joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c1f08
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140105700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400c1f52
call fcn.1400a70f8
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.1400a7118
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.1400a4280
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14009bb20
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400c1f5d
lea eax, [rbx + 1]
jmp 0x1400c1f3f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400c1f3d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400c1f3f
Function at 0x1400c33a4
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400a7138
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400c342e
cmp byte [rbp - 0x21], r15b
je 0x1400c3429
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400c3464
call fcn.1400b6600
test eax, eax
jne 0x1400c3450
cmp byte [rbp - 0x21], r15b
je 0x1400c3448
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400c3464
cmp byte [rbp - 0x21], r15b
je 0x1400c3461
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400af988
test eax, eax
jne 0x1400c3504
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400a7138
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400c34a3
cmp byte [rbp - 0x21], r15b
je 0x1400c34d8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400c34d8
call fcn.1400b6600
test eax, eax
jne 0x1400c34c4
cmp byte [rbp - 0x21], r15b
je 0x1400c34bd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400c34d8
cmp byte [rbp - 0x21], r15b
je 0x1400c34d5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400af988
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400c3504
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400c3507
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400c3515
mov rcx, rdi
call fcn.1400b6358
cmp byte [rbp + 0x3f], r15b
je 0x1400c3524
mov rcx, qword [rbp + 0x27]
call fcn.1400b6358
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x141473c31
Capabilities:
Encode data using base64

Disassembly:
ror si, 0xa8
mov qword [rsp + rbp + 0x2c88842], r9
mov rbp, qword [rdi + rbp*2 + 0x591108c]
mov eax, edx
not rbx
not rbp
jb 0x1414f932c
jb 0x14148f379

Function at 0x141479dab
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov qword [rsp + rdx - 0xff], 0xfffffffffc0efbb4
ror byte [rsp + rdx - 0xff], 0xa3
mov qword [rsp + rdx - 0xff], r10
push r11
cmovb ebp, ebx
sar edx, 0xf1
mov rbp, rdi
jae 0x14151f47a
jne 0x141475c78
add dl, 0x83
mov ebx, r9d
jno 0x141508fa7

Function at 0x14147c6d7
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + rsi*2 - 0x6850641e], rsi
not r8d
sub word [rsp + rsi - 0x3428320f], 0x5e2a
mov dword [rbp + rsi*2 - 0x6850641e], r8d
lea rdi, [rdi + rsi*2 - 0x68506422]
movzx r11d, si
mov esi, dword [rdi + rsi*2 - 0x6850641e]
mov eax, dword [rsp + r11*8 - 0x19078]
jbe 0x1414a1022

