joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140212210
Capabilities:
Encode data using base64

Disassembly:
pop rcx
adc rcx, 0xfffffffffffae802
jmp rcx
mul r11b
neg esi
xor cx, r10w
not rax
mov r9d, esi
sal rdx, 0x47
adc cx, 0xdaa9
or eax, ebx
setno sil
rol cx, 1
neg cx
mul esi
shl sil, 0x81
xadd r9b, bl
xor cx, 0xc08e
bts r11w, r11w
dec r9
adc cx, r11w
push r11
imul r11d, edx
sal r9, 0x7d
xor r10w, cx
neg esi
mul eax
xchg dword [rsp + r11 - 0x28c8ff], edx
lea rcx, [rsp + rcx + 8]
shr byte [rsp + r11*4 - 0xa323fb], 0x41
imul r11d, dword [rsp + r11*2 - 0x5191ff]
call fcn.140239f57
jae 0x140115d91
mov rsi, qword [r8 + r11 - 0xd604]
sar dl, 0x41
cmovg ecx, edi
shl dil, 0xa5
lea r11, [r11 + r8 - 0xd5fc]
shl rdx, cl
shl r8w, 0x6d
btc bp, dx
mov qword [rax + r8 - 0x8000], rsi
jmp rbx
inc edi
lea rcx, [rsp + rcx + 0x18]
shr rsi, 0xcf
setns al
setnp r10b
mov byte [rcx + rsi*2 - 0x8002], dl
btr eax, 0xa8
jae 0x1400dc9b4
mov eax, 0x9a369395
mov r9d, dword [r8 + riz]
lea r11, [rax + rax - 0x7afdd27f]
movsx esi, r11w
or esi, eax
adc r8, 4
xor r9d, r10d
neg r9d
shl r11d, 0x56
push rax
rol r9d, 1
movzx ecx, word [rsp + r11*2 - 0x557fffff]
mov ebx, eax
dec word [rsp + rcx*2 - 0x6d23]
lea r9d, [r9 + rax*2 - 0x39e04beb]
xor r9d, 0xdd9a7caa
cdqe
neg r9d
movsx edx, word [rsp + rax + 0x65c96c6b]
mov qword [rsp + rax + 0x65c96c6b], r10
xor dword [rsp + rax + 0x65c96c6b], r9d
bswap esi
pop r10
mul si
setb sil
ror dx, 4
movsxd r9, r9d
add rdi, r9
or cl, r11b
cwde
mov cx, word [r8 + rax*2 - 0x6b44]
not rdx
lea r8, [r8 + rax*8 - 0x1ad0e]
jl 0x1401c99eb
jmp 0x14009af9c
Function at 0x140213824
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0xb781889d
lea rax, [rdi*4 - 0x426febf7]
mov ebx, dword [r10 + rbx - 0x51a5ab38]
cwde
mov r11d, edi
xor ebx, r9d
xor ebx, 0xa78a272e
lea r8, [rax*4 + 0x51116408]
lea r11, [rdi*2 + 0x4c06cf82]
bswap ebx
cbw
lea rdx, [r11 + r11*4 - 0x5ec85f74]
ror al, 0x41
ror ebx, 3
xor r8, rdx
rol r8, 6
neg ebx
mov ecx, 0x57bc2690
xor dl, 8
or rax, rdi
push r9
movsx r9d, di
xor dword [rsp + rcx - 0x57bc2690], ebx
pop r9
movsxd rbx, ebx
cwd
dec di
js 0x1401cdbc2
rol dword [rsp + rcx - 0x55aeb201], cl
neg si
adc ax, 0xf594
not ax
mov word [rsp + r10 - 0x4938c5e1], 0x96b6
xor r11w, ax
sal sil, cl
xchg word [rsp + rcx - 0x55aeb200], r8w
ror byte [rsp + rsi - 0x7962e571], 0xc6
lea rax, [rsp + rax + 8]
xadd r9b, cl
mov dx, word [rax + r10 - 0x4938c5e5]
pop rsi
shr esi, cl
movzx eax, r8w
lea rbp, [r10 + rbp - 0x4938c5e7]
inc r10w
mov word [rbp + rsi - 0x92b70cc], dx
and eax, eax
jne fcn.1400e339e
mov r9d, 0x880f3d34
lea r8, [r9 + r9 - 0x38eb0f7a]
mov edx, dword [rdi + riz]
mov eax, r8d
add rdi, 4
lea rsi, [rax + r9 + 0x73aab235]
bt esi, r8d
xor edx, r11d
lea r10, [rsi + rax*8 - 0x1d7a86db]
bswap edx
lea edx, [rdx + r8 - 0x5f9e60df]
xchg r10, rax
xchg rsi, r8
ror edx, 2
push r10
call fcn.1401f44ec
mov ebx, 0x51a5ab38
lea r10, [r10 + rbx - 0x51a5ab3c]
jmp 0x1400e239d
add rbp, rbx
lea r10, [rcx + r10 - 0x57bc2692]
movzx ecx, word [r10 + rcx - 0x57bc2690]
xor cx, r9w
sub r8, r8
rol cx, 1
cwd
sub cx, dx
sal r8b, 0x26
sar rdi, 0xa3
xor cx, 0xc826
add cx, 0x1b14
cwde
bt ax, 0xa5
xadd rdi, r8
neg cx
sal dx, 0xce
cwde
rol r8w, 0x8c
xor r9w, cx
add rcx, rsp
cdq
movzx bx, byte [rdi + rcx]
lea rsi, [rdi + rsi - 2]
ror eax, 0x8a
sal ax, 0x85
mov word [rsi + rdi], bx
jb fcn.140158ba3
mov qword [rsp + rcx - 0x562570a0], 0x6800ea2a
pop rbx
mov cl, byte [r8 + rbp + 8]
pop r11
inc esi
ror esi, 0x5a
lea rbp, [rbp + r8*2 + 6]
sar word [rsp + r8 + 1], 0xc1
sub esi, dword [rsp + r8*4 + 1]
shrd eax, edx, cl
ror sil, 0xa6
neg rsi
mov dword [rbp + r8*8], eax
mov edx, esi
call fcn.1401c313d
movzx eax, word [rax + rbx - 0x14016aab]
btc dx, dx
lea r8, [r8*8 - 0x26cd3dcc]
lea rbx, [rcx + rbx - 0x55ae0684]
xor ax, r11w
or esi, esi
shr dl, cl
shr r8b, cl
rol ax, 1
lea r9, [r8 + rcx*2 - 0x73e448cd]
imul r9, r9
inc ax
xchg cx, dx
push r10
not ax
jmp 0x1400ff591

