joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408ed91e
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax - 0x1391], 0x60a4e80f
cbw
movsxd rdx, edx
btr r9d, 0xb4
pop r9
jb 0x1408dbe37
adc rdi, rdx
mov edx, 0xab841417
rol r11, 0xca
not eax
mov r11w, word [r10 + rcx*2]
jae 0x140910db7
mov edx, 0xb9ad0abe
lea r8, [rdx*8 + 0x6231bb35]
shl r8, 0x4c
mov r8, r9
lea rdi, [rdx + rdx*2 - 0x7c64f8ec]
push rdi
sbb r9, 8
mov qword [r9 + riz], r8
movzx ecx, byte [rsp]
movzx r10d, di
bts r10w, 0x1d
mov edx, dword [rbp + rcx*4 - 0x138]
lea rbp, [rbp + r10*8 - 0x13a6c]
adc byte [rsp + rcx*2 - 0x96], 0x35
or dword [rsp + rcx*2 - 0x9a], r10d
xchg r10, rdi
xor edx, ebx
bswap rcx
add r10d, dword [rsp + rdi*2 - 0x4e9c]
mov esi, r10d
rol edx, 3
push rsi
movzx r8d, word [rsp + rdi - 0x2745]
ror qword [rsp + rdi*2 - 0x4e9c], 0xa6
xor edx, 0xcb17cf1c
not edx
add dword [rsp + rdi - 0x2748], 0x6caa70b2
rol dword [rsp + r10 - 0x68904e9a], 0x6a
setns byte [rsp + rdi*4 - 0x9d2e]
lea edx, [rdx + rdi*4 + 0x168ee8d0]
xchg qword [rsp + rdi - 0x2746], r10
mov qword [rsp + rdi - 0x2746], rbx
xadd r8w, si
setne sil
xor dword [rsp + rdi - 0x2746], edx
lea r10, [rdi + r10*8 + 0x6083458f]
mov rbx, qword [rsp + rdi - 0x2746]
mov qword [rsp + rdi - 0x2746], r10
ror cx, 0x48
bts r10w, si
movsxd rdx, edx
neg r10
add r11, rdx
add qword [rsp + rdi - 0x274e], 0x5114c737
sar byte [rsp + rdi - 0x2741], 0x66
pop rdx
pop rcx
jae fcn.1408dc1c2
jmp 0x1408f761d
mov cx, word [r10]
mov ebp, 0x1e230b31
call fcn.140930db3
mov dword [r9 + r10*4 - 0x62d6e4e0], ebx
shl r10d, 0x3a
mov dword [rdi + r9 - 0x271fa9ad], ecx
mov dword [r9 + rdi - 0x271fa9b1], edx
add r8, qword [rsp + rdi*2 - 0x4e3f5362]
not word [rsp + rdi - 0x271fa9b1]
mov rbx, qword [rsp + rdi*2 - 0x4e3f535a]
jb 0x14090848c
or rsi, 0x24acd739
mov eax, dword [rbp + rdi*2 - 0x4e3f5362]
lea rdx, [r8 + r10*2 - 0x75a91d8]
sal edx, 0x5c
lea rbp, [rbp + rdi*2 - 0x4e3f535e]
bts r10, rdi
xor eax, ebx
sub rdi, r10
xor eax, 0x511c0e08
mov qword [rsp + 8], 0xffffffff8eb90e9a
neg eax
inc eax
xor eax, 0xb38bcfb7
sar byte [rsp + 3], 0xe4
sal rdx, 0xc1
xor dword [rsp + 2], edx
bswap eax
imul r8, r10
mov qword [rsp + 8], rbx
xor dword [rsp + 8], eax
shl esi, 2
mov rbx, qword [rsp + 8]
movsxd rax, eax
add r11, rax
call fcn.140913ddc
mov qword [rsp + rcx - 0x59e6ce39], rdx
mov qword [rsp + rdi*2 - 0x12], r11
ret 8
mov edi, dword [rbp + riz]
movsx edx, sil
xadd dl, dh
adc rbp, 3
xor edi, ebx
rol edi, 1
movsx eax, dx
lea edi, [rsi + rdi - 0x22ab5be9]
setb al
xchg r9w, ax
mov ax, word [r10 + rcx + 2]
not r9
bt dx, dx
lea r10, [r10 + r9 + 0x60a40003]
inc ecx
xor r11w, r9w
xor ax, r9w
call fcn.1408e278c
Function at 0x1408eeed1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [rbp + rdx - 0x21]
