joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140120eaf
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, dword [r10 + rax*4]
shr r9d, 8
xor r9d, eax
inc rbx
rol dword [rsp], 0xf2
xor r9d, 0xa2a3b09c
sar word [rsp + 6], 4
mov qword [rsp + 8], 0x3a338126
dec rbp
call fcn.140147985
and eax, 0xff
push 0xffffffffc3a40929
sar byte [rsp + 1], 0xa4
jp 0x140117e29
mov edi, 0x38087b82
movsx ecx, di
lea r9, [rcx*8 + 0x60129d01]
mov dx, word [rsi + rdi - 0x38087b82]
lea r9, [r9 + rcx*4 + 0x4301060b]
lea rax, [r9*4 + 0x91b1b2]
lea rsi, [rsi + rdi*2 - 0x7010f702]
inc ax
movsx ebp, ax
movzx eax, byte [rdi + r11 - 0x38087b82]
lea r11, [r11 + rdi - 0x38087b81]
sub ebp, ebp
push rbp
xor al, r10b
or cx, 0x593c
sar ebp, cl
dec al
neg qword [rsp + rdi - 0x38087b82]
shl ebp, cl
shr rcx, cl
ror al, 1
jmp 0x140135a43
ror di, 0xc5
bt ebp, 2
dec al
lea rdi, [r9*2 + 0x7c93fd03]
call fcn.1401313fb
mov ecx, 0xb230922d
rol ecx, cl
mov r9, qword [rsi + rcx*2 - 0x248b6c8c]
lea rbp, [rcx*2 + 0x278d6c2b]
mov cl, byte [rcx + rsi - 0x1245b63e]
lea rsi, [rsi + rbp - 0x4c18d8b5]
lea rbx, [rbp*8 + 0x29a6dc3b]
adc bp, bp
sal r9, cl
mov qword [rsi + rbp - 0x4c18b16e], r9
btr ebx, 0x29
mov ebx, dword [r11 + rbp - 0x4c18b16e]
call fcn.14011ad44

Function at 0x140121096
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3

Disassembly:
sub edx, eax
and dx, dx
mov edi, dword [r11 + rbp - 0x3add09ff]
mov qword [rsp + rcx - 0x6699c7c0], rax
adc byte [rsp + rcx - 0x6699c7c0], bl
lea r11, [rbp + r11 - 0x3add09fb]
sets bpl
sar rax, 0x52
jae 0x140138270
not word [rsp + 1]
call fcn.14012fcbd
call fcn.1401478a2
xor edi, r10d
bts rdx, rbx
sbb edi, 0xb4a168a0
xor edi, 0xc638801e
sar word [rsp + rbp - 0x3add08fe], 0x27
bt rcx, 0xa7
sub rdx, rdx
neg edi
bswap rcx
inc al
and byte [rsp + rdx + 6], 0x84
dec edi
bswap edi
inc bpl
dec ecx
lea edi, [rdi + rbp*2 - 0x448c8ef9]
push rax
cmovs rax, qword [rsp + rdx*4 + 2]
neg r9
xor edi, 0xe8a1ecbb
cwd
xor ebx, 0x2bac9a05
xadd dx, bx
mov qword [rsp + rbp - 0x3add08fa], r10
xor dword [rsp + rbp*2 - 0x75ba11fc], edi
add bl, dh
mov r10, qword [rsp + rdx*2 - 0xcdee]
sar r9d, 0x7d
lea rsi, [rsi + r9*2 - 0xa]
xchg qword [rsp + r9*2 - 2], rcx
xor r9b, 0x35
sar rbp, cl
mov qword [rsi + r9 - 0x34], rdi
pop rcx
pop rax
jge fcn.140146e5c
push rax

Function at 0x1401215d0
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3

Disassembly:
xor ecx, 0xbd9b34af
push 0xffffffffc3a54323
sal word [rsp + 0x14], 0x4d
js 0x140122cd9
dec rdi
jmp 0x14012a5ae

