joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c3980
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c3a2c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1400c39ba
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400c3c40
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400c39fa
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1400dd144
mov rcx, rbx
test rbx, rbx
jne 0x1400c39e0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140041640
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400c3d44
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400dd144
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400c3d50
cmp rbx, rbp
jne 0x1400c3cf0
cmp qword [rsp + 0x20], r14
jne 0x1400c3d1d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400c3d5f
mov qword [r15], r12
mov rax, r12
jmp 0x1400c3d62
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400c3d1d
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400dd144
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1400c3de8
cmp rbx, rbp
jne 0x1400c3dc2
jmp 0x1400c3d1a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400c3d70
jmp 0x1400c3d1d
Function at 0x1400c3a90
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x1400c3ac5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140041500
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1400c3c04
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1400c3b7d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400c3bf3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400c3bba
mov r10, qword [rdx]
cmp r10, rax
je 0x1400c3bb4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400c3bf3
cmp r9, rdx
je 0x1400c3bcf
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400c3c15
cmp r9, rdx
jne 0x1400c3bc0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1400c3b30
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400c3bf3
Function at 0x1400c3c40
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400c3a2c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1400c39ba
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400c3c40
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400c39fa
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1400dd144
mov rcx, rbx
test rbx, rbx
jne 0x1400c39e0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140041640
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400c3d44
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400dd144
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400c3d50
cmp rbx, rbp
jne 0x1400c3cf0
cmp qword [rsp + 0x20], r14
jne 0x1400c3d1d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400c3d5f
mov qword [r15], r12
mov rax, r12
jmp 0x1400c3d62
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400c3d1d
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400dd144
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1400c3de8
cmp rbx, rbp
jne 0x1400c3dc2
jmp 0x1400c3d1a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400c3d70
jmp 0x1400c3d1d
Function at 0x1400cbc60
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400cbd25
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400cbd25
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400cbd3e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x1400cbd15
cmp byte [rcx], 0x5c
jne 0x1400cbd0e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x1400cbd0e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1400cbcfc
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x1400cbd0b
test r8b, 0x10
jne 0x1400cbd0e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x1400cbd0e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400c8090
test edi, edi
jne 0x1400cbc80
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400c8080
int3
Function at 0x1400dbaa0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400dbad5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140041500
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400dbc16
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400dbb90
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400dbc05
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400dbbcd
mov r10, qword [rdx]
cmp r10, rax
je 0x1400dbbc7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400dbc05
cmp r9, rdx
je 0x1400dbbe1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400dbc27
cmp r9, rdx
jne 0x1400dbbd2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400dbb40
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400dbc05
Function at 0x1400ddc9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ddce6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ddce6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ddce6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ddce6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ddce6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ddce8
xor al, al
add rsp, 0x28
ret
Function at 0x140001220
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x390], rax
xor r9d, r9d
lea r8, [rsp + 0x280]
mov edx, 0x104
lea rcx, str.test.dll
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400012c7
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400012be
nop dword [rax]
lea rdx, str.SparkingZERO_Win64_Shipping.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400012ba
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001290
jmp 0x1400012be
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000133e
lea r9, str.SparkingZERO_Win64_Shipping.exe
mov qword [rsp + 0x30], 0
mov r8d, 0x104
mov qword [rsp + 0x20], 0xffffffffffffffff
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
test eax, eax
jne 0x14000131b
lea rdx, str.Could_not_find_process:
call fcn.140001390
mov rcx, rax
lea rdx, [rsp + 0x40]
jmp 0x140001322
lea rdx, str.Could_not_find_process:__conversion_error_
call fcn.140001390
lea rdx, [0x140001560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001363
lea rdx, [rsp + 0x280]
mov ecx, edi
call fcn.140001000
test al, al
jne 0x140001361
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.DLL_injection_failed.
jmp 0x140001322
xor eax, eax
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140001620
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x3a0
pop rdi
ret

Function at 0x140001ee8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f32
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f34
xor al, al
add rsp, 0x28
ret
Function at 0x140b693b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx r10d, dl
movzx ecx, r10w
mov ecx, dword [r9 + r10*4 - 0xf0]
mov qword [rsp + r10 - 0x3d], rbx
sub edx, r11d
push rdx
cpuid
or qword [rsp + r10 - 0x3d], r10
lea r9, [r9 + r10*2 - 0x82]
or r11w, word [rsp + r10*2 - 0x74]
lea r10, [r11 + 0x76a28fad]
mov dword [r9 + riz + 0xc], eax
jg 0x140bac95a
mov dword [r9 + riz + 8], ebx
ror word [rsp + 1], 0xa3
movsx ebp, word [rsp + 4]
mov dword [r9 + rbp*2 + 4], ecx
mov dword [rbp + r9], edx
call fcn.140b6ce7d