sub ecx, 0xf93fd785
inc dl
inc dl
lea rbp, [rbp + rdx - 0x1f]
mov r8d, ecx
xchg cl, dl
sar ecx, cl
xor esi, ebx
or r8, 0x362d40a5
xadd r8, r10
sal ecx, cl
inc esi
rol esi, 1
not esi
movzx edi, r10w
mov eax, 0x7b9ee85
cbw
ror esi, 1
and ax, di
not dil
bt rdx, 0x94
push rbx
sub r10b, dil
xor dword [rsp + r10 - 0x36ed687b], esi
inc rdx
xor ax, ax
pop rbx
btr r10, rcx
setb dl
cdqe
movsxd rsi, esi
sub rdx, rdx
shl r8b, 0x84
not r10
add r11, rsi
add rax, 0xffffffffe6a1b389
ror r10w, 0xe5
cbw
mov r10w, word [r9 + r10*2 + 0x6ddba688]
lea r9, [rdx + r9 + 2]
mov di, word [rbp + rdx]
xor cl, 0x81
lea rbp, [rbp + rdx*4 + 2]
ror rax, 0xa4
xor di, bx
or ecx, 0x1039fc9b
ror di, 1
add di, ax
xchg dh, dl
xadd eax, edx
shr ecx, 0x37
xor di, ax
shr cx, 0x4d
cbw
adc di, dx
and ecx, eax
xor bx, di
add rdi, rsp
inc ax
mov byte [rdi + rcx], r10b
call fcn.1408e8071
add rbp, 4
mov r10d, 0x332c9988
lea rdi, [r10 + r10*8 + 0x2004d002]
xor edx, ebx
movzx esi, di
lea rax, [rdi + r10*4 + 0x703e7884]
sub dil, al
neg edx
mov r8d, edi
bswap edx
lea rcx, [rsi - 0x626b0067]
bt r10w, di
mov ecx, dword [rsi + rbp - 0x7532f3a3]
shr rdx, 0xd2
lea rsi, [rsi + rdx*8 - 0xa654]
xor ecx, ebx
movsx r9d, dl
xor ecx, 0xd51ebd99
lea r8, [r9 + r9*2 - 0x7d5e5454]
shr r9b, 0x83
lea ecx, [rcx + rdx - 0x4c81fae6]
xchg bp, dx
bswap ecx
pop r11
rol ecx, 3
sub bpl, 7
inc ecx
push rbx
sub ebp, 0x2aa63fac
movsx r11d, bpl
mov ebx, r9d
xor dword [rsp + rdx - 0xf3a3], ecx
bt bx, 0x12
push r8
mov rbx, qword [rsp + rdx - 0xf39b]
lea rax, [rdx + r9*4 + 0x75267b05]
not qword [rsp + rdx*4 - 0x3ce8c]
setb al
movsxd rcx, ecx
xadd ax, r11w
xchg bp, dx
adc rdi, rcx
mov qword [rsp + rdx*8 - 0x6a8b8], rbp
cwde
inc al
mov r11, qword [r10 + rdx - 0xd518]
ror dx, 0xca
mov edx, dword [r10 + rdx*2 - 0x8c62]
adc dword [rsp + rbp - 0x4a8bf39a], r8d
sal byte [rsp + rax*2 - 0xd631], 0xe5
ror r9b, 0xe5
lea r10, [rax + r10 - 0x6b0d]
mov dword ss:[r11 + rbp - 0x4a8bf3a3], edx
cbw
jp 0x1408e69d7
sar dword [rsp + rax*2 - 0x2c], 0x41
mov qword [rsp + rbp - 0x4a8bf3a3], rdi
ret 8
Function at 0x1408efe96
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov edx, 0xe12b020f
lea rbp, [rdx + rdx*2 + 0x3328225]
movzx r11d, byte [rsi + riz]
mov r9d, edx
movzx ecx, r9b
lea rsi, [rsi + rcx*2 - 0x1d]
xor r11b, bl
and edx, ebp
movzx r8d, bpl
shr cl, 0x64
rol r11b, 1
xor r11b, 0xa
inc r11b
rol rbp, 0xbb
not r9d
adc ebp, r9d
rol r11b, 1
and rdx, 0xffffffffde94c89d
inc r11b
xor bl, r11b
shr cl, 0x67
lea r10, [rbp + r10 - 0x340a9a34]
push rdx
jnp 0x1408a535a
call fcn.14091ed88
mov eax, 0xd60225a0
lea rcx, [rax*8 + 0x42b37c2e]
movsx r9d, cx
mov edx, dword [rsi + riz]
add rsi, 4
movsx ebp, r9b
xor edx, ebx
inc rax
lea edx, [rbp + rdx - 0x4a38d8b3]