Function at 0x14012175b
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.140154294
movzx dx, byte [rsi]
jmp 0x14014d049
Function at 0x1401221ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rbp*4 - 0xac], rbp
mov qword [rsp + rbp - 0x2b], r10
shr dx, 0xaf
or al, al
xor dword [rsp + rbp - 0x2b], edi
pop r10
not bp
cwde
movsxd rdi, edi
add r8, rdi
bts eax, edx
rdtsc
lea rsi, [rsi + rbp - 0xffdc]
movzx edi, r9b
or rbp, rdi
sal rbp, 0x9e
mov dword [rsi + r9*4 - 0xa8], eax
movsx eax, dil
xor rbp, rbp
mov dword [rsi + rbp*2], edx
dec r9b
cwde
sar bp, 0x6c
jns fcn.140146e5c
and eax, ecx
mov dword [rsi + rdx - 0x74ae119d], eax
lea rcx, [r9 + r9*8 - 0x40e8ebfd]
ror cl, 0xa1
mov ebp, dword [rdx + r11 - 0x74ae11a1]
xor ebp, r10d
rol r9w, cl
inc ebp
neg r9
movsx eax, r9w
mov edi, r9d
xor ebp, 0x98a9e384
not edi
push rcx
pop r9
dec ebp
xadd ecx, edx
not ebp
and edi, eax
push rdx
pop rdx
dec ebp
inc edx
call fcn.14011b9d1
bt ax, 0xa9
bswap ebx
not ebx
inc al
movsx r9d, dl
ror bpl, 0xa6
neg ebx
not eax
jmp 0x14012dba9
not ebx
dec ax
bts cx, r9w
bswap ebx
or al, dil
inc r9d
xchg bp, r9w
push r10
shr edx, 0x68
shl bpl, 0x82
call fcn.14014b960

Function at 0x140123508
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3

Disassembly:
call fcn.140129bc7
mov edx, dword [r11 + rcx - 0x4500e30c]
movzx r9d, di
or ecx, 0x36071a37
lea r11, [r11 + rcx - 0x7707fb3b]
bts r9, 0x2a
mov ebp, r9d
xor edx, r10d
cwde
lea edx, [rdx + rbp*4 - 0x4aa2754e]
dec di
lea rdi, [rdi + rbx*4 - 0x41536a50]
shl r9, 0x97
ror edx, 1
and eax, ebx
and bx, 0xe912
sub rcx, r9
dec edx
xor bp, ax
bts rbx, rbx
lea rbp, [rax + rbx*2 - 0x3e2dbcb]
ror edx, 2
push r10
xor dword [rsp], edx
call fcn.140121680

Function at 0x14012369b
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsi + rdi*2 - 0x10008], rbx
movzx ecx, byte [r11 + rdi - 0x7ffa]
lea r11, [r11 + rdi - 0x7ff9]
movzx ebx, r9b
call fcn.14014047f

Function at 0x1401249c7
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
adc r8, rdx
inc rcx
mov r9d, dword [rdi + rsi - 0x38]
sar rbp, cl
sbb ecx, ebp
movsx edx, bpl
mov cl, byte [rsi + rdi*2 - 0x6c]
call fcn.14011d9ec

Function at 0x140125411
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push 0x3123f99c
lea rsp, [rsp + 0x18]
jne 0x14015cc98

Function at 0x140125780
Capabilities:
Encode data using base64

Disassembly:
adc r8, rbx
shr cx, 0xe1
mov qword [rsp + rax*4 + 4], r9
pop r9
pop rdx
jne fcn.140146e5c
Function at 0x140126c42
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rsp + rbx*2 - 0x2547995c], r10
lea rbp, [rbx + rbx*8 + 0x6716fa13]
xchg dword [rsp + rbx - 0x12a3ccae], ebx
dec r9w
xor dword [rsp + rbx - 0x12a3cca6], eax
mov r10, qword [rsp + rbx - 0x12a3cca6]
mov qword [rsp + rbx*4 - 0x4a8f32c8], 0xffffffffa91969b7
mov ecx, dword [rsp + rbx*2 - 0x2547995e]
movsxd rax, eax
push r9
neg rbp
add word [rsp + rbx*2 - 0x25479950], 0x8a87
add r8, rax
not dx
mov qword [rsp + rbx*2 - 0x25479964], 0x592e158e
movzx eax, word [r11 + rbx - 0x12a3ccb6]
shl cl, 0xa6
je 0x140141eae
add ax, cx
rol ebp, 0xde
mov edi, dword [rsp + rbx - 0x12a3cc96]
or bx, 0xc79c
ror ax, cl
pop rbx
add byte [rsp + rcx - 0x69b6fff5], 0x95
sbb ax, cx
sal dword [rsp + rdx - 0x4933a304], 0x5c
setp dl
adc r9w, cx
rol ax, cl
and cl, bh
lea rcx, [rbp*8 + 0x2fa054ad]
shr byte [rsp + rdx - 0x4933a2e2], 0x24
sub ax, r9w
shr rcx, 0x4a
neg ax
bts edi, edi
sal edi, cl
inc edx
xor r10w, ax
shr rbp, 0x1b
lea rax, [rsp + rax + 0x20]
shl qword [rsp + rdx - 0x4933a2fc], 0xb7
inc dword [rsp + rdx - 0x4933a2f6]
mov edi, dword [rdx + rax - 0x4933a302]
add bx, 0xa211
neg r9d
lea rsi, [rsi + rdx - 0x4933a306]
adc bl, ch
lea rax, [rbp*8 + 0x15086934]
sar word [rsp + rdx - 0x4933a300], 0x24
mov dword [rsi + r9 - 0x49ffffff], edi
call fcn.14014b5fe
bswap r9d
lea r11, [rbx + r11 - 0x12a3ccb4]
sbb cx, r9w
push rbp
xor ax, r10w
inc r9d
bswap edx
jp 0x14013d641

