joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff757aea630
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x7ff757aea664
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x7ff757aea650
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff757ae6ab0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff757aea689
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff757af5dc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff757aea703
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff757aea6fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff757aea6fe
push rdi
call fcn.7ff757c685a2
int3
call fcn.7ff757b4acec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff757aea710
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x7ff757aea744
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x7ff757aea730
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff757ae6ab0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff757aea769
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff757af5dc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff757aea7e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff757aea7de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff757aea7de
call fcn.7ff757b4acec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff757aea7f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x7ff757aea824
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x7ff757aea810
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff757ae6ab0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff757aea849
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff757af5dc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff757aea8c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff757aea8be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff757aea8be
call fcn.7ff757ccc786
invalid
call fcn.7ff757b4acec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff757aea8d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x7ff757aea904
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x7ff757aea8f0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.7ff757ae6ab0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff757aea929
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.7ff757af5dc0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x7ff757aea9a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff757aea99e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff757aea99e
push rdi
call fcn.7ff757cfbfda
int3
call fcn.7ff757b4acec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff757af1190
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x7ff757af11b3
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x7ff757af11a0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.7ff757ae6ab0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff757af1fc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x7ff757af1fe3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x7ff757af1fd0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x7ff757af1ff0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x7ff757af2018
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x7ff757af2000
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x7ff757af2020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x7ff757af2043
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x7ff757af2030
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x7ff757af2050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x7ff757af2073
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x65]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x7ff757af2060
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x7ff757af2780
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x7ff757af2867
sub r10, rdx
cmp r8, 8
jb 0x7ff757af2843
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x7ff757af27b0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x7ff757af2867
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x7ff757af2850
test r9d, r9d
sete al
ret
Function at 0x7ff757b11fe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x7ff757b1203e
mov dl, 1
call fcn.7ff757b02a80
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.7ff757b02a80
mov eax, ebx
jmp 0x7ff757b12082
cmp ebx, 2
ja 0x7ff757b12080
mov r9, qword [rdi + 0x668]
lea rdx, [0x7ff757b51638]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff757b2fd60
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x7ff757b2fd95
lea rdx, str.Couldnt_set_desired_mode
call fcn.7ff757b120a0
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x7ff757b2fdac
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.7ff757b12220
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x7ff757b2fdc8
mov rcx, rdi
call fcn.7ff757b2fca0
jmp 0x7ff757b2feff
cmp esi, 0x14
jne 0x7ff757b2fee1
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x7ff757b2fe49
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x7ff757b2fe49
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.7ff757afb730
test eax, eax
jne 0x7ff757b2feff
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.7ff757b4bad6
test rax, rax
je 0x7ff757b2fe3e
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x7ff757b2fe49
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ucrtbase.dll_free_1]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x7ff757b2fe6d
cmp byte [rsi + 0xf0d], bl
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x7ff757b5b639]
test rbp, rbp
mov r9, r8
lea rax, [0x7ff757b4e140]
cmovne r9, rbp
lea rcx, [0x7ff757b51468]
cmovne r8, rax
call fcn.7ff757b00950
mov rcx, rbp
mov r14, rax
call qword [sym.imp.ucrtbase.dll_free_1]
test r14, r14
jne 0x7ff757b2feac
lea ebx, [r14 + 0x1b]
jmp 0x7ff757b2ff01
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x7ff757b55c60]
call fcn.7ff757b45ec0
mov rcx, r14
mov esi, eax
call qword [sym.imp.ucrtbase.dll_free_1]
test esi, esi
je 0x7ff757b2fed5
mov ebx, esi
jmp 0x7ff757b2ff01
mov dword [rdi + 0xab8], 0x1f
jmp 0x7ff757b2ff01
cmp esi, 0x15
jne 0x7ff757b2feec
lea r8d, [rsi - 8]
jmp 0x7ff757b2fef5
cmp esi, 0x16
jne 0x7ff757b2ff01
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.7ff757b2f7d0
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff757b357f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x7ff757b35914
cmp r8d, 0xff
jne 0x7ff757b35851
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x7ff757b3583b
lea r8, [0x7ff757ae0000]
mov r9, qword [r8 + r10*8 + 0x777e0]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.7ff757b12220
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.7ff757b12220
cmp r8d, 0xfb
jne 0x7ff757b35863
lea r9, str.WILL
jmp 0x7ff757b358a1
cmp r8d, 0xfc
jne 0x7ff757b35875
lea r9, str.WONT
jmp 0x7ff757b358a1
cmp r8d, 0xfd
jne 0x7ff757b35887
lea r9, [0x7ff757b58204]
jmp 0x7ff757b358a1
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x7ff757b358fd
cmp r10d, 0x27
jg 0x7ff757b358d4
lea r8, [0x7ff757ae0000]
mov r8, qword [r8 + r10*8 + 0x77e00]
test r8, r8
jne 0x7ff757b358e4
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.7ff757b12220
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x7ff757b358bb
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.7ff757b12220
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.7ff757b12220
add rsp, 0x38
ret

