joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a580
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14003a593
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14003abf8
lea rdx, [0x1400ad768]
lea rcx, [rsp + 0x20]
call fcn.140058e38
int3

Function at 0x14004696c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400b5970]
xor edx, edx
jmp fcn.14003a580

Function at 0x14004734c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400b5970]
jmp fcn.14003a580

Function at 0x140069ee0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140069cb4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140069cb4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140069cb4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140069cb4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140069cb4
cmp dword [rcx + 0x84], 0xe
jbe 0x140069cb4
cmp dword [rcx + 0xf8], esi
je 0x140069cb4
mov ecx, r14d
call fcn.140069dfc
mov ecx, 2
call fcn.140066720
nop
cmp byte [0x1400b5ec0], 0
jne 0x140069d7e
mov r15d, 1
mov eax, r15d
xchg dword [0x1400b5eb0], eax
test ebx, ebx
jne 0x140069d27
mov rdi, qword [0x1400b0178]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400b5eb8]
cmp rcx, rax
je 0x140069d1e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140001ce0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400b5ff8]
jmp 0x140069d33
cmp ebx, r15d
jne 0x140069d39
lea rcx, [0x1400b6010]
call fcn.14006a994
nop
test ebx, ebx
jne 0x140069d50
lea rdx, [0x140081800]
lea rcx, [0x1400817d8]
call fcn.14006acf4
lea rdx, [0x140081810]
lea rcx, [0x140081808]
call fcn.14006acf4
movzx eax, byte [0x1400b5ec0]
test esi, esi
cmove eax, r15d
mov byte [0x1400b5ec0], al
jmp 0x140069d7e
mov ecx, 2
call fcn.140066774
test esi, esi
jne 0x140069d95
mov ecx, r14d
call fcn.140069db0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140069c44

Function at 0x14006e994
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14006e9b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140063024
or eax, 0xffffffff
jmp 0x14006e9b6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400704e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140070380
call fcn.140063094
mov dword [rax], socket
call fcn.140062e40
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140070368
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140070368
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400703b2
lock or dword [rax + 0x14], 0x10
jmp 0x140070368
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400703cf
mov rcx, qword [rbp + 0x10]
call fcn.1400784d4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14006cf7c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14006d4d4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140070426
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140070368
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140070492
mov rcx, qword [rbp + 0x10]
call fcn.14006cf7c
cmp eax, 0xffffffff
je 0x140070479
mov rcx, qword [rbp + 0x10]
call fcn.14006cf7c
cmp eax, 0xfffffffe
je 0x140070479
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14006cf7c
movsxd rdi, eax
lea rsi, [0x1400b6060]
mov rcx, rbx
sar rdi, 6
call fcn.14006cf7c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140070480
lea rax, [0x1400b05e0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140070492
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400704c8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400704c4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400704c4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14007036b
jmp 0x140070338
Function at 0x140bee03d
Capabilities:
Authenticate hmac

Disassembly:
pop r11
pop rdx
lea r13, [r13 + r13*8 - 0x6711c68]
push r12
mov rbp, qword [rsp + r13*4 + 0x19c0eda8]
mov r12, qword [rsp + r13*2 + 0xce076e0]
jmp 0x140c07ba5
push r13
mov r13, qword [rsp + r13 + 0x6703b88]
call fcn.140c1c018

Function at 0x140bee2c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r8 - 0x1c311baa], rcx
mov rbp, qword [rsp + r8*4 - 0x70c46ea0]
inc r8b
movsx r10d, cx
sub qword [rsp + r8*4 - 0x70c46eac], rcx
movsxd rax, eax
call fcn.140c1e29f

Function at 0x140beeeef
Capabilities:
Execute anti-debugging instructions

Disassembly:
add r8, qword [rsp + rcx - 0x78fce3f8]
rol dx, 0xab
xor bpl, r9b
lea rax, [rsi + rdx*2 - 0x6956464a]
btc edx, 0x1b
lea r9, [rsp + r9 + 0x18]
setae r8b
mov cx, word [r9 + rcx - 0x78fce400]
sbb qword [rsp + r10*2 + 8], r10
sal r8w, 0xe8
lea rbx, [r10 + rbx - 2]
or r8d, esi
adc byte [rsp + r10*4 + 9], 0xa0
mov word [rbx + r10], cx
mov r9d, 0xf89b940e
pop rcx
pop r8
pop rcx
jp fcn.140bfee45
not r9b
mov esi, 0x3116201a
movzx r8d, sil
and al, r9b
jmp 0x140c21d7a

