joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400542e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140253620]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140057f30
test rax, rax
je 0x140054334
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x1400543c9
mov ecx, 2
call fcn.14005b8f0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1400578c0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400543b5
test ebx, ebx
jne 0x1400543b5
lea ecx, [rax + 2]
call fcn.14005b8f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400543f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x140253620]
call fcn.140057f30
test rax, rax
je 0x140054425
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.14005b8f0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1400578c0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400544ae
test ebx, ebx
jne 0x1400544ae
lea ecx, [rax + 2]
call fcn.14005b8f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret
Function at 0x140058c60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x140058c9e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140058c80
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140058e85
mov ecx, 3
call fcn.140064db0
cmp eax, 1
je 0x140058e3c
mov ecx, 3
call fcn.140064db0
test eax, eax
jne 0x140058cd5
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x140058e3c
cmp edi, 0xfc
je 0x140058e85
mov qword [rsp + 0x50], rbp
lea rbp, [0x1402536b0]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.140053d10
test eax, eax
je 0x140058d19
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140054240
lea rdx, [0x1402536c9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x1402537cd], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140058d69
lea r8, str._program_name_unknown_
lea rcx, [0x1402536c9]
mov edx, 0x2fb
call fcn.140053d10
test eax, eax
je 0x140058d69
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140054240
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1402536c9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140058db8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x1402539c4]
lea r9d, [rax + 3]
lea r8, [0x14006f284]
sub rdx, rcx
call fcn.140064c90
test eax, eax
je 0x140058db8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140054240
lea r8, [0x14006f280]
mov edx, 0x314
mov rcx, rbp
call fcn.140056a80
test eax, eax
je 0x140058de4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140054240
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.140056a80
test eax, eax
je 0x140058e14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140054240
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.140064a30
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140058e85
cmp rax, 0xffffffffffffffff
je 0x140058e85
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140058ea0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.140064db0
cmp eax, 1
je 0x140058ed2
mov ecx, 3
call fcn.140064db0
test eax, eax
jne 0x140058f86
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x140058f86
mov qword [rsp + 0x48], rbx
lea rbx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140058efe
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140058ee8
jmp 0x140058f72
cmp edi, 0x17
jae 0x140058f72
mov ecx, 3
call fcn.140064db0
cmp eax, 1
je 0x140058f29
mov ecx, 3
call fcn.140064db0
test eax, eax
jne 0x140058f72
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x140058f72
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140058f72
cmp rax, 0xffffffffffffffff
je 0x140058f72
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140058c60
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x1400590e7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400990c0]
jne 0x1400537ba
rol rcx, 0x10
test cx, 0xffff
jne 0x1400537b6
repz ret
ror rcx, 0x10
jmp 0x140059040
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140253a80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140253b78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400590c5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140253a80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400590e7
mov rax, qword [rsp + 0x88]
mov qword [0x140253b78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140253b18], rax
mov rax, qword [0x140253b78]
mov qword [0x1402539f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140253b00], rax
mov dword [0x1402539e0], 0xc0000409
mov dword [0x1402539e4], 1
mov rax, qword [0x1400990c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400990c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140253a78], eax
mov ecx, 1
call fcn.14005b8f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14006f2c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140253a78], 0
jne 0x14005916e
mov ecx, 1
call fcn.14005b8f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400619a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x14025451c]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x1400619fc
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1400619dc
mov dword [0x14025451c], 1
jmp 0x140061a0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400619f6
mov dword [0x14025451c], 2
jmp 0x140061a79
mov eax, dword [0x14025451c]
cmp eax, 1
jne 0x140061a70
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140061a4a
cmp word [rdi], bp
mov rax, rdi
je 0x140061a29
add rax, 2
cmp word [rax], bp
jne 0x140061a17
add rax, 2
cmp word [rax], bp
jne 0x140061a17
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.140058a30
test rax, rax
mov rbx, rax
jne 0x140061a51
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140061b6b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140056690
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x140061b6b
cmp eax, 2
je 0x140061a79
test eax, eax
jne 0x140061a4a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x140061a4a
cmp byte [rax], bpl
mov rbx, rax
je 0x140061ac8
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140061a4a
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x140061a90
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.140058aa0
test rax, rax
mov r12, rax
jne 0x140061aed
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140061b6b
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x140061b55
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140061b7e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x140061b00
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.140053aa0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140061b66
Function at 0x140064a30
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140057e40
xor ebx, ebx
cmp qword [0x140254528], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140064b5c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140064c6f
lea rdx, [0x14006f538]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140064c6f
mov rcx, rax
call fcn.140057d70
lea rdx, [0x14006f528]
mov rcx, rsi
mov qword [0x140254528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140057d70
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140254530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140057d70
lea rcx, [rsp + 0x98]
mov qword [0x140254538], rax
call fcn.140055300
test eax, eax
je 0x140064b0f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140054240
cmp dword [rsp + 0x98], 2
jne 0x140064b5c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140057d70
test rax, rax
mov qword [0x140254548], rax
je 0x140064b5c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140057d70
mov qword [0x140254540], rax
mov rcx, qword [0x140254540]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140064c08
cmp qword [0x140254548], rbp
je 0x140064c08
call fcn.140057f30
mov rcx, qword [0x140254548]
mov rsi, rax
call fcn.140057f30
test rsi, rsi
mov r12, rax
je 0x140064c08
test rax, rax
je 0x140064c08
call rsi
test rax, rax
je 0x140064bd3
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140064bd3
test byte [rsp + 0x40], 1
jne 0x140064c08
lea rcx, [rsp + 0x30]
call fcn.140055350
test eax, eax
je 0x140064bf5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140054240
cmp dword [rsp + 0x30], 4
jb 0x140064c02
bts edi, 0x15
jmp 0x140064c46
bts edi, 0x12
jmp 0x140064c46
mov rcx, qword [0x140254530]
cmp rcx, rbp
je 0x140064c46
call fcn.140057f30
test rax, rax
je 0x140064c46
call rax
test rax, rax
mov rbx, rax
je 0x140064c46
mov rcx, qword [0x140254538]
cmp rcx, rbp
je 0x140064c46
call fcn.140057f30
test rax, rax
je 0x140064c46
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140254528]
call fcn.140057f30
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140064c6f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140064c71
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14049dddd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call 0x1403f1938
mov edi, 0xd6bce5bb
mov edx, 0xd49e1d02
sub r8, 1
movzx r9d, byte [r8]
mov ecx, 0x4d277b00
call fcn.14054a7dd