movsx r11d, al
not edx
and eax, ebp
dec bpl
lea edx, [rdx + rax*2 + 0x10353271]
inc r9
xor edx, 0x3394836
movsx r8d, ax
not r9w
xchg r8b, bpl
ror edx, 1
push rbx
idiv r9b
btr bp, 0xe
inc r9
xor dword [rsp + rax*4 - 0x8000], edx
xadd cx, bp
sub r11d, eax
pop rbx
shr r11b, 0x41
lea r8, [r11 + 0x23b95f88]
ror al, 0xe6
movsxd rdx, edx
xor cl, r11b
adc rdi, rdx
imul r11d, r8d
not eax
ror eax, cl
mov rbp, qword [r10 + rbp - 0xa92e]
lea rdx, [rcx*2 + 0x1e1ad83c]
mov rcx, qword [r10 + r11 - 0x48c9cb78]
adc dx, r11w
xchg r8b, al
shr rdx, 0x48
lea r10, [rdx + r10 - 0xe03a4ed]
mul r11
not rbp
or r11, 0x5a33112a
sbb r11w, 0x1d00
xadd eax, r9d
not rcx
or rbp, rcx
bts dx, 0xa4
sbb r9w, r11w
dec r8b
mov qword [r10 + rdx*2 - 0x20], rbp
jne 0x1408f838c
sar dword [rsp + rdi - 0x41affefd], 0xa8
mul si
sbb qword [rsp + rcx - 0xb0], rdx
mov qword [rsp + rcx - 0xb0], rbx
xor dword [rsp + rdi - 0x41afff00], r10d
not rsi
pop rbx
movsxd r10, r10d
push rdx
or ax, cx
push rdi
adc r11, r10
rol qword [rsp + rcx*8 - 0x580], cl
mov r10, qword [r9 + rcx - 0xb0]
xchg cx, ax
sal rsi, cl
pop r8
lea r9, [rcx + r9 - 0xa8]
neg qword [rsp + rcx - 0xb0]
mov dword [rsp + rcx*2 - 0x160], eax
mov cl, byte [rcx + rbp - 0xb0]
neg ax
lea rbp, [rdi + rbp - 0x41affeff]
xor cl, bl
lea r8, [rax + 0x67bd6009]
shr word [rsp + rax - 0xff4a], 0xa5
shl rdi, 0xad
neg cl
dec cl
idiv r8b
xor cl, al
sal ax, 0x49
call fcn.1409186e9
lea rsi, [r11 + rsi - 0x1c981626]
xor r9d, ebx
not r11
mov qword [rsp + r11 + 0x1c98162b], 0xffffffffd29c4b11
lea r9d, [r9 + r11*2 - 0x52e61f2e]
mov ebp, r8d
not r9d
rol r8d, 0xa6
neg r9d
pop rcx
lea r9d, [r9 + r11 - 0xc029761]
lea rcx, [rbp*4 - 0x26d7395b]
or bp, cx
inc r11d
push rbx
movsx eax, bpl
jb 0x14089c98d
inc rcx
xor dword [rsp + rcx - 0x367e2c4e], r9d
sal r8b, 3
movsx ebx, r11b
xadd eax, ebx
pop rbx
movsxd r9, r9d
div ebp
shl ecx, 0xa3
push rax
add rdi, r9
cqo
mov r11, qword [r10 + rdx*2 - 8]
xchg dword [rsp + rdx*2 + 1], ecx
mov r8d, dword ss:[r11 + rcx*2 - 2]
xchg qword [rsp + rcx*4 - 4], rbp
lea r11, [rdx + rdx*8 + 0x6403d923]
cdq
mov dword [r10 + rcx - 5], r8d
movzx r8d, ax
not rcx
lea r10, [r10 + rcx - 2]
imul r8, rcx
shr r8w, 0xa9
pop r11
ja fcn.1408f7a06
jmp rdi

Function at 0x1408f9204
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov qword [rsp], r11
lea r11, [rdx + 0x7528ba06]
lea r11, [0x1408dcb70]
Function at 0x1408fc3e6
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
sbb r8b, 0xb2
dec r9b
rol r8b, 1
inc ecx
bts ax, 4
mul r11b
xor bl, r8b
bswap r9d
imul r11w, r9w
mul dx
add r8, rsp
mov r11, qword [r8 + rcx - 0x671ac6b7]
lea r10, [rdx + r10 - 0xf45]
dec dx
btc r9d, ebp
rol edx, 9
mov qword [r10 + rcx - 0x671ac6b7], r11
jae fcn.1408f7a06
xor rcx, 0xffffffffe3aff410