Function at 0x140bef733
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x30]
je 0x140c2a4bf
mov r10d, 0xca189f93
push rdi
lea r10, [0x140c238d0]
Function at 0x140bf005b
Capabilities:
Encode data using base64

Disassembly:
and r10d, dword [rsp + r9*2 - 0x3fff4]
add r9, qword [rsp + r9 - 0x1fff6]
dec rsi
call fcn.140c2b01d
lea rsp, [rsp + 0x18]
jmp 0x140c0e48f

Function at 0x140bf102e
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movzx ebp, ax
xor dword [rsp + rcx*4 - 0x47c], r8d
cwd
mov qword [rsp + rax - 0x34], 0x4311c70c
mov rbp, qword [rsp + rcx - 0x119]
movsxd r8, r8d
neg r10b
xchg dx, si
add r11, r8
div r10d
call fcn.140bfaa96
Function at 0x140bf1d42
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x18]
jne 0x140c00ba5
mov rax, qword [rbp + riz]
call fcn.140bfc849
mov eax, 0x31280182
sal ax, 0x49
shr eax, 0x69
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
jmp 0x140c1287f
call fcn.140c2573c

Function at 0x140bf260d
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc esi
and dx, 0xf02d
and r8, r8
ror esi, 1
div r8b
mov qword [rsp + r9 - 0x4f8], rbp
and edx, 0xa8a09cbb
sub edx, eax
xor dword [rsp + r9 - 0x4f8], esi
or r10b, 0x9f
pop rbp
adc r9w, ax
ror r9, cl
movsxd rsi, esi
mul rax
btc r9d, 0xb9
bt edx, 0xa1
adc r11, rsi
sal cl, 0x43
xchg al, cl
bts r10d, r8d
mov esi, dword [rbx + r9 - 0x3593004]
bswap r9d
neg r8
bswap eax
mov r10d, dword [rbx + r9 - 0x305903]
or r8d, ecx
not esi
xchg r9d, eax
inc edx
sbb r8w, 0xde9b
not r10d
sete cl
add dl, 0xd
not r9b
and esi, r10d
or dx, dx
setge r8b
jg 0x140bfcfe0
rol dl, 1
movsx r8d, sil
sal r9b, 0x87
sbb dl, r9b
lea r8, [r9*2 - 0x356589e3]
movsx r10d, r9b
xor dl, 0xad
sar r8d, 0x72
dec dl
mov dword [rax + rbx - 0x305903], esi
mov esi, edx
movzx r10d, r8b
sal r8, 0x84
jmp r11

Function at 0x140bf2f52
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 8]
sub rsp, rcx
and rsp, 0xfffffffffffffff0
add rsp, rcx
call fcn.140c00b8f
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
push 0xfffffffff8899db8
dec dword [rsp + 4]
jne 0x140bed32b
mov esi, 0x3fb2cd08
movsx r9d, si
movsx edx, r9b
mov eax, dword [rdi + rsi - 0x3fb2cd08]
mov r8d, 0x1215b096
lea rdi, [rdi + rsi - 0x3fb2cd04]
shr r9d, 0x6f
mov ecx, r8d
and rdx, 0xffffffffa8b36ea2
xor eax, ebp
inc r8b
call fcn.140c0ac86

Function at 0x140bf9c78
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
lea rax, [r10 + r10*2 + 0x7f3c0939]
xchg r8b, dl
sub ecx, 0xf335c800
movsx r9d, dx
mov qword [rsp + r10*2 - 0x114], 0x68808c0f
mul r9
not ecx
jae 0x140c025e8

Function at 0x140bf9ca6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffffaa29d5b1
push 0x6027b52a
xor edi, r8d
push 0xffffffffe5856189
and edi, 0xff
jmp 0x140c128d8

