joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009ea68
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400915cc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400915cc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14009ebb8
cmp rax, 0xffffffffffffffff
je 0x14009ebb8
xor edi, edi
test rbp, rbp
jle 0x14009eb63
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400933cc
mov rbx, rax
test rax, rax
jne 0x14009eaf0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14009eb59
mov edx, 0x8000
mov ecx, r14d
call fcn.14008d54c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140094a48
cmp eax, 0xffffffff
je 0x14009eb39
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14009eb00
mov edx, r15d
mov ecx, r14d
call fcn.14008d54c
jmp 0x14009eb59
cmp byte [rsi + 0x38], dil
je 0x14009eb50
cmp dword [rsi + 0x34], 5
jne 0x14009eb50
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14009eb59
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400902d4
jmp 0x14009ebcc
jns 0x14009ebcc
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400915cc
cmp rax, 0xffffffffffffffff
jne 0x14009eb84
cmp byte [rsi + 0x30], dil
je 0x14009ebcc
mov edi, dword [rsi + 0x2c]
jmp 0x14009ebcc
mov ecx, r14d
call fcn.140098870
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009ebcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14009ebcc
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14009ebc5
mov eax, dword [rsi + 0x2c]
jmp 0x14009ebca
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400915cc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400a0530
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400a0558
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400a0558
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140f1510e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsi, [rsp + rsi + 0x10]
sbb edi, 0x1c884795
shr r11w, 0x25
mov qword [rsp + r11*4], r9
mov dword [rsi + r11*2], edx
sete byte [rsp + r11 + 5]
jbe 0x140f5c2f4
movsx esi, cx
xor r11d, 0xeab05e06
ror r9d, 0xa8
ror r11d, 1
xadd dword [rsp + rax*2 - 0x4f2b], eax
bswap r11d
rol word [rsp + rax - 0x10fc36db], 0x22
sar r9d, 0x6e
sar rax, 0x6e
mov qword [rsp + r9 + 8], r10
or byte [rsp + rax + 2], 0xab
movzx edx, r9w
jae 0x140f70ffb
mov edx, 0xe19653b1
shr edx, 0x37
mov r11, qword [r8 + rdx - 0x1cb]
movsx edi, dx
mov eax, edi
setnp al
xor r11, r10
rol r11, 1
neg r11
lea r11, [r11 + rdx + 0x768aa6c4]
neg r11
lea r9, [rdi + 0x2b053299]
and di, 0xba8f
xor r10, r11
rol r9b, 0x46
shl r9d, 0x1d
mov qword [rdx + rbp - 0x1cb], r11
js 0x140f293e1
movzx esi, word [rsp + rdi - 0x5fdcfb7e]
mov qword [rsp + rdx - 0x14716567], rbx
ret 0x18
xor r11d, dword [r8 + r11 - 5]
lea r8, [rdi + r8 - 0x6f61e006]
sub dword [rsp + rax - 0x2794], 0xef04c925
pop rdi
shl r9w, 0xee
xor r11d, r10d
add r11d, 0xcaa0e02b
movsx ecx, word [rsp + rax*2 - 0x4f2b]
push rdi
rol r11d, 1
sub r11d, 0xdca25307
jmp 0x140f3f462
xor dword [rsp + rax*4 + 8], r11d
lea rsi, [rax + rdx*2 + 0x29abadb4]
call fcn.140f4da4a
rdtsc
mov ecx, 0xa63a0324
rol rcx, cl
lea rsi, [rcx + rcx*8 + 0x65a8293f]
sbb rbp, 8
jmp 0x140f4578a

Function at 0x140f196e8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not cl
movsx r9d, si
sar al, 0x43
sal word [rsp + rsi*4 - 0x38513a4b], 7
rol cl, 1
sub rsi, rdi
adc cl, sil
call fcn.140f4bd3c

Function at 0x140f1e0c5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffb8a5ba8f
dec ebx
lea rsp, [rsp + 8]
jne 0x140f1805c

Function at 0x140f1f4a4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not word [rsp + 0xe]
lea rsp, [rsp + 0x10]
jmp 0x140f6c23a