Function at 0x7ff757b4a740
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sym.imp.ucrtbase.dll_malloc_1]
mov rdi, rax
test rax, rax
jne 0x7ff757b4a782
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x7ff757b4a7c9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x7ff757b4a822
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x7ff757b4a7e0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x7ff757b4a863
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x7ff757b5b3ea]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x7ff757b5b3eb]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x7ff757b4a830
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
Function at 0x7ff757b77550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x7ff757b7757c
xor al, al
jmp 0x7ff757b776a0
movdqa xmm0, xmmword [0x7ff757b97ae0]
movdqa xmm1, xmmword [0x7ff757b97af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x7ff757b97b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x7ff757b97b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x7ff757b77692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x7ff757b775f9
mov r11d, 2
jmp 0x7ff757b7761d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x7ff757b77613
mov r11d, 1
jmp 0x7ff757b7761d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x7ff757b776b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x7ff757b7765a
mov byte [rcx + 2], 0x3d
jmp 0x7ff757b7766a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x7ff757b7767c
mov byte [rcx], 0x3d
jmp 0x7ff757b77683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x7ff757b775e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x7ff757b7769b

Function at 0x7ff757bedac1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
call fcn.7ff757d04464

Function at 0x7ff757c1c62c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x28], r10
xor r12, r10
xor r12w, r12w
or r12b, byte [rsp + 0x2f]
add qword [rsp], 0xffffffffbfd2814c
xchg qword [rsp + 0x40], rcx
push r15
xor r10, 0x54e24d84
movzx r10w, r10w
je 0x7ff757c87d92
mov r10, qword [rsp + 0x40]
call fcn.7ff757c7a01e
xor ebp, 0x4aa1ac9
xchg qword [rsp + rbp - 0x184a3f30], rax
add qword [rsp + 0x18], 0xffffffffbfe87048
and bp, 0x5df9
sub ebp, ebp
not ebp
push r12
not bpl
mov qword [rsp + 0x20], rax
call fcn.7ff757c48b03

Function at 0x7ff757c68ea5
Capabilities:
Encode data using base64

Disassembly:
pushfq
test r12w, 0x56e4
setae r12b
xchg qword [rsp + 0x18], rbx
not r12d
sub r12, r12
or r12, 0x548c7a71
je 0x7ff757d00ede
call fcn.7ff757d5d575

Function at 0x7ff757ca5bd5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp r13b, 0xef
call fcn.7ff757c6614e
Function at 0x7ff757ca5bf5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r8
add qword [rsp + 0x18], 0xfffffffffff26a19
movabs r8, 0x3d7d105b11f14f0d
not r14
not r14b
add qword [rsp + 8], 0x1d37ff
add r8d, ecx
mov r8b, r14b
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
add qword [rsp + 0x10], 0xffffffffbfeeb463
sub r14d, r14d
neg ecx
xor cl, 0xc1
setge r14b
test rcx, 0x67763d24
movsx r8w, cx
call fcn.7ff757cb9746