Function at 0x1402143aa
Capabilities:
Encode data using base64

Disassembly:
adc rdi, rax
not ecx
and r8b, cl
mov qword [rsp + r11*8], 0x4b36cd22
mov r8, qword [rcx + rbp - 0x11fffff]
not dword [rsp + rcx - 0x11fffff]
call fcn.140197e30
mov ebx, 0xf9bf958a
mov eax, ebx
mov ebp, 0x422d50b2
mov si, word [r10 + rbp - 0x422d50b2]
lea r10, [r10 + rbp - 0x422d50b0]
shl bx, 0xb
call fcn.140147622
Function at 0x1402190c4
Capabilities:
Parse pe header

Disassembly:
setb cl
ror di, cl
xor r9w, di
xadd r11b, r8b
shr r8w, cl
mov word [rsp + rdx - 0x25babcef], dx
lea rdi, [rsp + rdi + 8]
bt r8d, edx
xadd byte [rsp + r11 - 0x31687cb], r8b
add qword [rsp + rdx*2 - 0x4b7579e4], 0x710eddbe
mov byte [rdi + rdx*2 - 0x4b7579e4], al
sete byte [rsp + rdx*2 - 0x4b7579e4]
inc ebx
sub byte [rsp + rcx - 0x5a4025fe], 0xa3
mov qword [rsp + rdx - 0x25babcf2], rbp
ret
movzx edi, word [rcx + r10 - 0x5a4026db]
xor di, r9w
ror di, 1
imul bx, cx
xor di, 0xa8bc
bts edx, r11d
mov qword [rsp + r11 - 0x3168791], 0xffffffffe134ae1b
adc di, 0x9205
ror cl, 0x87
jb 0x140209e25
Function at 0x1402199bf
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r8 - 0x59b9e2b0], r9
movsx r9d, di
imul r8w, di
xor dword [rsp + rdi - 0x59b9e2b0], eax
mov r9, qword [rsp + rdi - 0x59b9e2b0]
jmp 0x14022c4d1
xor r10b, 0xb
bt rdx, 0x14
shr di, 0x67
add dword [rsp + rbx - 0x793b0600], edi
xor r10b, dil
ror dx, 0xa7
add word [rsp + rbx - 0x793b05ff], ax
sets dl
ror r10b, 1
add al, 0x22
xor r10b, dil
call fcn.140216509
mov edi, esi
dec r8d
movsx ebp, cx
movsx edx, bpl
ror r8d, 3
push rcx
rol rdx, cl
movsx eax, bp
xor r8d, 0x591c0402
mov qword [rsp + rbp*2 - 0xdca4], r9
lea r9, [rax*2 + 0x113472a5]
sal edx, 0xd2
xor dword [rsp + rbp*2 - 0xdca4], r8d
jmp 0x14014083a
sub dil, 0x14
pop r9
cqo
shl sil, 0x66
movsxd r8, r8d
adc rbx, r8
mov di, word [r11 + rbp - 0x6e52]
bts si, ax
lea r8, [rsi*4 - 0x40d6ddf6]
mov cl, byte [r11 + rbp - 0x6e50]
lea r11, [rbp + r11 - 0x6e50]
shr di, cl
cdq
mov ecx, esi
and eax, eax
mov word [r11 + rbp - 0x6e52], di
shr esi, cl
ror edx, cl
xor rdx, rbx
jmp rdx
neg r10b
ror edx, 0xd5
jb 0x14012e56c
movsx eax, sil
not rax
xor r10d, 0xdb9e3e2f