Function at 0x140127979
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
sal word [rsp + 9], 0x48
shr edi, 8
xor edi, r11d
mov qword [rsp], 0xffffffffdb20342d
call fcn.14012291c
Function at 0x140128316
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsx ecx, r9b
rol rbx, 0x20
xor al, 0x24
mov qword [rsp + r9*2], rdx
sal word [rsp + r9*2], 0x46
sal qword [rsp + r9*4 + 8], 0x43
ror al, 1
push r9
not r9d
push rdx
xor al, r9b
sub al, dl
xchg ebx, edi
or rbp, rcx
xor r10b, al
dec cx
pop rbx
mov dword [rsi + rdi*2 - 4], eax
sar word [rsp + rdi + 8], 0x48
sbb rbp, rdx
movzx r9d, byte [r11 + rbp*2 - 0x5db00129]
pop rbx
adc byte [rsp + rdi*8 + 8], bpl
lea r11, [r11 + rbp*2 - 0x5db00128]
sub byte [rsp + rbp - 0x2ed8008e], 0x34
jl 0x140138df1
mov ebp, 0x51a27025
mov edi, dword [r11 + rbp - 0x51a27025]
lea r11, [r11 + rbp - 0x51a27021]
movsx edx, bp
xor edi, r10d
rol edi, 1
not bp
movsx eax, bpl
dec edi
neg edx
not edi
sbb edi, 0xda359c2f
push r10
mov ecx, 0x731e46b7
bswap ebp
xor dword [rsp + rcx - 0x731e46b7], edi
cdqe
or cx, ax
pop r10
lea r9, [rdx + rdx*2 - 0x25f7fbc2]
push rax
movsxd rdi, edi
setns byte [rsp + rax + 0x27]
sbb r9w, 0x80aa
adc r8, rdi
sub dx, word [rsp + rax + 0x2b]
seto byte [rsp + rax + 0x2a]
xchg qword [rsp + rax + 0x26], rax
mov rdx, qword [rsi + rcx - 0x731effff]
mov rdi, qword [rcx + rsi - 0x731efff7]
sar dword [rsp + rcx - 0x731efffc], 0xb9
lea rsi, [rcx + rsi - 0x731efff7]
movsx ebx, cl
add rdx, rdi
inc word [rsp + rcx - 0x731efffd]
mov qword [rsi + rcx - 0x731effff], rdx
ror al, 0x26
rol dword [rsp + rcx - 0x731effff], 0x85
cbw
mov qword [rsp + rcx - 0x731effff], r8
ret
xor r9b, r10b
ror r9b, 1
shr dil, 0x84
or dil, dil
sbb r9b, 0xc
inc ebx
xor byte [rsp + rbp - 0x2ed8008a], 0x2f
rol r9b, 1
neg cl
lea rax, [rdx + rbx*4 + 0x1baa478e]
sbb rdi, rbp
add r9b, bl
cbw
ror dx, cl
xor r10b, r9b
lea rbp, [rdx + rcx*8 - 0x2c594e45]
or edi, edi
lea rcx, [rdx*4 - 0x2bd7f058]
lea r9, [rsp + r9 + 0x10]
adc bx, cx
inc rbx
not cl
mov ebp, dword [r9 + rbx*4 - 0x3848]
btr edx, 0xb2
mov dword [rsi + rbx*4 - 0x3850], ebp
lea rsi, [rsi + rbx*4 - 0x3850]
movzx r9d, dil
pop rdx
pop rbp
jb fcn.140146e5c
Function at 0x1401291ab
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rbx, qword [rsi + rbx*2 - 0x4e7aac3c]
mov qword [rsp], 0x79b48308
mov edx, dword [rsp + 1]
push rdx
mov rdi, qword [rsi + rdx*2 - 0xf368fe]
shl word [rsp + rdx - 0x79b47e], 0xcd
movzx ecx, dx
call fcn.140129771
Function at 0x1401299c9
Capabilities:
Encode data using base64