Function at 0x7ff757d00eb6
Capabilities:
Encode data using base64

Disassembly:
setl dl
mov rdx, qword [rsp + 0x88]
neg byte [rsp + 0x50]
mov r13, r14
xor rbp, 0x71992e8e
call fcn.7ff757c48b0b

Function at 0x7ff757d00ed4
Capabilities:
Encode data using base64

Disassembly:
lea rdx, [rdx + 0x5864120]
neg rbx
jge fcn.7ff757da5637

Function at 0x7ff757d10596
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x18], 0xcaab2
mov rbp, rsi
mov rdx, rsi

Function at 0x7ff757d2d2ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r12, qword [rsp + 0x20]
and ebx, 0x347b2d31
call fcn.7ff757b865a5
jg 0x7ff757ca5c63

Function at 0x7ff757d376bb
Capabilities:
Encode data using xor

Disassembly:
xor qword [rsp + 8], 0x8926184
not byte [rsp + 8]
jle 0x7ff757d376d6
not dword [rsp + 8]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.7ff757e5e362

Function at 0x7ff757d6f86d
Capabilities:
Encode data using xor

Disassembly:
push r14
mov rcx, qword [rsp + 0x38]
setg r8b
add r8, r8
movabs r14, 0x391346a523e32afc
movabs rsi, 0x72065b36406b7d30
xor sil, sil
bswap r8
lea rcx, [rcx + 1]
xor r14, 0x4c3566e9
lea r14, [r14*4 + 0x17aa0ad1]
or r8, 0x2b9f0ed6
xor r8b, 0x3f
mov qword [rsp + 0x38], rcx
mov r8w, 0x3dbd
call fcn.7ff757c52f21

Function at 0x7ff757d7efb2
Capabilities:
Encode data using xor

Disassembly:
push rbx
add qword [rsp + 0x18], 0xd93a4
movabs rcx, 0xb6507037d1d4f5e
push r12
call fcn.7ff757ca1d0e
fisttp word [rax - 0x3d54aac9]
xchg ebx, eax
invalid
Function at 0x7ff757d9b609
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 8], r14
lea r10, [r10 + r10 + 0x787d4291]
je 0x7ff757d420bd
push r8
add qword [rsp + 0x50], 0x11e87f
movabs rax, 0x2f5c6e6c63140681
and r10w, r14w
push r12
xor r10d, dword [rsp + 0xa]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
jae 0x7ff757d51785
pushfq
push rdx
movabs rbx, 0xffb4edf02b94ccf
cmp r13w, 0x5096
jbe 0x7ff757c2333d
movabs rdx, 0xdd25cb14f721f82
call fcn.7ff757db8752

Function at 0x7ff757db8752
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffffdde70d
push r9
push r8
movsxd rbx, ebx
movabs r8, 0x250527906e13734
mov r9, rbx
cmp edx, 0x49b35c6
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
mov qword [rsp + 0x10], r13
setle bl
bswap r9
push rdx
neg r13d
not rbx
lea rsi, [rsi + 0x15f1035c]
not word [rsp]
lea r13, [rbx + r8*8 + 0x27382284]
add bl, r8b
jae 0x7ff757b7805f
mov r8d, r9d
xchg qword [rsp + rbx*2 + 0x57299da], rsi
and r8b, bl
xor r8d, r8d
push r9
cmova r8, rdx
xor dword [rsp], 0x76a96070
not r13d
mov rdx, qword [rsp + 0x28]
cmp dword [rsp + 0x20], 0x7862389a
lea r13, [rbx*4 + 0x605f4236]
jg 0x7ff757d114cd
not bx
mov r8, qword [rsp + 0x10]
or ebx, 0x204d1afb
call fcn.7ff757c1f0a7

Function at 0x7ff757dbd4c1
Capabilities:
Encode data using xor

Disassembly:
jo 0x7ff757c20f31
call fcn.7ff757d7e31f
call fcn.7ff757c77cd7

Function at 0x7ff757dbf6f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rsp + 0x20]
call fcn.7ff757d35a2a

