joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14082cf8a
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
sbb dl, dil
push r11
sal r11b, 0xc7
dec qword [rsp + r9*2 - 0x3f9eb43e]
ror dl, 1
sub dl, dil
neg dl
inc byte [rsp + r9*2 - 0x3f9eb443]
xor sil, dl
push r11
lea rdx, [rsp + rdx + 0x18]
and dword [rsp + r9*4 - 0x7f3d688b], ecx
xor r11w, 0x1600
bts di, 1
mov r8d, dword [rdx + r9*2 - 0x3f9eb446]
lea rbx, [r9 + rbx - 0x1fcf5a27]
add rcx, rcx
mov dword [rbx + r9*4 - 0x7f3d688c], r8d
pop rdx
pop r9
pop r8
jno fcn.140847ec1
call fcn.14082cfbd
movzx edx, byte [r10 + riz]
push r11
add r10, 1
lea r9, [rax + rdi*2 + 0xd83cb35]
cbw
xor dl, sil
sub al, ch
sal qword [rsp], cl
dec qword [rsp]
neg dl
jmp 0x140855395
sub r9d, 0x1502a110
jne 0x14080a5d1
pop rsi
btr r10, r11
pop rbp
setb dl
sar rdx, 0xa0
pop r10
call fcn.140832f72
rol r9d, 1
dec di
lea r9d, [r9 + rdi - 0x39bdbe46]
not r9d
lea r8, [rdi*8 + 0x518fa32]
push rdx
mov qword [rsp], rsi
sal dx, 0xb
xor dword [rsp], r9d
pop rsi
movzx eax, dil
sar al, 0xa6
movsxd r9, r9d
sub dl, 0x89
sbb rdi, r8
add rbp, r9
bts ax, 0x9b
rol dil, 0x61
movsx ecx, di
mov ax, word [rbx + rax*2 - 0x1002]
bts edx, 0xb9
inc di
lea rbx, [rbx + rdx*4 - 0x490041da]
movzx ecx, word [r10 + rdx*4 - 0x490041dc]
adc dl, dil
lea r10, [r10 + rdx - 0x124010fb]
sub dx, dx
sub rdx, r8
ror dx, 0x64
xor cx, si
bts dx, r11w
shr dl, 0x44
dec cx
not cx
xor edi, 0xd9732bc
sbb cx, 0x5d88
and r11w, r8w
btc dx, dx
xor cx, 0x871c
ror di, 0xae
movsx r9d, r8b
bts r8, 0x25
xor si, cx
and di, di
sub dx, dx
dec r8w
adc rcx, rsp
btr r11w, r11w
mov word [rcx + rdi - 0x3e245ce7], ax
lea rax, [r9*8 + 0x17b12007]
shl edx, 0xfd
xor rdx, rbp
jmp rdx

Function at 0x14082e4eb
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
neg qword [rsp + rdi*4 + 8]
mov qword [rsp + rdi*4], rdi
xor sil, r9b
add rcx, 0xffffffffa385753f
lea r9, [rsp + r9 + 0x10]
add edi, 0x51129d9e
not dl
movzx r11w, byte [r9 + r8*8 - 0x168]
je 0x14085845a
mov word [rbx + r8*2 - 0x5c], r11w
bt r8d, ecx
movzx r11d, cx
mov edi, dword [rdi + r10 - 0x51129d9d]
imul cx, cx
cwd
ror eax, cl
xor edi, esi
cdq
or r11d, 0x241aef9c
rol edi, 2
shr qword [rsp + rax*2 - 0x2dffff88], cl
mul cx
and qword [rsp + rax - 0x16ff0b00], 0xffffffffca864fba
xor edi, 0x62b70012
movsx r9d, r8w
call fcn.1408429c8
movzx edi, r9b
movzx eax, cx
and dil, r11b
xor edx, esi
dec rcx
neg edx
push r11
add r11w, cx
pop rdi
sbb edx, 0x84219e08
rol edx, 2
sal r11, cl
call fcn.1407fc89e

Function at 0x14082e56c
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
xor ax, si
inc r11d
shl edi, 0x9b
neg dword [rsp + r8 - 0x179ba1d1]
sbb ax, di
sub r11, rdi
not ax
pop rdi
xor ax, 0x510d
dec cx
mov edi, dword [rsp + r9 - 0x179ba1d8]
rol ax, 1
ror byte [rsp + r9 - 0x179ba1d0], cl
neg ax
xor ax, 0x8c8a
inc dil
xadd r11b, cl
shl cx, cl
xor si, ax
ror byte [rsp + r8 - 0x179ba1d5], 0xc7
dec r9d
lea rax, [rsp + rax + 0x10]
call fcn.140831b8a
Function at 0x140839066
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r8*2 - 0x5353e74e], rdx
sar dword [rsp + r8 - 0x29a9f3a5], cl
mov edx, dword [r10 + r8*2 - 0x5353e746]
xor edx, esi
not edx
shl qword [rsp + r8*2 - 0x5353e74e], cl
sbb edx, 0xb6828fbc
push r8
btc r11d, 0x35
ror edx, cl
lea r9, [r8 + 0x7c3cc315]
jmp 0x14084e5c8
Function at 0x14083a3c0
Capabilities:
Encode data using base64

