joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18135fc9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax - 0x6da2f9a4], rbp
mov qword [rsp + rax - 0x6da2f9b4], 0xffffffffd7b5f4ad
call fcn.1813bf020
mov ax, word [rsi]
mov r8d, 0x3186639e
movzx ecx, byte [r8 + r11 - 0x3186639f]
movzx edi, r8w
movzx r9d, r8b
mov ebx, r8d
xor cl, bpl
or bl, dil
mov edx, r8d
push r8
inc cl
inc byte [rsp + r8*2 - 0x630cc736]
mov qword [rsp + r8*2 - 0x630cc73c], rdx
rol cl, 1
neg cl
inc word [rsp + r8 - 0x3186639d]
dec cl
neg cl
not edx
or dil, r8b
pop rdx
sbb cl, 0x8c
xor bpl, cl
add r9d, 0xde3824b3
call fcn.1813e9b86

Function at 0x18135ffbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [rsp + 0xa]
xor r10d, 0x462c3b9f
movsx r11d, al
mov edx, dword [rsp + rax*8 - 0x6bd98]
mov qword [rsp + rax*4 - 0x35ed0], r11
sub r10d, 0xa2b06fae
mov qword [rsp + rax*8 - 0x6bd98], rbp
xor dword [rsp + rax*2 - 0x1af60], r10d
cqo
movzx ebp, byte [rsp + rax - 0xd7b3]
sub ebp, r11d
mov rbp, qword [rsp + rax - 0xd7ac]
movsx edi, r11b
jne 0x1813bd0b4
mov qword [rsp + rax*4 - 0x400], r10
ret

Function at 0x1813618cc
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub rsp, rcx
push 0xf04c038
jmp 0x18140ff7a
lea rsp, [rsp + 0x20]
mov qword [rbp + riz - 0x10], rsp
jmp 0x181379aae
jmp 0x1813533ac
mov qword [rdi + r8*4 - 0x24400], rdx
sbb bl, 0xa8
cqo
adc ecx, 0x521f2d34
lea r11, [r8 + r11 - 0x9104]
movsx edi, r9b
mov r8d, dword [r11 + r8 - 0x9100]
xor r8d, ebp
btr edx, r9d
not r8d
mov qword [rsp + rbx - 0x50], r9
mov qword [rsp + rbx - 0x58], 0x4d0e39aa
call fcn.181411449
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
call fcn.18137de65
xor sil, 0x1c
add dword [rsp + rcx - 0x3b218f17], 0xfa2d7b3f
inc sil
neg dil
lea r11, [rcx + rcx*2 + 0x3310eda9]
dec dword [rsp + rcx - 0x3b218f16]
not sil
shr ecx, 0x25
xor sil, 0x11
neg byte [rsp + rcx*4 - 0x76431e0]
xor bpl, sil
pop rax
add rsi, rsp
bswap r11
xchg cx, ax
shl ax, 0xe3
mov rax, qword [rsi + rcx - 0x1d90aab]
lea r9, [r9 + rcx*8 - 0xec85560]
movsx r10d, cl
xchg r10w, di
lea rdx, [rdi*8 - 0x19e3d24f]
mov qword [r9 + rcx - 0x1d90aab], rax
btr r11, r11
mov eax, edi
not r10d
mov ecx, dword [rbx + rcx - 0x1d90aab]
not ax
lea rbx, [rbx + r10 - 0x5006]
sbb al, r11b
jo 0x18139b48d
xor ecx, ebp
movzx esi, al
rol ecx, 3
bt eax, eax
inc ecx
btr edi, 3
xadd dl, dil
sal r11b, 0x21
bswap ecx
dec al
inc dx
inc ecx
dec edx
setno dil
xor ecx, 0xc32ec190
dec esi
sub rdx, 0xfffffffff89e7190
push rbp
push rdx
xor dword [rsp + r10 - 0x5002], ecx
dec dx
mov rbp, qword [rsp + rdi - 0x4a49fef9]
movsxd rcx, ecx
push r10
lea rdx, [r10 + rsi*2 + 0x51971325]
add r8, rcx
inc r11
shl qword [rsp + r10*2 - 0xa00c], 0x62
pop rax
pop rdi
pop rdx
js fcn.18134300b

Function at 0x181368a16
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov dword [r8 + rsi - 0x52ededc7], ebx
movsx ebx, r8w
mov qword [rsp + rdi - 0x52ee0001], 0x3327dc87
pop rbx
mov dword [rsi + rdi - 0x52edfffd], ecx
not bx
Function at 0x181368faf
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
neg edi
dec edi
call fcn.1813a6b1d
mov eax, dword [rbx]
add rbx, 4
mov r11d, 0xd823fe0d
xor eax, ebp
mov r10d, r11d
not eax
neg eax
movzx edx, r10b
ror r11b, 0x26
movzx ecx, r11b
rol eax, 1
bswap eax
and r10, rcx
push rbp
rol cl, 0xe2
xor dword [rsp + r10 - 4], eax
ror cl, 4
pop rbp
bt r10w, 0x8c
call fcn.18137f5ab

