joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140aa77cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd rax, r10
cqo
movsxd r11, r11d
sbb cx, 0x2c30
mul r10w
add rdi, r11
lea r11, [rax*2 - 0x1f590844]
imul ax, cx
movzx ecx, byte [r9 + r10*4 + 0x64]
or r11w, bx
xor r10b, bl
xor rax, rbx
lea r9, [r9 + rdx*4 - 0x3ff3b]
sal r11b, 7
sbb r11, r8
bt r11w, dx
xor cl, bpl
rol cl, 1
and r11b, 0xa1
inc cl
rol cl, 1
xchg ah, al
not rbx
push r8
neg cl
btc r11d, eax
call fcn.140b2a560
inc eax
shr ecx, 0xcf
shl qword [rsp + r10 + 0x4e0f8f27], 0x1d
setnp cl
mov qword [rsp + rcx - 0x45f0], rbp
xor dword [rsp + r10 + 0x4e0f8f27], eax
mov rbp, qword [rsp + rcx*8 - 0x22ff0]
movsxd rax, eax
sar r10w, 0x61
xadd dword [rsp + r10 + 0x4e0fc796], r8d
adc r10, r10
add rdi, rax
btr r10d, edx
pop r8
pop rbx
pop rax
jae fcn.140aaf605
mov ecx, 0x361e8033
movzx edx, cl
mov r11, qword [rdx + rsi - 0x33]
bts ecx, ecx
mov cl, byte [rdx + rsi - 0x2b]
mov r10d, edx
and edx, edx
shr r11, cl
movsx ebx, r10b
mov qword [rdx + rsi - 0x31], r11
mov r11d, dword [rdx + r9 - 0x33]
add ebx, r10d
lea rcx, [rdx*4 + 0x2e911804]
xor r11d, ebp
rol r10b, 0xe7
lea r8, [r10 + rdx + 0x1905cd1a]
dec r11d
movsx eax, cl
sal r10d, cl
and r8d, edx
neg r11d
sar al, 0xa1
inc cx
inc r11d
rol r11d, 3
sar bl, 0xc5
dec r8d
sete cl
push rbp
sal rbx, 0x5d
xor dword [rsp + rdx - 0x33], r11d
sub cx, 0x7595
cdqe
pop rbp
jne 0x140aa6d78

Function at 0x140ab57f7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cmp rsi, rbx
call fcn.140a90212
mov edi, 0xdc1e89ac
lea r10, [rdi + rdi*8 + 0x3c10402b]
mov ecx, r10d
lea rsi, [rsp + 0xf8]
lea rdx, [rcx - 0x3ee628f6]
movzx eax, dx
ror r10b, 1
mov r11d, dword [rax + rsi - 0xee41]
movsx esi, dil
dec dil
sar rcx, 0x1a
mov dword [r9 + rcx*4 - 0xfc], r11d
jb 0x140b1fa24
push rdx
jns 0x140af4081
mov ecx, dword [r8 + rcx - 0x3e]
dec r10b
lea r8, [rax + r8 - 0xee3d]
movsx r11d, si
neg dword [rsp + rax - 0xee41]
cwd
xor ecx, ebx
xadd dil, r10b
sbb sil, byte [rsp + rax*2 - 0x1dc82]
not ecx
lea ecx, [rcx + rdi - 0x7d7f22b5]
sbb edi, dword [rsp + rax - 0xee3e]
shl r11d, 0x58
rol ecx, 1
bswap ecx
rol ecx, 3
bswap ecx
xchg byte [rsp + rax - 0xee3c], al
and byte [rsp + rax - 0xedfd], sil
not ecx
inc dword [rsp + rax - 0xedfd]
mov qword [rsp + rax*2 - 0x1dc00], rbx
xor r10, rsi
xor dword [rsp + rax*2 - 0x1dc00], ecx
btr r11, r11
xor rax, rsi
xor sil, 0xba
pop rbx
sar rax, 0x83
movsxd rcx, ecx
bswap edi
add rbp, rcx
mov ecx, 0x45a0a409
shl al, 0x22
mov edx, dword [r9 + rax - 0x1fffe2f8]
not r11w
bts cx, r11w
dec r10
mov cl, byte [r9 + rax - 0x1fffe2f4]
call fcn.140ac2ed6
inc edx
mov ebx, dword [r9 + riz]
js 0x140a9c852