Function at 0x140c01849
Capabilities:
Authenticate hmac

Disassembly:
sub dword [rsp + 0x15], 0x653e19ad
mov qword [rsp + 8], 0x1dae95bb
xor r10d, 0xa8957983
neg byte [rsp + 0x1e]
jle 0x140c1ff8f
call fcn.140c24245
jmp 0x140c2c281
shr r10d, 8
add qword [rsp + 0xc], 0x2f81551d
rol word [rsp + 0x11], 0xf
ja 0x140c270a0
movsx r10d, dx
lea rdi, [r10 + rdi - 0x4dfc]
movsx ecx, dx
xor esi, ebp
sub esi, 0xc1003108
xor edx, 0x542ef62f
sal r9d, 0x1c
inc r9d
ror esi, 3
xor r10w, cx
btr dx, 0x1c
neg esi
shl r9d, 0xb7
lea esi, [rsi + r9 - 0x173d4406]
btc cx, r9w
push rbp
add r9w, r9w
mov ebp, edx
jge 0x140c2a3e1
lea rsp, [rsp + 0x28]
jne 0x140becf6b
pop rbx
jne 0x140c044ec
dec r8
jmp 0x140c0642a
xor r10d, eax
push 0x80ec494
jmp 0x140bfd820
inc rdx
jmp 0x140bef156

Function at 0x140c03ae8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x248872a2
test rcx, rcx
call fcn.140c04d76
Function at 0x140c04d76
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rsp + 0xa], 0xce92
lea rsp, [rsp + 0x28]
je 0x140c21411
mov r8d, 0x26bdc08f
or r8w, r8w
lea rdx, [0x140bf3988]

Function at 0x140c06e93
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub si, cx
mov word [rbx + rax*2 - 0x3c69b786], r10w
sar al, 0x81
jmp r11
adc r11, r9
call fcn.140c1732d
mov esi, 0xb599a09a
movzx eax, si
lea r11, [rsi*2 + 0x2f1e0402]
mov rsp, rbx
movsx ebx, r11b
movzx r9d, al
popfq
cwde
jmp 0x140c17937
xor r8w, bp
btc r9w, 0x93
ror r8w, 1
shr rdx, cl
mov qword [rsp + rdx - 0x2887ff], rdx
xor r8w, 0x9e90
add r8w, 0xb83b
rol cx, 0xe3
shr ecx, cl
movzx r10d, word [rsp + rcx - 0x18050a4f]
neg r8w
mov qword [rsp + rcx*2 - 0x300a14b0], rax
mov qword [rsp + rcx*2 - 0x300a14d0], rsi
xor bp, r8w
shl qword [rsp + rsi - 0x7558d601], cl
not byte [rsp + rcx - 0x18050a57]
ror dword [rsp + rcx - 0x18050a54], 0x2e
lea r8, [rsp + r8 + 0x30]
call fcn.140bf8be0
bswap r8d
push rbp
ror si, 0x48
xor dword [rsp + rdx - 0x7d0e1651], r8d
pop rbp
lea rax, [r9*8 + 0x3398b126]
movsxd r8, r8d
rol rax, 0x7d
bt r10w, 0x3e
add r11, r8
xor r9b, dl
and r10b, 0x9a
and al, sil
movzx r10w, byte [rbx + r10 - 0x44606482]
movzx ecx, sil
mul esi
mov r8b, byte [rax + rbx - 0x1e34929f]
dec rsi
lea rbx, [rbx + rax*4 - 0x78d24a82]
add r10b, r8b
sub ax, r9w
jno 0x140bf7653
movsx ecx, dl
mov ax, word [rbx + rdx - 0x4a24bf85]
mov cl, byte [rdx + rbx - 0x4a24bf83]
lea rbx, [rbx + rdx - 0x4a24bf83]
mov r9d, edx
lea r10, [rdx + rdx*4 + 0x931a79c]
shrd r8w, ax, cl
not r9b
lea rcx, [rdx + rdx*4 - 0x6255f775]
mov esi, r10d
mov word [rbx + rdx - 0x4a24bf87], r8w
shr r10w, cl
mov r9d, dword [rdx + rdi - 0x4a24bf87]
mov eax, esi
bts si, si
lea rdi, [rdx + rdi - 0x4a24bf83]
xor r9d, ebp
bts esi, 0x83
lea rsi, [rax + r10*2 + 0x369e5926]
lea r8, [rdx + rcx*4 + 0x78ec0ac]
ror r9d, 3
bt eax, esi
not r9d
imul ecx, r10d
shr rsi, cl
inc r9d
xchg r10, rax
neg r9d
xor rcx, r10
add r10d, eax
ror r9d, 1
jmp 0x140c21d58
call fcn.140c28c92
sar rdx, 0xfe
bts r8, rdx
push rbp
or ecx, r10d
xor dword [rsp + rdx*4], r9d
not r10
pop rbp
shl r10w, 0x43
movsxd r9, r9d
js 0x140bfb926
movsx edx, r8w
movzx ax, al
call fcn.140c099aa

