joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406d6ecc
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 0x40], rax
mov rbp, qword [rsp + 8]
neg r10b
lea r10, [rdi + rdi - 0x79f4b444]
mov r10, qword [rsp + r10*4 - 0x5e13e3e8]
sub word [rsp + 0x28], r10w
mov rsi, qword [rsp + 0x18]
lea rdi, [r10*2 - 0x1259e24c]
test edi, edi
jne 0x1403c2a5f
js 0x14043f15a
shl r12w, 0x8c
test r9b, 9
cmovne r9d, dword [rsp + 0x2b]
call fcn.140525d26

Function at 0x1406df742
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x38], r8
lea rdx, [rdx - 0x20c763c6]
jne 0x140490ae8

Function at 0x1406e5f97
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x84f737
bswap r8
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
jl 0x140401e58

Function at 0x1406e6319
Capabilities:
Encode data using xor

Disassembly:
push r14
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], r10
push rdx
jb 0x1403d9a06

Function at 0x1406e7ead
Capabilities:
Encode data using xor

Disassembly:
jbe 0x1403bb390
cmp byte [rsp + 0x50], r12b
jo fcn.1403fb4a3
mov r12, qword [rsp + 0x30]
add qword [rsp + 0x10], 0xffffffffbfb8ae3e
and byte [rsp + 8], 0x2b
setns byte [rsp + 0x50]
and byte [rsp + 0x50], 0x1d
shl qword [rsp + 0x50], 0x4f
call fcn.140542c6b
sti
mov r14b, 0xd4
lodsb al, byte [rsi]
invalid

Function at 0x1406f0ae4
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
push r12
xchg qword [rsp + 0x50], rdi
mov r12, qword [rsp + 0x48]
not r13
and r13b, r13b
jg 0x140356598
jg fcn.14044e453
shl r13w, 0x75
test qword [rsp + 0x20], 0xffffffffde9e97a0
jo 0x140603368
mov r13, qword [rsp + 0x38]
shr byte [rsp + 0x18], 0x13
add byte [rsp + 0x18], 0x1e
mov dword [rsp + 0x20], 0x399a4091
xor dword [rsp], 0x790b4a8
shl word [rsp + 0x18], 0xa7
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x1406f16b8
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov qword [rsp + 0x50], rax
movabs r11, 0x25b376a10309a290
add qword [rsp + 0x40], 0xffffffffbf9d9dc0
not r11b
and r15d, 0x3228f3b4
ja 0x140554b35

Function at 0x1406f181e
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
add qword [rsp + 0x18], 0xffffffffbfb13b52
movabs rdi, 0x259dd5b976b8238d

Function at 0x1406f8480
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
xor eax, 0xf7260c31
shl rax, 0xd1
lea rdx, [r8 + r13*8 + 0x74229b0c]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
call fcn.14064989a
Function at 0x1406f8b5f
Capabilities:
Encode data using xor

Disassembly:
jne 0x1404d543b
add qword [rsp + r12*2 + 0x18], 0xffffffffbfa43daf
test byte [rsp + r12*4 + 0x42], r11b
not r11d
not r11
lea r12, [r11 + r11*8 - 0x4f5ad3c3]
movsx r11d, byte [rsp + 0x43]
mov r11, qword [rsp + 0x38]
lea r12, [r12 + r12*4 + 0x5c1c8138]
mov qword [rsp + 0x40], r12
call fcn.140666500
lodsd eax, dword [rsi]
mov dl, 0x51
movsd dword [rdi], dword [rsi]
xor eax, 0x1ac4a6c4
add ebp, esi
push rsi
cmp ebp, edi
out dx, eax
jae 0x1403f0a7f
mov edi, 0x49b17dc4
mov edi, 0x1c3ebfc4
movabs eax, dword [0x137e4ec4a271c3c4]
mov ecx, 0x97f13b5a
movabs dword [0xcb3b58e8c817fec4], eax
push 0xffffffffffffffb2
invalid
test dword [rsp + r11 - 0xd065], ecx
mov dword [rsp + rcx + 0x40], 0x860c4697
xchg qword [rsp + rcx*2 + 0x48], rax
mov rcx, qword [rsp + rcx*2 + 0x10]
jge 0x1403f0a5f