Function at 0x140f1fb39
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jmp 0x140f14907
inc sil
add rbx, rax
lea r8, [rsi + r8 + 0x6fc1a7da]
movzx r11d, word [rdx + r8 - 0x63019f3e]
xor r11w, r10w
not r11w
neg rdx
not edi
movsx eax, si
dec r11w
mov qword [rsp + rdx + 0x63019f46], 0x23b8280f
neg r11w
call fcn.140f1a0ab
inc r9b
ror r11d, 1
rol ecx, 0x96
shl eax, 0x64
sal r9w, cl
dec r11d
xor r9, 0x581c2db8
push r10
or rdi, r9
push rax
sub si, cx
xor dword [rsp + rcx - 0x4f400023], r11d
ror ecx, 0xc8
and sil, 0x1c
setnp dil
mov r10, qword [rsp + r9 - 0x5c11ddb0]
movsxd r11, r11d
adc rbx, r11
mov qword [rsp + r9 - 0x5c11ddb0], rsi
pop rsi
pop rdx
jmp fcn.140f49209
inc eax
mov r9d, 0xcab8ef93
mov qword [rsp + rdx - 0x63019f3e], 0xffffffff903e6d39
mov edi, 0x528ba13d
bswap eax
not eax
dec eax
pop rsi
xor eax, 0xb8aada99
sal word [rsp + rdi - 0x528ba133], 0xe1
mov qword [rsp + rsi + 0x6fc192cf], r10
jbe 0x140f1ba0d
jns fcn.140f1ffe5
sub si, 0x1516
xor dword [rsp + rsi + 0x6fc1a7e5], eax
mov qword [rsp + rdx - 0x63019f3e], 0x45b100b9
mov r10, qword [rsp + rdx - 0x63019f36]
movsxd rax, eax
jmp 0x140f14776
Function at 0x140f214fd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ecx, r10d
push r9
lea rdi, [r9*4 + 0x41117c17]
add ecx, 0x1a34dabb
bswap ecx
mov qword [rsp + 8], rdi
xchg rdi, r9
lea r11, [rdi - 0x65f051d7]
sub ecx, 0x76874538
jmp 0x140f2e797
jmp 0x140f5c0f6
bswap ecx
mov esi, r11d
push rsi
inc r11w
lea ecx, [rcx + rdi - 0x73e38bdb]
pop r9
sar dil, 0xc5
pop r9
xor ecx, edi
mov qword [rsp + 8], r10
xor dword [rsp + 8], ecx
mov eax, r9d
or rdi, r9
ja 0x140f42619
mov r10, qword [rsp + 8]
xor r11b, byte [rsp + 2]
mov qword [rsp + 8], 0x5d2ce5ac
or edi, 0xd6902928
movsxd rcx, ecx
adc rbx, rcx
jmp 0x140f299e6

Function at 0x140f239e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11d, dword [r8 + rdx - 0x38]
xor r11d, r10d
lea r11d, [rdx + r11 + 0x1a34da88]
bswap r11d
mov qword [rsp + rdx*2 - 0x66], rdx
lea r11d, [r11 + rdx*4 - 0x76874604]
shl r9w, 0x46
jp 0x140f1fa0c
xor r11d, r10d
lea rcx, [rdx*4 + 0x1691f495]
push rdx
push rdx
lea r11d, [rdx + r11 + 0x1fa20aa1]
xor r11d, 0x768a4d18
jmp 0x140f2bd8e
pop rax
xor dl, byte [rsp]
sbb r11d, 0x6ea31812
not eax
ror r11d, 3
shl rax, 0xa8
sbb r11d, 0x85aab8aa
call fcn.140f19a0c