lea rdi, [rsi - 0x116c6372]
movsx ecx, ax
call fcn.140229bac
bt si, si
inc edx
shr rax, 0x48
rol edx, 2
movsx ebx, si
sal si, 0x66
sar ebx, 0x87
lea edx, [rdi + rdx - 0x7cf71cad]
jne 0x1401ad6e6
push rbp
mov ecx, eax
dec cx
xor dword [rsp + rax - 0x2e26ad], edx
shl rbx, 0xb
and rcx, 0xffffffff820c0f36
pop rbp
neg rsi
shl rsi, 0xe4
movsxd rdx, edx
btr eax, ebx
and sil, 8
adc r8, rdx
xchg ebx, edi
cqo
shr bl, cl
jb fcn.14007c713
mov ecx, 0x6ba6fb91
mov rax, qword [r10 + rcx - 0x6ba6fb91]
push rcx
mov cl, byte [rcx + r10 - 0x6ba6fb89]
mov edx, 0x881fa613
add r10, 0xa
mov esi, edx
lea rbx, [rsi + rsi*4 - 0x1fcc40db]
mov byte ss:[rax + riz], cl
movsx eax, dl
neg rdx
call fcn.1401a33c9
mov r8d, 0x59b9e2b8
mov rcx, qword [r11 + r8 - 0x59b9e2b8]
mov edi, r8d
movsx eax, r8w
mov ebp, eax
mov di, word [rcx + rdi - 0x59b9e2b8]
lea r11, [r11 + r8 - 0x59b9e2b2]
mov word [r8 + r11 - 0x59b9e2b8], di
lea r10, [r8 + r10 - 0x59b9e2bc]
mov ecx, ebp
xadd ebp, ecx
mov edx, r8d
mov eax, dword [r10 + r8 - 0x59b9e2b8]
xor eax, r9d
push rbp
xor qword [rsp + rdx - 0x59b9e2b8], 0x48bbe43f
sbb eax, 0x8a81db90
rol eax, 2
movsx edi, r8b
push rdi
lea eax, [r8 + rax - 0x139845f9]
sub qword [rsp + rdx - 0x59b9e2b0], 0x5eaccc83
bts edx, edi
not eax
xadd rdx, rdi
lea rcx, [rdi + r8*8 - 0x366d8b58]
rol eax, 1
bt rdi, r8
sbb eax, 0xfa9602a9
jmp 0x1400e233b
movsx edi, cx
xor esi, ebp
inc esi
not esi
mov qword [rsp + rbx - 0x793b0600], rdi
movzx r10d, ax
lea esi, [rbx + rsi - 0x2c7dbfc3]
shr dword [rsp + rbx - 0x793b05ff], cl
and al, byte [rsp + rbx - 0x793b05f9]
ror esi, 1
mov qword [rsp + rax - 0x600], rbp
shr r10, cl
xor dword [rsp + rbx - 0x793b0600], esi
movsx ebp, di
and r10, rbp
shl rax, cl
pop rbp
push rdi
movsxd rsi, esi
adc r8, rsi
add word [rsp + rax*4 + 6], r10w
add r10b, byte [r9 + rbx - 0x793b0600]
lea r9, [r9 + rax + 1]
xor r10b, bpl
sal qword [rsp + rax*4], cl
imul byte [rsp + rax*2 + 1]
jno 0x140195f5c
movsxd rax, eax
bt edx, 0x1d
setae r8b
not r8d
adc rbx, rax
add r8d, 0x1204be94
bt rdx, rbp
or rbp, qword [rsp + rdi - 0x59b9e2b8]
mov qword [rsp + rdi - 0x59b9e2b8], rbx
ret 8
Function at 0x14021b54f
Capabilities:
Encode data using base64