Function at 0x1404a3913
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffb0836302
xor esi, ebp
btr edi, ecx
movzx r9d, cl
ror word [rsp + r9 - 0x9c], 0xe
ror esi, 1
rol di, 3
mov qword [rsp + r9 - 0x96], rcx
movzx eax, r9b
inc esi
ror esi, 2
ror rcx, cl
and dword [rsp + rax*8 - 0x4ed], 0x572b6fb6
lea esi, [rsi + rdi*2 - 0x76244bdf]
sar dil, cl
jbe 0x1405afa5b
add dl, 0x91
lea rcx, [rcx + rcx*4 + 0x1d13762b]
mov ebp, 0xf202ed85
xor r9b, dl
lea r8, [r8 + rsi*2 - 0x7a]
dec byte [rsp + rsi - 0x35]
mov word [r8 + rsi*2 - 0x78], dx
mov edx, 0x56895532
mov ebp, dword [rsi + r10 - 0x3c]
movsx eax, dl
movsx r11d, si
lea r10, [rsi + r10 - 0x38]
mul word [rsp + rsi*2 - 0x74]
xor ebp, r9d
and r11, 0x610b8192
sbb ebp, 0xdea42928
xadd r11d, edx
rol ebp, 1
bswap ebp
inc ebp
mov qword [rsp + rsi*2 - 0x70], r9
xor dword [rsp + rsi - 0x34], ebp
mov r9, qword [rsp + rsi*2 - 0x70]
movsxd rbp, ebp
add rdi, rbp
cwde
inc r11w
pop rsi
pop r11
jns fcn.14061fa65
call fcn.1404f1326
mov qword [rsp + rax*2 - 0x134], rbp
jne 0x1404b721a