Disassembly:
not r8b
mov qword [rsp + r11 - 0x10a93425], r11
setb al
ror r8b, 1
pop r11
xor r11d, r11d
setg al
xor sil, r8b
movsx edi, dl
add r8, rsp
cdq
dec dx
add r11w, di
mov byte [r8 + r11 - 0x66], r9b
mov rdx, qword [rbx + rdx*2 - 0x1fffc]
jg 0x14084c009
mov edi, dword [r10 + rax - 0x67f40bff]
lea r10, [rax + r10 - 0x67f40bfb]
xor edi, esi
xor rcx, rax
not edi
rol edi, 2
xor cx, 0xf5b1
movsx edx, cx
sbb edi, 0x95000fbb
cwde
not edi
push rsi
movzx r8d, al
xor dword [rsp + rax*2 - 0x1800], edi
pop rsi
lea r9, [rcx + r11*4 - 0x1b5ee1f6]
shr edx, 0x46
movsxd rdi, edi
adc rbp, rdi
add r8w, r8w
movzx di, byte [rbx + rax*2 - 0x1802]
bswap r9d
sets dl
mul ax
mov cl, byte [rbx + rax]
sal r9d, 0xf5
and r9w, 0xfa16
add r8, rax
not dil
jae 0x140812f14
mov r8d, dword [r10]
mov r11d, 0x228e1694
lea r10, [r10 + r11 - 0x228e1690]
xor r8d, esi
movzx eax, r11b
mov r9d, eax
dec r8d
lea rax, [r9*4 + 0x2017b237]
mov edi, 0x603d9b2a
mov ecx, edi
not r8d
jmp 0x14086d6ef
mov r9d, eax
bts r9d, r11d
mov r8, qword [rbx + r11*2 - 0xc2]
add rdi, 0xfffffffff4978035
or r11, 0x19b87930
adc rdx, r8
shl al, 0x65
mov ecx, r11d
neg edi
mov qword [r11 + rbx - 0x19b8796c], rdx
shl ecx, 0x82
sar r9, cl
cqo
lea rbx, [rbx + r11*2 - 0x3370f2e2]
mov ecx, dword [r10 + r11*4 - 0x66e1e5d7]
jae 0x14086731d
cmovnp eax, edi
lea r10, [r11 + r10 - 0x19b87971]
setae dil
movsx r8d, dx
idiv edi
xor ecx, esi
bswap ecx
lea ecx, [r11 + rcx - 0x21b8a28f]
neg r9b
ror ecx, 2
shl edx, 0x94
bswap ecx
adc dx, r8w
push rsi
mov esi, r9d
push rdx
xor dword [rsp + r11*2 - 0x3370f2e4], ecx
sub r9d, 0x37abe4b2
mov rsi, qword [rsp + r11 - 0x19b8796e]
movsxd rcx, ecx
xor edx, r8d
adc rbp, rcx
xchg dword [rsp + r11*2 - 0x3370f2e9], eax
sub al, 0xa6
div r9d
mov qword [rsp + r11 - 0x19b87976], rbp
ret 8
xadd r11w, r9w
lea rdx, [rcx*2 - 0x156ba064]
dec r8d
add ax, ax
neg r8d
cwd
inc ax
dec r8d
or r11b, r11b
not r8d
btc edi, 0x96
jb 0x1408702c8
xor edi, r9d
neg r8d
shl r11, cl
rol rdi, cl
bswap r8d
bswap rax
setne al
ror r8d, 3
shr cl, 0xc1
push rsi
inc dil
movzx esi, r11w
xor dword [rsp + r9*2 - 0x2d28], r8d
dec esi
pop rsi
ror al, 6
movsxd r8, r8d
adc rbp, r8
xor r9w, r9w
adc dx, word [r9 + rbx]
movsx r8d, di
neg rcx
lea rbx, [rbx + r9*4 + 2]
adc r11b, dil
movzx r11d, byte [r10 + r9]
rol al, 1
lea r10, [r8 + r10 - 0x181]
and cl, ah
xadd rax, rdi
xor r11b, sil
cwde
not r11b
xor al, r8b
div dil
call fcn.14081fbe9
lea r10, [r10 + r9 - 0xb219]
xor edx, esi
neg ecx
shr word [rsp + r9*2 - 0x1643a], 0x26
ror edx, 3
jmp 0x14087733e
add byte [rsp + r9*4 - 0x2c86e], cl
lea edx, [rdx + r9*8 + 0x3b35631]
mov r8d, edi
lea r8, [r11 + r9*4 + 0x2cae4eb7]
rol edx, 1
shr byte [rsp + r9 - 0xb217], 3
inc edx
btc rdi, 0x95
ror edx, 3
bts r8w, r11w
shl cl, 0xc3
lea r9, [r8 + r9 - 0x73e8006a]
mov qword [rsp], rsi
push rcx
xor dword [rsp + 8], edx
sal dword [rsp + 1], 0x9a
jbe 0x140854c9e
Function at 0x14083c9dd
Capabilities:
Authenticate hmac