Function at 0x181368ffd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dword [rsp + rax*2 - 0x15b22], ebx
pop rdi
lea rbp, [rax*4 - 0x33783b49]
mov rbp, qword [rsp + r8 - 0x6a3cad89]
cbw
sal r8d, 0xdd
mov ecx, eax
movsxd rbx, ebx
adc r10, rbx
lea rbx, [r8 + rax*2 - 0x3b6703d3]
mov qword [rsp + rax - 0xff91], rcx
movsx r9d, byte [rsp + r8 - 0x1fffffff]
rdtsc
lea rsi, [rsi + rcx - 0xffa9]
mov qword [rsp + rcx - 0xff99], rcx
movzx edi, r8w
mov dword [r8 + rsi - 0x1ffffffc], eax
mov dword [r8 + rsi - 0x20000000], edx
shl ecx, cl
pop r8
pop r8
pop rdx
pop rbx
jge fcn.181381c17
not rax
mov qword [rsp + rdx*2 - 0x7af914d4], rdx
sal sil, 0x86
xor rax, 0x1f1c49a3
xchg word [rsp + rdx*2 - 0x7af914d2], r11w
not byte [rsp + rdi - 0x6f0d1479]
inc rax
sal r11w, cl
rol dword [rsp + rdi - 0x6f0d1484], 0x49
not rax
sar dx, 0x6d
lea rax, [rax + rdx - 0x7f2cfb2c]
not di
xor rbp, rax
and cl, byte [rsp + rdx*2 - 0x7af9ffe8]
mov qword [rdi + r9 - 0x6f0deb78], rax
lea r9, [r9 + rdx*2 - 0x7afa0000]
pop r11
pop rdi
pop rax
je fcn.18134300b
call fcn.18134540e

Function at 0x18136ab7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
xor eax, 0xc4a6b887
and di, 0xbd22
shr r10b, 0x22
lea eax, [rax + r10*2 - 0x1d7139d7]
mov qword [rsp + r10 - 0x3fb99a33], rdi
mov qword [rsp + r10*2 - 0x7f73345e], rbp
add r11, 0x7893a52d
movsx ebp, word [rsp + r10 - 0x3fb99a2f]
and qword [rsp + r10 - 0x3fb99a33], rbp
xor dword [rsp + rdi - 0x389433f8], eax
mov rbp, qword [rsp + rdi - 0x389433f8]
lea rdx, [rdi + 0x4d82e124]
movzx esi, byte [rsp + r10*2 - 0x7f733462]
sar r11b, 0xe2
movsxd rax, eax
sbb cl, r11b
shl rsi, 0x1d
jns 0x18139a131
adc r8, rax
rdtsc
lea r9, [r10 + r9 - 0x3fb99a3b]
inc word [rsp + r10 - 0x3fb99a2d]
mov qword [rsp + r10 - 0x3fb99a2b], rsi
xor r10d, dword [rsp + r10 - 0x3fb99a29]
mov dword [rdi + r9 - 0x389433fc], eax
mov dword [r10 + r9 - 0x3fb99a33], edx
jno 0x18134a730

Function at 0x18136b1c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror word [rsp + rbx*4 - 0x1ec732], 0x28
inc ebx
lea r11, [r11 + rbx*8 - 0x3d8ea5]
inc ebx
jbe 0x18139517c
xor dl, bpl
not dl
not r8w
idiv r9b
inc dl
not dl
mov qword [rsp + rbx - 0x7b1d5], 0xffffffffed25f302
jmp 0x18139a12c
call fcn.18137d846
Function at 0x18137018c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor r10d, ebp
call fcn.1813e9ac6
mul r11w
movzx eax, byte [rbx + rcx - 0x372a089b]
lea r10, [rcx*2 + 0x31a9ecad]
jno 0x1813ff4b3
lea rbx, [rbx + rcx - 0x372a089a]
lea rdi, [rcx - 0x78de89db]
xor al, bpl
and edx, r10d
or cl, r11b
call fcn.1813b6e0d
lea rcx, [rsp + rcx + 0x18]
sar si, 0x6e
sbb di, word [rsp + rsi - 0x2e77ffe9]
sal qword [rsp + rdx + 0x10], 0xcb
mov dword [rcx + rsi*2 - 0x5ceffffc], r11d
mov qword [rsp + rdi*8 + 8], 0x32820f17
mov r10d, dword [rbx + rdx*2 + 2]
sar eax, 0xd4
mov qword [rsp + rsi - 0x2e77fffe], rax
lea rdx, [rax + rax*8 + 0x6cb825a9]
lea rbx, [rbx + rsi*2 - 0x5ceffff6]
jbe 0x181359f49