Function at 0x140c07ae3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r10 - 0x68], 0xffffffff9713e50a
add r11, r9
call fcn.140c099fa
mov r8d, 0x3406e287
movsx esi, r8b
mov rdx, rbx
movzx r10d, r8b
lea rax, [r8 + r10*2 + 0x348c3bb8]
movsx ecx, r10w
lea rbx, [rbx + r8*2 - 0x680dc512]
inc r8b
mov dword [r8 + rbx - 0x3406e288], edx
cwde
cdq
mul ax
mov ecx, dword [rdi + r10*4 - 0x21c]
dec r10
lea rdi, [r10 + rdi - 0x82]
and r8d, 0xc0ab181
xor ecx, ebp
imul sil
cqo
rol sil, 0x26
not ecx
rol edx, 7
cdq
dec ecx
bts r8w, ax
not ecx
cdqe
push rsi
adc ecx, edx
sub r8w, r8w
xchg r10w, r8w
sub edx, dword [rsp + r8 - 0x4020086]
mov qword [rsp + r8*2 - 0x804010c], rbp
setg al
not r10w
lea r9, [r10 + r10*8 - 0x5541e4c1]
xor dword [rsp + r8 - 0x4020086], ecx
xor ax, 0xe8bc
pop rbp
adc sil, 0x9a
movsxd rcx, ecx
add r11, rcx
jmp 0x140bfad44
Function at 0x140c08315
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol edx, 1
inc r10b
not edx
inc dword [rsp + r9*2 - 0x5fffffe8]
call fcn.140c09477

Function at 0x140c09a1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop rdx
pop r10
pop rdx
pop rdx
pop rax
jp fcn.140bfee45
pop r12
call fcn.140bf0341
rol r8, cl
rdtsc
mov r10d, ecx
lea rbx, [rbx + r8*8 - 8]
movzx r9d, cl
bts esi, r10d
bts rsi, 0xab
mov dword [rbx + r8 + 4], eax
add r8w, 0xc02c
jae 0x140c18c04
mov dword [rbx + r8*4 - 0x300b0], edx
jno fcn.140bfee45

Function at 0x140c0c5f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r9b
neg r10d
setne dl
mov qword [rsp + r10 - 0x5492b9ff], rax
add r9b, r10b
neg r8b
not rcx
xor bpl, r9b
shl word [rsp + rsi + 0x2c72cc0f], 0xa5
shl dword [rsp + rsi + 0x2c72cc14], 0x1a
bt r10w, si
lea r9, [rsp + r9 + 0x10]
setb sil
xor dx, 0x3230
mov eax, dword [r10 + r9 - 0x5492b9ff]
pop rdx
xchg dword [rsp + r10 - 0x5492b9fb], r10d
add r8w, word [rsp + r10*2 + 6]
lea rbx, [rbx + r10*4 - 4]
ror edx, cl
neg rdx
mov dword [rbx + r10], eax
mov byte [rsp + r10*4 + 2], 5
pop rsi
jbe fcn.140bfee45

Function at 0x140c0e948
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rbp + riz - 8], rax
call fcn.140c0d80b
Function at 0x140c0f20c
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr byte [rsp + 0x15], 0xa5
inc esi
bswap esi
push 0xffffffff83a3ae2f
jmp 0x140c20769

Function at 0x140c12144
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pop rax
mov ebx, r10d
mov r10, qword [rsp + r10*2 + 0x48]
jmp 0x140c29310

