joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c09d0c
Capabilities:
Manually build aes constants

Disassembly:
neg r11d
btr ecx, 0xa8
or dword [rsp + rdx], 0x9f96a016
not sil
dec r11d
mov qword [rsp + rdx*2 - 6], r10
ror r9d, cl
call fcn.140c2deca
movsx eax, r9b
xor dword [rsp + rsi*8 - 8], ecx
xchg dl, r9b
lea rsi, [rax*4 - 0x4dbe2fc]
pop r10
movsxd rcx, ecx
and r11b, sil
adc rbp, rcx
cdq
jmp 0x140c1fe7a
xor r11d, r10d
lea r11d, [r11 + r8 - 0x286dbf4e]
mov qword [rsp + rdx - 3], rdx
not r11d
inc r9d
neg esi
jnp 0x140c04a78
add rax, rbp
jmp rax
cdq
xchg r9d, esi
mov r11w, word [rdi + rdx]
imul rsi, rcx
adc sil, dl
lea rdi, [rdx + rdi + 2]
mul dword [rsp + rdx*2 + 3]
shl r9, 0x73
shl edx, 0xda
xor r11w, r10w
xor r11w, 0xf528
xor byte [rsp + rdx*4 + 6], 0xa1
add dl, 0x88
adc r9d, esi
sbb r11w, 0x26bb
pop rdx
mul r9w
mul r9w
rol r11w, 1
ror rax, 0x5d
sal cx, 0x4c
adc r11w, dx
not r11w
cbw
xor r10w, r11w
add r11, rsp
idiv cx
neg rcx
mov dword [r9 + r11 - 0x25c65c00], r8d
not r9
jge 0x140c0ca6d
mov r8d, dword [rdx + rbx]
lea rcx, [rsi + rax*2 - 0x4ce6c1e9]
sub r11w, 0x3eae
push rsi
lea rbx, [rdx + rbx + 4]
jbe 0x140c0dff2
call fcn.140c09a7c
mov eax, 0x6493d192
mov esi, eax
mov r9w, word [rbx + rsi - 0x6493d192]
cqo
or si, 0x2a9d
mov ax, word [rbx + rax - 0x6493d190]
btr rdx, rsi
mov r11d, 0x9119a886
lea rbx, [rdx + rbx + 2]
jb 0x140c2a176
lea r8, [rsi*4 + 0x7a00803]
not r9w
mov ecx, esi
not ax
or r9w, ax
mov eax, edx
and al, dh
shl rax, 0x84
mov word [rdx + rbx], r9w
mov r8d, dword [rdi + rdx]
push rax
sub byte [rsp + rdx*4 + 4], r11b
xchg ecx, edx
lea rdi, [rsi + rdi - 0x6493fb9b]
neg rcx
or r11w, r11w
xor r8d, r10d
imul rax
and edx, 0x81033902
lea r8d, [r8 + rdx*4 + 0x651858af]
bt dx, 0x17
xor r8d, 0xc58b8a1e
rol cl, 0x44
jae 0x140c09b7c
mov esi, 0x2d8f3ca3
shl esi, 0xbd
mov r9d, 0x2913c6a0
mov r8d, dword [rdi + r9 - 0x2913c6a0]
mov r11d, esi
lea rdx, [rsi + r9*2 + 0x2ea2ca82]
lea rdi, [rdi + rsi - 0x5ffffffc]
xadd esi, edx
neg r9w
sal r9, 0x7e
xor r8d, r10d
dec sil
movzx ecx, si
or cx, si
bswap r8d
bswap r9d
call fcn.140c1cc86
sbb r9b, 0x2a
push rsi
movzx eax, word [rsp + r8*2 + 0x3b]
ror rax, 0x42
neg r9b
inc r9b
xor r9b, 0x80
lea rcx, [rdx + rdx*2 - 0x1b43166c]
not r9b
pop rdx
xor r10b, r9b
add r8w, si
add r9, rsp
cwde
call fcn.140bfd96c
mov r9d, 0xcda5fd2b
movzx r8d, r9b
mov ecx, r8d
mov eax, dword [rdi + r8*2 - 0x56]
lea rdi, [rdi + r8*2 - 0x52]
xor eax, r10d
bswap eax
not eax
mov r11d, ecx
xor eax, 0xcba2b3a2
xor rcx, rcx
not eax
push r10
mov edx, r9d
lea rdx, [rdx + r11*2 - 0x57c73251]
xor dword [rsp + r8*4 - 0xac], eax
pop r10
bt ecx, 0xb7
xchg r9w, dx
push r9
movsxd rax, eax
adc rbp, rax
or r8w, 0x8e0e
and r9b, 0x2c
mov eax, dword [rdi + r8*4 - 0x238bc]
xadd word [rsp + r8 - 0x8e2e], dx
and byte [rsp + r8 - 0x8e2b], 0x38
lea rdi, [rdi + r8 - 0x8e2b]
lea rsi, [rdx + r11*2 + 0x64afd710]
seta r11b
xor eax, r10d
ror r11, 0x60
inc eax
ror r11b, 0x43
not eax
rol rsi, 0x67
jb 0x140bfa4e0