Disassembly:
mov rbx, qword [rsi + rax + 8]
and rcx, rbx
sub dx, 0x4f32
or r9, qword [rsp + rax + 8]
adc dx, 0xd43c
not rcx
mov qword [rsi + rdx*2 + 0xf5f6], rcx
xadd byte [rsp + rax*8 + 0xe], dil
movzx ebp, byte [rax + r11 + 4]
btr dx, 0x96
ror dx, 0xe6
mov qword [rsp + rax], 0xffffffffaa30cb15
lea r11, [rax + r11 + 5]
xor bpl, r10b
push rdi
sub byte [rsp + rdx + 0xda01], dil
sbb bpl, dil
xor bpl, dil
bts di, dx
cbw
jb 0x14013ad2c
movzx ecx, dl
mov edi, dword [r11 + rcx*2 - 0x126]
bswap rdx
mov r9d, ecx
xchg ecx, r9d
lea r11, [r11 + rcx - 0x8f]
call fcn.14012c1e2
adc bpl, 0x1f
rol bpl, 1
or r9b, 0xa8
adc word [rsp + rax*2 + 0xd], di
sbb bpl, 0x29
cwd
xor r10b, bpl
mov byte [rsp + rax + 0xb], 0xb2
lea rbp, [rsp + rbp + 0x18]
mov rbx, qword [rbp + rax*4]
mov qword [rsi + rax*4], rbx
cdq
mov qword [rsp + rax*2], r8
ret 0x10