adc rdi, rbp
sub r9d, ecx
jp 0x140909d7b
or r8b, byte [rdx + rsi]
lea rsi, [rsi + rdx*2 + 1]
movzx ebp, dx
add edx, edx
xadd r9, rcx
xor r8b, bl
jmp 0x140934e71
inc eax
mov qword [rsp + rdx*4 - 0x94], rbx
mov ebx, ecx
xor dword [rsp + rdx - 0x25], ebp
cqo
shr cx, 0xa6
pop rbx
movsxd rbp, ebp
neg edx
je 0x1408b05b8
add r10, r10
rol ebx, cl
pop rbx
sar r10b, 0xa3
movsxd rax, eax
adc r11, rax
inc sil
mov rdi, qword [r10 + r9]
lea r10, [r8*4 - 0x4a58e4d5]
mov r10, qword [r10 + r9 + 0x4a58e45d]
bswap esi
rol rcx, cl
lea r9, [r9 + rdx*8 - 0x73da0]
dec esi
xadd rsi, r8
mov qword ss:[rdi + rdx*8 - 0x73db0], r10
sar esi, 0x4a
jmp r11
btc r11w, 2
sbb r8b, 0x10
cbw
xadd cl, dh
not r8b
btc rbp, r9
jae 0x1408908db

Function at 0x1408ff2a4
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push 0x17be7bb6
test ebx, ebx
mov qword [rsp + 8], 0xffffffffa428ae13
jmp 0x140894502

Function at 0x140902b7d
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
jb 0x1409238e0
mov qword [rsp], rax

Function at 0x140904c53
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
movsx r8d, bl
xor dword [rsp + rcx - 0xb8b2], ebp
mov rbx, qword [rsp + rcx - 0xb8b2]
sub cl, 0x1d
movsx r11d, al
movsxd rbp, ebp
shl r8d, 0xfa
neg cx
add rdi, rbp
mov qword [rsp + rcx - 0x4763], r11
mov qword [rsp + rcx - 0x475b], 0xc2c5ab1
movzx ecx, byte [rcx + rsi - 0x475f]
jmp 0x1408c758b
Function at 0x140906162
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
rol r8d, 1
lea rbp, [rcx + r9*8 - 0x487a4456]
neg r8d
call fcn.140931ff2
mov r8d, dword [rsi + rcx - 0xfe]
push r9
sal cl, 0x61
push rdx
lea rsi, [rsi + rcx*4 - 0x3f3]
sbb byte [rsp + rcx*8 - 0x7e4], 0xac
btr ax, cx
xor r8d, ebx
neg rcx
not r11w
dec r8d
xchg cx, ax
jmp 0x140894417
sub cl, r10b
not r10w
rol edi, 1
lea edi, [rdi + rcx - 0x5c88899e]
lea rdx, [r10 + rcx*8 + 0x6c0b43be]
lea rax, [r10*4 - 0x43dfd252]
mul eax
push rbx
xor dword [rsp + rcx - 0xcc00], edi
sal rax, 0x46
pop rbx
mov r8d, r10d
movsxd rdi, edi
add r8b, r8b
add r11, rdi
sar dx, 0x64
rol esi, 0xa7
xor sil, dl
mov rdi, qword [r9 + rsi - 0x54e621ec]
adc al, byte [rcx + r9 - 0xcbf8]
xchg r8, rcx
bt ecx, esi
xor r10d, edx
lea r9, [r9 + r8 - 0xcbf6]
inc dx
mov byte [rdi + r8 - 0xcc00], al
not r8d
shr ecx, cl
xchg cx, r10w
jmp r11
add dil, byte [r9 + rax - 0x1684cba9]
sal al, 0xa2
jns 0x1408e4a84
adc dl, dil
pop rsi
mov word [rsi + r9 - 0x698ffd24], dx
neg r8
add qword [rsp + rax*4 - 0x5a132e81], rcx
pop rcx
mov qword [rsp + rsi - 0x698ffd24], r11
ret 8
call fcn.140923ed7
mov rdx, qword [r10]
mov rcx, qword [r10 + 8]
push 0xffffffffc71f4e9f
add rdx, rcx
and byte [rsp], 0xd
mov r9d, dword [rsp + 4]
lea r11, [r9 + r9*2 - 0xe45f16e]
mov qword [r10 + riz + 8], rdx
movsx ebp, r9b
ror qword [rsp], 0x68