Disassembly:
inc esi
movzx eax, r10w
bt cx, r8w
call fcn.1401ca1e4
xadd ebx, r11d
lea rcx, [r11 + rsi - 0x1355b6cc]
lea rdx, [rsp + rdx + 0x28]
mov dword [rdx + rbx - 0x57c4], eax
mov edi, dword [rbx + r10 - 0x57c4]
movsx edx, cx
shl qword [rsp + rbx*2 - 0xaf78], cl
lea r10, [r10 + rbx*2 - 0xaf84]
xor edi, ebp
inc edi
not byte [rsp + rbx - 0x57b2]
xor edi, 0x2187b92
movzx eax, byte [rsp + rbx - 0x57a0]
pop rsi
dec dx
inc edi
cdq
cwd
neg edi
cbw
imul r11w
dec edi
neg edi
rol cl, 0x21
pop rcx
call fcn.1401ea0c2
mov r10d, 0x5b24a434
or r10, r10
mov esi, dword [rbx + r10 - 0x5b24a434]
lea rbx, [r10 + rbx - 0x5b24a430]
lea rcx, [r10*2 + 0x380e6325]
movsx r8d, cx
xor esi, r11d
movzx r9d, cl
jmp 0x1400ff581

Function at 0x14021c419
Capabilities:
Encode data using base64

Disassembly:
inc r8d
rol r8d, 2
mov qword [rsp + r9*2 - 0xd506], r9
inc r8d
add r9d, r10d
ror r8d, 2
neg r9d
xor r8d, 0x87bb04b7
dec al
mov qword [rsp + rax*2 - 0x2786], r11
xor dword [rsp + rax*2 - 0x2786], r8d
mul byte [rsp + r9 - 0x726c508d]
mov r11, qword [rsp + rax*4 + 0x18]
inc word [rsp + rax*2]
xchg qword [rsp + r9 - 0x726c5088], rax
movsxd r8, r8d
call fcn.1400f30ed
Function at 0x140220672
Capabilities:
Encode data using base64

Disassembly:
movsxd rsi, esi
add dl, dh
add r9, rsi
shl ebx, cl
or bx, 0x7a83
jae fcn.140199adb
mov qword [rsp], rbx
mov qword [rsp], rbp
je 0x14008a34e
xor dword [rsp], esi
neg r11w
dec ebx
ror dil, 0x23
pop rbp
jb 0x14013279a

Function at 0x14022963a
Capabilities:
Encode data using base64

Disassembly:
mov word [rsi + rcx - 0xb7df], r11w
not word [rsp + rax*2 - 0x21fa]
pop r11
pop rdi
pop rdi
pop rdi
pop rcx
pop rax
ja fcn.140158ba3