Function at 0x181374d9d
Capabilities:
Authenticate hmac

Disassembly:
xor r8b, 0x35
cdq
push r9
add r8b, 0x26
ror r8b, 1
shl qword [rsp + rdx*8], cl
js 0x18134ef05
btr edi, 0x1f
xor bpl, r8b
lea r8, [rsp + r8 + 0x18]
neg ax
shr dl, 0xc6
movzx ebx, cx
mov rax, qword [r8 + rdi]
sar dil, 1
and word [rsp + rdi + 2], dx
mov qword [rdi + rsi - 6], rax
lea r8, [r9 + rdx*2 - 0x6177e2df]
xadd rcx, rdi
lea rsi, [rsi + rdi*2 + 0x68f82fe4]
adc r9d, dword [rsp + rdi*2 + 0x68f82ffc]
pop rax
pop rcx
pop rdx
jae fcn.181381c17
sub r8b, 0x36
lea rcx, [rdx - 0x347c17f5]
ror r8b, 1
or al, r9b
js 0x181336fdf
Function at 0x1813784ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
movsx r9d, word [rsp + r8 + 2]
and qword [rsp + r8 - 1], 0xffffffffc12c9e88
xor edx, 0x7da4eea1
sbb eax, r8d
sub edx, r8d
xor eax, 0x5c181f28
neg r9d
and r9w, di
lea rbx, [rdi + r8*8 - 0xa626e53]
mov qword [rsp + r8*2 - 2], rbp
imul edx, r9d
xor dword [rsp + r8 - 1], eax
bts ebx, edi
sub r8d, edi
lea rcx, [rdx + r9*2 - 0xc7509ce]
pop rbp
xadd r9b, r8b
bts rcx, 0x1f
movsxd rax, eax
ror dx, 0x4b
call fcn.18140dd36
movsx r11d, sil
lea r10, [r10 - 0x38ec65c8]
mov word [r9 + rdi + 0x36529654], cx
lea r9, [rdi + r9 + 0x36529654]
or rsi, r10
sal sil, 0xe7
xor r10b, dl
add r11d, dword [rbx + rdi*2 + 0x6ca52cb3]
lea rbx, [rbx + rdi*2 + 0x6ca52cb7]
bt di, 0x2c
dec esi
xor r11d, ebp
dec r11d
shl rsi, 0xf1
add rdi, rax
shr esi, 0xaa
rol r11d, 3
bswap r11d
inc sil
mul dx
not r11d
cwd
push rax
mov qword [rsp + rsi*4 - 4], rbp
mov ebp, 0x28329a38
xchg rbp, r10
xor dword [rsp + r10 - 0x28329a38], r11d
pop rbp
cwd
movsxd r11, r11d
jmp 0x1813f883b
lea rdi, [rdx*8 - 0x1ec652e9]
not eax
xor eax, 0xc4a6b887
movzx ecx, dl
inc rcx
sub rdi, r10
lea eax, [rdx + rax + 0x10e10f66]
sub rdi, rdx
inc cx
push rbp
and edx, edx
jne 0x181378bee
mov r8d, 0x8e9bbfa1
mov cx, word [rsi + riz]
mov eax, r8d
movzx edi, r8b
mov r9d, 0xf9b13231
mov bx, word [rsi + rdi*2 - 0x140]
and r8b, 0x26
movzx edx, al
xor dx, di
lea rsi, [rdi + rsi - 0x9f]
call fcn.181410ab9
or si, 0xeda1
cdqe
lea r9, [r9 + rdx*2 - 0x168]
mov word [r9 + rdx*2 - 0x166], di
mov r11d, eax
mov r10d, dword [rdx + rbx - 0xb3]
lea rbx, [rdx + rbx - 0xaf]
movzx edi, si
btc si, 0x14
xor r10d, ebp
shr ecx, cl
inc word [rsp + rdx*2 - 0x161]
shl edx, cl
dec r10d
rol r10d, 3
not cl
add rax, qword [rsp + rcx - 0x17899]
cmovl esi, edi
bswap r10d
not r10d
mov qword [rsp + rdx - 0x2cc0], rbp
btr esi, edi
adc esi, 0x182cd22d
xor dword [rsp + rdx - 0x2cc0], r10d
btr rsi, rdx
pop rbp
inc r11b
btr rdi, 0x31
xchg edi, ecx
movsxd r10, r10d
xor edi, esi
bt ax, r11w
add r8, r10
mov r10d, r11d
sar r10, cl
shl dil, 0x44
ja fcn.18134300b
not bl
mov ebx, edx
mov edx, dword [rsp + 9]
mov edx, ebx
jae 0x181341c3e
xor ecx, ecx
shl dword [rsp + 9], 0x7a
cmp ebx, 4
not qword [rsp + 8]
push 0xffffffff82b57795
lea rsp, [rsp + 0x18]
jbe 0x1813784f4
mov edx, 4
lea ecx, [rbx - 4]
shl ecx, 3
sal edx, 3
mov eax, 0xaa1a8396
mov rax, rbp
jmp 0x1813e9d7f
call fcn.18134b0dd
mov r10d, 0x5120eb29
mov eax, dword [rbx + r10 - 0x5120eb29]
lea rbx, [rbx + r10 - 0x5120eb25]
bts r10w, r10w
xor eax, ebp
mov edx, r10d
jmp 0x18141b17f
cqo
add r8, r11
xadd rdi, r10
ror rdi, 0x1f
jne fcn.18134300b
dec eax
bswap eax
movsx r11d, r10w
jmp 0x1813569dc