Function at 0x140f26dfd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.140f4d5d5
xor dword [rsp + rdi*2 + 0x20], esi
and edx, r11d
mov qword [rsp + rdx*2 - 0x1106cfd6], 0xfffffffffdb10395
mov r10, qword [rsp + rdx*4 - 0x220d9f8c]
xor rdi, r11
jg 0x140f62687
movzx r11d, dl
shr edi, cl
not esi
bswap esi
js 0x140f40f0a
add rdi, rdi
sar rdi, cl
dec esi
ror word [rsp + rdi*2 + 0x11], 0xc6
add byte [rsp + rdi*2 + 0xa], 0x16
mov qword [rsp + rdi + 0x10], r10
call fcn.140f2308b
sbb r11d, 0xb6a35cb0
xor dword [rsp + r11 - 0x2421d956], ecx
pop r10
jmp 0x140f6bc56
inc r11d
add rbx, rcx
jmp fcn.140f3f933
push rdi
lea rcx, [r9 + rax + 0x403f37b4]
lea rsi, [rsp + rsi + 0x18]
not edx
mov r9w, word [rsi + r9 + 0x17b24fbe]
lea rbp, [rbp + rdi*4 - 0x212]
mov word [rdi + rbp - 0x84], r9w
lea r11, [rax + rcx*2 + 0x56b9e40a]
xadd eax, edx
lea rsi, [rdx - 0x24c97372]
lea r8, [r8 + rdi*4 - 0x214]
dec dword [rsp + rdx*2 - 0x16080]
inc qword [rsp + rdx*4 - 0x2c0f8]
mov eax, dword [r8 + rdx*2 - 0x16084]
jb 0x140f4c2f4
xor eax, r10d
bswap eax
movsx r9d, sil
not eax
mov r9, qword [rsp + 8]
add r9, 0xc346
jmp r9
neg cx
sub r9w, 0x1b06
jmp fcn.140f15066
movsxd rsi, esi
adc rbx, rsi
call fcn.140f5068f
lea rsi, [rax + rcx*4 - 0x746b5247]
and cx, cx
xor r9w, r10w
jmp 0x140f5c3e8
not ax
rol eax, 0xaf
movsxd rcx, ecx
jb 0x140f2eeab
mov qword [rsp + rdi + 0x20], r10
jo 0x140f21b10
sal al, 0xc1
jbe 0x140f26c8a

Function at 0x140f28cf2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rax*2 - 4], r9
jns 0x140f35df1

Function at 0x140f29900
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx esi, word [r8]
ror r9, 0xd8
xor si, r10w
sub si, 0x1b06
xor si, 0xa7b1
lea rax, [rdx + rax + 0x689e8407]
xchg byte [rsp + 0xc], cl
add si, 0xfb1f
call fcn.140f147cb
Function at 0x140f2ad00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rdx + rbp - 0x7cbf1f1a], rsi
movzx esi, byte [rsp + rdi*2 + 4]
pop rax
jns fcn.140f49209
rol r9d, 1
movzx eax, r11w
and qword [rsp + rsi*8 - 0x95f8], r11
movsx ecx, ax
bswap r9d
neg rax
lea rdx, [rdi + r11 - 0x335bde6e]
rol r9d, 2
not qword [rsp + rsi - 0x12bf]
mov qword [rsp + rsi*4 - 0x4afc], r10
jmp 0x140f430e2
mov rsi, qword [r9 + rdx - 0x7cbf1f1b]
lea rbp, [rdx + rbp - 0x7cbf1f23]
dec dl
jns 0x140f20cdd
pop rsi
xor r9d, r10d
lea r11, [rdi + rdi*4 - 0x755f90db]
bswap r9d
mov qword [rsp], r11
ror r9d, 3
dec r9d
movsx esi, di
jmp 0x140f215cb
ror dx, 0xaf
sub r11b, cl
xor dword [rsp + rsi - 0x12bf], r9d
shr edx, 0x4c
pop r10
call fcn.140f3bf20
lea r8, [rdx + r8 - 0x7cbf7c6e]
lea r9, [rax + rax*4 + 0x2b2adb96]
mov qword [rsp + rax - 0x668877f8], rax
mov qword [rsp + rax - 0x668877fc], rdi
movzx r9d, byte [r8 + rax - 0x66887800]
sal byte [rsp + rdx - 0x7cbf7c62], 7
or dword [rsp + rdx - 0x7cbf7c6d], 0x103ded22
xor r9b, r10b
pop r11
ror word [rsp + rax - 0x66887800], 0xa2
jae 0x140f5febb
add sil, 0xa4
call fcn.140f24e8f
neg cx
shl cl, cl
pop r10
mov eax, 0xee146ea3
or rdx, 0xffffffffe8071928
xchg dl, r11b
movsxd rsi, esi
rol ax, 4
shr r9d, 0xbb
add rdx, rdi
add rbx, rsi
jmp rbx
xor r9b, 0x2f
not r9b
rol r9b, 1
inc r9b
sal rax, 0x51
xor r10b, r9b
jmp 0x140f666a1
not si
lea r9, [rsp + r9 + 8]
movzx ecx, al
sar dx, 0x42
ja 0x140f28378