Function at 0x7ff757f9f22e
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.7ff7584a3961
invalid
Function at 0x7ff758089d1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r13, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
sub cl, 0xad
cmp word [rsp + 0x10], 0x27ae
call int.7ff7583c213d
call fcn.7ff757f4eea5
call rax
mov r11, rax
test rax, rax
jne 0x7ff7584043be
lea rcx, [rsp + 0x40]
seta ah
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov r11, rax
clc
test bh, 0x97
test rax, rax
jmp 0x7ff7584043b8
call rax
jmp 0x7ff758404513
sub eax, eax
jmp 0x7ff75840431d
jmp 0x7ff758404513
je 0x7ff758404316
cmp r11, rsi
jmp 0x7ff7584043c6
jne 0x7ff75840446b
cmp byte [rsp + 0x180], dil
je 0x7ff758404445
lea rax, [rsp + 0x40]
btr dx, 0xd1
btc edx, 0x14
movsxd rcx, r10d
sub rbp, rax
lahf
nop
stc
lea rdx, [rsp + rdi + 0x40]
cmc
mov ecx, edi
setno ah
bts eax, edi
mov al, sil
mov eax, 0x35e513e6
rol eax, cl
add al, dil
test r9b, 0x8b
test bl, r9b
xor al, byte [rdx + rbp]
jmp 0x7ff75840441b
mov byte [rdx], al
jmp 0x7ff758404422
je 0x7ff75840443d
inc rdi
clc
stc
test r13d, edx
cmp rdi, 0x104
jb 0x7ff7584043f1
lea rbp, [rsp + 0x40]
movsxd rcx, ecx
mov rdx, rbp
movzx cx, r15b
setbe cl
movzx ecx, cx
mov rcx, rsi
mov al, r15b
movsx rax, di
nop
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x7ff758401406
cmp byte [rbx + 1], 0x23
bswap dx
movsx rdx, dx
lea rdx, [rbx + 1]
jne 0x7ff7584044fc
movzx edx, byte [rbx + 2]
add rbx, 2
test dl, dl
jmp 0x7ff75840448f
je 0x7ff7584044ee
nop
cdqe
movsx eax, bp
movsxd rax, ebp
lea eax, [rdx - 0x30]
jmp 0x7ff7584044a6
inc rbx
cmp al, 9
jmp 0x7ff7584044b0
ja 0x7ff7584044ee
movsx eax, dl
bsf rdx, rdx
movzx edx, byte [rbx]
test r9d, eax
neg ch
or cl, sil
lea ecx, [rdi + rdi*4]
neg rdi
movzx edi, di
sal dil, 0x8a
lea edi, [rax + rcx*2 - 0x30]
cmp r11d, 0x43ed5a09
stc
test dl, dl
jmp 0x7ff7584044e8
jne 0x7ff75840449e
movsxd rdx, edi
rcl cl, 0x18
rol cx, 0x95
test spl, 0xf
sub r8d, r8d
mov rcx, r11
call fcn.7ff758403f89
jmp 0x7ff758404513
mov rbx, qword [rsp + 0x178]
mov rbp, r11
shld rdi, r8, 0x5d
mov rdi, qword [rsp + 0x150]
add rsp, 0x158
movsx si, dil
seto bpl
mov rsi, r14
pop rsi
movsx rbp, r8w
pop rbp
jmp 0x7ff758404549
ret

Function at 0x7ff7583f65ac
Capabilities:
Encode data using xor

Disassembly:
sub rbx, rbx
push r11
mov r14, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x31516a60
test rbx, 0x56bc24af
mov r11, rbx
movabs rsi, 0x4845416168a573fd
setb sil
mov rbx, qword [rsp + 0x18]
or sil, 0x1a
sub r11, 0x13a50d88
setg sil
or esi, 0x47041df3
add r11, 0x14bf65f0
bswap rsi
setge sil
mov r11, qword [rsp]
test sil, 0x41
mov si, 0x4507
setl sil
call fcn.7ff7583c64a0
xor edx, 0xb97c1ecf
adc edi, dword [rbx]
loope 0x7ff7583f65fb
outsd dx, dword [rsi]
invalid