Disassembly:
ror r9d, 2
add r9d, edx
lea rax, [r11 - 0xfb3c70]
cdqe
shl dil, 6
mov qword [rsp + rdi - 0x194b8f8], rsi
shr r11w, 0xcd
ror ax, 0x68
xor dword [rsp + rdi*2 - 0x32971f8], r9d
rol r11w, 0x64
sar qword [rsp + rdi - 0x194b900], 0xf5
mov rsi, qword [rsp + rdi*4 - 0x652e3f8]
movsxd r9, r9d
mov qword [rsp + r11 - 0x77770038], rdx
add rbp, r9
lea rcx, [rdi*2 + 0x2e91dda0]
mov qword [rsp + rdi - 0x194b900], rbp
ret 8
mov dword [rbx + rdi*2 - 0x652e6ba], ecx
shr dil, 0xa2
lea rbx, [rdi + rbx - 0x3297312]
mov r9d, dword [rdi + r10 - 0x3297317]
inc rdi
lea r10, [r10 + rdi*4 - 0xca5cc5f]
xor r9d, esi
mov qword [rsp + rdi*4 - 0xca5cc64], 0xffffffffc61f6b84
bswap r9d
xor r9d, 0x63381a34
rol qword [rsp + rdi - 0x3297312], 0x49
sar edi, 0xe1
jg 0x14081ceaf

Function at 0x14083d1b9
Capabilities:
Encode data using base64

Disassembly:
adc r9b, cl
shr r9w, cl
mov dword [rbx + r9 - 4], edi
lea rbx, [rbx + r9 - 4]
and eax, dword [rsp + rcx*8 - 0x34]
jle 0x14080452b
pop r8
jbe fcn.140847ec1
setp r8b
mov r11, qword [rbx + r9 - 8]
mov qword [rsp + rdi - 0x2eee0b02], rdi
dec edi
movsx eax, di
mov edi, dword [r11 + rdi*2 - 0x5ddc1602]
jno 0x1407f8575

Function at 0x14083e995
Capabilities:
Authenticate hmac

Disassembly:
xadd byte [rsp + rdi - 0x6a47], dil
inc ecx
not r8w
dec r8w
rol ecx, 1
xor ecx, 0x3b0defb7
mov qword [rsp + rdi*8 - 0x35080], rsi
push rdi
xor dword [rsp + rdi*4 - 0x1a830], ecx
mov word [rsp + rdi - 0x6a00], ax
mov rsi, qword [rsp + rdi*4 - 0x1a830]
add eax, r8d
add r11w, di
imul r11, rax
mov dword [rdi + rbx - 0x6a1a], ecx
lea rcx, [r11*8 + 0x317132d]
jae 0x140862d5d
neg r11b
lea rbx, [rdi + rbx - 0x6a1a]
push rax
mov r11d, dword [r10 + rdi*2 - 0xd420]
or di, word [rsp + rdi - 0x69f6]
lea r10, [rdi + r10 - 0xfff7]
sar r8d, cl
pop rdi
shr qword [rsp + r8*4 - 0xa18], 0xf3
xor r11d, esi
movzx edx, byte [rsp + rdi - 0x41ec29cc]
cdqe
lea r11d, [r11 + rdi*4 - 0x2f9302e7]
pop rcx
mov r9d, r8d
cbw
bswap r11d
neg word [rsp + r8*2 - 0x4ff]
ror r11d, 2
lea r11d, [r11 + rdi*2 + 0x763441da]
sub ecx, r9d
mov qword [rsp + r8 - 0x276], rsi
call fcn.140876219
mov edx, 0x79b5d9b8
movzx edi, dx
mov r8w, word [rbx + rdi*4 - 0x366e0]
movsx eax, dil
shr dil, 0x67
lea rbx, [rdx + rbx - 0x79b5d9b6]
xadd ax, di
mov di, word [r10 + rdi - 0xffb8]
lea r11, [rdx + rdx*4 + 0x6430260f]
lea r10, [r10 + rdx - 0x79b5d9b6]
cdqe
xor di, si
dec di
movzx ecx, al
not di
sal dl, 4
sar eax, 0xc2
neg r11d
xor di, 0x510d
not dl
not rdx
lea r9, [rax*4 + 0x621c4b28]
rol di, 1
dec rcx
not cl
bt dx, 0xa4
neg di
push r11
btc r11d, r11d