Function at 0x140c0aced
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140c20a03
push 0x24249d35
cmp ebx, 1
lea rsp, [rsp + 0x10]
jne 0x140c15302
mov rcx, rax
jmp 0x140c06533
jmp 0x140c165a9
cmp ebx, 2
jne 0x140c026d4
jmp 0x140c2339d
call fcn.140c310e8
Function at 0x140c0b1bf
Capabilities:
Manually build aes constants

Disassembly:
sub r9, r8
mov qword [rsp + rsi - 1], r10
jo 0x140c2fbdc
jg 0x140c04a99

Function at 0x140c0d302
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
sal r8w, 0x26
pop rcx
pop rax
jne fcn.140c10833
pop rsi
add rbp, rax
movzx edx, byte [rdi + r9 - 0x37acfd05]
lea rdi, [rdi + r8 + 1]
movzx eax, cx
dec dword [rsp + r9 - 0x37acfcfa]
lea r11, [r9 + r9*8 + 0x13a57e3f]
xor dl, r10b
pop r11
add r11, qword [rsp + r9*2 - 0x6f59fa0a]
rol dword [rsp + r9 - 0x37acfd04], 0x87
sbb dl, 0x2a
neg dl
inc dl
xor dl, 0x80
mov esi, ecx
sub r8b, 0x3b
not dl
xor r10b, dl
and byte [rsp + r9 - 0x37acfd01], cl
xadd r8d, eax
shl dword [rsp + r9*2 - 0x6f59fa06], cl
lea rdx, [rsp + rdx + 8]
btc eax, 0xe
shl dword [rsp + r9 - 0x37acfd03], 0xe4
mov r9w, word [r9 + rdx - 0x37acfd05]
dec r8
sub byte [rsp + r8*2 - 0x10ce3], al
lea rbx, [rax + rbx - 0x40c7]
dec word [rsp + r8 - 0x8671]
sar cx, 0xa4
mov word [rbx + r8*2 - 0x10ce4], r9w
jb 0x140bf652a

Function at 0x140c0da14
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11d, dword [rdi + riz]
movsx esi, r9w
mov ecx, esi
shl r9w, 0x43
lea rdi, [rsi + rdi - 0x5081]
rol r9d, cl
sbb si, si
lea rax, [rcx*4 - 0x227145f0]
xor r11d, r10d
neg ecx
cqo
neg r11d
cwd
sar sil, 0x26
btc r9, rax
xor r11d, edx
sub r9d, 0x66bbd22f
neg r11d
push rcx
rol word [rsp + r9*4 - 0x26d2cb8e], 0x81
xor r11d, edx
xor r11d, 0xb4af6daa
or r8w, ax
xor r8w, 0xaf96
sbb r11d, edx
shr dx, 0xe1
idiv dword [rsp + r9*2 - 0x136965c9]
call fcn.140c2387d
mov qword [rsp], r8
push 0xffffffffd028fd28
mov qword [rsp], rbx
mov r8d, 0x29afbc11
mov ebx, r8d
btr ebx, r8d
push rbp
rol r8, 0x46
mov ebp, r8d
push rbp
lea r8d, [rbx - 0x29adb811]
rol bp, 0xae
shl r8, 0x16
mov qword [rsp + rbx - 0x29adbc11], r10
movsx r10d, bpl
sal ebx, 0xc5
btr rbx, r10
push r12
setae bl
push rdi
shr bpl, 0xe5
or bpl, 0x88
add r10d, ebp
movabs rbp, 0
rol ebx, 0x92
jne 0x140c04b60
movzx r11d, word [rdi]
mov edx, 0x462b9da2
movzx r8d, dl
lea rdi, [rdx + rdi - 0x462b9da0]
movzx ecx, r8b
and r8w, 0x5938
xor r11w, r10w
push r8
xor r11w, 0x5d88
neg dword [rsp + rdx - 0x462b9da0]
movsx esi, dx
inc r11w
not r11w
pop rcx
xadd rdx, rcx
bt rcx, rsi
adc r11w, 0x5305
sal esi, 0xe9
xor r10w, r11w
mov r9d, ecx
shl esi, 0x10
lea rcx, [r8 + 0x7902487]
lea rbx, [rdx + rbx - 0x462b9dc4]
imul rsi, rsi
mov word [rbx + r8 - 0x20], r11w
movsx r11d, r8w
sub dx, r8w
mov ecx, dword [rdi + r8 - 0x20]
lea rdi, [rdi + rdx - 0x462b9d9e]
setp r8b
xor ecx, r10d
and esi, r11d
jnp 0x140bfd637
not r8
adc ecx, r8d
dec si
movsx eax, sil
setge al
xor ecx, r8d
dec r11d
sub ecx, r8d
push r9
pop r8
bt r8, rdx
neg ecx
xchg r8w, ax
bts r8, rdx
div eax
push r10
cdq
movzx r10d, r11w
xor dword [rsp + rdx*4], ecx
btr esi, r8d
dec r8w
btc r9, 0xab
pop r10
bts r9, 0x91
call fcn.140c24bf7
lea rdi, [rdi + r9*2 - 0x43290d24]
xor edx, r10d
lea r11, [r9 + 0x279ce81c]
call fcn.140c0a7ae
Function at 0x140c0dbac
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0x75961ca6
sbb rsp, 0x18
call rax
mov ebx, 0x1c188ab8
mov r9d, ebx
mov rsp, qword [rbp + rbx*2 - 0x38311580]
mov rbp, qword [rbx + rbp - 0x1c188ac0]
sar rbx, 0x41
lea r8, [rbx + 0x48008b36]
mov qword [rbx + rbp - 0xe0c455c], rax
mov rbx, rbp
pop r10
call fcn.140bf46ad