Function at 0x181378b65
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rdx, [rsp + rdx + 0x20]
push r9
mov byte [rdx + riz], bl
push rdi
mov ebx, dword [rsp + 0x27]
cmovae edi, r8d
mov qword [rsp + rdi*2 - 0x7ac6d20a], r10
ret 0x28
ror dl, 1
add dl, 0xbb
neg dl
dec cl
xor dl, 0xb4
sal cx, 0x4f
lea r9, [rdi*8 - 0x46ddf558]
adc dl, cl
bt r9w, 0xa2
sal r8w, 0x41
xor bpl, dl
inc di
btr rdi, rax
jb 0x18134c9e5
Function at 0x18137ddf3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec rdi
push 0x288d2620
jmp 0x1813a3968

Function at 0x181382399
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg di
rol di, 1
mov qword [rsp + r11*2], rsi
neg di
sal r11, cl
xor bp, di
and rsi, r11
shr dx, cl
xchg byte [rsp + r11*2 + 0x16], r11b
lea rdi, [rsp + rdi + 0x18]
sal qword [rsp + rsi + 0x10], cl
jne 0x18135c132

Function at 0x181382436
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rdx, [r11 + rsi*8 + 0x782f0935]
mov ecx, r11d
xor edi, ebp
call fcn.18138b228

Function at 0x181386959
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx r10w, byte [rax + r10*4 - 0x3ff60]
setl dl
mov word [r9 + rcx*8 + 0x64], r10w
xor dword [rsp + rcx + 0x18], 0xbf93fe9d
inc dil
lea r9, [r9 + rcx*4 + 0x30]
call fcn.1813dfd6b
jmp 0x18139723f

Function at 0x18138fa6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl dx, 0xcd
xor dil, bpl
xor dil, 0xb0
xor dl, 0x13
inc rax
adc dil, 0xa0
neg dil
ror dil, 1
mov qword [rsp + rdx*2 - 0x8026], 0xffffffff8ab4d8ad
xchg dword [rsp + rdx*4 - 0x1004a], ecx
xor bpl, dil
lea rdi, [rsp + rdi + 0x28]
or rbx, qword [rdx + rdi - 0x4013]
sar cl, 0x47
push rcx
cqo
mov qword [rsi + rdx*8 - 0xc], rbx
pop rcx
or dword [rsp + rdx*8 + 0x1b], r8d
lea rsi, [rsi + rdx*8 - 0xc]
not r8d
sub ax, cx
pop rdi
pop r8
pop rcx
pop rcx
pop rcx
jnp fcn.181381c17
Function at 0x18139502e
Capabilities:
Execute anti-debugging instructions
Manually build aes constants