Function at 0x1406fa0c6
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov r12, qword [rsp + 0x28]
add qword [rsp + 8], 0xfffffffffffcd4c3
add qword [rsp + 0x20], r12
shr r12w, 0xbf
je 0x140361b1d
jbe 0x14047190d
setge r15b
xor byte [rsp + 0x38], 0xaf
mov r15, qword [rsp + 0x40]
jns fcn.140505a0f
jge 0x14059c51f
call fcn.1404c9be1

Function at 0x1406fa9cf
Capabilities:
Packed with generic packer

Disassembly:
not cx
je 0x1405b0c43
shl qword [rsp + rbp - 0x26], cl
xchg qword [rsp + 0x38], rdi
mov rbp, qword [rsp + rbp - 0x1e]
or rcx, rcx
dec dword [rax + 0xb]
leave
cmp dword [rsp + 0x28], ecx
setno byte [rsp + 0x28]
cmp qword [rsp + 0x10], rcx
jg 0x1404e1e0f
jno 0x140625654
jle 0x1404f93bc
out dx, al
cmp dword [rdi + 0x61], ebx
sar byte [rdi], 0x99
movabs al, byte [0xe7e90d5f5a8effc3]
sub byte [rdi - 0x31], bl
sub byte [rdx + 0x744475a0], bh
invalid
movabs dword [0xece8d13ddbd64a3d], eax
pop rdi
ret 0x51c
call fcn.14065292a
jbe 0x14059f292
adc ah, byte [rdx]
add bl, ah
invalid
cmp dword [rsp + r14 + 0x18], 0xd21e43ac
jl 0x140362a9d
call fcn.1406add56
push 0xffffffffd44843a1
movsd dword [rdi], dword [rsi]
stosq qword [rdi], rax
mov bh, 0x35
add al, 0xed
test eax, 0x335f5a57
cmpsd dword [rsi], dword [rdi]
mov bh, 0xed
mov dl, cl
pop rbp
test al, 0xa4
invalid
shr rcx, 0x76
je 0x14059f2d4
mov rcx, qword [rsp + rcx - 0x3b4]
xor dword [rsp + 0x28], 0xd5228f98
neg byte [rsp + 0x10]
call fcn.140685ba5
cmp eax, 0x3a
std
sub al, 0xda
test dword [rcx], ebx
ja 0x140625619
invalid
pushfq
cmpsd dword [rsi], dword [rdi]
jns 0x14062566b
adc dword [rbx - 0x7f], ecx
jg 0x1406256f0
pop rbx
imul eax, dword [rax - 0x7a], 0x8e38fd19
cdq
movsd dword [rdi], dword [rsi]
mov ebp, 0x66788217
retf 0x4af3
mov ds, ecx
mov dh, 0xd1
invalid
jns 0x1404f939f

Function at 0x1406fcbf3
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.140770f17
Function at 0x1406fcc02
Capabilities:
Authenticate hmac
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rcx
push r15
movabs r15, 0x80a813af28979982
pushfq
shl r15, 0xff
shl r15d, 0x73
shr r15w, 0x19
not r15b
shl r15, 0x8e
and r15d, 0x7c25b83b
call fcn.14045b8bb
test qword [rsp + 0x20], rdi
setle byte [rsp + 0x20]
jo 0x1403f1425
mov rdi, qword [rsp + 0x38]
cmp byte [rsp + 0x28], r10b
js fcn.1406fa0c6
or word [rsp + 0x20], 0x6388
sub r10d, dword [rsp + 0x23]
mov r10, qword [rsp + r10 - 0x488e3528]
setno byte [rsp + 0x28]
xor qword [rsp + 0x28], 0xffffffffd08a8811
ret 0x18
call fcn.1405d734f
jbe 0x1406f60e3
movzx edx, word [rsp]
neg r15d
and dx, 0xb5b3
call fcn.140513c0f
mov qword [rsp + 0x40], rax
ja 0x140611ad5
adc ah, byte [rdi - 0x24]
movabs rax, qword [0x3dd2be5eda1bafe6]
mov bl, byte [rsi + 0x71]
iretd
call fcn.1403ba517
cmp r9d, dword [r15 + 0x4fa6e1d4]
int1
fsubr qword [0x19455e0ab]
cmp al, 0x4c
and esi, dword [rbx]
movsb byte [rdi], byte [rsi]
invalid
push rcx
jns 0x1403c2a31
add qword [rsp + 0x10], 0x10c20
mov r11, qword [rsp + 0x20]
add qword [rsp + 0x30], 0xfffffffffffba2d1
or r11d, dword [rsp + 0x23]
mov rax, qword [rsp + 0x20]
not eax
not r11
sub r11, qword [rsp + 0x20]
mov rcx, rax
je 0x1406a7591
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
test rsi, r8
mov cx, word [rsp + 0x23]
lea rax, [rax - 0x66cc9f63]
movzx esi, si
mov rsi, qword [rsp + 0x28]
mov r11, qword [rsp + 0x18]
mov rcx, qword [rsp]
lea rsp, [rsp + 0x30]
ret