Function at 0x140c0e4f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal sil, 0xc4
ror edx, 7
jmp rbp
sub r9w, r9w
add ecx, esi
adc rbp, rax
jmp 0x140bfb731
xchg word [rsp + 9], r11w
movsxd rsi, esi
call fcn.140c1fae3
mov r9d, 0x4236138
mov r11, qword [rbx + r9 - 0x4236138]
movsx esi, r9w
mov cl, byte [rbx + r9*2 - 0x846c268]
lea rdx, [rsi + rsi*4 + 0x171d3e89]
lea rax, [rdx + rdx - 0x1cfe84f1]
lea rbx, [r9 + rbx - 0x423612e]
xadd esi, r9d
mov byte es:[r11 + r9*4 - 0x184e0], cl
adc eax, r9d
bts r9d, 0xb2
mov eax, dword [rdi + r9 - 0x46138]
bts r9w, r9w
jae 0x140c11e50
lea rcx, [r9 + rdx + 0x1c3a7aa0]
lea rdi, [rdi + r9*4 - 0x1184dc]
bts r9d, ecx
xor eax, r10d
movsx r11d, cl
xor eax, 0x74ab0db7
rol eax, 1
mov r8d, esi
lea eax, [rax + rdx*4 + 0x58b68803]
imul rdx, rdx
shr r8d, 0x6e
bts r11d, edx
rol eax, 1
push rcx
mov qword [rsp + r9 - 0x2046138], r10
imul rsi, r11
add rsi, rsi
lea r10, [rsi*2 - 0x66c86363]
xor dword [rsp + r9*2 - 0x408c270], eax
lea rsi, [r11 + 0x2307230e]
pop r10
btc r9d, r8d
shr sil, 0x42
inc esi
movsxd rax, eax
jns 0x140c05a3f
mov r8d, 0x252d7930
mov edx, r8d
movzx esi, r8b
movzx r8w, byte [rbx + r8 - 0x252d7930]
mov al, byte [rdx + rbx - 0x252d792e]
push rsi
xadd sil, dl
not r8b
movsx r11d, si
not al
movzx r9d, byte [rsp + rdx*2 - 0x4a5af260]
and r8b, al
mov word [rbx + rdx*2 - 0x4a5af25e], r8w
btr r11w, r11w
mov rdx, qword [rdx + rbx - 0x252d792e]
shr dword [rsp + rsi - 0x60], 0x85
rol dword [rsp + rsi*2 - 0xbd], 0x53
xor esi, 0xc9828ab
mov cl, byte [rbx + rsi - 0xc9828c1]
movzx r8d, si
pop r11
shr rdx, cl
mov ecx, 0x47839f25
lea rsi, [r11*2 + 0x5c0103bd]
shl r11, cl
mov qword [rsi + rbx - 0x5c0103bb], rdx
setnp cl
lea rbx, [rbx + r9 - 0x2c]
sub esi, ecx
adc r11d, ecx
push r8
mov r8d, dword [rsi + rdi - 0x147d64bf]
lea rdi, [rdi + rsi - 0x147d64bb]
btr ecx, ecx
jae 0x140c28946

Function at 0x140c11fa1
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsxd rdx, edx
mov qword [rsp + r11 - 0x58107200], r11
mov ecx, 0x6d0f138f
adc rbp, rdx
pop rsi
inc r11d
mov edx, dword [rax + rbx - 0xbd6a58b]
mov r11d, dword [rbx + rax*2 - 0x17ad4b12]
lea rsi, [rax + r9*2 - 0x7d4ffb5c]
push r8
mov cl, byte [rbx + r8*2 - 0x6918]
lea rbx, [r8 + rbx - 0x348a]
jp 0x140c037e5
xadd word [rsp + rax - 0xbd6a587], si
ror byte [rsp + rax*2 - 0x17ad4b10], 0x81
shrd edx, r11d, cl
mov dword [rbx + rax*2 - 0x17ad4b16], edx
mov qword [rsp + r8*4 - 0xd240], rbp
ret