Disassembly:
inc ebx
lea rcx, [rdx*4 - 0x8d17bee]
rol ebx, 3
shl eax, cl
mul rax
mul dx
xor ebx, 0x8df817
pop r9
mov qword [rsp + r8*2 - 0x150af96c], rbp
cwd
movzx edi, cl
xor dword [rsp + r8 - 0xa857cb6], ebx
add rdx, rdx
mul edx
mov ebp, 0x1f318233
pop rbp
rol ax, 0x68
neg ecx
dec r8w
movsxd rbx, ebx
sbb r8b, r9b
neg rcx
add r10, rbx
xadd cl, dl
jno fcn.181381c17
sub r11, 4
mov eax, dword [r11]
xor eax, ebp
mov ebx, 0x97a30f9d
not eax
lea rdx, [rbx + rbx*8 - 0x5b7cbc5b]
movzx r8d, dx
bswap eax
lea eax, [rax + r8*8 + 0x3ba6b567]
rol eax, 2
mov ecx, 0x289b1d13
neg eax
movsx edi, cl
push rbp
movsx r9d, bx
ror cx, 0x6a
xor dword [rsp + r8 - 0xd02a], eax
lea rbp, [rcx + rcx*2 - 0x27579442]
push rbx
mov rbp, qword [rsp + r8 - 0xd022]
xchg word [rsp + r8 - 0xd02a], dx
jmp 0x181344d2f
push r9
sar word [rsp + r8*2 - 0x1666c], 0xc6
xor eax, ebp
inc eax
mov qword [rsp + r8*2 - 0x1666a], 0xffffffffbf84ca9a
push rbx
inc byte [rsp + rbx - 0x730813f6]
bswap eax
movsx edi, r9b
ror eax, 1
movzx ecx, bl
shr r8, cl
bswap eax
setne byte [rsp + r8*4 - 0xb2d]
shr cl, 0x21
ror eax, cl
shr dword [rsp + r8*2 - 0x588], cl
rol r8b, 0xc3
sbb eax, 0xeeb5edb4
xor rdi, r9
je 0x181387cdd
ror eax, 2
xchg ch, cl
or rdi, qword [rsp + rbx - 0x730813fc]
mov qword [rsp + r8*2 - 0x4bc], rbp
neg cl
xor dword [rsp + r8 - 0x256], eax
or ebx, dword [rsp + rbx - 0x730813fa]
sar byte [rsp + rbx - 0x73081402], 0xa1
call fcn.1813b972d
Function at 0x1813977d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax - 0x72b6e590], rbp
mov ebp, edi
xor dword [rsp + rax - 0x72b6e590], ecx
call fcn.181404496
mov r8d, 0xc09cb190
rdtsc
push r8
sub rsi, 8
shl dword [rsp], 0xe1
and dword [rsp + 1], r8d
or word [rsp + 2], 0x1901
mov dword [rsi + riz + 4], eax
push r8
mov dword [rsi + riz], edx
movzx edi, byte [rsp]
xadd r8b, dil
movzx edx, di
lea r11, [r11 + rdi*2 - 0x124]
mov r9d, dword [rdx + r11 - 0x90]
movsx ecx, dl
sbb cl, 0x1d
push rdi
xor r9d, ebp
shl r8b, 0x65
call fcn.1814013d5
bswap rcx
ror dword [rsp + rsi - 0x1810fffd], 0x67
call fcn.18137b571
mov r11d, 0x8e83e82d
mov r10d, r11d
mov rdi, r9
lea rsi, [r10 + r11*2 - 0x67f33e76]
movsx eax, sil
add r11b, 0x14
lea r9, [r9 + rax*2 - 0x26]
mov dword [r9 + rax*2 - 0x22], edi
cqo
and rax, rdx
mov esi, dword [rbx + rax*2]
lea rbx, [rbx + rax*4 + 4]
mul dx
xor r11d, r11d
movsx ecx, dx
xor esi, ebp
neg r11w
dec esi
lea rcx, [rdx + 0x44bbf33a]
mul cl
rol esi, 3
movsx edi, cl
rol dil, 0xa7
xchg r11d, edi
not esi
or r10, rcx
bswap esi
adc rax, rax
rol esi, 3
push rbp
sar dil, 0x41
xor dword [rsp + r11*8 - 0xe8], esi
xadd r11w, ax
cbw
pop rbp
movsxd rsi, esi
adc r8, rsi
shl r11d, 0xa3
jne fcn.18134300b
movsx ecx, r10b
ror edi, 2
or cx, 0xfe3e
sbb edi, 0xadb20d8f
sal cx, 0x45
movsx esi, cx
shl r10d, 0xdd
neg edi
movzx edx, r10b
sar si, 0xc
cmovne r10w, cx
xor edi, 0x67165827
bswap edi
not r10
sub r10w, cx
setb r10b
push rbp
adc r10w, r10w
xor dword [rsp + rcx*2 - 0x18f80], edi
and cl, sil
pop rbp
movsxd rdi, edi
dec ecx
add ecx, esi
add r8, rdi
mov rdi, qword [r9 + rcx*2 - 0x18f76]
lea r11, [rsi + rdx - 0x50d1aed2]
imul cx, dx
or ecx, dword ss:[rcx + rdi]
mov eax, r11d
lea rdx, [rax*8 - 0x3eebf06f]
mov dword [r9 + riz + 4], ecx
btc edx, r11d
mov r11d, dword [rdx + rbx - 0x3a869cdd]
lea rbx, [rbx + rdx*2 - 0x750d39ba]
mov ecx, esi
xor r11d, ebp
not dl
neg r11d
movsx edi, r10b
or dx, dx
and di, r10w
lea r11d, [r11 + r10*2 + 0x385ad750]
cbw
rol r10, 0xf4
push r10
not r11d
shr r10, 0x49
xor r11d, 0xf18922b3
rol byte [rsp + rdx - 0x3a869c1a], 3
sub dl, sil
lea r11d, [r11 + rdx*2 - 0x1de7ba1d]
xor sil, byte [rsp + rdx - 0x3a869c21]
shr byte [rsp + rdx - 0x3a869c1e], 0xc1
mov qword [rsp + rdx*2 - 0x750d3844], rbp
xor dword [rsp + rdi*4 - 0xc], r11d
pop rbp
sal sil, 0x86
sbb dil, 0x3d
mov dword [r9 + rdi*2 - 0x18c], r11d
sar dx, 0x41
sub edi, 0xee339735
jmp r8