Function at 0x140ac8aef
Capabilities:
Manually build aes constants

Disassembly:
lea rsp, [rsp + 0x20]
jbe 0x140aa5e39
call fcn.140aa5e0b
mov r11d, 0x8ebb4c90
movzx ecx, byte [r8 + riz]
movsx r10d, r11b
xor cl, bl
sub cl, 0xd
xadd r10b, r11b
movsx eax, r10w
rol cl, 1
mov edi, r10d
sub cl, 0x83
bts r11w, di
lea rdx, [rdi + r10*4 - 0x6a6c10e9]
setb r10b
neg cl
inc rdi
mov esi, edi
dec cl
xchg rdi, rax
lea rdx, [rsi + rdx*2 - 0x725f1dec]
jmp 0x140a8fcfd
Function at 0x140ad66da
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [r9 + riz]
mov qword [rsp], r8
add r9, 4
add qword [rsp], r8
jae 0x140af6a47
sub cl, cl
adc cl, byte [rsp + r11*2 - 0x1cf03]
mov qword [rsp + r11 - 0xe780], rbp
xor byte [rsp + rcx - 0xe700], 0xa
xor dword [rsp + r11*2 - 0x1cf08], ebx
bswap r11
movsx ebp, cx
mov rbp, qword [rsp + rax*2 - 0xc8]
movsxd rbx, ebx
add rdi, rbx
lea rbx, [r10 - 0xbf419d4]
lea rdx, [rbx + rcx*8 - 0x24d65c50]
pop r8
pop rbx
jmp fcn.140aaf605
ror dword [rsp + 2], 0x73
xor edx, ebp
rol qword [rsp], 0xd3
inc rbx
rol edx, 3
xor byte [rsp + 3], 0xa2
xor edx, 0x9c8fe5a2
push rbx
lea rax, [rbx + rbx*8 - 0x62540cfa]
dec edx
xchg byte [rsp + 3], al
rol edx, 2
mov r10d, r8d
dec r8w
push r8
neg edx
lea r11, [rax*4 - 0x4e5294c8]
sub edx, 0x96914095
and r8b, r10b
inc r10b
shr r10d, 0x48
bswap edx
bt eax, ebx
movsx ecx, r8b
jb 0x140ae280e
dec edx
ror edx, 1
shl word [rsp + r10*8 - 0x480cf2a], 0x69
sub rbx, r8
jne 0x140b08c71
lea edx, [rdx + r10*2 + 0x316b94e1]
inc r10
mov qword [rsp + r10 - 0x9019d8], rbp
sar r8d, 0x7c
sal r11d, cl
push r8
pop rax
adc rdi, r10
dec ebx
mul cl
movsx r10d, r8b
mov r11, qword [rdx + rsi]
shr al, 0x42
or dl, bh
adc r10w, word [rsi + rdx*8 - 0x4c0]
dec al
lea rsi, [rsi + rdx - 0x8f]
bt cx, ax
adc bx, 0x2d35
not ax
mov word [r11 + rdx - 0x99], r10w
cbw
lea r11, [rbx*8 + 0x1e2a3e26]
jmp rdi

Function at 0x140ad78eb
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push 0x1412678f
lea rsp, [rsp + 0x10]
add rsp, rcx
test ebx, ebx
push 0xffffffffcd865c8e
lea rsp, [rsp + 8]
je 0x140b0eeb2