Function at 0x140f3144a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsx r11d, r9b
lea r8, [r8 + rax*2 - 0x5f]
sal ecx, 0xec
xor esi, r10d
sar qword [rsp + rcx*2 - 0x77a59fe0], 0xd5
lea esi, [rsi + rcx*4 - 0x24aa5fd5]
mov qword [rsp + rcx*2 - 0x77a59ff8], 0xa1a639e
xor cl, al
neg ax
rol esi, 1
call fcn.140f56794

Function at 0x140f31481
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and ecx, dword [rsp + rdi*2 - 0xf6]
mov qword [rsp + rcx + 8], r10
rol edi, 0xcd
pop r11
xor dword [rsp + rcx*2], edx
jmp 0x140f682c1
adc cl, byte [rbp + rcx*8 + 8]
jmp 0x140f3d972
call fcn.140f2c525
mov r9d, dword [rsi + rbp - 0x3b8a6eee]
push rsi
not r11d
not r9d
or r11d, r9d
movzx r9d, cl
mov dword [rcx + rbp - 0x2d], r11d
sal word [rsp + rcx*4 - 0xbe], 0xcf
mov r11d, r9d
jae 0x140f549c2
bswap rsi
pop r10
movsxd rdx, edx
sar rcx, 0xc2
movsx eax, cl
shl rsi, 0x88
add rbx, rdx
mov rsi, qword [rbp + rcx]
xadd edi, eax
push rcx
jae 0x140f33600

Function at 0x140f31eca
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], r10
xor al, dh
jae 0x140f1f9f7

Function at 0x140f3d9a4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0xffffffff9a0bf42c
test ebx, ebx
jmp 0x140f18051
lea rsp, [rsp + 8]
add rsp, rcx
jmp 0x140f51b3d
jmp 0x140f1fca2

Function at 0x140f42d52
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rdx*2 - 6], 0xffffffff8e8b4fb5
rol dx, cl
ror dil, 1
bswap eax
call fcn.140f45bb8
Function at 0x140f46c22
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub r8, 4
mov ecx, 0x183c6f1b
xor esi, r10d
ror esi, 3
sar ecx, 0x4a
lea r9, [rcx*2 - 0x2b60fdcd]
neg esi
lea r11, [rcx + rcx + 0x28bdf031]
lea r9, [r9*8 - 0x26f86ada]
movzx edx, r9b
sub esi, 0xc933cebf
add edx, r11d
rol esi, 1
push r10
movzx r10d, cl
xor dword [rsp + rcx*2 - 0xc1e36], esi
pop r10
movsxd rsi, esi
movzx edi, r9w
rol r11w, 0x26
add rbx, rsi
mov rcx, qword [rbp + rcx*2 - 0xc1e36]
mov rdx, qword [rbp + r11*2 - 0x5195337e]
shl r11d, 0x92
adc rcx, rdx
movsx eax, r9w
mov edx, eax
movsx esi, dx
mov qword [r11 + rbp - 0x670bfff8], rcx
inc edi
lea rax, [rbp + rdi*8 - 0x4c370]
add r11d, edx
mov qword [rbp + r11 - 0x670b986e], rax
sub rsi, rdi
add r9w, di
jmp rbx
mov qword [rsp + rdx + 8], r9
not sil
not dil
setle cl
mov qword [rsp + rdx], r9
or sil, dil
sal cl, 0x85
lea rdi, [r9 + rax*4 + 0x19b1a583]
neg rcx
mov word [rbp + rdx*2 + 2], si
jle 0x140f507a7
mov esi, dword [r8 - 4]
jmp 0x140f3997c

