbx, [rsp + rcx - 0x7bab914d]
mov r9d, ecx
mov qword [rbx + rcx - 0x7bab921d], rax
add cl, 0x81
shl ecx, cl
movsx ebp, cl
mov r9d, dword [rsi + r9 - 0x7bab921d]
lea rax, [rcx*4 + 0x5fac9e17]
lea rsi, [rbp + rsi + 4]
rol r11d, 0x32
cdqe
jb 0x14033e075

Function at 0x140360cde
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
rol ebp, 0x26
xor r9, rdi
neg dx
mov qword [rsp + rcx*2 - 0x4000], rbx
not r9
inc r9
bt rdx, 0x86
xor r9, 0xffffffffa881f5b6
not r9
shr rbp, 0xc1
pop rax
xor rdi, r9
mov qword [r10 + rcx*4 - 0x8004], r9
mov qword [rsp + rcx - 0x2000], 0x3a12a68d
mul rdx
lea r10, [r10 + rcx*4 - 0x8004]
mov dword [rsp + rcx - 0x1fff], ebp
pop rbp
jo fcn.140358f58
sub r9w, dx
xor dword [rsp + r9 - 0x2502], ecx
pop rdi
add ebp, 0xf592c186
ror ebp, 0xb6
js 0x140390b1f
movsxd rcx, ecx
cmovs r9d, r11d
setbe bpl
xchg r9d, r11d
add r8, rcx
xchg r9, r11
inc r11d
mov r10d, dword [r11 + r10 - 0x2533]
movsx ecx, r11w
jno fcn.140358f58
mov rbp, qword [r10]
mov ebx, dword [rbp + riz]
mov dword [r10 + 4], ebx
jmp 0x140387a8e
Function at 0x140377d8c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add r8, rbp
mov rdx, qword [rsi + rbx - 1]
cwde
btc rbx, rcx
neg rcx
lea rsi, [rsi + rcx + 0x5e37cb09]
xor rdx, rdi
lea rbp, [rbx + rax*4 - 0x24600e58]
btr rbp, r9
bswap rdx
xor cx, bx
lea rdx, [rdx + rbx - 0x4a85109]
rol rdx, 1
sar r9w, 0x88
bswap rdx
dec r9w
adc rdx, r11
and cl, r9b
lea rbx, [r11 - 0x2a6945d2]
sal r11w, 0x84
xor rdi, rdx
xadd ebx, ebp
sal rax, cl
cmovs ebp, r11d
lea r10, [r10 + rcx + 0x5e37cafc]
push r11
bts rbx, 0x8d
inc cx
mov qword [r10 + r9 - 0xffff], rdx
sbb ebx, 0x6e9efc9c
ja 0x14039a545
mov rdi, qword [rsp + r11*2 - 0x3fc54764]
inc rcx
jge 0x140388f5c
movsxd r9, r9d
mov qword [rsp + r11 - 0x1fe2a3be], 0xffffffff99a68abc
imul rbp
mov qword [rsp + r11 - 0x1fe2a3a6], 0xffffffff90a1a136
adc r8, r9
add byte [rsp + r11 - 0x1fe2a3be], 0x8b
mov rbx, qword [r10 + r11*2 - 0x3fc54774]
mov r9, qword [r10 + r11*2 - 0x3fc5476c]
dec r11d
inc word [rsp + r11*4 - 0x7f8a8ef4]
bt cx, 0x35
add rbx, r9
add word [rsp + r11 - 0x1fe2a3b8], 0x8a82
mov qword [r10 + r11*4 - 0x7f8a8ee4], rbx
jge 0x14035c51e
jne 0x1403a3e9d
lea r10, [r10 + r11*4 - 0x7f8a8ee4]
sar r11w, 0x69
mov qword [rsp + r11*2 - 0x3fc5ffa2], r8
ret 0x18
Function at 0x2fc4d6b50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d7552
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4d75ea
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4d75ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d75c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d75c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7588
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d75eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d76f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7718
mov eax, 0
jmp 0x2fc4d7766
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7741
mov eax, 0
jmp 0x2fc4d7766
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7761
mov eax, 0
jmp 0x2fc4d7766
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d776c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d77ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d77e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d77e1
mov rax, qword [rbp - 8]
jmp 0x2fc4d77ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d77b4
mov eax, 0
add rsp, 0x20
pop rbp
ret