movzx ebp, byte [rsi + riz]
not dword [rsp + 2]
xor bpl, bl
sal qword [rsp], 0x8b
xor r9d, 0x3f2de108
rol bpl, 1
xor r11w, 0x88b9
movsx eax, r11w
xor bpl, 0xa
movzx ecx, byte [rsp + 2]
sub bpl, cl
rol bpl, 1
sub bpl, cl
pop r8
inc r8b
movzx edx, ax
xor bl, bpl
mov word [r10 + rcx - 0xf9], bp
lea r10, [r10 + rcx*2 - 0x1f8]
not edx
bts edx, eax
jb 0x1408dcf9a
cbw
sal rdi, 0xd9
add r11, rdx
xchg r8d, eax
mov qword [rsp + rax - 0x1684cb91], rdi
mov ecx, dword [rsp + rax*4 - 0x5a132e8a]
movzx dx, byte [rax + r9 - 0x1684cbab]
jmp 0x1408fdcd5

Function at 0x1409067a1
Capabilities:
Authenticate hmac

Disassembly:
xchg r9w, r8w
xor edx, 0xfe19e727
mov qword [rsp], r9
inc edx
mov qword [rsp + 0x20], rbx
add r8w, 0x4191
imul rbp, qword [rsp + 0x18]
shl qword [rsp], 0x88
xor dword [rsp + 0x20], edx
neg qword [rsp + 6]
add ebp, dword [rsp + 0x1b]
mov rbx, qword [rsp + 0x20]
mov dword [r10 + riz - 4], edx
and r11, qword [rsp + 8]
mov qword [rsp + 0x20], r9
or dword [rsp + 5], r11d
movzx ecx, byte [rsi + riz + 8]
movsx eax, r9w
movsx edx, r8w
and edx, eax
lea rsi, [rsi + rax + 9]
mul r11b
xor cl, bl
mov qword [rsp + rax + 0x10], 0xfffffffff2a1019d
sub cl, 0x10
cwd
ror r9b, 0x43
not cl
sbb cl, 0xb2
mul dword [rsp + rax*4 + 9]
rol cl, 1
sal r9b, 0x21
sbb r8d, r9d
xor bl, cl
lea rcx, [rsp + rcx + 0x28]
neg r11d
neg bpl
add rax, qword [rcx + r11]
inc bp
movzx ecx, byte [rsp + r11*2 + 0x22]
mov qword [r10 + r11 - 0xc], rax
movzx eax, byte [rsp + r11 + 0xb]
lea r10, [r10 + r11*4 - 0xc]
imul edx
add rcx, rcx
pop r8
pop rdx
pop rbp
pop r8
pop r11
jnp fcn.1408f7a06
Function at 0x140906e53
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea rbp, [rbp + rdx*8 - 0x144]
mov ecx, 0x299e443d
xor rax, rdx
lea rsi, [rdx + rdx*4 + 0x591f0b1f]
xor r8d, ebx
cwd
not r8d
lea rdx, [rsi + 0x7fa5b792]
xor rdx, rcx
bts esi, ecx
rol r8d, 3
btr esi, 0x17
lea r8d, [rcx + r8 + 0x41727dfd]
btc rcx, 0x28
ror r8d, 2
dec r8d
movzx edi, dx
shl eax, 0x4f
inc dx
xor r8d, 0xa4b5e53f
sar ax, 0x6f
push rbx
movsx ebx, si
xor dword [rsp + rax - 0x5414ffff], r8d
shl eax, cl
pop rbx
sal dx, 0xc8
jae 0x1408ddc70
dec rcx
movsxd r8, r8d
btr ecx, esi
cdq
push rdi
adc r11, r8
mov rdi, qword [rcx + r9 - 0x299e443c]
mul ax
movzx si, byte ss:[rdi + rcx*2 - 0x533c8878]
bts rax, 0x92
lea r9, [r9 + rcx*2 - 0x533c8872]
add ecx, dword [rsp + rcx - 0x299e4439]
jne 0x140920dc4
mov dword [r10 + rbp*2 - 0x6000e3ae], edx
cwde
sbb bp, bp
push rcx
mov qword [rsp + rbp*2 - 0x60000000], rdi
ret
bswap r11d
inc r11d
not r11d
or eax, r9d
mov edx, ebp
neg r11d
xor r11d, 0xc5342daf
bt ax, 0xa
mov qword [rsp + rax - 0x3043e3ba], rbx
sal r9d, 0xe6
xor dword [rsp + rax*2 - 0x6087c774], r11d
not eax
cbw
pop rbx
sub edx, 0xdb8bd0af
adc ecx, 0xe59029a5