Function at 0x140f4c26a
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11d, dword [r11 + r8 + 0x49203b08]
mov edx, 0x938b328d
xor r11d, r10d
dec rdx
jno 0x140f39b3d
mov edx, dword [rbp + rsi + 0x3dea53c2]
mov eax, r11d
setns al
mov eax, dword [rbp + rsi*2 + 0x7bd4a784]
sar esi, 0x54
adc edx, eax
sal r11w, 0x67
push rdi
add cl, byte [rsp + rdi*2 + 0x4a99994]
mov dword [rdi + rbp + 0x254ccd0], edx
jno 0x140f4a3a7
shr dx, 0xaf
inc r11d
add edx, edx
rol r11d, 3
call fcn.140f60aa8
mov r9d, dword [r8]
mov edx, 0x8017b00c
sal cl, 0xc1
xor r9d, r10d
call fcn.140f2ae33
shr di, 0xc3
adc rbx, r9
add edx, 0x470a3f03
call fcn.140f2290c
xor sil, r10b
jmp 0x140f674df
sal rdi, cl
not r9d
or rdi, 0xffffffffb5ab3338
mov qword [rsp + rsi*2 - 0x7f7d3ef4], r10
xor dword [rsp + rsi*2 - 0x7f7d3ef4], r9d
sar cx, 0xe5
movsx r10d, si
adc rdx, 0xffffffffdf005228
pop r10
xor rsi, rdi
jae 0x140f4fd3e
movsxd r9, r9d
mov r11d, 0x1c38982e
adc rbx, r9
neg dl
jp 0x140f2e5c0
mov r11d, 0x49203b08
neg r11
lea r8, [r11 + r8 + 0x49203b04]
jno 0x140f1b69e
lea rbp, [rdi + rbp + 7]
lea rsi, [r9 + rdi*4 - 0x4d56645f]
shrd r11, rdx, cl
add esi, eax
lea rcx, [r9*8 - 0x2c4bca5f]
movzx edx, ax
mov qword [rbp + rdi*2 - 6], r11
xor dil, 0xb9
rol sil, 0x47
lea r8, [r8 + rdi*4 - 0x2ec]
not dil
sal r9w, 0x2a
mov r9d, dword [rdi + r8 - 0x45]
xor r9d, r10d
xor cl, 9
sal edi, cl
neg r9d
lea r11, [rdi - 0x275130da]
xor r9d, 0x39369282
lea r9d, [r9 + rsi*2 - 0x20651578]
not r9d
xadd rax, rdi
jae 0x140f67c3b
mov byte [rsi + r11*2 + 0x3ee3b754], cl
mov qword [rsp + rdi], rbx
ret
sub sil, 0x29
xadd qword [rsp + 4], rax
rol sil, 1
mov edi, dword [rsp + 0xc]
inc sil
pop rax
xor r11d, 0x8eb679bb
jnp 0x140f65b09
xor r10b, sil
bswap eax
neg r11
lea rsi, [rsp + rsi + 8]
sub ax, 0xb124
jb 0x140f56f0b
add dl, byte [rsp + 1]
xor sil, 0x9a
jmp 0x140f64510
push rdi
mov qword [rsp + rax - 0x450003], r10
sar dx, 0x28
add rdi, r11
neg r11
xor dword [rsp + rdi*2 + 0x4e1861ae], r9d
dec sil
rol esi, cl
pop r10
not rax
and ax, di
rol esi, 0x43
movsxd r9, r9d
ror r11d, cl
ja 0x140f42b80
Function at 0x140f4c2a1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movabs r9, 0
push rbx
call fcn.140f4a59a