Function at 0x1406fd62a
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x56daf8f2
call fcn.14080b7ae

Function at 0x1406fd7b8
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [rsp + 0x20], 1
call fcn.1404ba42e
setae r9b
xchg qword [rsp + r9 - 0xb5b9], rbp
mov r9, qword [rsp + r9 - 0xb5c1]
sub qword [rsp + 0x20], 0xffffffffd981f32a
and qword [rsp + 0x20], 0x5ca9758b
shl dword [rsp + 0x20], 0xaf
jns 0x140048115

Function at 0x1406fe889
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov qword [rsp + 0x40], rax
jb 0x140675713
shl dl, 0x68
push r13
jl fcn.14055d45a
and r9d, 0x181d3b03
js 0x14055ae54
add qword [rsp + r9*8 - 0x40c097d8], 0xffffffffbfac42cf
lea rdi, [rdi + rbx - 0x4cd1f6f2]
sub bx, bx
je 0x1405f5f5d

Function at 0x140709be4
Capabilities:
Encode data using xor

Disassembly:
shl sil, 0x36
mov r9, qword [rsp + 0x10]
jne 0x1405db28f
call fcn.1404f8982
movsxd rdi, edi
xchg qword [rsp + rdi*2 + 0x30], rdx
mov rdi, qword [rsp + rdi*2 + 0x28]
js 0x14063af69
or word [rsp + 0x18], 0x812b
and byte [rsp + 0x18], 0xbb
shr dword [rsp + 0x18], 0xe1
sub dword [rsp + 0x18], 0x800ea789
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret
jns 0x14061308f
Function at 0x140001a3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a86
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a88
xor al, al
add rsp, 0x28
ret
Function at 0x140017b00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140017ca6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1402acfb0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140034060
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140017b6b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140017b80
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x140017ba5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140017bb9
cmp rbx, 0x1000
jae 0x140017b75
nop dword [rax]
jmp 0x140017c29
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x140017bcd
xor edx, edx
jmp 0x140017c20
mov rcx, qword [0x1402acfb0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140034060
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x140017baf
jmp 0x140017b94
call fcn.140067780
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.1400387a0
lea rax, [0x14032e565]
mov ebx, 0x18
call fcn.1400390a0
mov rax, qword [rsp + 0x38]
call fcn.140038da0
lea rax, [0x14032e6b5]
mov ebx, 0x19
call fcn.1400390a0
mov rax, qword [rsp + 0x30]
nop
call fcn.140038da0
call fcn.140038a00
call fcn.140038820
lea rax, [0x14033318c]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.140036e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140063bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140017b00
Function at 0x140017ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140017f0a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1402acfa8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.1400340e0
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140017d59
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140017d6c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x140017d90
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x140017da4
cmp rbx, 0x1000
jae 0x140017d63
jmp 0x140017e25
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140017db6
xor esi, esi
jmp 0x140017e16
mov rax, qword [0x1402acfa8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.1400340e0
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x140017d9a
nop
jmp 0x140017d82
call fcn.140067780
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140017ea5
call fcn.1400387a0
lea rax, [0x14032eee9]
mov ebx, 0x19
call fcn.1400390a0
mov rax, qword [rsp + 0x68]
call fcn.140038da0
lea rax, [0x14032e6b5]
mov ebx, 0x19
call fcn.1400390a0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.140038da0
call fcn.140038a00
call fcn.140038820
lea rax, [0x140328df3]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.140036e60
cmp eax, 0x5af
je 0x140017e48
call fcn.1400387a0
lea rax, [0x14032eee9]
mov ebx, 0x19
nop dword [rax]
call fcn.1400390a0
mov rax, qword [rsp + 0x38]
call fcn.140038da0
lea rax, [0x14032e6b5]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.1400390a0
mov eax, dword [rsp + 0x34]
call fcn.140038da0
call fcn.140038a00
call fcn.140038820
lea rax, [0x1403321d1]
mov ebx, 0x1f
call fcn.140036e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140063bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140017ce0
Function at 0x1400201c0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x140605462], 0
jne 0x1400202af
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x1400202a5
lea rbx, [0x1405d7890]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x11440]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x140020287
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.140066260
lea rax, [0x1403371c4]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.140036e60
nop
int3