Function at 0x14022d991
Capabilities:
Encode data using base64

Disassembly:
xchg rdx, rax
add rdi, rsi
shr r9, 0xe8
jns fcn.1400e339e
mov eax, 0x790c491f
mov rdi, qword [r8 + rax - 0x790c491f]
movzx r11w, byte [rax + rdi - 0x790c491f]
movzx esi, ax
movsx ecx, al
lea r8, [rcx + r8 - 0x19]
call fcn.14020e444
movsx ebx, ax
xor edx, r9d
push r11
call fcn.14009091b
call fcn.140118f0a
sar r9, 0x75
movzx esi, bl
lea r8, [r8 + rax - 0x78b6]
xor ecx, r10d
lea rdx, [r9 + rsi*8 + 0x2b151005]
inc r11b
rol sil, 0x83
neg ecx
cbw
not ecx
inc ecx
shl r11w, 0x23
mul bx
ror ecx, 1
push r10
xor dword [rsp + rax*4 - 0x21c30], ecx
pop r10
movsxd rcx, ecx
ror dx, 0x63
adc r9, 0xffffffffaa947eb8
shr r11d, 0x4a
add rdi, rcx
call fcn.1400c5d81
movsxd rdi, edi
mul r8w
inc rsi
dec bp
adc rbx, rdi
or edx, 0xa19aebbd
add r8, rsi
mov di, word [r11 + rcx - 0x75331a21]
push r8
mov cx, word [r11 + rbp - 0x200d]
sal eax, 0xec
adc rsi, qword [rsp + rbp - 0x200f]
lea r11, [r11 + rbp*2 - 0x401c]
xadd ebp, r8d
and di, cx
ror sil, 7
not di
bts rdx, rax
adc esi, 0x4bb7f120
mov word [r11 + rbp*2 - 0x1ca84020], di
and ax, dx
mov qword [rsp + rbp*4 - 0x39508040], rbx
ret
xchg bpl, dl
rol edi, cl
movzx esi, r8w
push r9
xor dword [rsp + rcx - 0x75331a21], edi
inc al
pop r9
jne 0x1400d3778
xor r9b, dl
lea rsi, [rbx + rsi - 0x2b4f58ad]
ror r11, 0x12
lea rbx, [rdi + r8 - 0x3d76f7d2]
cdqe
mov word [r11 + rsi], dx
neg r11d
xor di, 0xa799
movzx edx, cx
pop rcx
pop rdx
jae fcn.140158ba3
lea r11, [r10 + rdx + 0x7bacf91e]
pop r11
bts r9, 0x39
neg edx
movsxd rsi, esi
jb 0x140083b73
mov ecx, 0x75331a11
lea r10, [rcx + r10 - 0x75331a15]
movsx edx, cl
mov edi, dword [r10 + rdx*4 - 0x44]
xor edi, r9d
movzx ebp, cl
or bp, bp
movsx eax, cl
xor edi, 0xf1192827
neg ax
mul bp
mov r8d, 0xd13b4395
bswap edi
sub bp, 0xd4a3
and ebp, 0xc33ba41d
adc rcx, rdx
xor edi, 0x6e3ee707
shl r8, 0x12
sal ax, cl
neg r8b
inc edi
jmp 0x1401ca333

Function at 0x140231fdb
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ebp
push rbx
inc ecx
mov qword [rsp + rdx - 0x7f0b30a7], 0xffffffffda2cef34
not ecx
movzx edi, dl
inc ecx
lea rax, [rsi + rdx*2 - 0x6dddf1e2]
dec dl
not ecx
mov r11d, edx
call fcn.14016a94a
Function at 0x14023218d
Capabilities:
Encode data using base64