Function at 0x140c12935
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, ebp
mov qword [rsp + r10 - 0x31d44b90], 0xffffffff91111100
not eax
rol eax, 3
inc eax
bswap eax
or esi, esi
mov qword [rsp + r10*2 - 0x63a89720], rbp
push rdx
sar word [rsp + r10 - 0x31d44b8b], 0x47
xor dword [rsp + r10 - 0x31d44b88], eax
sar r10, 0xd2
mov rbp, qword [rsp + r10*2 - 0x18e2]
neg r9d
mov qword [rsp + r10 - 0xc6d], r8
movsxd rax, eax
add r11, rax
mov qword [rsp + r10 - 0xc6d], 0xffffffffad91b09f
dec qword [rsp + r10 - 0xc75]
pop r8
pop r9
jne fcn.140bfee45
neg eax
mov qword [rsp + rdx + 0x18], rbp
xor dword [rsp + rdx*4 + 0x18], r10d
add dword [rsp + rdx*2 + 8], eax
mul r9w
sal byte [rsp + rdx + 0xd], 0xe7
mov rbp, qword [rsp + rdx + 0x18]
cdqe
btc r9, rcx
movsxd r10, r10d
neg rdx
adc r11, r10
shr dword [rsp + rdx*4 + 0xa], 0x72
ror r8w, 0xa2
pop r9
pop r9
pop r10
pop rsi
jbe fcn.140bfee45