movsxd r11, r11d
add rdi, r11
mul r8d
bswap ebp
mov r9, qword [r10 + r9 - 0x10cc00]
mov edx, dword [rbp + r9 - 0x30000000]
mov r9d, r8d
bts rcx, 0x19
lea r10, [r10 + rbp*2 - 0x5ffffffc]
sub bp, 0x8e29
or r9d, r8d
jnp 0x1408ec2f7
mov r8d, 0x8006a829
mov eax, r8d
movsx edx, r8b
mov r8d, dword [rbp + rdx - 0x29]
xor ax, dx
jp 0x14089065f
mov word [r9 + rcx - 0x299e443c], si
mov qword [rsp + rcx - 0x299e443c], r11
ret

Function at 0x1409083f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0xffffffff8b3fb314
dec ebx
lea rsp, [rsp + 8]
jne 0x1408a7315

Function at 0x14090af69
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea rbp, [rbp + r10*8 - 0xbc]
movsx ecx, sil
mul dil
call fcn.1408fdb1d
and rax, rcx
movzx ecx, byte [rsp + 0xd]
btr ebp, ebp
not rax
xor r8b, 0xe
mov rdx, rax
btc r11, 0x8a
xadd cx, r8w
jae 0x1408a1386
mov qword [rsp + rbp - 0xf5e9], rdx
push r9
not r11
lea rdx, [rcx + rcx - 0x147378df]
push qword [rsp + 0x18]
popfq
movsx eax, r11w
mov byte [rsp + rbp*2 - 0x1ebef], dh
neg dx
mov qword [rsp + rbp - 0xf5f9], rdi
ret 0x18

Function at 0x14090d7fd
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x14089edea
Function at 0x140913836
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsxd rdi, edi
call fcn.140909f54
mov eax, dword [r8 + r10 + 4]
rol rcx, 0xda
dec dword [rsp + r8*2 + 2]
mul r11d
push rbp
or qword [rsp + r8 + 8], rcx
mov dword [r8 + r10], edx
mov r11d, ecx
xadd qword [rsp + r8*2 + 6], r8
mov dword [r10 + r11*2 - 0x2ffffffc], eax
mov eax, dword [rsp + r11 - 0x17fffff7]
mov qword [rsp + r11 - 0x18000000], rdi
ret 8
xor bx, cx
mov qword [rsp + rdi*2], r10
sar dil, 0xa1
ror dword [rsp + rdi*8 + 5], 0x77
mov word [r9 + rdi + 2], cx
call fcn.140922be2
mov r10d, 0x8098e9bd
movzx esi, r10b
movsx edx, r10b
mov edi, dword [rbp + rsi*2 - 0x17a]
movzx ecx, dl
mov r8d, 0x1d1c9f88
shl sil, 0xa3
lea rbp, [rbp + rsi*8 - 0x73c]
add rsi, 0xffffffffcaa7a502
lea rax, [rcx*2 + 0x361afa8c]
xor edi, ebx
or r10d, edx
lea edi, [rdi + r10 - 0x7bd21939]
sbb r10d, r8d
bswap edi
imul r8d
ror edi, 1
cdqe
lea edi, [r10 + rdi - 0xa3d438f]
cdqe
neg cx
bt r8d, edx
push rbx
xor dword [rsp + rsi + 0x35585a16], edi
pop rbx
neg dx
sal si, 3
jb 0x14088c511
mov r9d, dword [rsi]
mov ecx, 0x62968886
mov eax, 0xd704129b
lea rsi, [rcx + rsi - 0x62968882]
lea r8, [rcx + 0x30398bad]
movzx r11d, al
lea rbp, [rcx + rcx*4 + 0x38980236]
xor r9d, ebx
neg r9d
xadd rbp, r11
sal r11d, cl
not r11d
ror r9d, 1
xadd r11b, bpl
lea r11, [r11 + 0x2913c8ac]
lea r9d, [r9 + rcx + 0x6493cf8f]
bt bp, cx
shl rax, cl
bswap r9d
push rbx
sar r8b, 2
xor dword [rsp + rcx - 0x62968886], r9d
movzx ebx, al
pop rbx
sub r8d, r8d
setp al
movsxd r9, r9d
adc r11b, cl
or bp, cx
adc rdi, r9