Disassembly:
sal bl, 0xc6
neg eax
add bx, di
mov qword [rsp + r8*2 - 0x16e], r9
and r8w, 0x6f3d
xor dword [rsp + rdi - 0x57b52fb7], eax
pop r9
xor bx, r8w
neg cl
movsxd rax, eax
add rbp, rax
lea rdx, [r8 + rdi*4 - 0x7e42b560]
movzx r11d, dil
mov rdx, qword [r8 + rsi - 0x35]
movsx eax, r11b
xor r11, 0xffffffffd68a0a9e
sete cl
lea rsi, [rdi + rsi - 0x57b52faf]
shr ebx, 0x3d
push rdx
neg rdi
call fcn.140132a80
mov ecx, 0x1ca2f93b
mov ebx, 0xc710e689
movzx ebp, bx
lea r9, [r9 + rcx*2 - 0x3945f27a]
mov ebp, dword [rcx + r9 - 0x1ca2f93b]
xor ebp, r8d
rol ebp, 1
inc ebp
bts rcx, rcx
mov eax, 0x811e9e35
call fcn.1401dc01f
mov word [rsi + rdx - 0x304b65c3], bx
movzx eax, dil
lea r10, [rdx + r10 - 0x304b65c7]
mov qword [rsp + rdx - 0x304b65bc], rdx
setb dl
mov r8d, dword [r10 + rdx*2 - 0x6096ca00]
push rdi
cwde
sub rdi, 0xffffffffbf32c5a0
xor r8d, r9d
mul qword [rsp + rdx*2 - 0x6096c9ed]
cqo
mov ebx, dword [rsp + rdx]
xor r8d, 0xee286e98
bswap r8d
dec word [rsp + rdx + 0x16]
sar cx, cl
bt ax, cx
lea r8d, [r8 + rdi*4 - 0x321bc9d2]
pop rcx
neg r8d
imul rdx
div dword [rsp + rcx + 3]
bswap r8d
sub rax, rdi
xor r8d, 0x1538bc3e
inc rcx
sub r8d, ecx
mov qword [rsp + rcx + 0xf], r9
and dl, cl
cdqe
cmove di, word [rsp + rcx*4 + 6]
xor dword [rsp + rcx + 0xf], r8d
mov r9d, 0x2ba9b580
mov r9, qword [rsp + rdx*4 + 0x10]
movsxd r8, r8d
add rbp, r8
xor di, di
mov qword [rsp + rcx + 0xf], 0xffffffff861f6713
pop rax
pop rdx
pop r8
jno fcn.140158ba3
lea ecx, [rcx + r10 + 0x539d84e1]
setae dl
xchg dword [rsp + rdx - 0x3f8fe900], eax
xor ecx, 0x54812aaf
sub sil, r10b
sbb word [rsp + r10*4 - 0x2b2b5], dx
inc ecx
ror rsi, 0xdb
rol eax, 0xae
rol ecx, 3
xchg word [rsp + rdx*2 - 0x7f1fd1fe], dx
or rdi, rdi
xadd ax, dx
dec ecx
lea rbx, [rsi*2 + 0x4e800d93]
xor ecx, 0xc0c9406
rol esi, 0x14
not byte [rsp + rsi*2 - 0x35ffffc]
inc ecx
xor r10, qword [rsp + rsi*2 - 0x3600000]
adc esi, 0x8d209405
mov qword [rsp + rdx*2 - 0x7f1e77d6], rbp
xor dword [rsp + rdx - 0x3f8f3beb], ecx
pop rbp
cwde
or rbx, 0x500438b3
call fcn.14023b59a

Function at 0x140235235
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0xfb29a905
not eax
mov r11d, dword [rsp + rbx + 0x92]
jmp 0x1400fa1ef
movsx ebx, dil
lea r10, [rbx + r10 - 0x2d]
mov qword [rsp + rdi - 0x4a3ddc31], 0xffffffffa8b98dbe
xor eax, ebp
dec eax
neg rbx
ror byte [rsp + rbx + 0x34], 0xa1
movzx ecx, bx
ror eax, 1
rol bx, cl
shl bl, 0x24
jnp 0x14008335f
mov ebp, 0xa0b347af
call fcn.14016db05
mov qword [rsp + rcx*2], r9
xor dword [rsp + r11*4 - 4], eax
pop r9
neg rbx
movsxd rax, eax
sbb cl, dh
add rbp, rax
xor rdx, rbp
jmp rdx
Function at 0x140238180
Capabilities:
Encode data using base64

Disassembly:
rol ebp, 1
lea rax, [rdx*8 + 0x400c5796]
neg ebp
bswap ebp
mov qword [rsp + rdx - 0x6216], r8
mov qword [rsp + rsi - 0x35a56212], rdx
neg byte [rsp + rsi - 0x35a5620d]
xor dword [rsp + rdx - 0x6216], ebp
sal ax, 0x29
ror r11w, 0x69
ror byte [rsp + rdx - 0x621e], 0xc7
mov r8, qword [rsp + rsi*2 - 0x6b4ac41c]
xchg rdx, rax
xor dx, 0xf9a2
mov qword [rsp + rsi*2 - 0x6b4ac41c], rsi
movsxd rbp, ebp
xor rdx, qword [rsp + rsi - 0x35a5620a]
adc rdi, rbp
lea r9, [rax + r9 - 0x6226]
mov rcx, qword [r9 + rsi - 0x35a56212]
jmp 0x14012fcf0