Function at 0x1404a41d5
Capabilities:
Encode data using base64

Disassembly:
sal edi, 0xb0
not rbp
mov qword [rsp + rax - 0xba], r10
add r9d, eax
rol di, 0x6e
xor dword [rsp + rax*2 - 0x174], ecx
xchg edi, eax
idiv dl
pop r10
inc dx
movsxd rcx, ecx
xor ebp, 0x6781e41b
xor r9, 0xffffffffea929d2c
adc r11, rcx
xor dl, 0xb
add r9d, ebp
jb 0x1405f219c
mov r8, qword [rsi + rdi - 0xba]
setne dil
lea rsi, [rdi + rsi + 7]
jne 0x14067418b
movzx ecx, byte [rbx + rbp*2 - 0x6d8ed6bc]
neg dl
neg ax
adc rbx, rdi
xor cl, r10b
and dl, al
sub r9d, 0xca221e1a
neg cl
and dl, dil
adc cl, dil
push rax
neg cl
dec word [rsp + rbp - 0x36c76b5c]
not cl
not dil
xor r10b, cl
sub word [rsp + rax - 0xb9fffd], di
push rdx
bts bp, bp
lea rcx, [rsp + rcx + 0x10]
mov qword [rcx + rbp - 0x36c76b5e], r8
mov qword [rsp + rbp*2 - 0x6d8ed6bc], r11
ret 8

Function at 0x1404c0e8a
Capabilities:
Encode data using base64

Disassembly:
mov eax, ecx
lea ebx, [rsi + rbx + 0x632a160a]
xor ebx, 0xfb15f79a
mul ax
lea ebx, [rbx + rdx + 0x3eff95ef]
call fcn.140672fe3
jmp 0x1405beafd

Function at 0x1404c6e92
Capabilities:
Encode data using base64

Disassembly:
xor bp, dx
ror rdi, 0x3b
push rax
mov qword [rsp + r9 - 0x635e000a], rdi
xor bp, 0x21b9
sar rdi, cl
add qword [rsp + rdi - 0x37652], r9
rol bp, 1
xor r10w, bp
lea rbp, [rsp + rbp + 0x10]
inc rdx
movzx di, byte [rdi + rbp - 0x3765a]
and rax, r9
jge 0x1405e24ee
sub dword [rsp + r9 - 0x635e000c], r8d
lea rsi, [rsi + rax - 0x2400012]
mov word [rsi + rax*8 - 0x12000080], di
sbb edx, 0xef82f63c
pop r9
pop r9
jnp fcn.140621ffc

Function at 0x1404c77d8
Capabilities:
Encode data using base64

Disassembly:
mov rdx, qword [rbx + r8 - 0x65a16713]
lea rbx, [rbx + rsi*8 - 0x90]
mov qword [rsp + rsi*2 - 0x26], r8
xchg rdx, rbx
xchg edx, ebx
Function at 0x1404c990d
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [rbx + rbp - 0x5c90ed97]
lea rbp, [rbp + rbx - 0x5c90ed93]
mov qword [rsp + rbx - 0x5c90ed97], rbx
xor eax, r9d
movzx r8d, byte [rsp + rbx - 0x5c90ed95]
neg dword [rsp + r8*8 - 0x480]
neg eax
sub eax, 0xec8869b4
pop rdx
movsx esi, dx
shr r8, 0x3a
bswap eax
lea eax, [rax + r8 - 0x5310fdb9]
movzx r11d, sil
sub rbx, 0x55363f36
btc ebx, r11d
push r9
btr bx, 0xa1
ror r11, 0x3d
xor dword [rsp + rbx*2 - 0xeb558c2], eax
movsx r9d, dx
btc rdx, 0x2f
pop r9
movsxd rax, eax
shr ebx, 0x25
adc r10, rax
dec sil
add r8w, word [rbx + rbp - 0x3ad563]
lea rbp, [rbx + rbp - 0x3ad561]
mov eax, edx
xor r8w, r9w
neg r8w
cqo
bt dx, bx
sbb r8w, 0x663e
dec bl
jnp 0x140531295
lea rdx, [rax + rax*4 - 0x6bfa075e]
lea ebx, [rbx + rsi*2 - 0x6ab1bc9f]
jmp 0x1405f39a9
bswap ebx
rol ebx, 1
xchg esi, eax
call fcn.1405ffceb
not r8w
sub r8w, 0xf929
sal rax, 0x27
not r8w
xor r9w, r8w
lea rsi, [rax + rsi + 0x2da797be]
jmp 0x140629c52
bswap ebx
btr edx, eax
shl si, 0xe2
movzx r11d, dx
xor ebx, 0x504c20d
lea r8, [rdx + rsi*8 + 0x1e3a0299]
add r8, r8
jne 0x1404ef063

