joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141422583
Capabilities:
Encode data using base64

Disassembly:
mul r8d
mov qword [rsp + rcx - 0xfbffff8], 0xfffffffff9367637
ror dil, 1
cbw
xor bpl, dil
cdq
btr dx, dx
lea r10, [r10 + rcx*4 - 0x3f000008]
mov qword [r10 + rcx - 0xfc00000], rdi
push rax
btr ecx, 0x17
pop r11
pop rdx
pop rcx
jb fcn.141426d8b
mov edx, dword [rsi + rax*2 - 0x6e]
xor edx, ebp
not edx
xor rcx, rax
sbb edx, 0x9b1ad0a5
mov ebx, 0xad3df221
push rax
not edx
neg edx
not ax
shl dword [rsp + rax - 0xffc6], 0xa9
mov qword [rsp + rax*4 - 0x3ff20], rbp
push rax
xor dword [rsp + rax - 0xffc0], edx
bswap r11d
lea r8, [r11 + rax*4 + 0x3a94a61d]
push rcx
mov rbp, qword [rsp + r11*2 - 0x6e082158]
mov edi, 0xfd24fb3e
bt bx, 0x8a
sub r8w, di
movsxd rdx, edx
jge 0x141439d24
xor rax, 0xffffffffb42e0805
mov qword [rsp + r11*2 - 0x6e082158], rcx
adc r9, rdx
push r11
inc dword [rsp + r11 - 0x370410a3]
sub cl, 0
mov rcx, qword [rax + r10 + 0x4bd10833]
xchg qword [rsp + r11*2 - 0x6e082153], rbx
je 0x14142c7c1
mov r11d, 0x559582b3
inc r11b
lea rsi, [r11 + rsi - 0x559582b8]
btc r11d, r11d
mov r11d, dword [rsi + r11 - 0x558582b4]
jb 0x14142b1fb

Function at 0x141422677
Capabilities:
Encode data using base64

Disassembly:
xor r11d, ebp
mov qword [rsp + rdi*2 - 0x130], rdx
not byte [rsp + rdi - 0x92]
sal eax, 0x48
not r11d
movzx ebx, byte [rsp + rdi - 0x96]
neg bl
dec r11d
bt rdx, 7
rol r8d, 0xce
neg r11d
dec qword [rsp + rdi*4 - 0x260]
call fcn.14143aed1
Function at 0x14142470d
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jne 0x1414186ae
mov edx, 0xe48fbd1f
jmp 0x141410524
not edx
mov rdx, rax
push 0xffffffffe8245611
push 0x5bb23f92
lea rsp, [rsp + 0x10]
jmp 0x1414120c5
mov qword [rsp], 0xfffffffff7b4bf0e
cmp ebx, 2
not word [rsp + 1]
jmp 0x14140f0db

Function at 0x141424eab
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffff9a375b8b
lea rsp, [rsp + 0x10]
jne 0x14142bb45
call fcn.14143c0eb
jmp 0x141411997
call fcn.141401cee

Function at 0x141425a0b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov cl, byte [r10 + rbx*2 + 0x4bfa3ed8]
btc di, r8w
neg r8b
lea r10, [r10 + rbx*2 + 0x4bfa3ed2]
btr bx, di
mov r11d, 0x929f8883
shl r11b, 0x82
shrd rdx, rax, cl
rol dil, 0x81
xor edi, r11d
jns 0x14143a51b
dec ecx
div rdi
neg ecx
mov qword [rsp], 0xffffffffda02e09c
xor ecx, 0xe8332b8a
pop rbx
shr dil, 0x43
not dl
lea ecx, [rcx + rbx*2 + 0x11d06ab9]
push rbp
bt r8w, dx
neg dil
bts rbx, rdx
xor dword [rsp + rbx + 0x25fd1f64], ecx
div rdi
pop rbp
cdq
movsxd rcx, ecx
add r9, rcx
xor rdx, qword [r10 + rbx*2 + 0x4bfa3ec8]
mov rax, qword [r10 + rbx*2 + 0x4bfa3ed0]
inc bl
dec bl
jp 0x1414049b1
mov qword [r10 + rdi - 0x6d6077f1], rdx
jmp r9