Function at 0x140239b62
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov esi, dword [rcx + r10 - 0x5832a817]
dec cx
lea r10, [r10 + rcx - 0x5832a812]
mov qword [rsp + rcx - 0x5832a816], 0xffffffffe8097087
xor esi, ebp
movzx r11d, dx
neg dword [rsp + r11*2 - 0x1502b]
mov ebx, 0x880b8416
neg esi
shl dword [rsp + rcx - 0x5832a813], cl
jns 0x14012fc9b

Function at 0x140239f57
Capabilities:
Encode data using base64

Disassembly:
sal byte [rsp + rdx*2 - 0x7d49], 0x41
lea rdi, [rdi + rdx*4 - 0xfa9c]
lea r10, [rax + rdx*4 - 0x1fd21fc2]
shl dword [rsp + rdx - 0x3ea4], 0x47
xor r8d, r11d
sal dword [rsp + rdx - 0x3ea7], cl
sbb r8d, 0xbb282c2f
sal rcx, cl
pop rsi
xor r8d, 0x4c17e0ae
inc word [rsp + r9 - 3]
imul esi, r10d
jno 0x14016e0e7
neg r8d
add r10w, word [rsp + rdx - 0x3ea4]
ror edx, 0x54
bswap r8d
mul byte [rsp + rdx*2 - 0x7d4fffd]
mov qword [rsp + r9*8 - 0x38], r11
rol dx, 0xa6
not r10w
push rdx
xor dword [rsp + rdx*2 - 0x7d40038], r8d
mov r11, qword [rsp + rdx - 0x3ea0018]
mov qword [rsp + rdx - 0x3ea0018], rax
or qword [rsp + rdx*2 - 0x7d40038], r9
sub word [rsp + rdx - 0x3ea001b], r9w
movsxd r8, r8d
add rbx, r8
mov qword [rsp + rdx*4 - 0xfa80080], rbx
ret 8
adc rdi, r11
lea r11, [rsi + rsi*8 + 0x73ceba3]
mov rsi, qword [rbp + rdx*2]
lea rbp, [rbp + rdx*4 + 8]
call fcn.1400b3a43
mov dword [rsp + r8 - 0x6b212c04], r8d
ror sil, 1
not sil
lea rcx, [rdx - 0x6566d9fa]
rol sil, 1
xadd ecx, eax
dec sil
inc r8b
push rax
not sil
sub sil, 0x95
imul qword [rsp + rcx*2 - 0x2b8a08e]
xor r11b, sil
movzx r9d, r8b
sar qword [rsp + rdx*4 - 0xfa9c], 0xa9
lea rsi, [rsp + rsi + 0x10]
mov word [rsi + rcx*4 - 0x571412c], r10w
mov r8d, dword [rdi + rdx - 0x3ea8]
ja 0x14013a0e1
mov rsi, qword [rdx + rcx - 0x2ac000]
inc r11
lea rbp, [rbp + rdx*2 - 0x558008]
mov qword [rbp + rdx - 0x2ac000], rsi
pop rdx
pop rbx
jg fcn.1400a6a7c
pop r10
btr cx, 0x9e
cdq
mul rax
movsxd r11, r11d
lea r9, [rbx + r9*4 - 0x5be24af9]
jb 0x1400bb64e
jae 0x1401fe565
Function at 0x14023aa3c
Capabilities:
Encode data using base64

Disassembly:
lea rbx, [r10 + r10*8 + 0x45a786b9]
mov r11, qword [rsp + rax*4 - 0x60]
mov qword [rsp + rax + 0x16], rax
call fcn.1400b76f8
mov r11d, 0xfd831219
movsx ecx, r11b
mov eax, dword [r10 + rcx*2 - 0x32]
push rcx
or word [rsp + rcx - 0x16], r11w
sbb rcx, r11
adc r10, 3
mov edi, dword [rsp + 3]
movzx esi, cl
xor eax, ebp
movzx ebx, di
dec sil
btc r11, r11
ror eax, 1
and dword [rsp + rsi - 0xfc], ebx
jb 0x140115d8d
xor eax, 0x53202c16
neg sil
push rbx
dec rdi
not eax
lea eax, [rax + r11 - 0x72664286]
mov qword [rsp + rdi*8 - 0x90b8], rbp
rol dword [rsp + rdi - 0x1214], 0x9a
lea rdx, [r11 + rdi*8 + 0x20181f10]
neg word [rsp + rdi - 0x1215]
xor dword [rsp + rdi - 0x1210], eax
mov rbp, qword [rsp + rdi - 0x1210]
movsxd rax, eax
add r9, rax
mov rax, r8
xadd sil, bl
mov qword [rsp + rdi - 0x1210], 0xffffffff8da77209
lea r8, [r8 + rdi - 0x121a]
mov word [r8 + rdi*8 - 0x90c0], ax
add edx, ebx
adc dword [rsp + rsi*8 - 0xc6], esi
pop rdi
pop rdx
jno fcn.140199adb