Function at 0x1414866b7
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.14149e8f3
jmp 0x141515e69
mov eax, 0xc886d1f
shl rax, 0x3f
mov rax, qword [rbp + rax*2]
sub rsp, 0x20
call fcn.1414c91c2
push 0x2091102c
lea rsp, [rsp + 0x10]
je 0x141477c4b
mov eax, 0xae9d46a1
not eax
jmp 0x14151d951
push 0x6e9b91a8
cmp ebx, 1
not word [rsp + 3]
call fcn.1414de798
pop rbx
ja 0x1414ee56b
mov cl, byte [rdi + rsi*4 - 2]
or rbx, 0xffffffffa5876ba7
lea rdi, [rdi + rbx + 0x868945b]
inc bx
xor edx, esi
shr r9w, cl
neg edx
jbe 0x1414e70fc
xor dword [rsp + r11 - 0xea1], r9d
shr qword [rsp + r11 - 0xea9], 0x16
mov rbx, qword [rsp + r11 - 0xea1]
sar r8b, 0x21
movsxd r9, r9d
and r8b, sil
movsx eax, si
or r8b, r8b
adc r10, r9
pop r9
mov esi, dword [rbp + r11 - 0xea9]
mov qword [rsp + r11*8 - 0x7548], 0xc322c86
sal r9b, 4
shl ax, 0x65
mov r8d, dword [r11 + rbp - 0xea5]
mov cl, byte [rbp + r11*4 - 0x3a9c]
inc r9d
lea rbp, [rbp + r11*4 - 0x3a9e]
or r9b, 0x1d
dec word [rsp + r11*2 - 0x1d4f]
shld esi, r8d, cl
call fcn.1414c69ac
neg rdx
not esi
push rbx
adc r11, 0xffffffffed8d393b
xor dword [rsp + r9*2], esi
pop rbx
sar r8d, 0xb4
or r8, r9
movsxd rsi, esi
shr edx, 0x4c
inc eax
call fcn.14149330e
mov word [rsi + rdi - 1], r9w
jno 0x14146b893
movsxd rax, eax
rol rdx, cl
sbb sil, sil
neg r8b
add rdi, rax
lea r8, [rdx + rsi*4 + 0x362dc716]
jmp rdi
xor qword [rsp + rcx - 0x19c988d], r9
mov rdx, qword ss:[rcx + rbx - 0x19c988d]
movsx ebp, cl
mov qword [rdi + rcx*2 - 0x339311a], rdx
lea r8, [rcx + r8 - 0x19c9891]
shr rbp, 0x1c
mov r9d, dword [r8 + rcx*2 - 0x339311a]
call fcn.14149ec1f
mov edx, 0x5cbeb690
lea rax, [rdx + rdx*4 + 0x2903fdae]
neg dx
lea rdi, [rdx + rdi - 0x5cbe4972]
movzx r11d, dl
lea r9, [r11*2 + 0x4996cd0a]
movzx ecx, word [rdi + r11 - 0x70]
sbb edx, edx
call fcn.1414aa8e3
mov ecx, 0x19c988d
movzx r9d, cl
mov rbx, qword [r9 + rdi - 0x8d]
push r9
jmp 0x141510548
mov rax, qword [rbp + rbx*8]
jmp 0x1414c0d2d
Function at 0x14148c8e4
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jne 0x141492291
jmp 0x1414adddb
mov eax, 0x840dbe1d
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
call fcn.1414ce1a0
push rbx
jns 0x141521317
mov eax, 0xd9b8f12d
mov rax, qword [rbp + riz]
mov ebx, ecx
xor dword [rsp + r9 - 0x78a75e25], edx
shr r11d, 0x73
pop rbx
xor cx, si
movsxd rdx, edx
lea rax, [r9*4 - 0x1c5f9cfc]
adc r10, rdx
jmp fcn.1415004aa

Function at 0x14148cce7
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
lea r9, [rax + r9 - 1]
movzx ebp, byte [r9 + rax]
lea rcx, [rax*4 - 0x63778167]
call fcn.1414c395e
mov rdx, qword [rbp + r11*2 - 0x26]
mov r11w, word [rdx + rax + 0x6fe23ced]
mov ecx, r9d
lea rbp, [rbp + r8 - 0x64a189b1]
call fcn.1414fd433
call fcn.14147f58f
sub r8, 4
mov ecx, 0x698079bc
shl ecx, 0xc
call fcn.1414712f6
mov ebp, 0xb402b13f
movzx eax, bpl
mov esi, eax
mov r11, qword [r10 + rax*2 - 0x7e]
movzx edx, ax
xadd sil, al
lea r10, [rax + r10 - 0x37]
and al, dh
lea r8, [rax + rbp*8 + 0x6180babd]
jge 0x141465e6f

Function at 0x14148cd2c
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
sal r9d, 0xdf
dec ax
push rbp
mov qword [rsp + r9 + 0x10], rsi
neg ax
xor r11w, ax
lea rdx, [r9 + rcx*8 - 0x4f59acca]
or edx, 0xbfae681f
lea rax, [rsp + rax + 0x28]
jno 0x1414bec65
mov word [rax + r9*2], bx
pop rdx
mov qword [rsp + r9*2], r10
ret 0x18

Function at 0x14148e0b1
Capabilities:
Encode data using base64

Disassembly:
xor edx, ebx
bswap edx
rol cl, 3
xor edx, 0x2c3f4992
sal al, 0x65
call fcn.14148b7fd