Function at 0x141425a68
Capabilities:
Authenticate hmac

Disassembly:
movzx ebx, byte [rbx + rsi - 0x2f11]
xor bl, bpl
cdqe
add bl, 0xb9
bt r8, rdi
mov qword [rsp + rax*2 + 0x10], rdi
mov word [rsp + rax*4 + 5], ax
not bl
lea rax, [rax + rdx - 0x6d488af9]
add rdi, r11
jo 0x141435086
inc bl
rol edx, 0x2a
ror bl, 1
not bl
imul r11d, eax
xadd word [rsp + rdx*2 - 0x7ffeff9], dx
rol bl, 1
lea rcx, [r11 + r11*8 - 0x1cc7d15d]
call fcn.14140bea3
mov qword [rsp + rbx*4 - 0xbe10], rbp
cwd
neg r8w
xor dword [rsp + rbx - 0x2f78], ecx
mov rbp, qword [rsp + rbx - 0x2f78]
movsx r11d, word [rsp + rbx - 0x2f7f]
imul r8, rbx
movsxd rcx, ecx
xchg dword [rsp + rbx - 0x2f7c], eax
shr bl, 0x43
mov qword [rsp + rbx*4 - 0xbc44], rdx
adc r9, rcx
lea rsi, [rsi + rbx*2 - 0x5e23]
dec dx
jle 0x141413ef6
push rdx
cwd
ror ecx, 2
call fcn.14140e213
jmp 0x141431f75

Function at 0x141426e82
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jmp 0x141426c2f
call fcn.141415425
or dword [rsp + 0x12], 0x96817b06
mov qword [rsp], 0x1f9fda2c
and eax, 0xff
neg dword [rsp + 6]
mov eax, dword [rdx + rax*4]
shl byte [rsp + 0xa], 0xe4
jp 0x141427f3b
shr ebx, 8
jmp 0x14141387b
Function at 0x141429d31
Capabilities:
Encode data using base64

Disassembly:
not edx
cwde
ror dword [rsp + rcx - 0x36682536], cl
neg edx
mov qword [rsp + rcx - 0x36682532], rbp
mov edi, dword [rsp + rcx*2 - 0x6cd04a79]
xor dword [rsp + rcx - 0x36682532], edx
movsx ebp, r11w
shl al, 2
rol qword [rsp + rcx*2 - 0x6cd04a7c], 0x27
mov rbp, qword [rsp + rcx - 0x36682532]
bts ebx, ebx
and qword [rsp + rcx - 0x3668253a], rbx
movsxd rdx, edx
sar r11b, cl
jns 0x14141e215
mov r11d, 0xfb1e0191
lea rdx, [r11 + 0x133fe896]
mov ecx, 0x708285bc
mov di, word [rcx + r10 - 0x708285bc]
push r11
and dl, 0x3d
shl cl, 0x86
mov ax, word [rcx + r10 - 0x708284fe]
lea r10, [r10 + rcx - 0x708284fe]
lea r8, [r11 + r11*8 + 0x65023633]
add di, ax
push r8
add r11d, 0x441bb43f
movsx eax, r8b
mov word [r11 + r10 - 0x3f39b5d0], di
bswap eax
lea rdi, [r11 + rdx*4 + 0x1f891030]
rol byte [rsp + r11 - 0x3f39b5ca], 0x81
lea rsi, [rsi + r11 - 0x3f39b5d4]
mov edi, dword [rsi + r11*2 - 0x7e736ba0]
pop rcx
movzx ebx, dx
xor edi, ebp
ror edx, 0x19
inc edi
ror edi, 1
xadd qword [rsp + r11*2 - 0x7e736ba0], rbx
neg edi
sar rcx, cl
xor edi, 0x3aa22e2a
sub edi, 0xa1091596
push rbx
cwd
add r11w, 0x528c
mov qword [rsp + rdx*2 - 0x5de9fff8], rbp
idiv r11w
xor dword [rsp + r11*2 - 0x7e7210b0], edi
jmp 0x1414248d4
adc r9, rdx
mov qword [rsp + rbx*2 - 0x2856], r9
ret 0x10
movsx ebp, r8w
call fcn.14142ba07
or r8d, eax
rol r11b, 0x83
xor edx, ebp
lea edx, [rdx + rcx - 0x766d1166]
ror ebx, cl
xor edx, 0x909e9036
or word [rsp + rcx - 0x36682536], r11w
ror edx, 3
mov qword [rsp + rcx - 0x36682542], 0x6232ac2d
sub edx, 0xe095b800
push r8
jmp 0x14141136d