Function at 0x140ad9d73
Capabilities:
Encode data using base64

Disassembly:
mov dword [rbx + rsi - 0x5000], r10d
call fcn.140a78762
mov eax, 0xe53fe720
movzx edx, ax
mov eax, dword [r9 + rdx*2 - 0x1ce40]
lea r9, [r9 + rdx*4 - 0x39c7c]
movsx r11d, dx
xor eax, ebp
sal r11w, 0xc1
lea eax, [rax + r11 - 0x38fac0ab]
lea r10, [rdx + r11*4 - 0x7b4059e0]
rol eax, 2
movzx ebx, r11w
movsx ecx, r11w
not eax
dec cl
push r11
dec eax
rol dword [rsp + rdx*2 - 0x1ce3c], 0xdc
push rcx
sbb r11, rbx
rol eax, 2
lea r10, [rcx*8 - 0x38e890ea]
xchg word [rsp + rdx - 0xe71d], bx
imul cx, bx
mov qword [rsp + rdx - 0xe718], rbp
xor dword [rsp + rdx - 0xe718], eax
dec cx
sal dl, 0x47
sete byte [rsp + rdx - 0xe700]
mov rbp, qword [rsp + rdx - 0xe6f8]
lea r8, [rdx*8 - 0x1d551874]
neg dx
dec rdx
movsxd rax, eax
add word [rsp + rdx*2 - 0x31fb], 0x609c
add rdi, rax
jmp 0x140abf653
mov qword [rsp + rax - 0x2cfa0722], rcx
jae 0x140ad2b88
jne 0x140a8e68b
jmp 0x140ab1536
Function at 0x140ae92da
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11d, 0xb39d4e89
rol rcx, 0x19
adc rsi, 4
movzx ecx, byte [r9 + riz]
btc r11d, r11d
adc r9, 0
xor cl, bpl
mov eax, 0xd230b986
bts r11, 0x27
jae 0x140ac6f2a
mov edx, 0xa409ed26
mov r11d, edx
lea r11, [r11*4 - 0x4655b0f5]
mov r10, qword [r9 + riz]
movzx esi, r11w
xor r11b, sil
movzx eax, byte [r8 + rsi*4 - 0xe8c]
movzx ecx, dx
bswap ecx
xor al, bl
ror al, 1
dec esi
jl 0x140a8ca48
je 0x140aa85ee
not al
and cx, 0x8d96
sbb al, 0xe
ror al, 1
xor bl, al
mov edi, 0xe60e7a06
dec rsi
add rax, rsp
jmp 0x140a91cfd
jb 0x140ad9f10
sar word [rsp + 0x10], 0xa3
sbb ecx, 0x6b9d4dae
ror ecx, 1
call fcn.140ad6676
mov edi, 0x2701069c
movzx r11w, byte [r9 + rdi - 0x2701069c]
movzx esi, di
shr esi, 0x42
mov sil, byte [rsi + r9 - 0x1a5]
movzx ecx, di
bts cx, cx
lea r9, [rdi + r9 - 0x2701069a]
not r11b
not sil
lea rdx, [rdi*8 - 0x3753217c]
movsx eax, cx
bt di, 0x18
or r11b, sil
sal dx, 0xc9
cdq
mov word [r9 + rdi*2 - 0x4e020d38], r11w
mov esi, dword [r8 + rdi - 0x2701069c]
lea r8, [r8 + rdi*2 - 0x4e020d34]
lea r10, [rcx + rcx*8 - 0x60e00ed5]
xor esi, ebx
neg rcx
btc ecx, 0x22
lea esi, [rsi + r10*2 + 0x13252c9f]
shl r10, 0xd4
rol esi, 2
sub edi, edx
shr rcx, cl
xor esi, 0x220bfb2b
cdqe
not r10d
neg esi
bt eax, eax
push rbx
jae 0x140b10bd1
mov eax, dword [r9]
mov r10d, 0x45249b9e
lea r9, [r10 + r9 - 0x45249b9a]
movsx edx, r10b
xor eax, ebp
lea rbx, [r10 + r10 - 0x33e367ef]
sar ebx, 0x7b
bt rdx, r10
rol eax, 3
movzx ecx, dx
xor eax, 0x9c8fe5a2
sar dx, 0xce
neg bx
lea r8, [rbx + rbx + 0xd1cff0f]
add eax, edx
sar bx, 0xe8
xor dx, r8w
rol eax, 2
add rax, rdi
xor dword [rsp + rcx], esi
pop rbx
sal ax, 0xc3
and rdx, 0xffffffff81299d22
and r10w, r10w
movsxd rsi, esi
adc rbp, rsi
movsx r11d, cx
ror rcx, 0x26
dec edi
or rcx, rbp
jmp rcx