Function at 0x14083ed8c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub rdx, r8
ror cx, 1
not cx
jmp 0x14086deea
mov qword [rsp + r11 - 0x1eb764e9], 0x5ea7ff3e
dec edi
neg edi
mov qword [rsp + rdx*2], rsi
neg r8b
xor dword [rsp + r11*4 - 0x7add93a4], edi
btr rdx, 0x87
btc r11d, 0x92
pop rsi
add r8d, 0xcd08da9c
movsxd rdi, edi
bts r9w, 0xb0
sbb r8w, dx
adc rbp, rdi
movzx ecx, word [r10 + r11 - 0x1eb364e9]
xchg r8, rax
not eax
lea r10, [r10 + r8 - 0xffa7ab]
not r11
lea rdx, [rdx + r11*4 - 0x1bf50d79]
xor cx, si
cdq
bt dx, r9w
neg al
sbb cx, dx
jmp 0x14082da27
Function at 0x140842e66
Capabilities:
Authenticate hmac

Disassembly:
dec r8
adc eax, r8d
neg eax
neg word [rsp + r8*4 + 0xd]
sub dx, word [rsp + r8 + 0xb]
adc eax, r8d
shr rdi, 0xbe
movsx r11d, dl
shl qword [rsp + r8 + 9], 0x35
xor eax, r8d
xchg dword [rsp + r8*2 + 0xa], r8d
neg eax
add r9, r8
push r9
bswap eax
mov qword [rsp + r8 + 8], rdi
sar dword [rsp + r8*2 + 0xf], cl
ror eax, 3
mov qword [rsp + r8*2 + 0x10], rsi
inc qword [rsp + r8*2 + 2]
jnp 0x14080b8a8

Function at 0x140847476
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov word [rdx + rax], r11w
mov qword [rsp + rdx], 0x650ad0ae
xor dl, byte [r10 + rdx*2 + 4]
pop r9
mov eax, edi
lea r10, [r10 + rcx*8 - 0x1f003]
mov r11d, edi
jmp 0x140875638
mov r8d, 0xae25fabc
xor dl, sil
and r11d, r9d
xor dl, 0xbf
xchg r8w, di
sub dl, cl
xchg cx, di
lea rax, [r8*2 - 0x2756bae3]
bts r11w, cx
not dl
add dl, dil
inc r9w
setge r11b
or r8b, r11b
rol dl, 1
dec rdi
xor sil, dl
shr r8b, 0x47
adc rdx, rsp
shr rdi, cl
inc rcx
mov r8, qword [rdx + rcx - 0xfabd]
call fcn.1408260a3
Function at 0x14084ad70
Capabilities:
Encode data using base64

Disassembly:
bt rdi, 0x8e
bswap eax
mov dword [rbx + rdx*2], r11d
xchg dil, cl
inc rdx
lea rdx, [rdi + rcx*8 + 0x403b5596]
or edi, dword [r10 + r9*4 - 0x20ffc]
cdq
imul cx
lea r10, [r10 + rdx*8 + 4]
jno 0x14085230b
pop r9
pop rdx
pop rax
pop r8
jmp fcn.140847ec1
mov ecx, dword [r10]
pop r9
mov r8d, 0xd9203587
add r10, 4
xor ecx, esi
mov edx, 0xb890ffb6
mov r9d, 0xa15ad8f
neg r8w
sbb ecx, 0x99a30817
lea rax, [r9 - 0x5579a2e3]
inc dx
ror ecx, 3
bswap ecx
rol r9d, 0x4e
lea ecx, [rcx + r8 - 0x1986d0d0]
lea r11, [r8 + r9*2 + 0x6ea1fd25]
btc ax, dx
push rsi
mov edi, r9d
btr di, dx
cqo
xor dword [rsp + rdx + 1], ecx
call fcn.14081af2f
mov edi, 0xdfbd9485
mov rcx, qword [rbx + riz]
mov r9, qword [rbx + riz + 8]
lea rax, [rdi*4 + 0x50b365ba]
add rcx, r9
mov r9d, edi
sal al, 0x25
mov qword [rbx + riz + 8], rcx
movsx r11d, di
mov r8d, eax
call fcn.1408304d5
neg r8b
shl r9w, 0x8a
xor sil, r8b
sar di, 0x27
adc r8, rsp
ror edi, 0x64
bt eax, 0xb0
mov r11d, dword [r8 + r9*2 - 0x10800]
and r9w, r9w
cqo
dec r9w
lea rbx, [rbx + rdx*4 - 4]
jae 0x14080ed22
sal r11d, cl
bswap r8d
xor r8d, 0x25247d35
add eax, edi
cmovns rax, r11
sbb r8d, 0xac85ec82
bswap r8d
and r11b, cl
push rsi
seta dil
xor dword [rsp + r9], r8d
and r11b, 0xaa
btr edi, r9d
pop rsi
push rax
btr di, cx
movsxd r8, r8d
pop r9
sar edx, 0x61
add rbp, r8
lea r8, [rdi + rcx*4 + 0x390142b]
jmp fcn.140847ec1
not edi
div r9b
sub edi, ecx
shl byte [rsp + rdx + 6], cl
inc r11
add byte [rsp + rdx + 4], r9b
neg edi
cwd
bts r9w, 0xa6
mov qword [rsp + r9*8 - 0x41ff8], rsi
xor dword [rsp + rdx], edi
pop rsi
jmp fcn.140812886
xor edi, esi
btc cx, ax
mov r11d, 0x3b1bd7b1
adc edi, ecx
push rax
cdq
jmp 0x14084bd15