Function at 0x14142b66f
Capabilities:
Authenticate hmac

Disassembly:
jl 0x14143036c
sub rsi, 4
mov edx, 0xc2311719
mov edi, 0xd9b2d920
jmp 0x141418faf
xor ebx, ebp
ror ax, 0x2c
not ebx
mov qword [rsp + rax - 0x4d0], rax
movsx ecx, di
adc ebx, 0xbc120e39
inc edi
neg ebx
sub al, byte [rsp + rax*2 - 0x99e]
mov r8d, eax
shr r8b, 0x83
ror ebx, 1
not ebx
push r8
and edi, dword [rsp + rax - 0x4c9]
seto byte [rsp + rax*4 - 0x1333]
mov qword [rsp + rax - 0x4c8], rbp
xor dword [rsp + rdi - 0x1000], edi
or rcx, qword [rsp + rax*2 - 0x9a0]
pop rcx
xor dword [rsp + rax*4 - 0x1340], ebx
movsx ebp, r8b
movsx edx, bp
and al, ch
pop rbp
cdqe
movsxd rbx, ebx
adc r9, rbx
movzx r11d, ax
add r11b, 0x83
shl dl, 0x65
jmp r9
Function at 0x14142b8b0
Capabilities:
Encode data using base64

Disassembly:
mov dword [rdi + r10 - 0xa5ff], ebx
jmp 0x14141e4eb
xor bx, 0xa8a6
push r8
dec dx
shl r8, 0xcc
not bx
rol byte [rsp + r8*2 - 0x18b5fff], 0xa5
rol bx, 1
lea rdx, [rax - 0x58fa22ca]
mov r11d, 0x13b8f01b
sub bx, 0x61a7
shr ecx, 0xa8
rol dword [rsp + r8*2 - 0x18b5ffe], 0x7f
xor bp, bx
imul cl
lea rbx, [rsp + rbx + 8]
mov r8d, dword [rdx + rbx - 0x14a7d391]
ror dil, 0x61
movzx ebx, cx
lea r10, [r10 + rdx*2 - 0x294fa726]
ror al, 3
mov dword [r10 + rdx*2 - 0x294fa722], r8d
idiv rax
inc dl
neg cl
pop rbx
jno fcn.141426d8b
lea rsi, [rsi + rdi*8 - 0x52ffc]
movsx ebx, dil
imul r11d, edi
movzx ecx, dx
mov r8d, dword [rdi + rsi - 0xa5ff]
xor r8d, ebp
add qword [rsp + rdi*4 - 0x297f4], rdi
ror r8d, 1
xor r8d, 0xf2919c2e
shl qword [rsp + rdi - 0xa5ff], cl
not ebx
adc byte [rsp + rdi*4 - 0x297f9], dil
neg r8d
ror qword [rsp + rdi*2 - 0x14bf9], cl
call fcn.14143cc68
sub rsi, 4
mov edi, 0x44117c3e
lea rdx, [rdi*4 + 0x78ad01ac]
mov r11d, dword [rsi + rdi - 0x44117c3e]
xadd rdx, rdi
xor r11d, ebp
movzx r8d, dil
mov eax, edi
lea rcx, [r8 + r8*2 + 0x55a33638]
inc r11d
rol r11d, 1
btr dx, ax
xchg ch, cl
inc r11d
shr r8b, 0xe6
sub r8d, r8d
add r8w, di
neg r11d
and ax, 0xa633
push rbp
sar rax, cl
lea rcx, [rdx*2 + 0x6995481b]
shr ecx, cl
xor dword [rsp + r8 - 0xf2a4], r11d
pop rbp
sal di, 0x26
cwd
not r8w
movsxd r11, r11d
adc r9, r11
lea rsi, [rsi + r8*2 - 0x1ab8]
ror ax, 0x81
movzx ebx, word [rsi + r8*4 - 0x356c]
cbw
xor bx, bp
idiv edi
btr r8w, 0x18
sbb bx, 0x4b14
and di, r8w
jbe 0x1414069f6
jne 0x14141e09d
sub rsi, 4
mov edi, 0x20852185
movzx r8d, dil
jmp 0x14141f882
rol bl, 1
mov edi, dword [rsp + 0xa]
xor bl, 0x87
mov r8d, edi
add bl, 0xac
not word [rsp + rdi - 0xa5a0]
shl r8d, 0xa4
xadd byte [rsp + rdi - 0xa5a2], dil
xor bpl, bl
movsx edx, word [rsp + rdi*8 - 0x527f7]
mov qword [rsp + rdi*2 - 0x14a00], r8
lea r10, [r10 + rdi*4 - 0x29404]
not dil
mov r11d, edi
jmp 0x141416077