Function at 0x140ae9799
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [rsp + 5], 0xaf
mov qword [rsp + 0x18], rbx
setns byte [rsp + 0xf]
push 0x4a1a9f26
xor dword [rsp + 0x20], r10d
mov rbx, qword [rsp + 0x20]
movsxd r10, r10d
add rbp, r10
mov qword [rsp + 0x20], 0x3011a533
jmp 0x140ae1cd5
xor ecx, 0xdc07998c
mov qword [rsp], 0xffffffffc10793bd
dec rax
call fcn.140a98d73
xor r10d, ebx
push 0xffffffffd6113831
not r10d
ror qword [rsp], 0x11
neg r10d
mov qword [rsp + 8], 0x7c197921
add r10d, 0x2a04af8b
push 0x3884e009
shl dword [rsp + 0x14], 0x1b
not r10d
push 0xffffffffb7b01896
je 0x140abe5d0
mov r10d, 0x569e02bf
lea rbx, [r10 + r10*4 + 0x710f87bf]
xadd r10, rbx
mov r8, qword [rbx + r9 - 0x569e02bf]
movzx ecx, r10b
lea r9, [r9 + rbx - 0x569e02b7]
mov edx, 0x8d17f62f
movsx eax, bl
xor r8, rbp
ror al, 4
movsx r11d, r10b
add edx, ecx
neg r8
lea r8, [rcx + r8 - 0x4be33b31]
neg r8
jmp 0x140b252d2
ja 0x140acf4c0
mul ax
setae r10b
lea r8, [rcx + r8 + 0x2e94d0ca]
mul r10
shl r11b, 0x46
cqo
xor rbp, r8
lea rsi, [rsi + rbx - 0x569e02c7]
mov qword [rsi + rcx - 0x39], r8
mov r10d, dword [rcx + r9 - 0x39]
or bl, 0xbb
rol dl, 0x21
lea r9, [rcx + r9 - 0x35]
shr bl, 0x41
xor r10d, ebp
and dl, ah
cdq
shl rcx, 0xc3
rol r10d, 3
xadd rdx, rbx
dec r10d
dec edx
Function at 0x140af0bca
Capabilities:
Authenticate hmac

Disassembly:
bswap ebx
mov qword [rsp + rdx + 8], rax
sal ecx, cl
btc r10, rax
sbb ebx, edx
dec rcx
shr r10w, cl
mov qword [rsp + rdx*4 + 0x10], rdx
ror ebx, 1
call fcn.140b062c4