Function at 0x14084d5b7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rcx, ecx
mov qword [rsp + rax*2 + 0x54], 0x79b0f503
mov qword [rsp + rax + 0x26], r11
adc rbp, rcx
shr ax, 0x65
shr r8d, 0x5e
not edi
movzx dx, byte [rbx + rax + 0xf802]
sub dword [rsp + rax*2 + 0x1f00f], eax
sal qword [rsp + rax + 0xf80a], 0x43
mov cl, byte [rbx + rax*2 + 0x1f006]
adc word [rsp + rax + 0xf80f], r9w
not rdi
lea rbx, [rbx + rax + 0xf804]
jno 0x140870b94
mov r8d, 0x37372fae
lea rax, [r8 + r8*4 + 0x2729191b]
lea rdi, [rax*4 - 0x2c501b44]
mov eax, dword [r10 + r8*2 - 0x6e6e5f5c]
lea r10, [r10 + r8*2 - 0x6e6e5f58]
sal dl, cl
mov word [rax + rbx + 0xf802], dx
or word [rsp + rax*4 + 0x3e016], 0x871c
call fcn.14081e6b3
mov eax, 0x1b02af83
movzx r8d, al
movzx edi, r8w
mov rdi, qword [rbx + rax - 0x1b02af83]
push r8
lea r9, [rax*8 + 0x1887fd3c]
mov rax, qword [rbx + rax - 0x1b02af7b]
call fcn.14081cf13

Function at 0x14085032f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov r8d, dword [r11 + r8*4]
neg dword [rsp + 0x16]
shr r9d, 8
mov qword [rsp], 0xac323f
push 0x39a01a2d
push 0x24302323
xor r9d, r8d
shl qword [rsp + 0xe], 0xba
inc rdi
xor r9d, 0x8a80e28b
dec rdx
lea rsp, [rsp + 0x30]
jne 0x14085199d
Function at 0x140851981
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor si, r8w
add r8, rsp
add cx, 0x639a
call fcn.14087028b
mov edi, dword [r10]
mov ecx, 0xd1a19d21
sub r10, 0xfffffffffffffffc
xor edi, esi
imul ecx, ecx
not edi
movzx r9d, cl
lea edi, [rdi + r9*2 + 0x483dbd0c]
movzx r8d, r9b
shr ecx, 0x24
xor edi, 0xb6b5e182
dec edi
movzx eax, r9b
push rsi
neg r9d
movzx r11d, cl
xor dword [rsp + rcx*4 - 0x397cdf90], edi
pop rsi
bts eax, r9d
movsxd rdi, edi
adc rbp, rdi
sub r11w, r8w
and ecx, eax
lea rax, [rsp + rcx - 0x38]
adc r11d, ecx
rol r11w, 0xee
mov edx, r8d
mov di, word [rax + rcx*2 - 0x80]
mov ax, di
shr r9, 0x54
not ecx
mov cl, byte [r9 + rbx - 0xfff]
bts r11d, 0x3a
sal ax, cl
add r9d, r8d
movzx ecx, r11w
mov word [rbx + r8 - 0x41], ax
jmp rbp
mov edx, 0xa324cca3
mov eax, 0xbf1f92b6
lea rdi, [rax + rax + 0x6f04bca5]
not r9d
mov dword [rbx + riz + 0x14], r9d
dec dx
shr rdi, 0x7c
lea rbx, [rbx + rdi + 0x14]
jp 0x140836620
lea rsp, [rsp + 0x20]
je 0x14085036f
mov r11d, 0x15b14819
shl r11b, 0xe3
lea r11, [0x1403c08a0]
mov r8d, 0xdc9f858b
sal r8d, 0xd5
movzx r8d, byte [rdi + riz]
push 0xffffffffde3d46ac
push 0x1c0670ad
xor r8d, r9d
call fcn.14086316d
setae dl
inc r8w
ror r8w, 1
jmp 0x14084cb20