Function at 0x14142e2ba
Capabilities:
Authenticate hmac

Disassembly:
push 0x42cea10
not byte [rsp + 3]
add r10, 0xc
jmp 0x14142759b

Function at 0x14142e7f4
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
jbe 0x14141f2c7
mov eax, 0x5dbc51a7
call fcn.14141f2b5
Function at 0x14142e809
Capabilities:
Encode data using base64

Disassembly:
push rcx
mov qword [rsp], 0xffffffffa09f98a8
call fcn.14142aa0f
jo 0x1409c1686
wait
cdq
mov al, 0xed
and eax, esp
sti
cmp esp, esi
push rsp
or esi, dword [rdi + 0x265348d4]
cwde
push rbx
cwde
add byte [rax], al
add dword [rcx + 8], edi
add byte [rcx + 0x74], bh
sub eax, 0x2e347100
add byte [rax], bl
add dword [rdi], ebp
add byte [rcx], dl
invalid
sar r8w, 0x2f
adc al, 0x31
jmp 0x1414256a0
jmp 0x141410477
push 0xffffffffd592270a
lea rsp, [rsp + 0x30]
jmp 0x1409c1667
bt rdx, rbx
lea rsi, [rsi + rcx*2 - 0x12c4]
bts dx, di
ror rdx, 0x23
mov edx, dword [rsi + rcx - 0x960]
mov r11d, ecx
xor edx, ebp
rol byte [rsp + rcx - 0x95c], 3
bswap edx
sar word [rsp + r8 - 0x5f440284], 0x27
not edx
rol dword [rsp + rcx - 0x960], 0x89
add ebx, dword [rsp + rcx - 0x95e]
adc qword [rsp + rcx*2 - 0x12c0], rdi
dec edx
or r11b, bl
imul edi, r11d
call fcn.141414184
jmp r9
neg edx
sbb r8w, 0x289
ror al, 1
sub al, 0x17
inc dx
push rdi
push rdi
not al
shl dx, 0x84
sub rdx, rdx
xor al, 0xa3
xor bpl, al
lea rbx, [rdi + rdx*4 + 0x7c9c8a0d]
pop rdi
sar rbx, cl
lea rax, [rsp + rax + 8]
not r8d
mov qword [rdx + rax], r11
jnp 0x141413a07
mov byte [rsp + r13 - 0x9ad3], bpl
mov r14, qword [rsp + r13 - 0x9aa4]
call fcn.141434ab7
mov eax, dword [rsi + riz]
call fcn.141413880
mov ecx, 0xecabd58b
rol rcx, 0x1f
movzx edi, cl
lea rsi, [rsi + rdi - 4]
call fcn.14141631d
xor dword [rsp + rbx - 0x28400000], edi
shl r8d, 0x6f
cqo
pop rbp
jp 0x141438899
add r9, rax
jmp 0x14140b99e
btr rdx, 0x10
mov qword [rsp + r8 - 0x65120f20], rdx
mov bx, word [r8 + r10 - 0x65120f1e]
push rcx
cdqe
or dword [rsp + rdx - 0x4ffffff8], r11d
lea r10, [r10 + r8 - 0x65120f1e]
not byte [rsp + rax + 0x18fb4b2e]
jl 0x141435b88
or r11w, word [rsp + rdx - 0x4ffffff2]
adc di, bx
and qword [rsp + rdx - 0x4ffffff8], r11
shr byte [rsp + rcx - 0x65120f19], 0x83
mov word [r8 + r10 - 0x65120f20], di
mov qword [rsp + r8 - 0x65120f20], r9
ret 8
sar dx, 0xc9
jae 0x141404861
sub rsi, 4
call fcn.14140c650
mov r11d, 0x6f164899
mov edx, r11d
mov r8, qword [rdx + r10 - 0x6f164899]
mov rdx, qword gs:[r8 + r11 - 0x6f164899]
movzx edi, r11w
push r11
mov qword [r10 + r11 - 0x6f164899], rdx
lea r11, [rdi + r11*8 + 0x152a7e23]
inc dword [rsp + rdi*2 - 0x9132]
or dword [rsp + rdi*2 - 0x912e], r11d
lea rsi, [rsi + rdi*2 - 0x9136]
imul r11, r11
xor r11, 0xffffffffa583f42a
and word [rsp + rdi*2 - 0x912f], r11w
mov edi, dword [rdi + rsi - 0x4899]
sub byte [rsp], r11b
or qword [rsp], 0xffffffffbc903dba
xor edi, ebp
movzx ecx, r11w
push r11
pop r11
dec edi
not edi
call fcn.141425cbb
sub edx, ebx
neg bl
movsxd rdi, edi
bts rax, 0xb8
adc r9, rdi
jmp 0x141424e8d
Function at 0x141430700
Capabilities:
Encode data using base64