Function at 0x140af3e99
Capabilities:
Parse pe header

Disassembly:
xor ecx, ebp
neg ecx
mov qword [rsp + rbx - 0x8c], r11
pop rax
btc bx, ax
lea ecx, [rcx + rbx*8 + 0x2092aea3]
btc rax, r11
lea rax, [r11 + rbx + 0x1f961c3d]
bswap ecx
jb 0x140b3af1a
not ecx
push rbp
movzx r8d, r10b
xor dword [rsp + rbx*8 - 0x8460], ecx
neg bx
pop rbp
jle 0x140aecc3d
mov edx, 0x60101dbf
movzx eax, dx
lea rcx, [rax + rax + 0x7020da5]
mov r11d, dword [r9 + rdx - 0x60101dbf]
mov ebx, eax
jmp fcn.140b251c6
Function at 0x140af4e5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], rcx
not r8w
neg r8w
rol r8w, 1
movsx r11d, bl
xor r11b, 0x8b
sbb r8w, 0x4f09
not r8w
call fcn.140b1b335
movzx r10d, byte [r8]
xor r10b, bl
mov edx, 0x7f2bb511
mov eax, 0xea9dc6a2
sub r10b, 0x3b
rol rdx, 0x19
xadd dl, al
ror r10b, 1
add r10b, 0xb
mov ecx, eax
neg r10b
imul rdx
xor bl, r10b
not dx
add r10, rsp
movzx esi, cl
mov r11w, word [r10 + rdx*4 - 0x3a79d60]
movsx edi, dl
btc ax, 0xb2
mov word [r9 + rdx*8 - 0x74f3ac2], r11w
sbb al, 0x97
movzx r11d, si
xchg edx, edi
xor r11d, dword [r8 + rdx*2 - 0xaf]
ror rcx, 0xfe
xor r11d, ebx
ror cx, 0xb
or edx, 0x4f039021
rol r11d, 2
lea r11d, [r11 + rdx + 0xc1a40c1]
sal esi, 0x13
lea r10, [rax - 0x6663c045]
rol cx, 0x68
ror r11d, 1
bt rdi, rdi
inc r11d
rol r11d, 2
xor rax, 0x55185e93
push rbx
dec sil
xor dword [rsp + rsi*2 - 0x1fe], r11d
not dx
inc esi
pop rbx
neg rdi
jle 0x140b0956e
mov edx, 0x3863a8
btr edx, edx
mov eax, dword [r9 + rdx*4 - 0xe18aa0]
xor eax, ebp
inc edx
or dl, dl
xor eax, 0x3312b69d
push rdx
mov r8d, 0xcdb5180b
lea eax, [rax + rdx*2 - 0x5375bf82]
dec dword [rsp + rdx*4 - 0xe18aa4]
ror eax, 1
sub word [rsp + rdx*4 - 0xe18aa0], r8w
lea r11, [r8 - 0x1b5dce59]
xadd byte [rsp + rdx - 0x3862a9], r11b
dec eax
xchg qword [rsp + rdx - 0x3862a9], r8
not eax
movzx ebx, byte [rsp + rdx - 0x3862a6]
mov qword [rsp + rdx - 0x3862a9], rbp
bswap r11d
xadd edx, ebx
xadd bx, r8w
xor dword [rsp + rdx*4 - 0xe18dd8], eax
lea rcx, [rbx + rdx*2 - 0x5ac5727d]
pop rbp
movzx r10d, r11b
or rbx, rcx
shl cl, 0xa5
movsxd rax, eax
adc rdi, rax
dec r11w
movzx ecx, byte [rdx + r9 - 0x386372]
movsx eax, bx
or rdx, r8
xchg r11w, ax
xor cl, bpl
rol cl, 1
lea rdx, [rax + r10*2 + 0x7288e48d]
not cl
imul r11d
xor cl, 0x92
ror cl, 1
xor bpl, cl
idiv r11b
rol rbx, 0x4f
add rcx, rsp
neg r10d
mov r11w, word [rcx + rdx*2 - 0x7354]
mov word [rsi + rdx*2 - 0x7356], r11w
lea rcx, [r8 + 0x3abb6b8b]
sal rcx, 2
movzx r10d, byte [r9 + rdx*2 - 0x734f]
xor rdx, 0x3eb59392
lea r9, [r9 + rdx*2 - 0x7d6b546a]
shl ecx, 0x55
neg dx
shr dl, 0xc5
xor r10b, bpl
rol r10b, 1
sal rcx, 0xcb
xor r10b, bl
push rax
ror r10b, 1
inc qword [rsp + rdx - 0x3eb55506]
lea r11, [rbx*4 + 0x4cbb003c]
neg r10b
sar byte [rsp + rdx - 0x3eb55505], 0x61
imul rbx
imul cx
xor bpl, r10b
cwd
lea r10, [rsp + r10 + 8]
inc bl
sar dword [rsp + rdx*8 + 0x80001], 0xf1
mov r11, qword [r10 + rdx + 0x10000]
bswap ecx
idiv rbx
mov qword [rcx + rsi - 0xa], r11
jmp 0x140b0bfc9
sal r8d, 0x55
lea rsi, [rsi + rcx*8 - 0xa]
jne 0x140aa2af0
Function at 0x140af660f
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
xor dword [rsp + r10*2 - 0x2ca4], eax
sar cx, 0x41
not dx
mov rbx, qword [rsp + r10*8 - 0xb2a8]
sar si, 0xe8
mov qword [rsp + r10 - 0x1656], rsi
shl byte [rsp + r10 - 0x1654], 0x21
movsxd rax, eax
jp 0x140a8cec5
mov r11d, dword [r9]
mov r10d, 0xa9ac183a
call fcn.140a759ce
mov edi, 0x8b9249af
mov r11d, dword [r9 + riz]
movsx r10d, di
rol r10b, 6
movsx esi, r10w
mov esi, dword [r9 + r10*8 - 0x24f54]
mov edx, r10d
neg rdx
not r11d
lea rax, [r10 + r10*4 + 0x3cb0ef81]
mov ecx, edx
xadd r10w, di
not esi
inc al
bt rax, 0xb7
xadd rdi, rax
and r11d, esi
and ebx, esi