Function at 0x140b6de70
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r8, qword [r9]
mov rbp, qword [r9 + 8]
mov qword [rsp], 0xffffffffd1379c92
mov edx, 0xed2098bc
mov cl, byte [r9 + riz + 0x10]
movsx r11d, dl
jmp 0x140bcba00

Function at 0x140b6f64a
Capabilities:
Encode data using base64

Disassembly:
not dl
lea r8d, [r8 + rdx*2 - 0x39ae42aa]
not word [rsp + rdx - 0xf1]
not rbp
inc rbp
rol r8d, 1
btc rdx, 0x38
sbb edx, ebp
dec r8d
add bpl, bpl
mov qword [rsp], rbp
bswap r8d
inc bpl
call fcn.140b4cfec

Function at 0x140b850a1
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
adc r9, 0xfffffffffffffff7
movzx edx, bpl
mov eax, r8d
mov edx, dword [rsi + rdx - 0xed]
add rsi, 0xfffffffffffffffc
and rbp, r8
mov qword [rsp], 0xffffffffce959ebe
xor edx, edi
ror r8, 0x18
movzx ecx, word [rsp + 3]
sbb edx, 0xe19b26b2
lea r11, [r8*4 + 0x7116d3b8]
shl eax, cl
cmovns rbp, rax
bswap edx
xor edx, 0x2832d434
lea r10, [r8 + rcx*8 - 0x645f45f5]
sal r8b, 0xc3
lea edx, [rdx + rbp - 0x6b61d3f4]
shl qword [rsp + rcx*4 - 0x3ff38], cl
mov qword [rsp + rcx*8 - 0x7fe70], rdi
adc rax, 0x43120cac
mov edi, eax
cmovo rdi, r11
xor dword [rsp + rcx - 0xffce], edx
and edi, 0x803a8225
neg r10w
pop rdi
shl r10b, 0xc1
jp 0x140bbe53d
movsxd rdx, edx
add rbx, rdx
shl rcx, cl
or r8b, cl
mov edx, r10d
jge fcn.140badb97
mov edx, 0x1ea5da18
mov edx, dword [rdx + rsi - 0x1ea5da18]
xor edx, ebp
not edx
add edx, 0xac93e630
mov eax, 0x4b1a070b
movsx r10d, al
mov r8d, 0xa52de13c
bswap edx
movsx ebx, r10w
shr r10, 0xa3
lea r10, [r8 + rax*4 - 0x346f87a]
ror edx, 3
push rbp
xor dword [rsp + rax - 0x4b1a070b], edx
pop rbp
inc r8b
movsxd rdx, edx
add r9, rdx
shl r8, 0x8e
movsx r11d, ax
mov bl, byte [rdi + rax - 0x4b1a070b]
jp 0x140bdcbfe
mov al, byte [r11 + rdi - 0x709]
push r10
not bl
xadd dword [rsp + r11 - 0x70a], r11d
sal qword [rsp + r11 - 0x1ce4f04], 0x68
not al
or bl, al
jmp 0x140bc1986

Function at 0x140b85136
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub rbp, r10
lea rsp, [rsp + 0x18]
lea r9, [0x140b8513e]
mov r8d, 0x48be237
call fcn.140bcdf8d

Function at 0x140b8713c
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec r10
not word [rsp + 0x21]
lea rsp, [rsp + 0x28]
jne 0x140ba4cd0
mov ebp, 0x5cb900bc
mov r11d, ebp
pop r9
lea r10, [rbp - 0x4ed236d5]
pop rbx
Function at 0x140b88989
Capabilities:
Encode data using base64

Disassembly:
add rax, 0x11b20b9
bswap rax
mov qword [rsp + r11 - 0xe85e0c0], rdi
dec edx
xor dword [rsp + r11*4 - 0x3a178318], ebp
mov qword [rsp + r11*2 - 0x1d0bc190], r8
lea rdi, [rdx + rcx*8 + 0xe951313]
mov rdi, qword [rsp + r11 - 0xe85e0c0]
neg cx
and ecx, 0xe89a0403
sar r10d, 0x93
movsxd rbp, ebp
adc rbx, rbp
sal word [rsp + r11 - 0xe85e0c3], 3
or eax, dword [r9 + r11 - 0xe85e0c2]
lea r9, [r9 + r11 - 0xe85e0be]
movzx r11d, byte [r11 + rsi - 0xe85e0cd]
ror ecx, 0x8a
not r10b
lea rsi, [r8 + rsi - 0x49]
xor r11b, dil
push r10
movzx ebp, word [rsp + rcx - 0x21f4]
add r11b, r10b
shl r10w, 0x6b
rol r11b, 1
mov qword [rsp + rcx*2 - 0x43f0], 0x45977920
shr dl, 0xa1
and r8d, 0xad185d3d
dec r11b
ror r11b, 1
xchg r8b, bpl
not r11b
dec rbp
not qword [rsp + rcx - 0x21f6]
xor dil, r11b
lea r11, [rsp + r11 + 0x18]
rol r10b, 0xc1
xchg word [rsp + rcx*4 - 0x87f5], r8w
sal word [rsp + rcx*2 - 0x43ec], 0x4b
mov dword [r11 + rcx - 0x2200], eax
je 0x140baa388
mov r11d, 0xc13e0403
mov r10d, dword [r9 + riz]
lea rbp, [r11 + 0x48407a5]
movzx ecx, byte [rsi + riz - 1]
xor cl, dil
lea rax, [r11*2 + 0x7a941fa2]
lea rdx, [r11*4 + 0x4057b82]
xchg bp, ax
not cl
or rdx, r11
sbb rbp, 0x6313761f
xor cl, 0x1f
lea rbp, [rax + rbp*4 + 0x2f23ae37]
btr ebp, 0x96
neg cl
call fcn.140b989b3