Function at 0x140c13206
Capabilities:
Execute anti-debugging instructions

Disassembly:
jns 0x140c02e88
sbb eax, 0xd38a87a0
movsx edx, cl
sub esi, r11d
xadd r11b, cl
ror eax, 3
or esi, edx
ror cx, 0x62
bswap ecx
sbb eax, edx
mov qword [rsp + rcx*2 - 0x7f810040], rdx
sub dx, dx
mov qword [rsp + rcx - 0x3fc08018], r10
jae 0x140c0110a
Function at 0x140c14468
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor r9d, r10d
sar r11, 0x75
lea rax, [rcx + r8 + 0x3f24fa39]
xadd dword [rsp + r11 + 8], r8d
xor r9d, 0x3916850c
mov qword [rsp + r11*2], 0x22ce996
pop rcx
sar qword [rsp + r11*2], cl
neg r9d
mov esi, dword [rsp + r11 + 4]
or word [rsp + r11*4 + 3], 0x7712
lea r9d, [r8 + r9 - 0x4f6cb8ef]
btc r11w, dx
setae byte [rsp + r11 + 3]
and rcx, 0xffffffffe23a6699
not r9d
shl dword [rsp + r11 + 3], cl
mov qword [rsp + r11*4 - 4], r10
sbb al, cl
inc sil
xadd ax, dx
xor dword [rsp + r11*4 - 4], r9d
shl cl, 0x82
movzx r10d, r11b
cqo
pop r10
cqo
sar r11, 0xe0
movsxd r9, r9d
mul dl
adc rbp, r9
mul cl
push rsi
pop rdx
jae fcn.140c10833
Function at 0x140c14db1
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.140c1aacd
bswap eax
pop rsi
push r10
neg cl
or rsi, rsi
xor dword [rsp], eax
movzx edx, cx
call fcn.140c0fda2
dec ebx
mov qword [rsp], 0xffffffffdc97b09a
push 0xffffffffff93f828
push 0x6dbe62b1
lea rsp, [rsp + 0x18]
jne 0x140c2d225
mov eax, 0x860bc9a0
lea rax, [rax + rax - 0x57fe9b7c]
mov rax, qword [rbp + riz]
jmp 0x140bf7d7a
call fcn.140c128e5
add rbp, rdx
mul r8b
sbb r11d, 0x46954384
mov r8d, dword [r9 + rbx - 0x9f]
sar byte [rsp + r9 - 0x9b], 0x81
cwde
movzx edx, al
mov ecx, dword [rbx + r9*2 - 0x13a]
shl ax, 0xcd
lea rbx, [rbx + r9 - 0x97]
ror qword [rsp + rax - 0x4000], 0xf2
sbb r9d, dword [rsp + r9*4 - 0x27a]
add r8d, ecx
lea r9, [rsi + rsi*4 - 0x54db286a]
neg si
mov ecx, r8d
and eax, edx
mov dl, byte [rdi + rax*2 + 4]
cwde
rol byte [rsp + rax*4], 0x64
mov qword [rsp + rax + 8], rsi
lea rdi, [rax + rdi + 5]
or dword [rsp + rax*2 + 0xa], esi
xor dl, r10b
or word [rsp + rax*2 + 2], r11w
sbb eax, dword [rsp + rax*4 + 0xc]
adc rsi, 0xffffffffb437b485
sub dl, al
neg dl
rol dl, 1
bt r11d, 3
call fcn.140bfd18d
mov ecx, 0xfe22c907
mov si, word [rbx + riz]
add rbx, 2
movzx edx, byte [rdi + riz]
movsx r9d, cx
mov r8d, r9d
add cx, cx
adc rdi, 0
sar r8b, 0xc1
xor dl, r10b
call fcn.140c272c2
mov r9d, 0x3aba1813
movzx r8d, r9b
mov ecx, 0x84bd581e
mov cx, word [r8 + rbx - 0x13]
lea rdx, [r9*8 + 0x23b020e]
add dl, r8b
lea rbx, [r9 + rbx - 0x3aba1811]
push r8
movzx r9d, byte [rdi + r9*2 - 0x75743026]
not dx
lea rdi, [r8 + rdi - 0x12]
jbe 0x140bf36d8
call fcn.140c2c835
mov esi, 0x8212bba7
movsx ecx, si
mov eax, dword [rdi + riz]
lea r9, [rsi + rsi*8 + 0x1d106800]
rol cx, 0x43
adc rdi, 3
xor eax, r10d
push rcx
ror eax, 2
imul esi, ecx
not eax
lea eax, [rax + rcx - 0xc7ee39d]
jb 0x140c065f2
not rsi
movsxd rax, eax
shl r9d, cl
bswap rcx
add rbp, rax
xor cx, word [rbx + r9*2 - 0x4259f000]
xor dx, word [rbx + rdx*2 + 2]
lea rax, [rsi + r11 - 0xfbab7a]
xor al, 0x16
sbb r9d, eax
lea rbx, [rbx + r9 - 0x122d3844]
cwde
and cx, dx
not cx
and rax, r9
mov word [r9 + rbx - 0x122d3846], cx
setbe sil
movsx ecx, r9w
jmp rbp
mov eax, 0xdb07da9c
not eax
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
jmp 0x140c19856
Function at 0x140c181ab
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor edx, eax
neg edx
pop rax
call fcn.140c32ec5
mov ecx, 0x7596683b
lea rax, [rcx + rcx - 0x18f31dd5]
mov esi, eax
mov r9d, dword [rdi + rcx - 0x7596683b]
sar cx, 0xe6
movsx edx, al
movsx r8d, dx
lea rdi, [rdi + rcx - 0x7596019c]
sar rdx, 0x3f
lea r11, [r8 + rcx*8 + 0x463b083d]
xor r9d, r10d
lea r9d, [r9 + r8 - 0x23721471]
call fcn.140bf4244