Function at 0x1408539e6
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
mov qword [rsp + rdi - 0x6c32], rcx
adc rbp, r9
shr dword [rsp + rdi*4 - 0x1b0c6], cl
pop r11
jne fcn.140847ec1
mov edi, 0xb0b2ec0a
btc di, di
mov rcx, qword [rbx + riz]
mov dil, byte [rbx + riz + 8]
adc rbx, 9
mov r9d, 0xbbb824a5
mov byte ss:[rcx + riz], dil
lea rcx, [r9*8 + 0x2cbd040d]
shl cx, 0x4a
mov r9d, dword [r10 + riz]
lea r11, [rcx*2 + 0x722efdbc]
js 0x140835134
mov r11d, 0xd22da322
mov rdx, rbx
lea rdi, [r11*4 + 0x643f85b8]
shr r11w, 0x29
movzx eax, di
mov qword [rbx + rax*2 - 0x2488], rdx
mov ecx, dword [r10 + rax*2 - 0x2480]
btr r11, r11
mov r8d, r11d
lea r10, [r10 + rax*4 - 0x48fc]
xor ecx, esi
shr al, 0x21
neg ecx
ror ecx, 3
xchg dil, r11b
lea ecx, [r11 + rcx - 0x75173091]
rol di, 0x8e
bswap ecx
shr r8b, 0xe2
not r8
bswap rax
lea ecx, [rcx + r8 + 0x35988ffa]
lea rdi, [r11 + r8*2 - 0x4f7f02e0]
movzx edx, r11w
xor ecx, 0xc33b5506
rol dx, 5
movsx r9d, dil
not ecx
adc di, r11w
sar r9d, 0x4b
push rsi
xor dword [rsp + rdx - 0x800], ecx
add rdx, rax
call fcn.140837cf9
Function at 0x140853c5f
Capabilities:
Encode data using xor

Disassembly:
lea r8, [rcx + rcx*8 - 0x62530c47]
xor al, sil
inc cl
inc qword [rsp + rdi - 0x3d33]
dec r9
xor al, 0x10
sal r8w, 0x47
ror r8w, cl
imul r8, r9
dec al
neg al
rol r8b, 0x83
mov dword [rsp + rdi - 0x3d30], r8d
not qword [rsp + rdi - 0x3d33]
not al
xadd r8d, r9d
dec cl
push rdx
xor sil, al
lea rax, [rsp + rax + 0x10]
mov dword [rax + r9 - 0x5136e5dd], r11d
and r9w, 0x1a3b
mov qword [rsp + r9 - 0x51360019], rbp
ret 8
lea rsp, [rsp + 0x20]
je 0x140853cf0
push rbx
mov ebx, 0x221b1906
push rsi
mov esi, ebx
btr ebx, 0xa5
ror bx, 1
lea rbx, [0x14076f5f8]
mov esi, 0x7a8891bc
neg sil
imul si, si
movzx esi, byte [r8 + rsi - 0x7a881a10]
xor esi, edi
and esi, 0xff
mov esi, dword [rbx + rsi*4]
shr edi, 8
push 0x1826cf92
sub dword [rsp + 1], 0xda3e1684
xor edi, esi
not dword [rsp + 1]
dec word [rsp + 5]
inc r8
xor edi, 0xc6212b31
inc byte [rsp + 7]
dec rdx
not word [rsp + 3]
lea rsp, [rsp + 8]
jne 0x140853c81
mov eax, 0xa2b8338b
lea rbx, [rax + rax*4 + 0x58b03996]
pop rsi
shl eax, 0x81
mov ecx, eax
pop rbx
mov r9d, 0xc905738e
not edi
mov edx, 0x8f3d0534
btc r9, r9
sbb dl, dh
mov r11d, edi
movzx edi, dl
movsx eax, r9w
movzx eax, byte [r10 + rax - 0x338a]
xadd r9w, dx
push rdx
xchg word [rsp + rdi*4 - 0xb7], di
lea r10, [rdi + r10 - 0x3d2e]
movsx ecx, dl
jg 0x14080a349
Function at 0x140856711
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
ror di, 1
add di, 0xde98
shl ax, 0x61
ror di, 1
and al, dl
imul cl
adc di, 0xddbf
mul dx
shl rdx, 0xb5
neg di
cbw
xor di, cx
sub di, cx
sub r8b, r9b
btr ecx, 0x15
xor si, di
mul eax
bts rdx, r8
shr al, 0xc3
adc rdi, rsp
dec r8
mov dword [rdi + rax*8], r11d
movzx r11d, al
shr ecx, cl
mov r8d, dword [rbx + rax*2 + 4]
imul r11b
sar r9b, 0xa7
lea rbx, [rbx + rcx*2 + 8]
adc r11b, r11b
jp 0x14080d160
not dl
mov r9w, word [r10 + rcx + 6]
ror r11b, 0x65
adc r10, r11
xor r9w, si
call fcn.140871bea
call fcn.1408285be
mov eax, dword [rbx]
jmp 0x1408154ba
xor dword [rsp + rcx + 0xeb9128b], r8d
lea rsi, [rdx*8 - 0x645d8bf0]
sub rcx, rsi
pop rsi
movsxd r8, r8d
cwd
movsx r9d, cx
adc rbp, r8
movzx r8d, r9w
neg cx
movzx r11d, di
add r11d, dword [rax + rbx - 0x80000000]
xor di, word [rdi + r10 + 4]
shr rcx, 0x2a
inc r9d
rol ax, 0xa1
xor di, si
lea rdx, [r9*8 + 0x2db15faf]
jmp 0x1407fadd3
mov r8d, 0x228c93ba
mov ecx, dword [rbx + r8*2 - 0x45192770]
lea rdx, [r8*8 - 0x137db5f6]
call fcn.14082564e
or r9b, r8b
adc rbp, rcx
call fcn.14084d890
sal r8d, 0xec
jne 0x140865412
mov qword [rsp + rcx - 0x648c6a97], 0x55811b8a
dec edx
neg edx
mov qword [rsp + rcx - 0x648c6a97], rsi
rol r11d, cl
sal di, 0xa8
shr rcx, 0xe
xor dword [rsp + rcx*2 - 0x32462], edx
sal ax, 0xa8
ror rcx, 0xda
sbb cl, 0x93
pop rsi
and rax, rdi
sub r11b, 0x1d
movsxd rdx, edx
movsx r8d, di
not rdi
adc rbp, rdx
call fcn.1408386ad
dec rdi
xor dword [rsp + r8*2], ecx
and ax, r11w
xor r11b, r11b
inc r11b
pop rsi
movsxd rcx, ecx
jae 0x1408562c7
lea r8d, [rcx + r8 - 0x22eeb626]
movsx edi, al
mov edx, eax
btc edx, 0x9f
push rsi
sbb eax, edx
jne 0x14080d979
adc r9d, ecx
mov dword [rbx + r8*2 - 0x6b51e000], r9d
lea rcx, [r11 + 0x67982515]
mov r9d, ecx
mov edi, dword [r8 + r10 - 0x35a8f000]
lea r10, [r10 + r8 - 0x35a8effc]
lea rax, [r9*2 + 0x112ddd16]
add rcx, r8
setb al
xor edi, esi
rol r8d, cl
shr r11, 0xf
xor edi, 0x59897786
and r8, 0x180dfc29
btc r11, rcx
sbb edi, 0xf6a5922d
bt r8w, r8w
ror al, 0xe1
ror edi, 2
bswap edi
rol r9d, cl
bswap rdx
neg edi
bts cx, 3
adc r9d, 0xfdbb0f17
ror r11d, 1
inc edi
rol edi, 3
dec dl
xor edi, 0x94a378af
mul r9b
setb cl
inc eax
ror edi, 1
push rsi
sub r8b, dl
xor dword [rsp + r8 - 0x8d429], edi
jmp 0x140823e23