Function at 0x181397c9c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [r9 + riz + 2]
mov qword [rsp], 0xffffffff9290af3d
call fcn.18138590a
Function at 0x18139959c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmovae r9, qword [rsp + 0xd]
mov ecx, dword [rdi + riz]
lea rax, [r9 + rdx*8 + 0xb18996]
pop r9
bt rbx, 0xb6
mov edx, ecx
movsx r9d, al
pop rax
mov qword [rsp + r9 - 0x1e], r8
movzx ecx, word [r11 + r9*8 - 0x136]
lea r11, [r11 + r9*8 - 0x136]
xor cx, bp
mov qword [rsp + r9 - 0x1e], 0x3392eb9c
dec cx
neg cx
lea rbx, [r9*8 + 0x35336da1]
shr r8b, 0xc5
jae 0x18139ba1e
movsxd r11, r11d
dec rcx
add r8, r11
mul dl
inc edi
mov di, word [rbx + rdi - 0x22]
mov r11d, eax
lea rbx, [rbx + rsi*4 - 0x86]
sub cl, r10b
xchg r10d, eax
rol esi, cl
xor di, bp
add di, dx
neg di
sub di, 0xd92a
sal si, 0xc5
neg di
btr rax, 0xb4
jae 0x1813421c4
inc cx
not r9d
mov edi, r8d
dec r9b
rol cx, 1
or rbx, 0x3e0097ad
xor bp, cx
call fcn.18136ab2d

Function at 0x18139a0ce
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], 0xffffffffe81f100b
mov r10d, dword [rdx + r10*4]
call fcn.18134e89f
movsxd r11, r11d
call fcn.1813c1fd0

Function at 0x18139c59e
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r11d
push rcx
lea r11d, [r11 + rax*4 - 0x3293a51b]
xor word [rsp + rcx - 0x6d82], di
mov qword [rsp + rcx - 0x6d7d], 0xffffffff8c9317a0
bswap r11d
mov qword [rsp + rcx*2 - 0xdaf2], r10
jno 0x1814072ca
Function at 0x1813a28f2
Capabilities:
Parse pe header

Disassembly:
not eax
mov word [r10 + r9 - 0x2d0f4b01], dx
pop rsi
pop r10
pop rdx
pop rdx
pop rax
ja fcn.18134300b

Function at 0x1813a2909
Capabilities:
Parse pe header

Disassembly:
add r10, r9
lea r9, [r8 - 0x4640dad0]
mov rdi, qword [rbx + rsi]
or r8d, 0x8116e49c
mov rax, qword gs:[rdi + rax + 0x6868fe97]
mov qword [rsi + rbx*4], rax
push rbx
jb 0x1813f8c80
neg bl
adc qword [rsp + rbx*4], r10
ret 8
xchg edx, ecx
movsxd r9, r9d
mov qword [rsp + rax + 0x6868fe97], rbx
jg 0x181375cbc
mov edx, 0x209df423
mov rdi, qword [rsi + rdx*2 - 0x413be846]
mov ebx, dword [rdi + rdx - 0x209df423]
mov dword [rsi + rdx - 0x209df41f], ebx
jmp 0x18134b426
Function at 0x1813a6efa
Capabilities:
Execute anti-debugging instructions