Function at 0x140c18488
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], rcx
dec esi
shl rdx, 0xf8
mul cl
mov qword [rsp + 8], r10
xor dword [rsp + 8], esi
mov r10, qword [rsp + 8]
mov qword [rsp + 8], 0x15077810
xchg qword [rsp + 7], rdx
cbw
movsxd rsi, esi
add rbp, rsi
mov dword [rsp + 3], ecx
shr word [rsp + 3], 0xa2
not byte [rsp + 5]
pop r8
pop r8
jns fcn.140c10833
Function at 0x140c1caf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
and r11w, r9w
setbe r11b
xor dword [rsp + r8 - 0x480279ca], eax
pop r10
movsxd rax, eax
bswap rcx
dec dx
add rbp, rax
movzx r9d, byte [rdi + r8 - 0x480279ca]
dec sil
shl ecx, 0x4c
lea rax, [rdx + rdx*8 + 0x12be080d]
lea rdi, [rcx + rdi + 1]
xor r9b, r10b
sub r8w, ax
sub rdx, rcx
xor r9b, 0x9c
not esi
bswap edx
neg r9b
inc r8
xor r9b, dl
mul cl
inc r8w
xchg ah, dl
neg r9b
not r11d
push rsi
xor r10b, r9b
lea r9, [rsp + r9 + 8]
and byte [rsp + rcx], r8b
ror r11b, 0xc4
pop rdx
movzx si, byte [r9 + rcx]
bswap rax
lea rbx, [rbx + rcx - 2]
cmovp r8, rcx
or r8, 0xffffffffca822284
shl rcx, 0x73
mov word [rbx + rcx], si
jbe 0x140bf4d1f
mul r8b
mov esi, 0x3a01a9bc
jno fcn.140c10833
mov eax, 0x8521fb17
and rax, rax
mov rax, qword [rbp + rbx*8]
call fcn.140c0aced
mov r8d, dword [rdx + r8*4]
shr word [rsp + 9], 0x4f
shr r9d, 8
xor r9d, r8d
shr word [rsp + 0xc], 0xe4
push 0x16acb639
inc rcx
rol qword [rsp], 0x33
jb 0x140c28fb9
call fcn.140c023f2
push r10
bts r11d, 0x38
xchg r9w, dx
xor dword [rsp + r9 - 0xb2c], r8d
jmp 0x140c28b4a
adc rbp, r8
inc dx
ror rax, cl
adc cl, al
mov rcx, qword [rbx + r11*2 - 0x1658]
bts esi, edx
mov r11d, dword [rbx + r11 - 0xb24]
lea rbx, [rsi + rbx - 0x6a94917c]
sbb sil, dl
lea rdx, [rsi + rax*4 - 0x7ac73f4d]
mov dword [rcx + rsi - 0x6a9491a0], r11d
jmp rbp
call fcn.140c2b98f
push 0xffffffffab31bc84
mov qword [rsp + 8], rax
lea rsp, [rsp + 8]
push 0xffffffff9d20dd22
jmp 0x140c2fe5c
push 0x70a1e2bf
movsxd rsi, esi
shr word [rsp + 1], 0xac
adc rbp, rsi
lea rsp, [rsp + 0x28]
jmp 0x140c00168
bt r11d, eax
ror sil, 0x22
pop r10
sbb si, cx
xadd r9, r11
movsxd r8, r8d
jge 0x140c0863c
mov r9d, 0xc6b04b00
mov ecx, dword [rdi + riz]
lea r8, [r9 - 0x4fcaabda]
movzx esi, r9b
lea rdi, [rdi + r8 - 0x76e59f22]
movzx eax, sil
call fcn.140c33059
xor r9d, 0x2b990a98
mov qword [rsp + 8], 0xffffffffe38fbb23
dec r11
jmp 0x140c0a16b
dec ebx
push 0x6511df3c
lea rsp, [rsp + 0x10]
jne 0x140bfa3e3
mov rax, qword [rbp + riz]
call fcn.140c2b759
bswap eax
inc r9w
inc r9b
dec eax
mov r11d, ecx
movsx edx, r8b
rol eax, 3
not r8b
neg eax
sub r8d, 0xea27323b
shr dx, 0xc5
dec eax
push r10
xor dword [rsp + r9 - 0x5f2944dc], eax
and cl, 0x37
rol r11b, 0x43
pop r10
movsxd rax, eax
movzx esi, dx
add ecx, r9d
add rbp, rax
neg ecx
ror rcx, 0x97
or r11d, r8d
mov ebx, dword [r8 + rbx - 0x15d8cdea]
jle fcn.140c10833
mov qword [rsp + 0x18], r10
mov r10d, 0xe18dbd09
xor dword [rsp + 0x18], esi
add r10, r10
sal r10, 0x9a
dec r10
mov r10, qword [rsp + 0x18]
jb 0x140bf3973
jp 0x140c22a69