Function at 0x141491886
Capabilities:
Encode data using base64

Disassembly:
ror r8b, 1
shr cl, 0x63
movzx ebp, cx
neg r8b
mov qword [rsp + r11*4 - 0x14890], r11
dec sil
xor bl, r8b
sal word [rsp + r11*2 - 0xa43d], cl
jp 0x1414b88cd
lea r8d, [r11 + r8 + 0x233e3e06]
lea rbp, [r11*4 - 0x7f79ffc3]
push rbx
movzx edx, bpl
xor dword [rsp + r11 - 0x18], r8d
lea rsi, [rcx + rcx*8 - 0x4e5db6fa]
dec bp
pop rbx
ror rbp, cl
movsxd r8, r8d
adc rdi, r8
dec rbp
mov dl, byte [rdx + r10 - 0x9d]
ror cx, 0x82
jae 0x1414df78a
sal eax, 0xb1
lea r8, [rsp + r8 + 0x18]
pop rdx
and r11d, esi
mov rcx, qword [r8 + r11*2 - 0x48]
sar qword [rsp + r11*2 - 0x43], 0xcc
lea r10, [r10 + r11 - 0x2c]
mov qword [r10 + r11*2 - 0x48], rcx
jae 0x1414aa848
sal ecx, cl
mov r8b, byte [r10 + r11 - 0x16]
lea r10, [r11 + r10 - 0x16]
sbb cl, 0x93
not dl
not r8b
sub rcx, rcx
push rsi
dec word [rsp + rcx*2 + 2]
or dl, r8b
pop rbp
xor r11w, 0xa923
mov word [r10 + rcx*2], dx
or rcx, rdi
jmp rcx

Function at 0x1414992f3
Capabilities:
Encode data using base64

Disassembly:
lea r10, [r10 + r8 - 0x21]
add r11, rdx
sar r8w, 7
dec r8d
mov qword [r10], r11
lea rcx, [rcx*4 - 0x65cb53d0]
call fcn.1414c6fd0
mov r11, qword [r10]
pop rsi
movzx r8d, al
lea rcx, [rax*8 - 0x5a692280]
mov rdx, qword [r10 + r8 - 0x21]
jmp 0x141482841
Function at 0x14149bc46
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r11 - 0x7ff8], rbx
push rcx
and r11b, byte [rsp + r11 - 0x7ff1]
xor dword [rsp + r11*2 - 0xfff0], esi
sal r8b, 0x43
sbb ecx, r11d
mov rbx, qword [rsp + r11*4 - 0x1fff0]
movsxd rsi, esi
dec r11b
add r10, rsi
xor qword [rsp + r11*4 - 0x203fc], r10
ret 0x10
xor esi, ebx
rol r11b, 0x27
lea esi, [rsi + r11*4 - 0x327d0ba]
ror esi, 2
lea esi, [rsi + r11*2 - 0x7784f721]
sub word [rsp + r11 - 0x327b], ax
shl r11w, 0xcf
movsx ecx, r11b
not esi
movzx edx, byte [rsp + r11*2 - 0xfff6]
js 0x1414acc10
mov r8d, 0xe391db0f
inc esi
bswap rcx
mov qword [rsp + r11 - 0x8000], 0x50210bba
jmp 0x14148b583