Disassembly:
jbe 0x1813e1c5c
mov qword [rsp + 0x20], rbp
push 0xffffffffa714a0ab
mov ebp, 0xc6a91014
xor dword [rsp + 0x28], eax
push rbp
btc bp, bp
mov rbp, qword [rsp + 0x30]
call fcn.181407cf2
lea eax, [rax + rdi*2 - 0x39f83046]
mov qword [rsp + rsi - 0x21fff8], rsi
ror eax, 3
lea r10, [rdx + r11*8 - 0x184ba9f3]
mov qword [rsp + rsi - 0x21fff8], rbp
xchg r10, rsi
mov qword [rsp + r10*2 - 0x440000], 0xfffffffff7870589
xor dword [rsp + r10 - 0x21fff8], eax
add dil, byte [rsp + r10 - 0x21ffff]
mov rbp, qword [rsp + r10*2 - 0x43fff8]
movsxd rax, eax
adc r8, rax
sub dl, r11b
call fcn.1813762dc
mov r10d, 0xe215a48b
lea rdx, [r10*2 - 0x14ee25f1]
movzx ecx, dl
mov eax, dword [rbx + rcx*2 - 0x4a]
movsx edi, cx
lea rbx, [rcx + rbx - 0x21]
shr r10d, 0x9b
xor eax, ebp
sal rdx, cl
sbb eax, edx
movsx r11d, dl
bswap eax
not eax
inc cx
btr r11d, r11d
jae 0x1813f9c8c
inc eax
push 0xffffffffbb975eaf
neg eax
push 0x551b938e
neg qword [rsp + 7]
neg word [rsp + 5]
sbb eax, 0x2a91b991
and byte [rsp + 0xf], 0xbf
ja 0x18134b1f6
mov r8d, 0x1f9bd288
movsx ebx, r8w
lea rax, [rbx + r8*8 - 0x6cf2ce2]
mov ebx, dword [rsi + r8*4 - 0x7e6f4a20]
lea r9, [r8 - 0x6d622d67]
not r9d
push rax
mov eax, dword [rsi + r9 - 0x4dc65ada]
mul ebx
mov byte [rsp + r8 - 0x1f9bd284], 0x18
mov dword [r8 + rsi - 0x1f9bd288], edx
mov edx, r9d
movzx ecx, byte [rsp + r8 - 0x1f9bd288]
mov edi, dword [rsp + r8*4 - 0x7e6f4a1f]
mov dword [r9 + rsi - 0x4dc65ada], eax
mov r8d, dword [r11 + r8*4 - 0x7e6f4a24]
xor r8d, ebp
btr rcx, rcx
mov ebx, dword [rsp + rdx - 0x4dc65add]
push r9
lea r8d, [r9 + r8 - 0x4c1f9941]
xadd qword [rsp + r9 - 0x4dc65ad7], rbx
neg r8d
dec dx
dec r8d
ror edi, 7
shr cl, cl
ror r8d, cl
btc rdi, 0xa7
dec r8d
ror qword [rsp + r9 - 0x4dc65ad6], cl
mov qword [rsp + r9 - 0x4dc65ad6], rbp
xor dword [rsp + r9 - 0x4dc65ad6], r8d
ror r9b, cl
mov eax, dword [rsp + r9 - 0x4dc65ada]
mov rbp, qword [rsp + r9 - 0x4dc65ad3]
mov qword [rsp + r9 - 0x4dc65adb], r9
add qword [rsp + rdx - 0x4dc65add], r9
movsxd r8, r8d
adc r10, r8
mov r8d, dword [rcx + rsi - 3]
and rdi, rdx
lea rsi, [rsi + r9 - 0x4dc65ad7]
movzx edx, word [r11 + rcx*4 - 0x12]
sar rbx, 0xd6
lea r11, [r11 + r9 - 0x4dc65ae1]
xor dx, bp
mov qword [rsp + r9 - 0x4dc65ad3], rcx
inc dx
xor dx, 0xb996
pop rbx
inc dx
sal dword [rsp + r9 - 0x4dc65ad8], cl
cbw
not dx
xchg rcx, rax
sar r9b, 0xa2
xor bp, dx
rol cl, 0x21
lea rdx, [rsp + rdx + 8]
mov dword [rdx + r9 - 0x4dc65af6], r8d
cdqe
shl qword [rsp + r9 - 0x4dc65af6], cl
mov qword [rsp + rcx*2 - 0x9a0168], r10
ret
xor eax, 0xc4a6b887
xor r10b, 0xbb
lea eax, [r10 + rax + 0x6201f9e8]
jo 0x1813731fb
bt cx, r10w
bts rcx, 0x3c
push rbp
xor dword [rsp + r10*2 - 0x14e], eax
btr cx, cx
dec dx
pop rbp
xadd r11w, di
movsxd rax, eax
adc r8, rax
ror rcx, cl
jae 0x1813a772a
Function at 0x1813a7d05
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, 2
jmp 0x18141f5c7
lea rsp, [rsp + 0x20]
jne 0x18137a050
mov rcx, rax
call fcn.1813ae607
jne 0x1813de00a
call fcn.1813373d7
neg r10b
mov edi, dword [rsp + rsi*2 - 0xde]
lea rax, [rsi + rsi*2 - 0x23f6ac78]
push rax
not r10b
shl qword [rsp + rsi - 0x6e], 0x72
movsx ecx, dil
inc r10b
call fcn.1813d0ef6