mov r11d, dword [r10 + r8*4]
push rbp
jmp 0x1408f414a

Function at 0x1409189dd
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rcx*4 - 0x7fd7c], rbx
xor rdx, r10
xor dword [rsp + rcx - 0x1ff5f], edi
call fcn.1408d3c4e

Function at 0x14091aa00
Capabilities:
Manually build aes constants

Disassembly:
call fcn.1408931d1
mov qword [rsp + r10 - 0x21236c87], rsi
bswap eax
ror byte [rsp + r10 - 0x21236c87], cl
jae 0x1408c9599
Function at 0x140926263
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
call fcn.140904c3e
rol edi, 1
not r10
movsx r8d, word [rsp + rax - 0xb]
or ecx, dword [rsp + rax*2 - 0x13]
not edi
bswap rsi
ror edi, 1
btr r8d, 0xb4
mov qword [rsp + r8 - 0xb], rbx
and ax, 0x42b7
adc rcx, rax
xor dword [rsp + rax - 3], edi
pop rbx
neg r10
cwd
movsxd rdi, edi
add r11, rdi
mov di, word [r9 + rax*8 - 0x18]
sar rax, cl
lea r9, [r9 + rax*2 + 2]
movzx ecx, word [rbp + rax*2]
lea rbp, [rbp + rax*4 + 2]
sbb sil, sil
bts dx, si
inc r8
xor cx, bx
or dl, 0x96
mul rax
inc r10d
ror cx, 1
sar dx, 0x66
shl dl, 0xa1
dec cx
imul al
not cx
dec cx
xor bx, cx
add rcx, rsp
cwd
neg al
sbb r8, 0xffffffffad16943d
mov byte [rcx + rdx*2], dil
setae r8b
xor rdx, r11
jmp rdx
cmp ebx, 2
push 0xffffffff848d0b01
lea rsp, [rsp + 0x10]
jne 0x1408ed38a
call fcn.14089c885
mov eax, 0xec323898
mov edx, 0xd837400d
mov r11d, dword [rsi + riz]
mov ebp, eax
xor r11d, ebx
xor bpl, dl
movzx r8d, bp
inc r11d
sal ax, 0x6a
bswap r11d
call fcn.1408fc062
xchg r11, rax
ror rbp, 1
movzx ecx, r9b
and cl, r8b
xor r8, r11
inc rbp
ror rbp, 7
dec rbp
ror r11w, 0x4e
and al, ch
xor rbx, rbp
and r9d, 0x50a4c799
cwd
lea r10, [r10 + rdx*2 - 0x20006]
mov qword [r9 + r10 - 0x40004311], rbp
jg fcn.1408f7a06
lea rcx, [rsi*2 + 0x3bb1be1d]
xor edi, ebx
bts dx, si
btc r10d, eax
inc edi
push rax
jmp 0x1409164d2

Function at 0x14092a935
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwde
lea rbp, [rsi + rbp - 0x61]
xor r8d, ebx
not al
bswap r8d
not eax
xor r10, qword [rsp + rax - 0x38]
mov edi, dword [rsp + rax*2 - 0x6f]
not r8d
push rsi
xor r10b, byte [rsp + rax - 0x29]
inc r8d
sal dx, 0x6b
not r8d
neg rsi
sbb r8d, 0xfd30e3b3
call fcn.140929160
neg r8d
mov ecx, r10d
xadd si, r10w
push rbx
adc rcx, 0xffffffffbc97a6b3
xor dword [rsp], r8d
inc ax
pop rbx
movzx edx, cl
movsxd r8, r8d
cwd
add r11, r8
push rcx
mov edx, dword [rdx + r9 - 0xffff]
xadd esi, ecx
bts eax, 0x17
ror eax, cl
mov eax, dword [r9 + rcx*2 - 0x4fa0104c]
adc qword [rsp + rcx - 0x27d00828], r10
mov esi, dword [r9 + rcx*2 - 0x4fa01048]
lea r9, [rcx + r9 - 0x27d00824]
dec cl
jne 0x140925ab3
lea rdx, [rdx + rax - 0x12246bd]
and r8, rcx
not rdx
bswap rcx
or r10d, ecx
lea rdx, [rdx + rax*4 + 0x7a08072f]
and sil, r8b
jb 0x14090f345
bswap rdx
btr edi, 0xa9
setae r10b