Function at 0x140f4dc27
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
or edx, esi
xor r11, rdi
not edx
movzx eax, di
mov dword [r11 + rbp - 0x49add401], edx
lea r8, [r11 + r8 - 0x49add405]
dec ax
mov edx, dword [r8 + rdi - 0x49add612]
lea rcx, [rdi*2 + 0x350d9c0c]
lea rsi, [rax*2 + 0x4480483b]
xor edx, r10d
ror edx, 1
ror edi, cl
rol rcx, cl
inc edx
inc dil
xor ax, 0xf229
call fcn.140f26d19
push rdi
ror eax, 1
sal r11, 0xd8
mov qword [rsp + rcx*8 - 0x606140], r10
ror r9d, cl
xadd edi, r11d
xor dword [rsp + rcx*2 - 0x181850], eax
ror ecx, 0xa4
pop r10
movsxd rax, eax
jb 0x140f538bd
movsxd rdx, edx
mov qword [rsp + rax - 0x739ede33], rsi
add cx, 0xc234
call fcn.140f44dc0
mov edi, 0x49add612
movzx r11d, dil
or r11w, 0x211
mov edx, dword [rbp + rdi - 0x49add612]
mov r9d, edi
movzx esi, r9b
mov esi, dword [rdi + rbp - 0x49add60e]
lea rbp, [rbp + r11 - 0x20f]
jne 0x140f1c00a
ror eax, 1
bswap r9d
inc eax
sub r11w, r11w
jno 0x140f41d41
add rbx, rax
jmp 0x140f653ec
xor r9, rbx
jmp r9

Function at 0x140f53f05
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rcx, ecx
not di
mov qword [rsp + r11 - 0x373cc13a], rdx
lea rsi, [r9 + r9*4 + 0x3717a584]
add rbx, rcx
mov rax, qword [rdi + rbp - 0x7130f9bd]
not rdx
mov cx, word [rbp + r11 - 0x373cc12a]
jmp 0x140f510c1

Function at 0x140f55b83
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jnp 0x140f1c514
pop rdx
pop r9
pop rcx
pop rdi
jbe fcn.140f49209
Function at 0x140f55b94
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov al, byte [rbp + 2]
mov edi, 0x3c81e70c
jp 0x140f476a9
mov qword [rsp + rsi - 0x5f0], r10
add r9d, edi
sub byte [rsp + rsi*4 - 0x17fe], cl
xor dword [rsp + rsi - 0x5f0], edx
mov r10, qword [rsp + rdi - 0x5f0]
sub rsi, qword [rsp + rdi - 0x5f8]
ror r9w, 0x65
movsxd rdx, edx
add byte [rsp + rdi - 0x5f5], dil
adc rbx, rdx
call fcn.140f2ab2f
call fcn.140f26fe3
rol r11d, 2
mov qword [rsp + 8], 0xfffffffff09d1f1a
movsx eax, word [rsp + 0xc]
bswap r11d
xchg byte [rsp + 0xe], al
lea r11d, [r11 + rax - 0x44438de4]
call fcn.140f4bb61
jmp 0x140f45da2
mov edx, 0x87048592
movzx si, byte [rbp + riz]
xor dx, dx
jle 0x140f13d38
adc sil, al
mov r9d, 0x12142f35
movsx ecx, di
push r9
mov word [rbp + r9*4 - 0x4850bcd2], si
mov r11d, dword [r8 + rdi*2 - 0x7903ce1c]
shr r9d, cl
lea r8, [r8 + r9*2 - 0x24288]
adc rcx, qword [rsp + rdi - 0x3c81e70c]
mov esi, r9d
xor r11d, r10d
lea r11d, [rdx + r11 + 0x4051bb9]
call fcn.140f26d2f
lea r9, [r11 - 0x17580470]
neg cl
mov qword [rsp + r11*2 - 0x62], r11
dec dword [rsp + r11*2 - 0x50]
xor r10b, cl
ror r11, 0x3b
movsx edi, r11b
lea rcx, [rsp + rcx + 0x18]
mov dx, word [rcx + r11*2 - 0xc40]
shl dil, 5
lea rbp, [r11 + rbp - 0x622]
mov ecx, r9d
xchg byte [rsp + r11*2 - 0xc31], r11b
mov word [rbp + r11*8 - 0x3000], dx
adc word [rsp + r11 - 0x5f5], 0x22a4
lea r8, [r8 + r11 - 0x604]
xchg esi, r11d
mov edx, dword [rsi + r8 - 0x600]
push rsi
xor edx, r10d
pop rdi
shl rax, 0xb7
dec edx
xor r11b, 0xb4
inc qword [rsp + rsi - 0x5f4]
sal r11w, 0x21
bswap edx
lea edx, [rsi + rdx + 0x60299980]
neg byte [rsp + rsi - 0x5f7]
xor edx, 0xad3fc7ba
jmp 0x140f1f571