Disassembly:
bts r8, rdx
jb 0x141422bb5
mov edi, 0x8208731f
mov ebx, edi
mov bx, word [r10 + riz]
movzx r8d, di
movsx eax, r8b
movsx r11d, ax
mov cl, byte [r10 + r8*4 - 0x1cc7a]
shl r11b, 2
lea r10, [r10 + r8*4 - 0x1cc7a]
sar rdi, 0xed
and ax, 0x4b31
shl bx, cl
mov ecx, 0x211e031
imul r8
dec r8b
mov word [r10 + rdi], bx
sub ecx, r8d
jg 0x1414188ff
adc r9, rdi
mov qword [rsp], 0xffffffffc7bab50d
sub rsi, 8
sub r11b, byte [rsp + 2]
mov rbx, qword [rsi + riz]
jae 0x14140864b
xor rbx, rbp
and dx, word [rsp + 5]
neg qword [rsp]
ror cx, cl
rol rbx, 4
call fcn.14141058d

Function at 0x141430dca
Capabilities:
Encode data using base64

Disassembly:
mov qword [r8 + r10 - 0x11ad0b7d], rdi
or bx, 0xb33b
mov edi, 0x759de71f
jl fcn.141426d8b
mov qword [rsp + r8*4 - 0x46b42df4], 0x758dba01
xor bp, di
inc bx
sal byte [rsp + r8 - 0x11ad0b7c], 0xe5
cmove cx, bx
lea r10, [r10 + r8 - 0x11ad0b85]
pop r11
rol rcx, 0xc5
jne 0x14140a86d

Function at 0x141430dfd
Capabilities:
Encode data using base64

Disassembly:
movzx edx, r11w
imul edx, r11d
movzx ebx, byte [r11 + rsi - 0x70bf6309]
xchg r11b, dil
mov eax, edi
xor bl, bpl
neg dil
ror eax, 0xce
xor bl, 0x82
sub bl, 0x83
jmp fcn.1414133a9
call fcn.141412b57
movsx edx, cl
inc ax
lea r10, [rcx + r10 - 0x25f9936a]
sal byte [rsp + rax*8 - 0x7fcc6], 0xc5
mov word [r10 + rax*2 - 0x1ff32], di
xchg byte [rsp + rcx*2 - 0x4bf326c9], bh
neg ecx
dec ax
lea rsi, [rsi + rax*8 - 0x7fcc4]
push rax
rol bx, 0x2e
cqo
mov r11d, dword [rsi + rax - 0xff98]
lea rbx, [rbx*8 - 0x3e737e3]
xor r11d, ebp
mul word [rsp + rax - 0xff95]
jb 0x14142d35d
call fcn.14141f281