xor rbx, rdx
bt r8, rcx
sbb ax, di
mov qword [r9 + rax*8 - 0x53026], rdx
shl dword [rsp + rax - 0xa5f8], 0x6d
lea r9, [r9 + rax - 0xa60a]
sal byte [rsp + rax*2 - 0x14bfe], 4
or al, 0x25
adc r10w, si
pop rsi
pop rdi
js fcn.1408dc1c2
adc r11, rdi
lea rdx, [rdx*8 + 0x40870c29]
xor sil, sil
shr r8w, 1
mov rax, qword [r10 + r9 - 0x68c0120]
btr r8, rdx
xor si, word [rax + r10 - 0x68c0120]
bswap rcx
sar r10w, 4
sar r8w, 0xc2
lea r9, [r9 + r8*2 + 6]
dec dl
mov word [r9 + r10*2 - 0xd180024], si
add r8, r11
jmp r8
Function at 0x14092b9c6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rbp - 0x1c0000], r9
mov r9, qword [rsi + rbp*8 - 0xdffffc]
xchg qword [rsp + rbp - 0x1c0000], rcx
not rbp
lea rsi, [rsi + rbp + 0x1c000d]
xor r9, rbx
not r9
sar eax, 0x73
bswap r9
setne byte [rsp + rbp + 0x1c0001]
not r9
adc bpl, 0x3e
cdqe
ror cx, cl
lea r9, [r9 + rbp - 0x3f04a061]
sal rbp, 0x73
neg r9
xchg dword [rsp + rax*8 + 4], ecx
xor r9, 0xffffffffe2bd2f0e
shr dl, 0x81
and r8b, bpl
not word [rsp + rax*2 + 1]
xor rbx, r9
sal r8b, 1
mov qword [rax + r10 - 8], r9
and rdx, rbp
lea r10, [r10 + rax*2 - 8]
pop r9
jle fcn.1408f7a06

Function at 0x14092d17c
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov esi, 0x36b06f0a
lea rsi, [0x1408b9808]
mov edi, 0xf3f5f15
sub edi, edi
add dil, byte [rdi + rax]
jmp 0x1408c6e80
call fcn.1408c5b22
call fcn.1409030be
mov eax, 0x83a48904
mov cx, word [r9 + riz]
imul rax, rax
mov r10w, word [r9 + riz + 2]
lea rdi, [rax + rax*2 + 0x433e6faa]
not cx
not r10w
movsx esi, ax
cdqe
and cx, r10w
mov word [rsi + r9 - 0x480e], cx
add rdi, rax
mov edx, dword [rbp + rax + 0x118ab7f0]
lea rdi, [rsi*2 - 0x505f44df]
xor edx, ebx
movsx ecx, al
call fcn.1408ce352
push 0x631c04be
jmp 0x1408ff1bc
mov edx, 0x3f8edd86
movsx r9d, dx
not r8d
mov dword [r10 + rdx*2 - 0x7f1dbb0c], r8d
movsx ecx, r9b
xchg cl, r9b
mov r11d, dword [rdx + rsi - 0x3f8edd86]
mov r8d, 0x4b4302c
sar r9w, cl
lea rsi, [rdx + rsi - 0x3f8edd82]
dec rdx
xor r11d, ebx
neg r11d
and r8w, dx
xor r11d, 0x83279a37
xor rdx, rcx
movzx eax, r9w
rol r11d, 1
or r9b, cl
sbb edx, 0x1b250994
shr rdx, cl
xor r11d, 0x6516ca93
ror r9b, 0x83
push rbx
xor dword [rsp + rdx - 0x2953061], r11d
movzx ebx, cl
xadd dl, ch
pop rbx
movsxd r11, r11d
add rdi, r11
movzx ebp, dx
jmp rdi
lea rsp, [rsp + 0x10]
je 0x1408f2770
push 0x1d379737
sal word [rsp + 2], 0x2f
jns 0x140932636
mov qword [rsp], rsi
push rdi
js 0x1408c1431
push 0x2ca5052b
xor r8d, r8d
test r9, r9
jmp 0x1408c8a66
xor edx, ebx
movzx eax, r8w
mov qword [rsp + r8 - 0x51a6ca2f], rax
neg edx
inc edx
call fcn.140935ece
jmp 0x14090739d
lea r9, [rdi + r9 - 0x4c0bd91c]
movsx esi, dx
not esi
movzx ecx, byte [rdi + rbp - 0x4c0bd91e]
dec ax
neg di
xadd di, si
lea rbp, [rbp + rax*8 - 0xe7]