Function at 0x140f59df7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec edi
cmovle rdx, rdi
rdtsc
sal r9w, 0x43
bswap rsi
lea rbp, [rcx + rbp - 0xff33]
and sil, dil
shr dil, 0x25
setne sil
mov dword [rbp + rcx - 0xff27], eax
push rsi
sbb edi, ecx
mov dword [rcx + rbp - 0xff2b], edx
ja 0x140f62313
and qword [rsp + rax*2 - 0x355d90f2], rsi
add rsi, rdx
sbb r9d, 0x67b5fe8d
call fcn.140f27ceb
ror edx, 1
mov qword [rsp + r11*2 - 0x18], rcx
rol si, 0x25
inc edx
inc dword [rsp + r11*2 - 0x18]
ror edx, 1
mov qword [rsp + r11*4 - 0x30], r10
and cx, si
jge 0x140f6998b
mov r11d, dword [rsp + 1]
xor esi, r10d
sal r11w, 9
call fcn.140f427ae
neg cx
add rbx, rax
jmp 0x140f44fdc
shr dword [rsp + rcx*4 - 0x3fcaa], 0xa9
and byte [rsp + rcx - 0xff2b], 0xb1
pop rdi
jnp fcn.140f49209
xor dword [rsp + r11*2 - 0x18], edx
pop r10
movsxd rdx, edx
add rbx, rdx
mov rcx, qword [r11 + rbp - 0xc]
mov si, word [rcx + r11 - 0xc]
push r11
lea rbp, [rbp + r11*8 - 0x5a]
mov word [rbp + r11*2 - 0x18], si
neg qword [rsp + r11 - 0xc]
mov qword [rsp + r11 - 0xc], rbx
ret
Function at 0x140f5a238
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sar sil, 0xe1
shl dword [rsp + rdx*4 + 2], 0x68
xor di, r10w
call fcn.140f4f643
movsxd rsi, esi
mov rdi, qword [rsp + 8]
add rdi, 0x4f28a
jmp rdi
mov qword [rsp + r9 - 0x468f918d], r9
sub ecx, 0xca85fc09
movzx r11d, r9w
ror ecx, 1
sub dword [rsp + r9 - 0x468f918a], 0x348b5930
bswap r11
jge 0x140f63f46
xor ecx, 0xc739c52b
lea rax, [r11 + r11 + 0x2a9c0a2a]
movzx edx, r9b
inc ecx
shr r9, 0x65
mov qword [rsp + r9], r10
setns dl
lea r10, [rdx + r11*2 + 0x6f109098]
xor dword [rsp + r9], ecx
mov edi, r9d
sub di, 0x28a9
pop r10
shr r9, 0x5e
movsxd rcx, ecx
movzx esi, di
or r11b, dl
call fcn.140f263d6
call fcn.140f49b07
not r9
not dil
jb 0x140f6dacc
and word [rsp + 5], 0x2c2a
lea rdi, [r9 + r9*8 - 0x6fcc5df4]
adc rbx, rcx
lea rsi, [r9 + 0x7537e38d]
sub r8, 2
movzx edx, r9w
movzx edi, word [rdx + r8]
jmp 0x140f15355
mov eax, esi
and r11b, dil
ror r9, 0x8b
sar r9b, 3

Function at 0x140f5d5ad
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0xeb465bf
mov r9, rax
push 0xffffffff87954003
lea rsp, [rsp + 8]
jmp 0x140f1f79b
jmp 0x140f56a10
mov r8, rax
call fcn.140f47f9d
push 0x732c7a8e
cmp ebx, 4
push 0x45153823
lea rsp, [rsp + 0x10]
jne 0x140f57c08
jmp 0x140f2bea4
cmp ebx, 3
mov qword [rsp], 0x702a5b3b
push 0xffffffff9f23e892
lea rsp, [rsp + 0x10]
jne 0x140f376fc
jmp 0x140f430da

Function at 0x140f63679
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not dl
push rsi
shl r9, 0x68
rol dl, 1
mov qword [rsp + rsi - 0x7aa65003], 0xfffffffff7bb4c12
dec dl
call fcn.140f6784f