Function at 0x14143202d
Capabilities:
Encode data using xor

Disassembly:
push r9
mov qword [rsp], 0xffffffffa09f98a8
call fcn.14142aa0f
lodsd eax, dword [rsi]
mov dl, byte [rbx - 0x14]
sahf
sbb eax, dword [rcx + 0x46]
outsd dx, dword [rsi]
movabs eax, dword [0x411b9eec538aad00]
outsd dx, dword [rsi]
adc bl, cl
int 0x38
insd dword [rdi], dx
sbb eax, dword [rcx + rax + 0x75]
shl dword gs:[rdx], 0xa6
loopne 0x140a14309
sub eax, 0xab62c9d2
sub edi, dword [rax + rax*8 - 0x373d5d07]
cmp dword [rdx + rbp + 7], eax
outsd dx, dword [rsi]
jg 0x140a14271
sar cl, 0xa2
ret 0x39c8
std
or ch, byte [rsi]
or eax, 0x10f9d30d
cmp bl, byte [0x1b7d00917]
call rbp
fstp qword [rbp + 0x6090b8d4]
ficom word [rbp + rax*2 - 0x7c]
jo 0x140a14302
jne 0x140a14293
scasd eax, dword [rdi]
int3
js 0x140a142ad
mov dl, 0x83
and eax, 0x622ea905
pop rdx
add bh, byte [rax]
lodsd eax, dword [rsi]
scasd eax, dword [rdi]
and dl, cl
invalid
test eax, 0x25a622e
cmp byte [rbp + 0x62d122af], ch
or bh, bh
invalid
dec ebx
mov qword [rsp], rbp
xor dword [rsp], ebx
mov ebp, 0x171cd092
pop rbp
movsxd rbx, ebx
add r9, rbx
jmp 0x14143b5a4
mov qword [rsp], 0x56b4e38c
sar word [rsp], 0x42
bswap ebx
dec word [rsp + 6]
jl 0x1414224d8
push 0x668c3886
push 0xffffffffbd8ce683
lea rsp, [rsp + 0x10]
jmp 0x140a14263
Function at 0x141432395
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
jne 0x14142a473
mov r11d, 0xdd2ece9a
lea rax, [r11*2 + 0x7f010eb5]
sub rsi, 4
mov r8d, 0xe7922c14
not r8
mov edx, dword [rsi + riz]
xor edx, ebp
rol edx, 1
add r11b, r8b
movzx edi, al
xor edx, 0xa2b171b6
mov ebx, eax
lea rcx, [rax + r11 + 0x74362f98]
call fcn.14142dae5
mov r9d, 0x9f929ba2
bswap r9d
mov r9, rax
jmp 0x14140f922

Function at 0x141433faf
Capabilities:
Authenticate hmac

Disassembly:
rol bl, 1
movzx ecx, r8w
lea rdi, [rcx*4 + 0x420d4ca2]
imul r8, qword [rsp + rcx*2 - 0x101e]
not bl
sal dil, 0xa6
cmovs edi, dword [rsp + rcx*4 - 0x2044]
mov r11d, dword [rsp + rcx - 0x809]
inc bl
xor bl, 0x15
mov qword [rsp + rcx - 0x813], rdi
xchg byte [rsp + rcx*4 - 0x2042], dil
dec bl
dec word [rsp + rcx*4 - 0x2042]
xor bpl, bl
lea rdi, [rdi*4 + 0x352f363d]
call fcn.141417ffb
or cl, 0xaf
movzx ebp, dx
xor dword [rsp + rax*4 - 0x1f00c], edi
pop rbp
rol rax, 0x60
movsxd rdi, edi
jae 0x141431509