Function at 0x14012a335
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx edi, bp
xadd r9w, di
mov dl, byte [rbp + rsi - 0x1830edfd]
lea rsi, [rsi + rbp*2 - 0x3061dbfc]
xor cl, bpl
inc r9b
sub di, ax
xor dl, bpl
push rax
bt ebp, edi
movzx ebx, r9w
and cl, dl
rol bp, 0x88
setb al
mov word [rsi + rbp*2 - 0x3061ffda], cx
sar byte [rsp + rbp - 0x1830ffe8], 0xe4
mov qword [rsp + rbp - 0x1830ffed], r8
ret
inc r9d
cdqe
mov qword [rsp + rbp - 0x4c], r10
and rdx, rdi
dec rdx
xor dword [rsp + rdi - 0x75b9dd4b], r9d
lea rax, [rbp*8 - 0x58e47b41]
push rcx
mov r10, qword [rsp + rdx - 0x75b9dd42]
neg rbp
jbe 0x140118fac
add r8, rdi
sar bpl, 0x85
sbb al, r9b
movzx cx, byte [rsi + rbp - 0x1830edff]
ja 0x140119a3c
mov edx, 0x95bf5e1b
mov eax, dword [r11 + riz]
bt rdx, rdx
xor eax, r10d
bswap eax
movsx ebp, dx
inc eax
mov ecx, 0xfb0583c
not eax
inc eax
shr cx, 0xeb
xor eax, 0x16807ba9
xadd rcx, rbp
mov ebx, ecx
mov edi, ebp
push r10
lea r9, [rbp*4 - 0x575ebd71]
or r9, 0x361414bf
bts r9d, ecx
xor dword [rsp + rbp - 0xfb0000b], eax
xchg rcx, r9
or cx, dx
pop r10
cmovb ebp, edx
movsxd rax, eax
adc r8, rax
add r9w, di
movsx eax, bx
setae r9b
movzx ecx, byte [rbp + r11 - 0xfb00007]
cqo
sbb r9w, r9w
xor cl, r10b
add cl, 0x86
shr rbp, 0x33
rol cl, 1
dec cl
shl dl, 0x81
sal bx, 0xe
xor cl, 0x19
lea rdx, [rax*8 + 0x5e241082]
rol cl, 1
jmp 0x14012cfa1
shl al, 0x46
sbb cl, bpl
cwd
inc di
setg dil
neg cl
or rdx, rdx
add ax, 0x6b1e
bswap rdx
sbb cl, 0x3e
xor r10b, cl
not bx
not di
ror rbp, 5
mov dword [rsi + rbp*2 - 4], ecx
movzx r9d, byte [r11 + rbp*8 + 5]
jae 0x14013aaa3
sal rbp, 0xf5
cbw
lea r11, [r11 + rbp + 6]
xor r9b, r10b
inc dil
xchg dil, al
sal bp, 0xf
sbb r9b, 0x97
sal bpl, 0x47
bts di, 0xb0
not edx
xor r9b, 0x34
rol r9b, 1
not dx
xor r9b, bl
xor r10b, r9b
add r9, rsp
sub rdx, rdx
xadd bp, di
movzx bx, byte [r9 + rdx]
cmovle eax, edi
adc bp, dx
mov word [rdx + rsi - 6], bx
lea r9, [rdx*4 + 0x5bb93304]
cwd
lea rsi, [rsi + rdx*4 - 6]
shl al, 0x25
movsx ecx, r9b
xor r9b, r9b
jge fcn.140146e5c
Function at 0x14012b2f1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xadd ecx, ebx
add r8, rbp
inc rdi
call fcn.14014668d
mov edi, 0x162d14af
mov r9, rsi
mov eax, edi
inc di
movzx ebx, dil
lea rsi, [rsi + rdi - 0x162d14b4]
mov dword [rsi + rdi*2 - 0x2c5a2960], r9d
mov r9d, eax
mov ebp, dword [r11 + rdi*2 - 0x2c5a2960]
lea r11, [r11 + rdi*2 - 0x2c5a295c]
cdq
sub dl, 0x8b
shl rbx, 0xb2
xor ebp, r10d
rol edx, 0x36
mov ecx, edi
xor ebp, 0x6a162199
ror edi, cl
dec ebp
sal ebx, cl
rol ebp, 3
cdq
not r9w
lea ebp, [rbp + rdi - 0x713e9acc]
bswap rbx
bswap ebp
neg rcx
bts dx, 0x3b
neg ebp
sar dx, 4
cwd
inc ebp
shl cl, 0xc2
xor ebp, 0x16a26f90
btr edx, 0x80
sal rdi, 0x75
btc ebx, 0x34
push r10
xor r9d, 0x7222bdb5
jae 0x14012eabb
mov r9d, 0x7b3c962f
mov ebp, r9d
mov eax, 0xb8b2dfa3
mov ax, word [rsi + rbp - 0x7b3c962f]
rol bpl, 7
sar r9w, 0xac
mov bx, word [rsi + rbp - 0x7b3c9695]
mov edx, 0x521d15aa
shr r9d, 0xc5
xadd rbp, r9
mov cl, byte [rsi + r9 - 0x7b3c9693]
xor rbp, 0xffffffff9e3f4f02
setbe dl
lea rsi, [r9 + rsi - 0x7b3c9693]
bswap r9d
js 0x14012a5b3
pop r10
neg rcx
xor dx, 0xce9a
movsxd rbx, ebx
or r9w, ax
cqo
sal rbp, 0xb1
add r8, rbx
add rdx, r8
jmp rdx
xor dword [rsp + rax*2 - 0x2c5a295e], ebp
xadd rbx, r9
dec r9
cwde
pop r10
xchg dil, cl
add r9b, dil
movsxd rbp, ebp
dec di
sal rcx, 0x26
adc r8, rbp
sar ebx, 0xc2
xchg bx, di
jae fcn.140146e5c
mov ebx, 0x3d097427
mov eax, dword [r11 + rbx - 0x3d097427]
shr bl, 0xe1
btc ebx, ebx
movzx ecx, bx
lea r11, [r11 + rbx - 0x3d01740f]
xor eax, r10d
lea rdi, [rcx*2 + 0x650a149e]
lea eax, [rbx + rax + 0x6c38ae76]
neg eax
bswap eax
lea rbp, [rdi*8 - 0x4f5c06ee]
lea rdi, [rcx + rbx + 0x239b5da3]
xchg di, bx
neg eax
push r10
jmp 0x140141849

Function at 0x14012c77c
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
sar word [rsp + rax*2 + 0x1ecd72b1], 0x27
and cl, 0xbf
lea r9, [rsp + r9 + 0x20]
mov rbp, qword [r9 + rax + 0xf66b94b]
lea rsi, [rsi + rax*8 + 0x7b35ca50]
mov qword [rsi + rax + 0xf66b94b], rbp
pop rbp
pop rdx
pop rcx
pop rdx
jns fcn.140146e5c