Function at 0x1404ca47d
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r9 - 0x502b8223], rsi
ror eax, 2
movsx r10d, sil
xor word [rsp + rsi*4 - 7], 0x7a7
xor eax, 0xbd270da0
bswap eax
xadd r10d, esi
neg eax
or dword [rsp + r9 - 0x502b8223], 0xebbbc893
or di, r9w
pop rdx
push rbp
inc dl
xor dword [rsp + rsi*8 - 0x18], eax
sub dil, r9b
pop rbp
lea rbx, [rbx + r9 - 0x502b8227]
shl r10d, cl
or r9, r9
sar r10b, 0xa1
mov dword [rbx + rsi*2 - 6], eax
xadd sil, r10b
seto r9b
sal rdx, 0xf9
lea r8, [r8 + rsi*2 - 0x3a]
mov eax, esi
neg rax
mov esi, dword [rsi + r8 - 0x1b]
push rdi
mul eax
xor esi, ebp
neg esi
sub dword [rsp + r9 - 0x502b8200], ecx
jb 0x140672e57
push rdx
dec esi
sal rdi, 0xe4
ror esi, 1
dec edx
dec esi
cdq
imul word [rsp + rdx + 0xe]
not r10w
ror esi, cl
sar ax, 0xc2
mov qword [rsp + rdx + 8], rbp
movzx ebp, cx
je 0x1404ff427

Function at 0x1404d6afa
Capabilities:
Authenticate hmac

Disassembly:
lea rbp, [r10 + rbp - 0x5d9f65ac]
pop rdx
or dword [rsp + r10 - 0x5d9f65a9], r10d
xor r8d, r11d
call fcn.1405275fe
mov edi, 0x18355d03
lea rbp, [rbp + rdi - 0x18355d04]
movsx eax, di
cdqe
movzx r9d, di
movzx edx, byte [rbp + rdi - 0x18355d03]
sal di, 0x81
mov ecx, eax
xor dl, r11b
neg dl
lea rsi, [rax + rdi - 0x5de319d8]
sal r9, cl
call fcn.1405af86c
mov ebp, dword [rbx]
mov edi, 0x58845235
lea rbx, [rbx + rdi - 0x58845231]
neg dil
xor ebp, r10d
lea rdi, [rdi + rdi + 0x1c00bdb2]
movzx ecx, dil
movzx eax, cl
lea ebp, [rbp + rcx*8 - 0x5139a259]
lea rdx, [rdi + rax - 0x3170addf]
xor ebp, 0xd99f4690
shl al, 0x44
cdq
neg ebp
dec ebp
jmp 0x1406539fd
Function at 0x1404d9468
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [rsp + rbx - 0x77888ff6]
lea rbp, [rbx + rbp - 0x77888ffc]
shr bx, cl
lea rax, [rbx + rcx + 0x3d9e2a89]
or cx, dx
xor r11d, r9d
rol r11d, 3
dec ax
jle 0x1405e49b9
xor dword [rsp + rdx - 0x1d22aee0], ecx
rol r8b, 0x22
push r8
mov rbx, qword [rsp + rbp + 0x5a8f2058]
shr r8b, 0x44
call fcn.140518ef8
dec r11b
lea rdx, [rbx + 0x16850613]
imul ebx, dword [rsp + rbx]
xor r11b, 0xbc
shl edx, 0xe3
xadd qword [rsp + rbx + 8], rbx
lea rcx, [rbx + 0x5983aa1e]
xor r9b, r11b
lea r11, [rsp + r11 + 0x10]
mov si, word [r11 + rbx - 0x77885129]
lea rdi, [rdi + rbx - 0x7788512b]
sub dx, 0xe39a
xor rcx, 0xfffffffff60d722b
sal bx, cl
mov word [rbx + rdi - 0x77889000], si
dec byte [rsp + rbx - 0x77888ffb]
mov r11d, ebx
mov r11d, dword [rbp + r11 - 0x77889000]
ja 0x1404cf8be
Function at 0x1404e7c37
Capabilities:
Encode data using base64
Hash data using murmur3
Parse pe header

Disassembly:
add rdi, 2
pop r8
xor dx, bx
push rax
not dx
xor dx, 0xac0c
movsx r9d, byte [rsp + 1]
mov ebp, eax
inc dx
lea rcx, [rbp + 0x169f3320]
not dx
xadd bpl, cl
je 0x140603d1c
and bpl, byte [rsp + rbp*2 - 0x3d]
xor bx, dx
jmp 0x14053ab5b
xor dword [rsp + 8], edx
movsx r9d, r11w
lea r11, [rcx*4 + 0x400cc4bb]
mov rbx, qword [rsp + 8]
and bp, cx
movsxd rdx, edx
call fcn.14063a62f

Function at 0x1404e8203
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
idiv al
call fcn.1404c2e2a