Function at 0x140c1d500
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rbx, [rbx + rsi - 0x41a1]
xchg word [rsp + rsi*2 - 0x832c], r11w
sets r11b
mov word [rbx + rsi*4 - 0x1067c], dx
inc cl
pop r11
pop rcx
pop r9
ja fcn.140c10833
sar ax, cl
xor edx, r10d
movsx r9d, r11b
call fcn.140c357f5

Function at 0x140c1e0ca
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movzx r9w, byte [rbx + riz]
lea rcx, [rax + rax + 0x45346c26]
call fcn.140c11e0d
Function at 0x140c1e3ce
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r8 - 0x11cd34b5], 0x7b9d06a8
mov qword [rsp + r8 - 0x11cd34bd], 0x7c953698
movsxd r11, r11d
mov qword [rsp + r8 - 0x11cd34c5], r9
sar r8d, cl
add rbp, r11
idiv cl
imul rdx
mov r9d, dword [rbx + r8*2 - 0x11cc]
mov esi, ecx
rol byte [rsp + r8 - 0x8e4], 1
setae byte [rsp + r8*4 - 0x2386]
movzx r8d, byte [rdi + r8*4 - 0x2394]
cwde
idiv dword [rsp + rax]
xor r8b, r10b
sub byte [rsp + rax - 0x1b506c5], ch
neg r8b
lea rdx, [rsi + rsi*4 + 0xa045687]
sal rsi, cl
lea r11, [rcx + rax*8 + 0x1f041f02]
sbb r8b, 0x1f
cbw
sub word [rsp + rax*4 - 0x6d7ff64], ax
not r8b
setle cl
neg r8b
cwde
ror r8b, 1
cqo
not r8b
sar si, 0x4a
and rcx, r11
xor r10b, r8b
mul word [rsp + rcx*8 + 0x12]
and qword [rsp + rcx*4 + 6], 0xffffffffd3892c2f
lea r8, [rsp + r8 + 0x18]
neg r11b
shl dx, 0x8c
add r11b, cl
mov dword [rcx + r8], r9d
push r11
add rcx, qword [rdi + rcx + 5]
shr dword [rsp + rsi - 0x21fffd], 0x49
sar r11w, 0xeb
cdq
lea rdi, [rdi + rsi*2 - 0x43fff3]
lea r9, [rdx*4 - 0x7a56ec73]
xor rcx, r10
ror word [rsp + rsi - 0x21fff7], 0xec
jae 0x140c24cfa
neg rcx
xadd r9b, sil
bt r11w, dx
dec qword [rsp + rsi*2 - 0x4400fa]
bswap rcx
sal ax, 0x85
not rcx
pop r8
call fcn.140c2f901
mov r10, qword [rsp + rax + 0x2cfbeba9]
or rcx, qword [rsp + rax + 0x2cfbeba1]
and r11b, cl
sbb r9b, 1
movsxd rdx, edx
shl byte [rsp + r9*2 - 0x4260f82e], 0x65
add rbp, rdx
mov si, word [rax + rbx + 0x2cfbeb99]
shr qword [rsp + r9 - 0x21307c13], cl
lea rbx, [rax + rbx + 0x2cfbeb9b]
pop r8
mov cl, byte [rdi + rax*2 + 0x59f7d732]
mov qword [rsp + rax*2 + 0x59f7d73a], rax
lea rdi, [rdi + r11*2 - 0x175]
dec byte [rsp + rax + 0x2cfbeba4]
dec dword [rsp + rax + 0x2cfbeba4]
xor cl, r10b
cwde
xor cl, 0x9b
not qword [rsp + rax*8 - 0xa330]
xchg qword [rsp + rax*2 - 0x28c8], r8
add cl, 0x3e
not r8b
inc word [rsp + rax - 0x1462]
inc dword [rsp + rax*2 - 0x28c5]
xor cl, r8b
rol r8, 0xc4
xor cl, 0x9a
dec cl
xor r10b, cl
lea rcx, [rsp + rcx + 0x10]
mov word [rcx + rax - 0x1467], si
inc byte [rsp + rax*8 - 0xa32a]
cbw
mov qword [rsp + rax*2 - 0xce], rbp
ret 8