Function at 0x14012c7af
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
not edi
shr ax, cl
lea rcx, [rbp*8 + 0x5b3d00b8]
jno 0x14014964b
mov qword [rsp + rax*2 - 0xfff6], r10
sbb word [rsp + r9*4], bp
xchg byte [rsp + rax*2 - 0xfffe], r9b
xor dword [rsp + rax - 0x7ff7], edi
cdqe
add ax, word [rsp + rax - 0x7ff9]
jg 0x14013af4d
adc edi, 0x973d882c
dec ax
sub dx, bp
shr byte [rsp + rax*2 - 0x1fff2], cl
xor edi, 0x5b8d94a3
mov qword [rsp + rax - 0xffff], rbx
bts r9w, dx
adc byte [rsp + rax*2 - 0x1fff0], bl
sbb edi, r9d
jmp 0x14011fe08
mov r10, qword [rsp + rax - 0x7ff7]
rol al, 5
xor qword [rsp + rax*4 - 0x1fffc], rcx
movsxd rdi, edi
mov qword [rsp + rax - 0x7ff7], rax
mov dword [rsp + rax*4 - 0x1fff0], 0x843e42a9
adc r8, rdi
pop rdx
pop r9
jmp fcn.140146e5c
Function at 0x14012d413
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rsp + rcx - 0x453ba844], r10
xor dword [rsp + rcx - 0x453ba844], r9d
mov r10, qword [rsp + rcx - 0x453ba844]
sar ax, 1
lea rsi, [rsi + rcx - 0x453ba85c]
mov qword [rsi + rcx - 0x453ba854], r9
mov edi, dword [rcx + r11 - 0x453ba854]
cbw
mov qword [rsp + rcx - 0x453ba854], rdx
lea r11, [r11 + rcx - 0x453ba850]
xor edi, r10d
sal qword [rsp + rcx - 0x453ba84f], cl
xor edi, 0x69879c81
shr dx, 0x24
movzx ebp, bx
bswap edi
inc ebx
ror edi, 1
jmp 0x140157ac1
shr word [rsp + rcx - 0x453ba84b], 0x84
mov qword [rsp + rbx - 0x1fa4f227], rax
sbb edi, eax
xchg byte [rsp + rbx*4 - 0x7e93c8cf], al
mov r9d, ebp
pop rdx
mov qword [rsp + rbx*2 - 0x3f49e466], r10
xor dword [rsp + rbx - 0x1fa4f22f], edi
sub rbp, rbx
xadd r9, rax
mov r10, qword [rsp + rcx - 0x453ba84c]
shl rcx, cl
movsxd rdi, edi
mov qword [rsp + rax*8 - 0x791a8], r9
adc r8, rdi
movzx edi, al
sar bpl, 0x21
pop rcx
pop rdi
jno fcn.140146e5c

Function at 0x14012d5a2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
je 0x14015c364
jmp 0x14011b8b6
test ebx, ebx
mov qword [rsp], 0xffffffff9f36feb6
jmp 0x1401298b8

Function at 0x14012eab6
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
jmp 0x140146afb
lea rsp, [rsp + 8]
jne 0x14015e8d5

Function at 0x1401304fd
Capabilities:
Encode data using base64

Disassembly:
not ebx
bts r9w, bp
mov qword [rsp + rax - 0x1a58], r10
shr rax, cl
shl al, 0x64
ror ecx, 0xde
xor dword [rsp + rax + 8], ebx
bt di, 0x3f
mov qword [rsp + rax], rax
movzx r10d, cl
mov r10, qword [rsp + rax*4 + 8]
xchg al, dl
xadd ecx, edi
sub rax, 0xfffffffffdbddaa8
movsxd rbx, ebx
call fcn.14015921e

Function at 0x1401320db
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3
Manually build aes constants

Disassembly:
lea rsp, [rsp + 0x18]
jne 0x14012d88f
push 0x71021c3c
mov r9d, dword [rsp]
pop r9
mov r9, rax
push 0xfffffffff48fc60f
call fcn.140143f2a

Function at 0x140132982
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
btr dx, 0x3d
xor ebp, r10d
bt rdi, 0x1a
lea ebp, [rbp + rbx*2 - 0x77802f02]
lea rax, [rbx + r9*4 + 0x12831a9e]
xor ebp, 0x9f650d
lea ebp, [rbp + rbx*4 - 0xf852254]
not ebp
xchg dword [rsp + r9*8 - 0x58e], edi
sal r9w, 0xe6
not bl
mov qword [rsp + rdi*4 + 8], r10
call fcn.140127044
rol ecx, 0x49
movzx edx, dil
xor ebp, 0x8c020b29
cqo
ror word [rsp + r9 - 0x70], 0xec
cdq
rol ebp, 3
neg ebp
sub qword [rsp + r9 - 0x6c], 0xffffffffec31ba84
btc r9w, 0x8c
xor word [rsp + r9 - 0x1072], 0xe717
rol ebp, 1
dec qword [rsp + r9*2 - 0x20e0]
neg ebp
neg byte [rsp + r9*8 - 0x839b]
bswap ebp
pop r9
lea rcx, [rdx*8 - 0x185142f2]
adc byte [rsp + rcx*2 + 0x30a285e8], 0xa1
mov qword [rsp + r9*2 - 0x401fc474], r10
shl rdi, 0xe3
xor dword [rsp + rcx + 0x185142f2], ebp
dec rcx
jl 0x140137346