Function at 0x140b01f6e
Capabilities:
Encode data using base64
Manually build aes constants
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + rsi - 0x32], rdi
not ax
mov r11d, 0x7d969138
or dl, sil
dec ax
not ax
xchg word [rsp + rsi*2 - 0x60], r11w
imul rdx, rcx
not qword [rsp + rsi - 0x32]
adc ax, 0xd734
ror rdi, 0x99
or di, word [rsp + rsi*4 - 0xc5]
xor bx, ax
shr sil, 0x62
sets dil
adc edx, edi
lea rax, [rsp + rax + 8]
rol r10b, 0xa1
mov ecx, dword [rax + rdx - 0xad85e4b]
inc edi
rol si, 0x69
lea r9, [r9 + rdx*2 - 0x15b0bc9a]
mov dword [r9 + rdx*2 - 0x15b0bc96], ecx
and byte [rsp + rdx - 0xad85e46], r10b
not byte [rsp + rdx*2 - 0x15b0bc96]
mov edx, dword [r8 + rdx - 0xad85e4b]
lea r8, [rdi + r8 - 0xc6fd]
xor edx, ebx
mov ecx, 0x9919cfae
xor qword [rsp + rdi*2 - 0x18e02], 0xffffffffa5baa325
ror edx, 3
inc edx
xor edx, 0xc01ac03d
neg r11d
rol edx, 1
and byte [rsp + rdi*2 - 0x18dfd], r11b
inc edx
xor dil, 0x22
bswap edx
lea rdi, [r11*8 - 0x474f3f60]
mov qword [rsp + rsi - 0x1800], rbx
adc ecx, 0x1895b03a
bswap rcx
xor dword [rsp + rsi*4 - 0x6000], edx
sar r10w, 0xd
mov eax, edi
jb 0x140aa1607
pop rbx
xor rdi, 0xffffffffbebac6b7
shr r10b, 0x41
add dil, r10b
movsxd rdx, edx
ror di, 0x4f
xchg r11, rdi
sar esi, 0x77
adc rbp, rdx
jmp fcn.140b0f105
Function at 0x140b167c0
Capabilities:
Manually build aes constants