Function at 0x140b8ad36
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r11w, word [r9 + rdx - 0x5eb33d69]
xor byte [rsp + rdx - 0x5eb33d5d], bpl
adc r8d, eax
lea r9, [rdx + r9 - 0x5eb33d67]
mov qword [rsp + rdx - 0x5eb33d6b], 0x7f327db6
movzx r10d, word [rsi + rdx - 0x5eb33d71]
sal byte [rsp + rdx - 0x5eb33d67], 0xc1
setl al
lea rsi, [rsi + rdx - 0x5eb33d71]
xor r10w, di
xor word [rsp + rdx - 0x5eb33d5f], ax
add rbp, qword [rsp + rdx - 0x5eb33d63]
dec r10w
shr r8w, 7
rol r10w, 1
inc word [rsp + rdx - 0x5eb33d5f]
neg r10w
call fcn.140b9338b

Function at 0x140b8ae1e
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mul dl
pop rax
jno fcn.140bdc582

Function at 0x140b93ac8
Capabilities:
Encode data using base64

Disassembly:
dec r11
push 0x1db3b530
push 0xffffffffb9acfc9d
lea rsp, [rsp + 0x38]
jne 0x140b6ad54
jmp 0x140bd6852
mov esi, 0xcfb28d25
pop rsi

Function at 0x140b95a23
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffd6360400
jns 0x140b7ab8e

Function at 0x140b9f094
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol r8w, 0x6d
pop rbx
pop rdx
pop rax
pop r11
pop rbx
jne fcn.140bdc582
sar r8w, 4
lea rdi, [rdi + rbx*2 - 0x1b22a]
mov qword [rsp + rbx*8 - 0x6c890], 0x588041d
jne 0x140b655e0

Function at 0x140ba75e6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg word [rsp + 0x17]
jbe 0x140bed53d
xor r10d, 0x6a00009f
dec rdx
lea rsp, [rsp + 0x28]
jne 0x140b5e96c
mov r8d, 0x1b9caa90
pop r9
shr r10d, 8
xor r10d, r8d
jmp 0x140b4dd08
jae 0x140b9a758
inc r11
ror qword [rsp + 0x17], 0xff
inc qword [rsp + 0x1f]
jae 0x140b6e4a9
Function at 0x140babafd
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor cx, 0x209d
jmp 0x140bbd87d
mov qword [rsp + rax*2 - 0x9cfec00], rbp
or rax, 0xffffffff86814882
sbb r8b, dl
bt rax, rdx
xor dword [rsp + rax + 0x7918017e], ebx
movzx ebp, ax
and dx, bp
neg r8w
pop rbp
shr r11d, cl
lea rax, [r8 + rax - 0x116557ff]
ror dl, 0x26
movsxd rbx, ebx
btc r11w, cx
adc r9, rbx
movzx ebx, dl
ror r11d, 0xc5
jae 0x140c0b247
lea r10, [rdx - 0x724fb7f0]
rol cx, 1
xor r10, rdx
xor cx, 0x542a
or dl, r10b
dec cx
call fcn.140be7b88
mov dx, word [rdi]
jmp 0x140bec6c2
shr rcx, 0xef
or cx, word [rsi + rcx*2]
lea rsi, [rbx + rsi + 2]
not rbx
xor ebx, 0x961710a5
xor cx, bp
dec dl
rol r11, 7
btr r10d, edx
adc cx, r11w
shl rbx, 0x9c
jp 0x140b58c99
mov rax, qword [rdi + rax*2 - 0x2ed34b18]
inc r8w
lea rdi, [r11 + rdi - 0x60000e16]
ror r11d, cl
ja 0x140bc83e6