Function at 0x140c1ec01
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0x412ea534
jnp 0x140c20178
cmp rbx, r9
call fcn.140bf4775
mov edx, 0xa6146136
lea rax, [rdx*8 - 0x7d4b34f5]
lea r9, [rdx + rdx - 0x2af81460]
mov edx, dword [rdi + riz]
add rdi, 4
movzx r11d, al
movsx ecx, r9b
xor edx, r10d
mov esi, eax
bts r9w, cx
add rax, 0xffffffff8f94e605
rol edx, 3
xor rax, r9
movsx r8d, cx
rol eax, 0x7e
neg edx
lea rax, [r11 + r11*2 - 0x2cfbedca]
btr r9d, 0xa8
xor edx, 0x2185d61d
push rax
shl r8d, cl
dec edx
call fcn.140c1ce68
add byte [rsp + r8 - 0x8e28], r11b
xor dword [rsp + r8*2 - 0x11c56], eax
mov r10, qword [rsp + r8*4 - 0x238b4]
neg ecx
lea rbx, [r8 + rbx - 0x8e33]
mov dword [rbx + r8*4 - 0x238bc], eax
pop r11
dec r9d
pop rdx
jno fcn.140c10833

Function at 0x140c20e97
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r8, [r9 + rdx*8 + 0x2ea28312]
xor r10b, r11b
shr sil, 0x45
mov qword [rsp + rdx - 0x7a1b8d01], r9
seta byte [rsp + rsi - 0x7a1b8cfc]
lea r11, [rsp + r11 + 8]
je 0x140c21a09
Function at 0x140c2155c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x140c1563c

Function at 0x140c21566
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edx, 3
mov qword [rsp + r11 - 0xef6caa1], r10
mov r10d, 0x1d344896
xor dword [rsp + rcx*2 - 0x343a9e5a], edx
mov r10, qword [rsp + r11*2 - 0x1ded954a]
movsxd rdx, edx
mov qword [rsp + rcx*4 - 0x68753cc4], rsi
or eax, dword [rsp + rcx*4 - 0x68753cc0]
neg dword [rsp + rcx*2 - 0x343a9e61]
add rbp, rdx
dec dword [rsp + rcx - 0x1a1d4f2f]
mov qword [rsp + rcx - 0x1a1d4f29], 0xffffffffd006deb6
mov rax, qword [rdi + r11*4 - 0x3bdb2aa0]
add word [rsp + rcx*2 - 0x343a9e58], cx
xor rax, r10
inc dword [rsp + rcx*2 - 0x343a9e60]
or byte [rsp + rcx - 0x1a1d4f2c], r11b
lea rdx, [r11 + rcx + 0x6eb5d7a0]
neg rax
mov byte [rsp + r8*4 - 0x3b0], dl
sal r8b, 0xa1
dec rax
pop rdx
neg r9w
not rsi
ror rax, 7
neg byte [rsp + rcx*2 - 0x343a9e5b]
lea rax, [r11 + rax + 0x5817d8ec]
ror rax, 1
xor r10, rax
rol word [rsp + rcx - 0x1a1d4f30], 0x85
xor byte [rsp + rcx - 0x1a1d4f2c], 0x1c
mov qword [rcx + rbx - 0x1a1d4f39], rax
movzx eax, r8w
mov al, byte [rcx + rdi - 0x1a1d4f25]
lea rdi, [rcx + rdi - 0x1a1d4f24]
bswap r11
xor al, r10b
and dx, 0x93bb
adc al, 0x26
xadd dword [rsp + rcx - 0x1a1d4f2f], ecx
xor r8b, byte [rsp + r8 - 0xda]
not al
or esi, r8d
shl r9b, 0x21
neg al
shr edx, 0xb1
sbb al, r11b
rol dl, 0xe7
and dword [rsp + r8 - 0x68], 0xfc24952a
xor r10b, al
lea rax, [rsp + rax + 8]
mov rcx, qword [rax + rsi - 0x6aade27e]
sub word [rsp + rsi - 0x6aade279], 0x5d3b
ror dl, 6
mov qword [rsi + rbx - 0x6aade28e], rcx
lea rbx, [rbx + rsi - 0x6aade28e]
bts rsi, 0x30
movsx eax, sil
pop r9
jae fcn.140c10833
mov ecx, 0xb884158b
movsx r11d, cx
movsx eax, cx
movzx r8w, byte [rbx + r11*2 - 0x2b16]
movsx r9d, cx
cdqe
mov cl, byte [rbx + r11*8 - 0xac56]
sar r11, 0xcb
lea rdx, [r9 + rax - 0x4704af8]
add rbx, r11
btc eax, 0x83
adc rax, rax
shr r8b, cl
mov word [rbx + r11 - 2], r8w
lea rdx, [r11 + r9*8 + 0x1903621f]
movzx ecx, r11b
not ax
mov r9d, dword [rdi + r11*2 - 4]
cbw
movsx esi, r11b
sal rcx, cl
lea rdi, [rdi + r11*2]
jbe 0x140c13633
xor r9d, r10d
sub r11d, 0xc91f5b91
sub r11b, al
bswap r9d
or al, r11b
mov r8d, 0x27bd02b8
sete dl
not r9d
lea r9d, [r9 + r11*4 + 0x1b1a8a4b]
ror r9d, 3
push r10
shr r11, cl
and esi, 0x3e19d508
xor dword [rsp + r11 - 0x36e0a4], r9d
xor cl, dh
bt edx, 0x1d
pop r10
setb r8b
cmovae rax, rcx
sar sil, cl
movsxd r9, r9d
sub r8, r8
btc r11, 0x32
adc rbp, r9
sal cl, cl
setbe al
add rsi, rbp
jmp rsi
Function at 0x140c25d88
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x140c11b15
ror edx, 3
dec ecx
mov qword [rsp + r9 - 0x2194868c], r10
btc esi, r11d
pop rsi
xor dword [rsp + r9 - 0x21948694], edx
pop r10
sal r11w, 0x4f
lea r11, [rax + rax*2 + 0x39b83391]
movsxd rdx, edx
movzx esi, r9b
sar r9b, 3
rol rsi, 0xa2
adc rbp, rdx
push rsi
mul dword [rsp + r9*2 - 0x43290de1]
jno 0x140c32061
mov rcx, rbx
setae r11b
setb dl
lea rbx, [rbx + r9 - 0x219486f6]
mov dword [rbx + r8*2 - 0x26], ecx
pop rax
jb fcn.140c10833
mov edx, 0xdf378186
mov r11d, edx
mov r11, qword [rbx + riz]
lea r8, [rdx*2 - 0x456d70d0]
mov rax, qword [rbx + riz + 8]
add rbx, 8
lea r9, [r8 + r8 + 0x2a86a1a8]
jmp 0x140c2513b