Disassembly:
lea rax, [r10 + rax - 0x779ab41b]
movzx edx, byte [rsp + r10 - 0x2bb77918]
add r10d, dword [rsp + r10 - 0x2bb7791b]
neg rax

Function at 0x140b177d6
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x28]
jne 0x140af5d53
pop r9
mov eax, 0xb92e0998
movzx ebx, ax
add eax, eax
pop rbx

Function at 0x140b18ebf
Capabilities:
Authenticate hmac

Disassembly:
mov r8d, dword [rsi + rcx - 0x7b7ffffc]
lea rsi, [rsi + rbx*2 + 4]
adc r10d, r8d
dec ecx
push rbx
mov dword [rsi + rcx - 0x7b7fffff], r10d
sub dl, 0
xor qword [rsp + rbx], rdi
ret
mov eax, 0xa52f8ba7
mov ebx, 0x9780b486
mov ebx, dword [r9 + riz]
movsx edx, ax
movsx r11d, dx
add r9, 4
btr dx, 0x16
mov r10d, eax
or r11d, eax
xor ebx, ebp
add dl, al
ror ebx, 2
lea r8, [rdx*4 - 0x216ac9da]
dec edx
inc ebx
btc r8w, 0xb8
sbb rdx, 0x6492f304
cbw
neg ebx
xor r11w, ax
mul r8b
jo 0x140b17748
mov ecx, 0xd1a5f03d
mov r10d, dword [r9 + riz]
lea r11, [rcx + rcx - 0x3dc647c3]
push rcx
add r9, 4
movzx ebx, cx
xor r10d, ebp
imul rcx, rbx
adc r11b, cl
sar r11b, 0x22
xor r10d, 0x76158a18
bswap r10d
movsx r8d, word [rsp + rbx*4 - 0x3c0f1]
jmp 0x140a98833
lea r9, [r9 + r10 - 0x18]
xor ebx, ebp
rol r8b, 0x45
not ebx
bswap ebx
sbb ebx, 0x2d02022a
push rbp
xor dword [rsp], ebx
pop rbp
lea rcx, [r11 + r10*8 - 0x1ad6ec41]
and rax, r8
ror al, 1
movsxd rbx, ebx
adc rdi, rbx
mov r10d, dword [rsi + riz]
shl ecx, cl
movsx ebx, cl
jp 0x140a8396e
mov edx, 0x92bc8238
movsx r10d, dl
movsx r8d, r10w
mov ebx, dword [r9 + r10*2 - 0x70]
ror r10b, 0x21
jae 0x140ada573
mov qword [rsp + rsi*4 - 0x184], 0xffffffff9914d7bf
lea r8, [rsi + r8 - 0x5d]
pop rcx
xor r11d, ebx
sub rcx, 0x1bb82824
sar rdx, cl
bswap r11d
dec si
jle 0x140b1fa1d
adc r11d, 0x93b38ab0
bts ecx, 0xa5
shl ecx, cl
call fcn.140ab4187
jmp 0x140acfd3d
mov ecx, 0xbf3ab89f
mov edx, ecx
Function at 0x140b1afd8
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
cwde
dec cx
rol r10d, 1
dec ebx
not rdx
dec dx
neg r10d
cdq
ror al, 3
shl rdx, 0xd5
xor r10d, 0x3286a5b9
cwde
lea r10d, [r10 + rax*8 + 0x473c8482]
dec edx
bswap rax
mul edx
push rbp
movsx ebp, bl
div bpl
bt cx, 0xf
xor dword [rsp + rax*4], r10d
call fcn.140aa789c
sar dx, 0x69
dec dil
push rsi
shl si, 0xa1
and dx, word [rsp + rdx + 0x3c]
ror dil, 1
xor bl, dil
neg dx
shl edx, 0x8f
mul al
lea rdi, [rsp + rdi + 0x40]
or ax, 0x6b37
mov dword [rdi + rdx*2], r10d
dec al
pop rax
inc word [rsp + rax + 0x2c]
mov qword [rsp + rax*2], rbp
ret 0x30
lea edi, [rdi + r10*2 + 0xb04c4ae]
sbb eax, dword [rsp + rcx*2 - 0x1f8]
not dl
btr si, 0xaa
mov qword [rsp + rax - 0x7ff8], rbx
or edx, edx
call fcn.140b1527c
call fcn.140af04bf
bswap ecx
add qword [rsp + r10 - 0xa360], rdi
mov qword [rsp + rdi - 0x5d385293], rbx
xor dword [rsp + rdi - 0x5d385293], ecx
pop rbx
and edi, 0xfa5ea9b
dec r11w
movsxd rcx, ecx
call fcn.140ac7905
mov qword [rsi + r8*2 - 0xb8], r11
mov r10d, dword [rax + r9 - 0x73112730]
lea r9, [rax + r9 - 0x7311272c]
or r8, rcx
xor r10d, ebp
jmp 0x140aa5cf3
xor edi, ebx
xor si, r11w
ror edi, 2
bt ax, r10w
or rsi, 0x791ff2b4
not edi
mov qword [rsp + r10 - 0x77d46ac2], rax
sar al, 0xe1
sbb edi, 0xecaeba80
lea rdx, [rax + r10*4 + 0x542e13a3]
bswap ecx
and cx, cx
neg edi
sub dword [rsp + rcx*2 - 0xf7], ecx
adc cx, cx
jge 0x140ab23dc
mov eax, 0x73112730
mov r11, qword [rsi + rax - 0x73112730]
lea rcx, [rax + rax*2 - 0x33ccc1f0]
jmp 0x140b1b9d1
movzx r8d, al
mov r10, qword [r8 + rsi - 0x28]
movsx edx, ax
mov ebx, r8d
cdq
add r11, r10
inc rbx
sal r8b, 0x81
jns 0x140afc966
Function at 0x140b2518e
Capabilities:
Manually build aes constants