Function at 0x14149f1d1
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.141474378
jb 0x1414fc61c
mov ebp, 0xdf9ce69e
or byte [rsp + rax - 0x58bc0d9f], 0x38
lea r9, [rsp + r9 + 0x10]
jg 0x1414a23bc
call fcn.1414beec0
pop rbx
movsxd rdx, edx
add r10, rdx
jmp r10
mov qword [r9 + rdx - 0x58bc0dad], rsi
movzx r9d, bpl
shr dx, 0x8d
inc eax
lea r8, [r9 + r8 - 0xa2]
jae 0x1414eebdf
mov ebp, 0x94b84cab
push rbp
sub r9, 4
lea rdx, [rbp + rbp*8 + 0x38aef1a4]
jmp 0x1414f5b84
call fcn.1414fb28c
xadd r9d, ebx
pop r11
lea rcx, [rdx + rsi*8 + 0x111fb037]
movsxd rax, eax
adc r10, rax
shl r9b, cl
movzx eax, bp
xor ebp, 0xcba1f190
jae fcn.1415024e5
mov ebx, dword [r8 + r9 - 0x9e]
xor ebx, r11d
rol ebx, 1
sar byte [rsp + r9*2 - 0x13c], 0x24
bswap ebx
xor al, bpl
jge 0x14150764f
mov rsi, qword [rbp + riz]
mov r11d, 0x94b9020f
and r11w, r11w
mov r9d, r11d
mov r8w, word [rbp + 8]
movzx ecx, r9b
lea rbp, [rcx + rbp - 5]
mov word ss:[rsi + rcx - 0xf], r8w
dec r11d
movsx esi, r11b
lea rdi, [rdi + rcx - 0x13]
adc r11d, 0xc79db4af
jb 0x1414644af
mov ebp, dword [r9]
mov byte [rsp], dl
xor ebp, ebx
sar qword [rsp], 0xda
xor ebp, 0x20bf170c
movsx ecx, word [rsp + 3]
rol ebp, 1
movsx esi, dl
jmp 0x141487a70
ror ebx, 3
lea rsi, [rcx + rcx*8 - 0x66f313d5]
sal word [rsp + r9*2 - 0x136], 0x87
dec ebx
inc sil
or r9, qword [rsp + rdx - 0x58bbfff8]
mov qword [rsp + rax - 0x58bc0d28], r11
and qword [rsp + rax - 0x58bc0d30], rcx
dec esi
xor dword [rsp + rdx - 0x58bbfff8], ebx
mov r11, qword [rsp + rax - 0x58bc0d28]
inc al
rol esi, 0xda
movsxd rbx, ebx
mov qword [rsp + rax - 0x58bc0d29], rsi
call fcn.1414702fa
push 0xffffffffca2bad30
cmp ebx, 3
lea rsp, [rsp + 8]
jne 0x141474ea5
jmp 0x1414ec51f
Function at 0x14149f9b9
Capabilities:
Encode data using base64

Disassembly:
pop rbp
pop rsi
pop rbp
jmp fcn.1415024e5
mov qword [rsp + rdx*2], r11
xor dword [rsp + rax*2 - 0x7c], esi
shl dl, 0xa1
pop r11
movsxd rsi, esi
lea rcx, [rbp + 0x28976082]
xor rax, rax
jno 0x1414cc97f
mov r11, qword [rsp + 0x10]
ror r9, 0xb
mov ecx, eax
movsxd rdx, edx
adc r10, rdx
mov qword [rsp + rcx - 0x1b7b5919], rcx
jmp 0x141497cbc
adc r10, rsi
rol ax, 0x89
mov rbx, qword [rbp + rdi - 0x642d1d3e]
movzx r9d, ax
sar rcx, 0x3d
or eax, r9d
or dl, byte [r8 + rax - 5]
xor dl, r11b
dec dl
movsx esi, r9b
inc bpl
rol dl, 1
lea rbp, [rax - 0x6dd31063]
or eax, r9d
neg dl
not r9b
neg ebp
inc ax
xor dl, r9b
xadd bp, si
neg rbp
sub dl, al
not rax
rol ebp, 0x9c
rol dl, 1
and ebp, r9d
adc dl, 0xa8
shr esi, 0x8c
sal ebp, 0xca
jne 0x14151eae7
xor r11b, dl
neg rbp
add rdx, rsp
shl rax, 0x1a
jnp 0x1414a7bb3
mov qword [rdx + rbp*2 + 0x7c800], rbx
jp 0x1414ba408
mov edx, 0x7f3ac22d
call fcn.1414e2a04