Function at 0x141434026
Capabilities:
Authenticate hmac

Disassembly:
ror dil, 1
cbw
imul bx
jb 0x141400b69
mov r9d, dword [rdx + r9*4]
jb 0x14141b815
shr ebx, 8
shl word [rsp + 0x1d], 0x4f
jae 0x14142cf82

Function at 0x1414348a1
Capabilities:
Authenticate hmac

Disassembly:
neg r11b
xor bpl, r11b
mov qword [rsp + rcx*2 - 0x62d29000], rbx
add dword [rsp + rcx*2 - 0x62d28ffc], 0x7484a09c
adc rax, rax
lea r11, [rsp + r11 + 8]
mov edi, dword [rcx + r11 - 0x31694800]
not bx
sal rdx, 0x77
movzx r8d, byte [rsp + rcx - 0x31694800]
lea r10, [r10 + rcx - 0x31694804]
rol r8b, 0xa7
not word [rsp + r8 + 2]
mov dword [r10 + r8*2], edi
neg dl
xor r8, rcx
pop rbx
jne fcn.141426d8b

Function at 0x141435c42
Capabilities:
Authenticate hmac

Disassembly:
lea r10, [r10 + rdx - 0x7d8edb96]
mov qword [rsp + rdx - 0x7d8edb8e], rdx
lea r8, [rdx*8 + 0x62848c8b]
mov qword [r10 + rdx - 0x7d8edb8e], rbx
lea rsi, [rsi + rdx - 0x7d8edb92]
or dx, cx
mov r11d, dword [rdx + rsi - 0x7d8efb8f]
call fcn.141429b3f
Function at 0x1414381f9
Capabilities:
Authenticate hmac

Disassembly:
pop rax
pop rdx
jmp fcn.141426d8b
xor dword [rsp + rax - 0x9500], r11d
mov rbp, qword [rsp + rax*2 - 0x12a08]
mov r8d, eax
movzx edi, cx
movsxd r11, r11d
lea rdx, [rcx*2 + 0x448ea9b1]
add r9, r11
mov qword [rsp + rbx - 0x52bd0021], rcx
mov r10d, dword [rbx + r10 - 0x52bd0021]
jmp 0x14140567a

Function at 0x14143a9f6
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x1414396f7
lea rsp, [rsp + 0x10]
jmp 0x141411368

Function at 0x14143aa5d
Capabilities:
Encode data using base64

Disassembly:
pop r14
mov rdi, qword [rsp + r14 + 0x52ef5b69]
movsx r12d, r14w
push qword [rsp + 0x30]
popfq
mov r9, qword [rsp + r14 + 0x52ef5b79]
not r12
mov r10, qword [rsp + r14 + 0x52ef5b81]
mov qword [rsp + r14 + 0x52ef5b61], r12
call fcn.14143b050
mov rdx, qword [rsp + 8]
push 0xffffffffad10a4bf
mov qword [rsp + 8], 0xffffffffec9ebe08
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
shl qword [rsp + 8], 0x42
jne 0x141404b67

Function at 0x14143c0eb
Capabilities:
Authenticate hmac

Disassembly:
push 0xffffffffa3ba8f2b
push 0x70a05233
mov rcx, rax
mov qword [rsp + 7], 0x43ad89c
call fcn.141418126