Function at 0x1404f0bed
Capabilities:
Encode data using base64

Disassembly:
movzx ebx, word [r10]
add r10, 2
mov eax, 0xd7a0fe8d
movsx edx, al
lea r11, [rax + rax*2 - 0x604bd3fc]
xor bx, r9w
neg bx
ror r11, 0x1b
movsx esi, r11b
adc bx, 0x9c02
inc r11w
lea rsi, [rdx*2 + 0x52237d9b]
not bx
jg 0x14056d8b4
bswap ecx
xor ecx, 0x1c9e7822
mov r11d, ebx
inc ecx
lea rdx, [rbx + r11*8 - 0x66ca635d]
lea r8, [rdx*8 + 0x232dc63d]
mov qword [rsp + r11*4 - 0x409ffff8], rbx
not ecx
add r8w, 0x3b3
neg r8
dec ecx
mov qword [rsp + r11*4 - 0x40a00000], 0xffffffff838f959c
rol ecx, 1
lea rax, [rdx + rdx*8 - 0x74561247]
mov qword [rsp + r11 - 0x1027fff8], r9
xor dword [rsp + r11 - 0x1027fff8], ecx
mul dx
pop r11
pop r9
movsxd rcx, ecx
imul dx
add r10, rcx
jmp 0x1405b15da
lea rbp, [rdx + rdx*2 - 0x1852f0eb]
mul eax
inc bx
not bx
lea r11, [r11*4 + 0x3b8fc202]
sar r11b, 0xa6
rol bx, 1
sub bx, 0x5d27
mov ecx, ebp
neg bx
not r11b
xor bx, 0x5f8b
sar bp, 0x8d
shl al, 0x86
neg bx
mul dl
rol al, 0xc7
not bx
jae 0x1405f3b38
movzx r8d, bpl
bts r8, r8
jmp r11
inc eax
push rcx
sal ebx, 0x68
mov qword [rsp + rbx - 0x6e6627f8], r11
add rbp, rcx
btr r8, rbp
xor dword [rsp + r8 + 8], eax
sar bl, 0xe4
jae 0x1405ccf74
neg r8w
sub ebx, 0x331f2e2b
mov rax, qword [rbp + r11 + 0x7c706a64]
mov esi, r8d
bswap edx
lea rbp, [r11 + rbp + 0x7c706a6c]
btc ebx, edx
xor rax, r9
xor si, r11w
lea rax, [rdx + rax + 0x1c09aca4]
and si, r11w
je 0x1404c98c9
neg rax
jmp 0x1405e2e5d
push rbx
mov r11, qword [rsp + rbx - 0x6e6627f0]
movsxd rax, eax
not bl
adc r9, rax
call fcn.140643cab
xor rax, 0x10a8df2f
lea rsi, [rsi + r11*2 - 0x2b46dbce]
call fcn.1405557bf
mov edi, 0xcc80fcab
mov esi, dword [r9]
lea rbx, [rdi*8 - 0x606cdaf5]
movzx eax, dil
mov cl, byte [r9 + rax*4 - 0x2a8]
sar bl, 1
lea r9, [rax + r9 - 0xa9]
lea rdx, [rdi*2 + 0x4c0c0287]
movzx ebp, bl
call fcn.140517547
dec bp
mov r10, rcx
movzx ebx, ax
mov rsi, rdi
cwd
movsx ecx, bp
jno fcn.140520791
xor r11w, dx
add rdx, rsp
movsx ecx, di
lea rbx, [rbp + rbp*4 - 0x34e5825c]
mov r8d, ebx
mov ecx, dword [rdx + rax*2 - 0xc368]
lea rsi, [rsi + rax - 0x61b8]
btc bp, 0x38
mov dword [rsi + rax - 0x61b4], ecx
lea r10, [rax + r10 - 0x61b8]
ror eax, 0xef
mov eax, dword [r10 + r8 - 0x4e6e6628]
lea rcx, [rbx*8 + 0x4139fc1f]
push rdi
xor eax, r11d
dec dword [rsp + r8 - 0x4e6e6628]
sub eax, 0xa62cae32
rol eax, 1
xor r8d, r8d
and word [rsp + r8 + 4], 0x2118
neg dword [rsp + r8*4 + 2]
adc eax, r8d
neg eax
bt r8w, bx
jae 0x14059856d
ror dx, 3
jae 0x1405ddc93
sbb bx, 0x7409
rol rbp, cl
call fcn.140530da3