Function at 0x1414a15bc
Capabilities:
Hash data using murmur3

Disassembly:
xor ebx, r11d
inc ebx
dec rcx
not ebx
bswap ebx
push rsi
lea ebx, [rbx + rsi*2 - 0x7a810419]
mov dword [rsp + rcx - 0x41b7de34], esi
jg 0x1414e6641
mov eax, dword [r9 + r8 - 0xb]
xor eax, r11d
lea rbp, [r9 + rdx - 0x184fbc5c]
sub rbp, 0x6a2ff5a6
adc r9d, edx
inc eax
not bpl
dec bp
rol eax, 1
ror dl, 0xc7
mov ecx, 0x378ce78e
push rsi
not eax
sbb eax, 0xcfbd3224
shl si, 0x61
bswap eax
lea rbx, [rsi*4 - 0x6451a5fc]
dec sil
inc eax
ror eax, 1
jmp 0x1415056d5
adc r9w, ax
add cl, sil
mov qword [rsp + rsi*4 - 0x10], 0x4fb86700
mov word [rcx + rdi - 0x41b7de3e], r9w
mov ebx, dword [r8 + rcx - 0x41b7de44]
sub byte [rsp + rsi - 3], sil
lea r8, [r8 + rsi - 8]
push rsi
jae 0x14147ee07
inc bpl
not ebx
mov r9d, dword [rsp + rsi*4 + 2]
mov qword [rsp + rcx - 0x41b7de2f], r11
xor dword [rsp + rsi + 0xc], ebx
xchg qword [rsp + rsi + 4], r9
mov r11, qword [rsp + rcx - 0x41b7de2f]
sal r9d, cl
sal word [rsp + rcx - 0x41b7de3a], 0xa8
call fcn.1414ab96d
sar si, 0xc8
bswap eax
mov qword [rsp + rbp - 0x7d804b4b], r11
xor dword [rsp + rsi - 0xfffb], eax
shr r9w, cl
xor bx, r9w
inc ecx
pop r11
inc rbx
sar r9d, cl
push rbp
movsxd rax, eax
sar ebp, cl
add r10, rax
mov qword [rsp + rbp*4 - 0x3ec00], r10
ret

Function at 0x1414ae290
Capabilities:
Authenticate hmac
Hash data using murmur3

Disassembly:
movsx eax, bp
bswap esi
mov qword [rsp + r9*2 - 0x9c188a], r9
mov qword [rsp + r9*2 - 0x9c187a], 0x31d734
call fcn.1414fca69

Function at 0x1414b4f13
Capabilities:
Hash data using murmur3

Disassembly:
movzx edx, byte [rsp + r11*2 - 0x72]
lea eax, [rax + r11*4 + 0x3a80458d]
neg r9w
push r9
mov qword [rsp + r11 - 0x26], rbx
mov qword [rsp + r11 - 0x36], r9
xor dword [rsp + rcx*4 - 0x368], eax
movzx r8d, dx
mov rbx, qword [rsp + r11 - 0x26]
call fcn.1414a05c4
mov eax, 0x50b44601
movzx r9d, al
lea rcx, [r9*4 - 0x17ec3272]
lea rdi, [rdi + r9 - 3]
not r9b
dec r9d
sal r9d, cl
movzx r8d, word [rdi + r9 - 0x3f40000]
xor r8w, bx
rol r8w, 1
sal ax, 0xa9
inc r8w
add ax, 0x3227
not r8w
adc r8w, 0x542f
movzx esi, r9b
xor bx, r8w
rol cx, 0x86
shr ax, 0x6a
sar ax, 0xee
adc r8, rsp
jmp 0x1415195a8
Function at 0x1414bde45
Capabilities:
Hash data using murmur3