Function at 0x140132b9c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ecx, ecx
jmp 0x140134e33
test rdx, rdx
jmp 0x14015f6d1
Function at 0x140132c93
Capabilities:
Encode data using base64

Disassembly:
bt ebx, edx
neg eax
ror byte [rsp + rbx*4 - 0x4a8f32cd], 0x47
mov qword [rsp + rbx*2 - 0x2547996c], rbx
jae 0x14011509e

Function at 0x140133691
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
add ax, word [rsp + 0xd]
mov ebp, dword [rsp + 0xa]
mov qword [rsp + rbp - 0xfff7], r10
movsx ecx, r9w
xor dword [rsp + rbp - 0xfff7], edx
cwde
mov r10, qword [rsp + rbp*2 - 0x1fff6]
mov qword [rsp + rbp - 0xfff7], 0xffffffffc4bd0d27
call fcn.14012e157

Function at 0x140133f10
Capabilities:
Encode data using base64

Disassembly:
xor edi, 0xdd009284
not edi
call fcn.1401318ff

Function at 0x1401345d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14013acc2
lea rsp, [rsp + 0x18]
jne 0x14015daf1
call fcn.140136692
mov edi, 0x43a0029
movzx r9d, di
mov ebx, dword [r11 + rdi*2 - 0x8740052]
movsx edx, r9w
movsx ebp, dl
call fcn.14013d1b0
push 0x3a89a29
cmp ebx, 3
lea rsp, [rsp + 8]
jne 0x14015f862
push 0xffffffff8d104aa5
mov r8, rax
lea rsp, [rsp + 8]
jmp 0x14013e471
jmp 0x14015c51c
push 0x3695ad04
cmp ebx, 4
jmp 0x140119a37
Function at 0x140135aa7
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov rdx, qword [rsi]
push 0xffffffffc536c785
mov r9d, dword [rsp]
mov r9, qword [rsi + riz + 8]
call fcn.14014aa24

Function at 0x140135abe
Capabilities:
Encode data using base64

Disassembly:
jmp 0x14015c333
mov rax, qword [rsi + rdi*2 - 0x1cc000]
mov qword [rsp + rdi*2 - 0x1cc000], rdx
movsx r9d, bpl
movzx dx, byte [rax + rdi*4 - 0x398000]
jmp 0x1401348ca

Function at 0x140135ed6
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
movzx ebp, ax
mov r10, qword [rsp + rax - 0x6b36fff0]
xchg byte [rsp + rbx*4 + 0xd], r9b
mov word [rsp + rbx*2 + 8], di
call fcn.140135fac

Function at 0x140137438
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdi*8 - 0x244f8], 0xffffffffda07b788
jmp 0x1401545ec