Function at 0x1400226a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14002279e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x1400226e0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x14002278f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.140023260
nop dword [rax]
test rax, rax
je 0x14002278f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x1400227e0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.140063a80
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x14002277d
xor eax, eax
jmp 0x140022787
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x1400226d2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.140063bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.1400226a0
Function at 0x1400300a0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x140030346
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x14003033a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x140605462], 0
jne 0x140030102
xor edx, edx
xor ebx, ebx
nop
jmp 0x14003014a
xor edx, edx
jmp 0x14003012d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.14001f9e0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x140030106
add rax, 0x1260
call fcn.14002ff60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x1400302d4
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x140030147
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.140014a80
test rax, rax
jne 0x1400301a2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x140030147
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x1400301e9
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140030147
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x14003032d
lea r10, [0x1405d7890]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x14003026f
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x1400302a5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x140030147
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x140030325
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x140030147
cmp rbx, 0x200
ja 0x140030318
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.140025b60
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.14002ff60
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.1400662c0
mov rax, r8
call fcn.140066240
mov rax, r8
mov ecx, 0x40
call fcn.140066260
mov edx, 0x200
nop
call fcn.1400662a0
nop
mov qword [rsp + 8], rax
call fcn.140068640
mov rax, qword [rsp + 8]
jmp fcn.1400300a0
Function at 0x1400456a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004580a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x1400456b8
cmp edx, ecx
jne 0x1400457f8
nop dword [rax]
test rsi, rsi
jne 0x1400457f8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140045714
nop
call fcn.140067be0
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.1400455a0
mov rcx, qword [0x1405b0d98]
mov rdx, qword [0x1405b0d90]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x1400457f3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x1400457e8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x1405b1ef0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x1405b1ef0], rbx
nop
mov edx, 1
lea rsi, [0x1405b1ef8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x1400457d7
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x140335fa5]
mov ebx, 0x28
call fcn.140036e60
mov rcx, rax
mov rax, rsi
call fcn.140066240
call fcn.140035320
lea rax, [0x140333fa2]
mov ebx, 0x23
call fcn.140036e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140063bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400456a0
Function at 0x140052560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x1400526d8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x14005259c
test r8b, r8b
jne 0x14005259c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x1400525af
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140052698
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x140052686
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x14005267c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x140052603
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x140052646
mov eax, 1
cmp rax, rbx
ja 0x140052635
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.140066300
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x140052674
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x14005263d
mov r8d, eax
mov eax, r10d
jmp 0x140052608
mov rcx, rbx
call fcn.140066240
xor eax, eax
mov rcx, rax
call fcn.140066240
mov eax, r8d
mov rcx, rbx
call fcn.140066300
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x1400526ce
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x140052691
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x1400525b5
mov eax, edx
mov rcx, rbx
call fcn.140066240
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140066240
nop
int3
Function at 0x14005a280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005a339
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x14005a380]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140063a80
xorps xmm15, xmm15
mov r14, qword [0x1406056b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140063bc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14005a280