Disassembly:
rol dl, 0x82
jae 0x1414e7e4f
neg edx
mov r11d, ebp
sub edx, 0xb3ac207
lea r8, [r11*2 + 0x7f19539a]
bswap edx
jmp 0x1414fe93c
mov rax, qword [rbp + riz]
sub rsp, 0x18
push 0xffffffff8291b83c
call fcn.1414f8a3d
sub r9, 4
mov ebp, 0xc5b45f95
mov edx, dword [r9]
xor edx, ebx
jmp 0x1414b7963
mov rsi, qword [r9 + rsi*2 + 0x4abf450]
xor rsi, rbx
shr rax, cl
xor r8d, 0xa21fc706
inc rsi
mov ebp, edx
ror r8, 0xbe
xchg ecx, eax
rol rsi, 3
xor rsi, 0xffffffffa336759c
bswap rsi
shr ebp, 0xd
shl rcx, 0x1d
xor rbx, rsi
sar al, 0x61
add al, 0x99
lea r10, [r10 + r8 - 0x3562337c]
shr dx, 0xe1
xadd ecx, r11d
mov qword [r10 + r11*2], rsi
sar r11d, cl
setne cl
jbe fcn.141485a3f
sal r11w, 0x84
neg edx
call fcn.14151a19b
lea r9, [rax + rax*4 - 0x6151b950]
mov edx, dword [rdi + rsi*2 - 0x53660672]
call fcn.1414d6684
pop rbx
movsxd rcx, ecx
adc rdx, 0x23ba5e29
and dl, 0x87
sar si, 0x64
add rdi, rcx
not sil
lea rcx, [r8*8 + 0x713b498c]
lea r9, [r9 + r11 - 0x50b8b42e]
jmp 0x14149a75d

Function at 0x1414c5a51
Capabilities:
Encode data using base64

Disassembly:
lea rcx, [rax*8 + 0x5a3b6b12]
xor r8d, ebx
lea rdx, [rax*4 - 0x2c00678]
sub r8d, 0x38304311
mov qword [rsp + rax - 0x72074200], rax
xor r8d, 0xf862982
dec byte [rsp + rax - 0x720741fe]
setne dl
xadd cl, dl
inc r8d
pop rsi
ror r8d, 3
lea rax, [rax + rax*4 + 0x1715052f]
push rbx
mov r11d, 0x5dbad811
xor dword [rsp + r11 - 0x5dbad811], r8d
push r11
ror qword [rsp + rsi - 0x72064200], cl
mov rbx, qword [rsp + r11 - 0x5dbad809]
jae 0x1414cf2da
mov esi, 0xd994032b
movsx r8d, sil
movsx ecx, si
lea r9, [r9 + r8*2 - 0x5a]
dec ecx
mov r11d, dword [r9 + r8*2 - 0x56]
jns 0x1414c5ff7
xor r11d, ebx
jmp 0x1414e7268
and r11w, r11w
dec eax
movsxd r8, r8d
jg 0x14150023e
mov eax, 0x76bc7a2a
movzx esi, ax
mov eax, dword [rax + rbp - 0x76bc7a2a]
call fcn.1414f63f3
add rsi, r8
dec r11d
xor r11d, 0x9aa2b893
ror r11d, 1
call fcn.14148454d
mov r9d, 0xe727c799
mov ecx, r9d
sub r8, 8
mov rdx, qword [r8]
movzx eax, cx
xor rdx, r11
bswap rdx
lea rbp, [rax + rcx*4 + 0x74ad5c34]
ror rdx, 3
xadd r9b, al
sub r9d, ebp
not rdx
lea rsi, [rax + rcx*8 + 0x4a222b2]
xor rdx, 0x13359da0
neg rdx
mov qword [rsp + rax - 0x51394f26], rsi
adc r10, r8
mov r8d, edx
neg esi
mov edx, dword [rax + rbp - 0x51394f2e]
mov eax, dword [rbp + r11 - 0x5dbad80d]
mov esi, dword [rbp + r11 - 0x5dbad809]
neg byte [rsp + r11 - 0x5dbad810]
mov r9d, dword [rsp + r11 - 0x5dbad80a]
lea rbp, [rbp + r11 - 0x5dbad80d]
neg r8d
and r8b, 0xa2
div esi
rol word [rsp + r11 - 0x5dbad80a], 0x8e
mov dword [rbp + r11 - 0x5dbad811], edx
call fcn.141477eb3
mov cl, byte [r10 + rcx*2 - 0x62]
lea r11, [r11*4 - 0xac8c7ef]
lea r10, [r10 + rsi*2 - 0x46]
shrd dx, bp, cl
push r11
call fcn.1414aefaf
Function at 0x1414cba92
Capabilities:
Authenticate hmac