Function at 0x140f654ef
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx - 0x1e7a4055], r10
sar r11, 8
jnp 0x140f3459b

Function at 0x140f65567
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
or al, r11b
mov r11d, dword [rax + rbp - 0x6f]
xchg r9, rdi
call fcn.140f67e0a

Function at 0x140f657fb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rsi*4 - 0x674], 0x67092084
xchg byte [rsp + rsi - 0x19b], al
mov eax, dword [rsi + r8 - 0x1a2]
dec ecx
call fcn.140f2aa4b

Function at 0x140f6907d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor r11d, r10d
call fcn.140f276ae
mov esi, 0x769f718b
mov r9d, 0xd5981638
call fcn.140f66ebf
xor dword [rsp + r11*2 + 0x2f761f2], ecx
mov r10, qword [rsp + r11*2 + 0x2f761f2]
sal r9, 0x62
pop rdi
call fcn.140f61556
mov r11d, dword [rcx + r8 - 0x73b2c770]
jne 0x140f28a8e

Function at 0x140f6908b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xadd qword [rsp + rax + 0x28], rcx
lea r10, [rax + rbp - 0x220]
and r10b, 0xf0
mov rsp, r10

Function at 0x140f69ce0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0xffffffffbe01983a
lea rsp, [rsp + 0x18]
call rax
mov ebx, 0xae93031d
movsx esi, bx
movzx edi, sil
mov rsp, qword [rbp + rsi*8 - 0x18f8]
jmp 0x140f667bd
Function at 0x140f6d2c5
Capabilities:
Encode data using base64

Disassembly:
neg ecx
pop r11
not sil
inc ecx
sar edi, 0xd1
push r10
xor dword [rsp + rdi - 0x1ca1], ecx
call fcn.140f30464
mov qword [rsp], rdi
shl si, 0xc2
bswap ecx
neg rdi
lea rdx, [r11 + 0x781fa116]
sub r11, rdx
xor ecx, 0xa3a18110
xadd esi, edx
jns 0x140f20bb4
call fcn.140f22954

Function at 0x140f6e954
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea r8, [r8 + r11*8 - 0xba62804]
lea rdx, [r11 + r11 - 0x174bed48]
je 0x140f38a8e
mov rsi, rbp
mov edx, 0xc330f62a
movzx r11d, dx
lea rbp, [rbp + r11 - 0xf62c]
lea rax, [r11*4 + 0x36be508c]
xchg r11b, dl
lea r9, [rdx + r11 - 0x20fe9ccd]
mov word [rbp + r11*4 - 0x3d8a8], si
shr rax, 0xc7
lea r8, [rax + r8 - 0x6d8456]
mov eax, dword [r8 + r11 - 0xf62a]
jns 0x140f3d8bc
lea r8, [r11 + r8 - 8]
neg r11b
xor dil, r10b
sub eax, dword [rsp + r11*2 - 0x1e7]
adc dil, 0xa4
call fcn.140f42d52
rdtsc
movsx ecx, dil
lea rbp, [rbp + r11*4 - 0x2e98a74]
sal r11, cl
setb r11b
mov dword [rbp + r11*4 - 0x5d313fc], eax
sar ecx, 0xda
mov dword [rbp + r11*4 - 0x5d31400], edx
movsx esi, dil
jae 0x140f28697
sal word [rsp + r11*2 + 0x1c], 0xa2
movzx edi, byte [r8 + r11*2 - 0xb]
jne 0x140f2a774
mov r11d, 0xba629b
lea rdi, [r11*8 - 0x25cf74d7]
jmp 0x140f53074

Function at 0x140f7045d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor di, r11w
xor dword [rsp + r11 - 0x373cc13a], ecx
pop r10
call fcn.140f53f05
add dil, r11b
sub dword [rsp + rax*4 - 0xec014c], edx
ror dil, 1
not ax
call fcn.140f43e17
xor ecx, 0x34052022
mov qword [rsp + r11 - 0x373cc13a], r9
sub qword [rsp + rdi - 0x7130c700], r9
dec r9w
ror ecx, 3
inc rax
add qword [rsp + rdi - 0x7130c700], r10
jmp 0x140f28210