Function at 0x140856872
Capabilities:
Encode data using base64

Disassembly:
lea r10, [rdi + r10 - 0x7acac260]
mov qword [rsp + rcx - 0x1dd9], rdi
jle 0x140802fcd
Function at 0x140856888
Capabilities:
Encode data using base64

Disassembly:
add dl, 0x15
jmp 0x140861cbb
neg dl
jmp 0x14085cfd1
or byte [rsp + 9], 0xba
mov qword [rsp], 0x4a0fa83c
xor sil, dl
mov qword [rsp + 8], r10
shr word [rsp], 0xa8
mov qword [rsp], rbp
mov ebp, 0x14648a
push rsi
setp bpl
mov rbp, rbx
mov ebx, 0x8b1bf682
dec bx
and bx, bx
mov ebx, edx
mov edx, ebx
xor ecx, ecx
call fcn.140843914
mov qword [rsp + r9*2 - 0x4e1ccd4a], rsi
xor dword [rsp + r9*2 - 0x4e1ccd4a], r8d
movsx esi, r9w
cdq
pop rsi
xchg r9d, r11d
movsxd r8, r8d
not eax
add rbp, r8
lea r8, [rdx + rax*8 + 0x21123598]
lea rcx, [rbx + rax*2 - 0x1ff1c]
xor r8b, 0x82
lea r11, [rdx*4 - 0x39dafb6f]
and rdi, r9
mov qword [rax + rbx - 0xff95], rcx
lea rbx, [rbx + rax*2 - 0x1ff24]
mov ecx, r11d
add di, ax
jnp fcn.140847ec1
jmp 0x1408589a1

Function at 0x1408579a3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edx, 4
lea ecx, [rbx + riz - 4]
lea rsp, [rsp + 8]

Function at 0x140857f9a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x28]
je 0x140819b78
mov ecx, 0xce299105
lea rdx, [0x14080c898]