Disassembly:
xor r9b, dl
inc r8b
mov qword [rsp + rax - 0x73f35c1], rdx
xor r8b, 0x1e
ror r8b, 1
xor r8b, 0xa
xadd dword [rsp + rax - 0x73f35bf], eax
mov r11d, eax
movsx esi, r11w
xor bl, r8b
lea rbp, [rbp + rdx*2 + 0xc992fa2]
call fcn.14148183a
push 0xffffffffb51e1514
mov r8d, 0x3f9f6f85
mov word [rsp + r8 - 0x3f9f6f80], r8w
mov rax, rbp
xchg byte [rsp + r8 - 0x3f9f6f82], r8b
inc word [rsp + r8 - 0x3f9f6fb5]
lea rbp, [rbp + r8 - 0x3f9f6fb9]
jnp 0x1414df076
mov dword [rbp + r8 - 0x3f9f6fb5], eax
lea rdi, [rdi + r8*2 - 0x7f3edf6e]
mov r8d, dword [r8 + rdi - 0x3f9f6fb5]
push 0xfffffffffd9bcb1e
pop r11
xor r8d, ebx
call fcn.1415208ab
jmp 0x1414e2adc
mov r9d, 0xd3bc80a5
mov edx, r9d
movzx ax, byte [rbp + riz]
shl edx, 0x3b
mov cl, byte [rbp + rdx - 0x27fffffe]
movsx esi, dx
lea rbp, [rdx + rbp - 0x27fffffe]
shl al, cl
lea rcx, [rsi + r9*4 - 0xbe51051]
call fcn.141484d1a

Function at 0x1414ccd97
Capabilities:
Encode data using base64

Disassembly:
adc r10, 0xc
push 0x673dad3d
xor ebp, ebp
push 0xffffffff909b75af
test rdx, rdx
push 0xffffffffc49b5085
lea rsp, [rsp + 0x20]
je 0x1414f6e69
push r10
mov r10d, 0x452eae1c
add r10w, r10w
push rdi
jle 0x1414fdbff
js 0x1414b17bc
lea rdi, [r10*2 - 0x5841e1e7]
lea r10, [0x14150e9a8]

Function at 0x1414cf724
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov qword [rsp + rbx - 0x54a19766], rax
mov edx, dword [rdx + r8 - 0x142e43a9]
xor qword [rsp + r9 + 4], 0x4706be06
setle bl
xor edx, r11d
rol edx, 1
add r9b, al
mov ebp, esi
jae 0x1414fc5bb
neg edx
xor edx, 0xe1127c31
not r9w
lea edx, [rdx + rbx - 0x642ad022]
lea rcx, [r9 + r9*4 - 0x74585e69]
sub r9, rcx

Function at 0x1414d5edb
Capabilities:
Encode data using base64
Encrypt data using chaskey
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + rax*4 - 4], rsi
rol ebx, 1
not ebx
mov qword [rsp + rax*8], r11
sub word [rsp + rax*2 - 1], cx
rol eax, 1
lea rdx, [rsi + r9 - 0x367802cf]
xor dword [rsp + rax*2 + 4], ebx
pop rsi
pop r11
add dl, ch
inc r9w
movsxd rbx, ebx
jno 0x1414ff9b4
adc r10, rbx
shl rsi, cl
mov r9, qword [rdi + rax*2 + 0x14]
lea rdi, [rdi + rax*8 + 0x10]
xchg bpl, sil
movzx ebp, byte [r8 + rax*4 - 0xf]
lea r8, [r8 + rax*4 - 0xf]
jp 0x141520c53