Function at 0x14143d071
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
call fcn.14143cf18
mov edi, 0xdf8b6187
sub rsi, 4
mov edi, dword [rsi + riz]
mov edx, 0x9f02aa28
xor edi, ebp
movsx ecx, dx
push rcx
sal rcx, cl
xor edi, 0x1917b4ab
jmp 0x14143debc
Function at 0x14003bb90
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003bb9d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003bbad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003bb95
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003bbc5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003bbb2
sub eax, 3
jb 0x14003bbdf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003bc16
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003bc06
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003bc04
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003bbf3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003bb52
jmp 0x14003bb9d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003bc62
cmp rsi, rcx
jae 0x14003bc6a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003bc49
cmp al, 0x8f
ja 0x14003bc49
cmp byte [rsi - 2], 0xf
je 0x14003bc4f
sub al, 0xe8
cmp al, 1
ja 0x14003bc33
cmp rsi, rcx
jae 0x14003bc6a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003bc39
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003bc6a
lodsb al, byte [rsi]
jmp 0x14003bc49
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003bcd3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4cd58]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003bc77
jns 0x14003bcac
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003bcb6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003bccd
mov qword [rbx], rax
add rbx, 8
jmp 0x14003bc97
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003bd2b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x920
mov rax, qword [0x140026c00]
xor ebx, ebx
mov rdi, rcx
cmp rax, rbx
je 0x140001041
cmp word [0x140026c02], bx
je 0x140001035
call rax
mov qword [0x140026c00], rax
mov ecx, eax
call fcn.140002760
mov rcx, rax
jmp 0x1400010a8
mov ecx, 0x27
call fcn.140002760
mov r9, qword [rdi + 0x10]
mov r8d, dword [rdi]
lea rcx, [rsp + 0x120]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
cmp dword [rdi + 0x18], ebx
jbe 0x1400010a0
lea rsi, [rdi + 0x20]
mov r8, qword [rsi]
lea rdx, str._t0x_p_n
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
add ebx, 1
add rsi, 8
cmp ebx, dword [rdi + 0x18]
jb 0x14000106c
lea rcx, [rsp + 0x120]
call fcn.14000c668
call fcn.140005bc4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001714
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
test rdx, rdx
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
je 0x14000173a
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + VariantCopy]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140001749
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
lea rcx, [rdi + 0x18]
mov rdx, rsi
mov qword [rdi + 0x10], rbx
call fcn.140001384
lea rcx, [rdi + 0x18]
mov dx, 0x5c
call fcn.1400014f8
and dword [0x140026c20], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x14000130c]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [0x140026c10], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x140026c80], 2
mov qword [0x140026c18], rax
je 0x1400017b3
call fcn.14000bb20
mov rax, qword [0x140026c18]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, dword [0x140026c20]
and qword [0x140026d48], 0
test r8d, r8d
je 0x140001822
cmp r8d, 1
je 0x140001814
cmp r8d, 2
je 0x14000180d
cmp r8d, 3
je 0x140001806
cmp r8d, 0x67
jle 0x1400017f5
cmp r8d, 0x6a
jle 0x14000188d
mov edx, 0x14
xor ecx, ecx
call fcn.14000c7c4
jmp 0x14000188d
mov edx, 0x12
jmp 0x140001819
mov edx, 0x13
jmp 0x140001819
mov edx, reloc.COMCTL32.dll_InitCommonControls
xor ecx, ecx
call fcn.14000c7c4
jmp 0x14000188d
cmp dword [0x140026d44], 0
jne 0x14000188d
mov rcx, qword [0x140026c18]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [rsp + 0x40]
test eax, eax
je 0x14000184d
test ecx, ecx
jne 0x14000184d
xor eax, eax
jmp 0x140001892
mov edx, 0x80070000
mov eax, ecx
and eax, edx
cmp eax, edx
je 0x140001864
mov r8d, ecx
mov edx, 0x21
jmp 0x1400017fa
movzx ecx, cx
cmp ecx, 0xe
jne 0x140001875
cmp dword [0x140026c84], 0xffffffff
je 0x14000188d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, dword [rsp + 0x40]
mov edx, 0x22
lea ecx, [rdx - 0x21]
call fcn.14000c7c4
mov eax, 0x80004005
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400026f0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
movzx edx, word [0x140026c24]
test dx, dx
jne 0x140002755
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov word [0x140026c24], ax
and cx, 0x3ff
cmp cx, 9
je 0x140002720
movzx eax, ax
jmp 0x140002758
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
cmp ax, 0x409
jne 0x14000274e
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov ecx, dword [0x140021814]
mov dx, word [0x140026c24]
cmp eax, ecx
cmove dx, cx
mov word [0x140026c24], dx
jmp 0x140002755
mov dx, word [0x140026c24]
movzx eax, dx
add rsp, 0x28
ret