Function at 0x14085aeba
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0x20a37c0d
not byte [rsp + 7]
call fcn.140864440
mov qword [rsp + rax - 0x3736ed80], rbp
ret 8
lea rsp, [rsp + 0x10]
jne 0x1407ff3d5
mov r8d, 0x819fbeb9
mov r8, rax
call fcn.14083f650
mov r11d, 0xc987cd9a
movzx r9d, byte [r10 + riz]
movsx eax, r11b
bts r11d, r11d
xor r9b, sil
neg r9b
mov edx, r11d
inc r9b
ror r9b, 1
dec eax
inc r9b
xchg edx, r11d
neg r9b
movsx edi, dx
xor sil, r9b
add r9, rsp
mov edx, dword [r9 + riz]
movsx r9d, ax
add ax, r9w
mov dword [rbx + riz - 4], edx
lea rcx, [rax + rax*8 - 0x106c3f6e]
mov r11, qword [rbx + riz - 4]
adc rbx, 3
movzx r8d, r9b
rol r8, cl
movzx edi, byte [r10 + r8 - 0x98fffff]
jae 0x140837164
Function at 0x14085d707
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx - 0x56ddc400], r11
xor dil, 0x9f
sal dl, 0x26
lea rdx, [r11 + rcx*8 + 0x5996cf13]
push r11
xor sil, dil
ror r11, 0xe0
neg word [rsp + rcx - 0x6420fb27]
jge 0x140824ca2

Function at 0x14085ed5d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
neg eax
rol eax, 2
mov qword [rsp + r8*2 - 0x26351472], rdx
or qword [rsp + rcx*2 - 0x11472], 0x82071bf
xor eax, 0xfbb98e0b
movsx r9d, dx
movzx edi, word [rsp + r8 - 0x131a8a39]
pop rcx
push rsi
add edi, r11d
xor dword [rsp + r8*4 - 0x4c6a28e4], eax
movzx esi, dl
pop rsi
bts rdi, 0xba
sal r11w, 0xea
sbb r8b, dil
movsxd rax, eax
add rbp, rax
mov r11, qword [rbx + r8*2 - 0x26351482]
btr rcx, rdx
push r8
lea rbx, [rbx + r8*4 - 0x4c6a28fc]
ror dx, 0xf
movzx edx, word [r8 + r10 - 0x131a8a41]
lea r10, [rcx + r10 + 0x70d70a45]
neg byte [rsp + r8*4 - 0x4c6a2900]
je 0x14086c16f

Function at 0x1408602ec
Capabilities:
Encode data using base64

Disassembly:
neg r9d
add rax, 0x52b0a5bb
inc r9d
xor r9d, 0xe37a107
call fcn.140855ec6
Function at 0x140861cb1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov rax, qword [rbp + rbx*8 + 0x20]
call fcn.140816a88

Function at 0x140862aee
Capabilities:
Encode data using base64

Disassembly:
movsxd rcx, ecx
bts r11w, r9w
add rbp, rcx
pop rdx
pop rax
pop rdi
jmp fcn.140847ec1
setbe r8b
and rdx, 0xffffffff941a2032
lea r10, [r10 + rdx*2 + 6]
or byte [rsp + rdx + 0x16], dh
sal r11, 0xd3
xor ecx, esi
dec edx
mov edi, r9d
xor ecx, 0x8f26d221
btr eax, 0x90
dec r8d
sub ecx, edx
sar byte [rsp + 0x14], 0xa7
ror r11, 0xc8
ror ax, 0xae
ror ecx, 2
cdq
inc r8d
xor ecx, 0xb1ac28ae
mov qword [rsp + r8 + 0x18], rsi
cwd
pop r11
xor dword [rsp + r8 + 0x10], ecx
lea r8, [rdx + 0x7bb46482]
movzx r11d, word [rsp + 0xa]
rol qword [rsp + r11 - 0x49a1], 0xba
mov rsi, qword [rsp + r11*8 - 0x24d38]
sal r8b, 0x62
jnp 0x140803a51

Function at 0x140862b6c
Capabilities:
Encode data using base64

Disassembly:
sal edi, 0xcc
rol r11, 0xf8
push rsi
mov esi, r11d
not dil
ja 0x14082e8c4
mov dword [rbx + r9], edx
call fcn.14086f0f2
mov r9d, 0x883c9baa
mov r9d, dword [r10 + riz]
mov r11d, 0xad94f720
movzx eax, r11b
movzx r8d, r11w
lea r10, [r10 + rax - 0x1c]
shr r11w, 2
sal ax, 0x6f
adc r11d, r8d
xor r9d, esi
sar r11w, 0x43
dec r11b
movsx ecx, ax
rol r9d, 1
xor r9d, 0xbb23e392
lea rdi, [rax - 0x3a61b9fe]
inc r9d
rol r9d, 1
jmp 0x14080802d