Disassembly:
xadd bl, bh
neg r10d
bswap r10d
ror r8d, cl
mov qword [rsp + rax - 0x53bff98], r11
ror r10d, 1
sar r11d, 0x53
xor r10d, 0xe5218436
mov qword [rsp + rax*2 - 0xa77ff30], rbp
xor eax, ebx
jae 0x140b311ee
Function at 0x140b3ab7b
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header
Resolve function by parsing pe exports

Disassembly:
movsxd r10, r10d
and di, cx
call fcn.140af2dcc
Function at 0x140027ce0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b684
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b684
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027e30
cmp rax, 0xffffffffffffffff
je 0x140027e30
xor edi, edi
test rbp, rbp
jle 0x140027ddb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dc70
mov rbx, rax
test rax, rax
jne 0x140027d68
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027dd1
mov edx, 0x8000
mov ecx, r14d
call fcn.140015828
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c360
cmp eax, 0xffffffff
je 0x140027db1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027d78
mov edx, r15d
mov ecx, r14d
call fcn.140015828
jmp 0x140027dd1
cmp byte [rsi + 0x38], dil
je 0x140027dc8
cmp dword [rsi + 0x34], 5
jne 0x140027dc8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027dd1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019d48
jmp 0x140027e44
jns 0x140027e44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b684
cmp rax, 0xffffffffffffffff
jne 0x140027dfc
cmp byte [rsi + 0x30], dil
je 0x140027e44
mov edi, dword [rsi + 0x2c]
jmp 0x140027e44
mov ecx, r14d
call fcn.140016e28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027e44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027e44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027e3d
mov eax, dword [rsi + 0x2c]
jmp 0x140027e42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b684
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001964
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019b0
xor al, al
add rsp, 0x28
ret
Function at 0x140001a74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001abe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001abe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001abe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001abe
cmp dword [rcx + 0x84], 0xe
jbe 0x140001abe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ac0
xor al, al
add rsp, 0x28
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62