Function at 0x1813abf93
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea rsp, [rsp + 0x10]
jne 0x1813f9281
mov r9, rax
jmp 0x1813c3c83
call fcn.1813961c4
mov ebx, 0x2f16830e
call fcn.18140f577
jmp 0x1813b6782
mov eax, 0x26869d99
sal rax, 0x41
sub eax, 0x510ce490
mov rax, qword [rbp + rbx*8 + 0x20]
push rax

Function at 0x1813add74
Capabilities:
Encode data using base64

Disassembly:
lea r9, [rax + r9 - 0x16c1]
adc r11d, 0x2aa86db9
sets r11b
jge 0x1813c0814
mov qword [rsp + r11*2 + 0x69c6be0a], rdx
movsxd rax, eax
adc di, word [rsp + rdx*4 - 0x6c94e475]
sbb r11d, edi
shl r10, cl
add r8, rax
xadd rcx, r11
mov qword [rsp + rdi - 0x5d407aa8], r8
ret 8
xor bx, bp
neg rdi
imul ax, di
dec bx
bt r9d, 0xb6
mov qword [rsp + rax*2 + 0x37a4ec00], rdx
neg bx
btr edi, edi
add byte [rsp + rdi*2 - 0x6a6223de], dh
inc dil
ror bx, 1
xor dl, dil
xor word [rsp + rax + 0x1bd27608], ax
sub rdx, qword [rsp + rax*2 + 0x37a4ec02]
dec bx
xor bp, bx
lea rbx, [rsp + rbx + 0x10]
rol dil, 0x22
or di, di
mov dword [rbx + rax + 0x1bd27600], ecx
jae 0x1813c8899
mov r10d, dword [rbx]
mov r11d, 0x19afe9ae
not r11d
mov ecx, r11d
xor r10d, ebp
mov edi, 0x81016393
or r11w, di
movsx edx, cx
not r10d
mov eax, r11d
not edx
btr rdi, r11
neg r10d
inc r10d
xadd edi, r11d
rol cx, 7
not dx
not r10d
bswap r10d
sal r11, 0xb
ror r10d, 3
shr dil, 0xa6
xor r10d, 0x372f662b
bts ecx, 0xba
btc eax, edi
dec r10d
movsx esi, dl
push rbp
xor dword [rsp + rdi - 0x6751db01], r10d
movzx ebp, si
shl esi, 0x94
cdqe
pop rbp
sub rax, rdi
btc r11w, 0x14
movsxd r10, r10d
ror si, cl
jb 0x1813da341
or cl, sil
adc r8, r10
mov r10w, word [r9 + rdi - 0x6751db01]
xadd dil, al
imul esi, ecx
jno 0x18134af71
add si, word [r9 + rsi - 0x3faffffe]
sal ax, 0xad
adc r10w, si
bt dx, di
sbb rdx, 0xffffffffef2499b5
mov word [rdi + r9 - 0x6751dbcf], r10w
movzx ecx, word [rbx + rdi - 0x6751dbcd]
adc r11b, 0x8f
push rax
lea rbx, [rdi + rbx - 0x6751dbcb]
dec word [rsp + rdi - 0x6751dbd0]
lea r10, [rax + r11*2 - 0x4f7414d7]
xor cx, bp
add rax, 0x2a9df6be
inc rax
cdqe
adc cx, 0x626
ror cx, 1
inc r11w
add cx, 0x7a80
ror qword [rsp + rax + 0x5663e941], 0xcd
cwde
xor dword [rsp + rax - 0x16bc], edi
xor cx, 0x641a
inc r10
bt edi, 0x3b
and dl, al
not cx
xor bp, cx
add edi, edx
lea rcx, [rsp + rcx + 8]
mov edx, dword [rdi + rcx - 0x782c586d]
movzx esi, byte [rsp + rdi - 0x782c586b]
mov dword [r9 + rsi*8 - 0x7da], edx
pop r11
movzx ecx, dil
jne 0x1813aa6e0
jno fcn.18134300b
dec dil
mov word [rdx + r10 + 0xf095767], cx
dec rsi
sal rax, 0xb6
jmp r8
pop r8
mov ebx, eax
mov qword [rsp + rax + 0x1bd27600], r10
ret