Function at 0x140c26523
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rbx + r9 - 0x909], r8w
or rax, rdx
mov qword [rsp + r9 - 0x907], r9
mov r8d, 0x3fa21b2f
mov r11d, dword [r9 + rdi - 0x905]
ja 0x140c168e7
mov r8d, dword [rdi]
mov r11d, 0xc5a4fb92
lea rdx, [r11 + r11*4 + 0x649a4b37]
add rdi, 4
neg dl
sub rdx, 0xfffffffff3913a0e
movzx r9d, dx
xor r8d, r10d
movsx ecx, dx
add r9d, ecx
inc r8d
lea rdx, [rdx + rdx*2 - 0x627da17b]
btc ecx, edx
not r8d
mov eax, 0x4dbb1520
rol r8d, cl
movsx esi, dx
xor edx, r9d
push r9
neg r8d
bswap r8d
shl word [rsp + r9*2 - 0x1ef7e], cl
dec r8d
ror ax, 2
shr cx, 0xed
mov qword [rsp + r9*2 - 0x1ef84], r10
xor dword [rsp + r9 - 0xf7c2], r8d
pop r10
movsxd r8, r8d
cwd
rol dl, 0x27
adc rbp, r8
lea rsi, [r11 + r9*8 + 0x3333660a]
mul r11d
movzx r8d, si
mov rsi, qword [rbx + rdx*2 - 0x78060684]
sub ax, dx
not r9
mov cl, byte [rbx + rdx*2 - 0x7806067c]
btc r11, 9
lea rbx, [r9 + rbx + 0xf7c5]
call fcn.140c21ccc

Function at 0x140c28820
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx r11d, r9b
ror dl, 1
xor r10b, dl
mov qword [rsp + rsi - 0x429c729e], 0xffffffff9d837022
lea r9, [rax + rcx*8 + 0x2f91f8a2]
push r9
lea rdx, [rsp + rdx + 0x10]
ror r11, 0x6d
mov dword [rsp + rcx + 0x194949fe], 0x2315b1b0
mov r9, qword [rdx + rsi - 0x429c729e]
jae 0x140c17189

Function at 0x140c28861
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r11d
push 0xffffffffca325c96
or byte [rsp + 2], 0xa8
inc qword [rsp + 0x18]
xor r11d, 0xf51e4b10
jmp 0x140c119f3
shr dword [rsp + 4], 0xd9
not r11d
not word [rsp + 0x1d]
adc r11d, 0x8ca03280
sal word [rsp + 0x18], 0x84
call fcn.140c2009d
jae 0x140c0b6a8