Function at 0x1414d8d64
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
and eax, 0x3e9f2437
mov qword [rsp + r11*4 + 0x55744fa4], 0x2b9ac3f
mov rsi, qword [r9 + r11*4 + 0x55744fa4]
mov qword [rsp + r11 + 0x155d13f1], rax
mov qword [r11 + rbp + 0x155d13e1], rsi
lea rbp, [rbp + r11*4 + 0x55744f9c]
mov r8d, dword [rdi + r11*2 + 0x2aba27cd]
lea rdi, [r11 + rdi + 0x155d13e4]
cmovp cx, word [rsp + r11 + 0x155d13f0]
xor r8d, ebx
and cx, ax
neg r8d
or cl, r11b
jne 0x1414f0050
Function at 0x1414db98d
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [rsp + r11*4 + 0x5fe329ac], r9d
push rax
jmp 0x1414c57ec
not r9d
inc r9d
not r8d
lea rax, [rsi*8 - 0x105e4946]
bswap r9d
add r8w, 0x7518
xchg si, r11w
lea r9d, [rcx + r9 - 0x360b38f5]
xchg r8d, edx
inc r11b
ror r9d, 1
pop rcx
sal ax, 0x4a
bswap r9d
lea r11, [r8 + rax*4 + 0x1ab29595]
push rbx
movsx ecx, ax
jb 0x1414aea0e

Function at 0x1414de798
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x14150c999
push rax
push 0xffffffffa4b84aa4
dec ebx
lea rsp, [rsp + 8]
jne 0x1414866c7
mov eax, 0x5a256b9b
xor al, ah
dec eax
mov rax, qword [rbp + rbx*8 + 0x20]
jae 0x141477c38
mov ebp, 0x4029702b
call fcn.1414b4543
mov edx, 0xfd253396
mov rax, qword [r10]
lea rcx, [rdx - 0x362c07e]
mov esi, dword [rax]
add r10, 4
mov dword [r10], esi
sub cx, 0xfe80
lea rbp, [rcx + 0x36081538]
sub r9, 4
mov esi, edx
mov edx, dword [r9]
xor edx, ebx
movzx r11d, si
xor bpl, 0x38
inc edx
xor edx, 0x8097ab16
not edx
sub r11, rbp
and rbp, rsi
movzx r8d, r11b
dec edx
xchg ecx, r11d
push rbx
xchg r11b, bpl
push rcx
xor dword [rsp + r8 - 0xa6], edx
jmp 0x1414a6323
cmp ebx, 3
jne 0x141464728
jmp 0x1414e6675
rol rcx, 0xc6
bswap r8d
mov rbx, qword [rsp + rbp - 0x2d000190]
lea rbp, [rsi*2 - 0x6ae4b46d]
mov qword [rsp + 8], r11
call fcn.1415183c6
lea rsp, [rsp + 0x10]
jne 0x1414e29b6
push 0x2095f330
mov rcx, rax
lea rsp, [rsp + 8]
jmp 0x141477c39
cmp ebx, 2
push 0x5e0f5629
lea rsp, [rsp + 8]
jne 0x1414972fd
mov edx, 0xe1278589
push rdx
pop rdx
mov rdx, rax
push 0xffffffffb42b67a6
lea rsp, [rsp + 8]
jmp 0x141477c39
mov r8d, 0xf7356c28
mov r8, rax
jmp 0x141477c39
push 0x2e14878a
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x141480819
mov r9d, 0x35b8e9b2
call fcn.1414de931

Function at 0x1414de931
Capabilities:
Hash data using murmur3

Disassembly:
mov r9, rax
lea rsp, [rsp + 8]
jmp 0x141477c39

Function at 0x1414e7558
Capabilities:
Encode data using base64

Disassembly:
inc ebp
mov qword [rsp + r11 + 0x10], r8
dec edx
mov qword [rsp + r11*8], 0xffffffffb715fe25
sub dword [rsp + r11*2 + 0x23], ebp
mov qword [rsp + r11 + 0x20], rbx
shl rcx, cl
mov ebx, r8d
xor dword [rsp + r11 + 0x20], edx
not qword [rsp + r11 + 0x10]
call fcn.14149dbbb