Function at 0x140138c7f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r9, [rax*8 - 0x135695c7]
mov dword [rbx + rcx - 0x9a], edi
movzx edi, r9w
mov qword [rsp + rcx - 0x9a], r8
ret 0x18
adc bl, 0x11
sal eax, 0x4a
not bl
push rbp
rol bl, 1
add bl, 0x25
sal bpl, 0x61
rol word [rsp + r9 - 0x58e39b3d], 0xec
cbw
xor r10b, bl
and rbp, 0xffffffffda19dea8
push r9
lea rbx, [rsp + rbx + 0x20]
jg 0x140129693
mov qword [rsp + r9 - 0x58e39b53], r9
xor bl, r10b
bswap rdx
sub bpl, bpl
ror bl, 1
xor byte [rsp + r9 - 0x58e39b44], dl
jge 0x14012efee
Function at 0x140138ca0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xadd edi, eax
inc r9w
or eax, 0x6324c40f
neg dil
shl edx, 0x48
xor r10w, r9w
rol edx, 0x3b
lea rsi, [rsi + rbp*2 - 0x1144e562]
rol rbx, 0x71
mov word [rbp + rsi - 0x8a272b0], r9w
sal ax, 0x61
jl 0x1401301f7
movsxd rcx, ecx
pop r9
call fcn.140142652
mov r9d, 0x4d03090c
movsx edi, r9w
mov ecx, dword [r11 + rdi*2 - 0x1218]
lea r11, [r11 + rdi - 0x908]
xor ecx, r10d
inc ecx
lea rdx, [r9 + rdi*4 + 0x1090ca13]
not r9w
neg ecx
not ecx
call fcn.140131c17
mov eax, 0xc18b393
mov ecx, 0xce0204a7
mov rbx, qword [rax + rsi - 0xc18b393]
movsx r9d, al
sar r9, cl
mov cx, word ss:[rbx + rax*4 - 0x3062ce4c]
lea rbp, [r9 + rax*2 - 0xdd9a2ee]
lea rsi, [rsi + rax - 0xc18b38d]
mov edx, r9d
mov word [rax + rsi - 0xc18b393], cx
adc r9d, edx
lea rcx, [rdx*2 + 0x57960387]
btc dx, r9w
mov edx, dword [rax + r11 - 0xc18b393]
setae bpl
xor ax, r9w
movzx ebx, r9w
lea r11, [r11 + rax - 0xc18b38f]
movsx edi, bpl
setbe cl
rol rcx, 0x4a
xor edx, r10d
not bx
xor edx, 0xf3b98ac
or rax, rax
lea edx, [rdx + rax*2 + 0x2c5b3e6e]
rol rcx, 0x92
lea rax, [rbp + rdi*4 + 0x181a9238]
xor edx, 0x8f3c7f95
add bx, bx
xchg rcx, rbx
neg edx
add edx, edi
rol edx, 1
push rcx
xor edx, 0x9d29c500
mov qword [rsp + r9], r10
lea rax, [r9*8 - 0x796bd3f7]
xor dword [rsp + r9*2], edx
pop r10
btr r9, rdi
movsxd rdx, edx
shr bx, 0x48
xor bx, bx
adc r8, rdx
call fcn.14013fd26
mov ebp, dword [rbp + r11 - 0x8a272b0]
lea r11, [rax + r11 - 0x6324897a]
xor ebp, r10d
add eax, 0x7320ecae
ror ebp, 1
movzx r9d, al
shr rbx, 0x12
xor ebp, 0x73828a3a
rol rdx, cl
inc ebp
ror ebp, 1
bts di, ax
adc bx, 0x9e39
push r10
neg rdi
movzx r10d, dil
xor dword [rsp + rcx - 0x718e3d99], ebp
shr rdi, cl
call fcn.140146cf8
mov edi, 0x52dab89
movzx eax, di
add rdi, 0x2c092c12
mov rsp, rsi
movsx r13d, di
push rdi
movsx r14d, di
push qword [rsp + 8]
popfq
movzx r9d, al
jmp fcn.140158e9d
dec dil
ror rbp, 0x5d
movsx edx, word [rsp + 8]
rol dil, 1
btr rbp, 0x2f
movsx ecx, word [rsp + rdx*4 - 0x185fc]
neg dil
xor r10b, dil
pop r9
rol bx, cl
mov r9d, dword [rsp + rdx*2 - 0xc300]
lea rsi, [rsi + rdx - 0x6184]
mov word [rdx + rsi - 0x6182], di
shl cx, cl
movzx eax, cl
inc bp
mov edi, dword [r11 + rdx - 0x6182]
rol rcx, cl
cbw
lea r11, [r11 + rdx - 0x617e]
xor edi, r10d
rol word [rsp + rdx - 0x6182], 0xa6
setae bl
xor edi, 0x5a3d71af
pop rax
cqo
dec edi
cbw
sal al, 0x81
rol edi, 1
bts bp, dx
neg bp
jns 0x140129a75
neg edi
ror edi, 1
push r10
rol rbp, 0x12
xor dword [rsp + rdx*2], edi
dec r9w
sub dx, 0x4219
pop r10
movsxd rdi, edi
xor bl, bl
sub cx, bp
add r8, rdi
btc r9, 0xba
push rbx
pop rax
jae fcn.140146e5c

Function at 0x140139b7a
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
and ecx, ebp
mov qword [rsp], 0xfffffffff4a8df0b
not ecx
mov ebp, dword [rsp + 0xb]
movsx ebx, dx
mov dword [rsi + riz + 4], ecx
movsx edi, byte [rsp + 8]
movzx ecx, bpl
and ecx, dword [rsp + rcx*2 - 0xbb]
mov ebx, dword [r11 + rcx*8]
jle 0x14015b8f8