Function at 0x14023ab15
Capabilities:
Encode data using base64

Disassembly:
call fcn.1401ecbd4
mov r11d, dword [r8]
mov esi, 0x63868028
lea r8, [r8 + rsi - 0x63868024]
movzx eax, si
movzx edi, si
lea rdx, [rax*4 - 0x11e4f7ed]
movzx ecx, word [r10 + rsi - 0x63868028]
lea r10, [r10 + rax*8 - 0x4013e]
lea rbx, [rax + rdi + 0x12aeb101]
shr bx, 0xf
xor cx, bp
neg rdi
sbb cx, 0xe1a4
bt eax, 0xba
xor cx, 0x1d8b
rol cx, 1
not cx
add si, si
and ebx, ebx
xor bp, cx
jmp 0x1400924fe
bts di, bx
push rdi
lea rcx, [rsp + rcx + 8]
xadd word [rsp + rsi - 0x6386004d], dx
mul qword [rsp + rax - 0x8028]
jb 0x14014e464
mov eax, dword [rbx + rax - 0x56b03638]
lea rbx, [rbx + r9*2 - 0x6c6c]
sar r9b, 0x82
xor eax, r11d
mov r10d, r9d
sub si, r9w
inc edx
rol eax, 1
jmp 0x140114dca
lea rsi, [rsi + r8*8 - 0x24072]
jae 0x14008a537
mov ecx, 0x1c1777be
mov rcx, qword [rcx + rbp - 0x1c1777be]
mov esi, 0x56b03638
movzx r9d, si
mov eax, esi
mov rsi, qword ss:[rcx + r9*2 - 0x6c70]
mov qword [rbp + r9 - 0x3638], rsi
movzx esi, r9w
movzx edx, ax
jmp 0x1401fcc2e
and dl, byte [rsp + rbx - 0x3bfedfe]
lea rsi, [rsp + rsi + 0x18]
xchg byte [rsp + rbx*2 - 0x77fdc0e], al
neg word [rsp + rbx*4 - 0xeffb835]
mov qword [rsp + rbx - 0x3bfee12], rdx
mov bx, word [rsi + rbx*4 - 0xeffb848]
mov qword [rsp + rax - 0x46f8], rcx
call fcn.1400a0ead
mov edx, 0x4400480f
mov r11, qword [rsi + rdx - 0x4400480f]
movzx r8d, dx
movzx edi, dx
mov bx, word ss:[r11 + rdx - 0x4400480f]
bts edi, edi
jae 0x14022a27d

Function at 0x14023ab74
Capabilities:
Encode data using base64

Disassembly:
jmp r9
mov dil, byte [r10 + r8 - 0x5a34]
mov qword [rsp + r10 - 0x5a36], r10
lea r8, [r10 + r8 - 0x5a34]
xor r10w, word [rsp + rax*4 - 0x166]
or dl, dil
btc rax, rsi
pop rdi
not dl
imul r10d, edi
not rbx
mov word [r8 + r10 - 0x1fca0364], dx
xor rdi, 0x215d32e
dec esi
jp 0x14021d4db
Function at 0x2fc4db5e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dbfe2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc500108]
test eax, eax
je 0x2fc4dc07a
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc500110]
mov qword [rbp - 8], rax
jmp 0x2fc4dc05e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dc052
cmp qword [rbp - 0x10], 0
je 0x2fc4dc052
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dc018
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dc07b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dc180
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dc1a8
mov eax, 0
jmp 0x2fc4dc1f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dc1d1
mov eax, 0
jmp 0x2fc4dc1f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dc1f1
mov eax, 0
jmp 0x2fc4dc1f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dc1fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dc27a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dc271
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dc271
mov rax, qword [rbp - 8]
jmp 0x2fc4dc28f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dc244
mov eax, 0
add rsp, 0x20
pop rbp
ret