Function at 0x140c12a0c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x30]
jbe 0x140c12a30
mov edx, 0xcdafbd9d
mov eax, edx
mov edx, 4
mov ecx, eax
cdqe
and ecx, ecx
lea ecx, [rbx + rax*2 + 0x64a084c2]
mov eax, 0xfdafedb4
sal ecx, 3
ror ax, 0x6a
xor al, ah
bt ax, 0x27
sal edx, 3
shr ax, 0x6e
sar rax, 0x43
sub al, ah
mov rax, rbp
jnp 0x140c108ce
mov esi, 0xb117230b
movsx r10d, si
mov ecx, r10d
mov edx, dword [rdi + r10*2 - 0x4616]
lea rdi, [r10 + rdi - 0x2307]
xor edx, ebp
btr esi, esi
xor edx, 0x9921cf33
movsx r9d, r10w
lea rax, [rcx + r9*8 - 0x42ecb25c]
shr rcx, cl
ror edx, 1
xor rsi, rsi
bswap eax
inc edx
bt r10d, 0x92
rol rsi, 0xa
mov r8d, 0x2b9a0e80
ror edx, 3
shr cl, 0x43
lea edx, [rdx + r10*8 - 0x68150d6b]
btc esi, r9d
not edx
shr r8, 0x12
inc r10w
push rbp
xor dword [rsp + rsi*2 - 0x1000], edx
movzx ebp, si
pop rbp
inc rax
movsxd rdx, edx
call fcn.140c1ccb9
mov r9d, 0x4696888f
lea rcx, [r9*4 - 0x64a3bcb]
lea r8, [rcx + r9*2 - 0x1cd239f4]
mov r10d, dword [rdi + r9 - 0x4696888f]
lea rsi, [rcx + r8*4 - 0x12526c46]
bswap esi
movzx edx, si
lea rdi, [r9 + rdi - 0x4696888b]
xor r10d, ebp
rol r10d, 3
rol r8, 0xf7
Function at 0x140c1355a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov r10d, dword [rdi + riz]
lea rsi, [rsi + rsi - 0x9e3746a]
add rdi, 4
pop rcx
movzx ecx, dl
xor si, dx
xor r10d, ebp
movzx r8d, cx
bts cx, dx
shl r8b, cl
sbb r10d, 0xa680a727
bts si, si
bts ecx, r8d
ror r10d, 1
dec r10d
bswap r10d
ror si, cl
bt cx, cx
push rbp
xor dword [rsp + rcx - 0x25], r10d
btc dx, cx
pop rbp
movzx r9d, r8b
lea rax, [r9 + rdx*2 - 0x29ec01d9]
movsxd r10, r10d
add edx, edx
push rdx
add r11, r10
xor word [rsp + rdx*2 - 0x30b65c13], ax
add ax, 0x1a34
movzx esi, word [rdi + rdx - 0x185b2e0a]
sbb dl, 0xb4
ror r9d, 0xf0
adc word [rsp + rcx*2 - 0x47], 0x8487
lea rdi, [rdi + rdx*4 - 0x616cb956]
cmovnp ax, cx
setg r8b
jb 0x140c1d28b
xor si, bp
xor dword [rsp + rdx - 0x185b2e55], 0xa320c395
push r9
sbb si, 0x2d90
ror si, 1
xor si, 0x5fbf
xchg word [rsp + rdx - 0x185b2e54], dx
movzx r10d, r8w
ror si, 1
add edx, 0x862dd9b2
push r8
btr rcx, 0x3e
xor bp, si
btc rcx, 0xb6
or edx, dword [rsp + r8*8 + 0xf]
lea rsi, [rsp + rsi + 0x18]
mov rdx, qword [rsi + r8*2]
shl r10, 0xb
inc ax
lea rbx, [rbx + r8*2 - 8]
xchg cx, r8w
mov qword [r8 + rbx - 0x25], rdx
cwde
not r8d
pop rsi
pop rdx
pop r8
ja fcn.140bfee45
mov edx, 0x392d6d2f
movsx eax, dl
lea r10, [rdx + rdx - 0x47cf1a65]
mov rax, qword [rbx + rdx - 0x392d6d2f]
mov esi, r10d
btr rdx, rsi
lea r9, [rsi + rsi*4 + 0x201a2219]
mov dl, byte [r10 + rbx - 0x2a8bbff1]
mov r8d, r9d
ror r9d, 6
lea rbx, [rbx + r10*2 - 0x55177fe8]
sar r10d, 0x10
inc r8
mov byte [rax + rsi - 0x2a8bbff9], dl
sal r10, 0xbe
xadd r10w, r8w
ror r9, 0x75
mov ecx, dword [rdi + r10*4 - 0x387dc]
bts r10w, si
shr r8, 0x9f
lea rdi, [rdi + rsi*2 - 0x55177fee]
sar r8, 0xad
xadd r9d, r8d
xor ecx, ebp
not r8
xor ecx, 0xb9ab440c
neg ecx
lea ecx, [rcx + r10*8 + 0x6f82ae02]
imul r10d, esi
jno 0x140c23dc4
not ecx
call fcn.140c2879d
mov esi, 0x9c00052e
mov r9d, dword [rdi + riz]
movzx edx, sil
lea r8, [rdx*4 + 0x74b7eebe]
lea rdi, [rdi + rdx - 0x2a]
movsx eax, r8b
mul r8
xor r9d, ebp
lea r10, [rsi*8 + 0x4be07a4]
xor r9d, 0xd523e719
xor eax, r8d
lea r9d, [r9 + rdx*2 - 0x229e3f93]
jb fcn.140c22896
cwd
not r9d
btr si, r8w
btc r8, rsi
neg r9d
xor edx, 0x8fb17717
ror rax, 0x68
lea rcx, [r10 + rax + 0x5b14513b]
push rbp
add al, dh
ror al, 0x64
bswap rsi
xor dword [rsp], r9d
pop rbp
neg dl
movsxd r9, r9d
xadd si, ax
sal cx, cl
idiv r8b
add r11, r9
mov rax, qword [rbx + riz]
mov sil, byte [rax + riz]
and dl, ch
shl r10d, 0xbb
adc rbx, 6
movsx eax, cx
inc r10
mov word [rbx + riz], si
sub ecx, 0x34077902
sar cx, 0xe6
cwde
jmp r11
Function at 0x140c1696a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mul r10b
adc rdi, 3
cdqe
push rax
bswap eax
xor esi, ebp
not qword [rsp]
mul eax
xor esi, 0x6600df9c
sar eax, cl
cwd
dec esi
not esi
sub r9b, byte [rsp + rdx - 0x79b5fffa]
shl byte [rsp + rdx - 0x79b5fffa], 0x21
ror esi, 1
lea r8, [rdx + rdx*2 + 0x49a916ad]
mov qword [rsp + rdx - 0x79b5ffff], rbp
imul r10b
xor dword [rsp + rdx - 0x79b5ffff], esi
jmp 0x140c206c9
mov r9d, ecx
mov esi, dword [rdi + riz]
jmp 0x140bf5abe
xor dword [rsp + rdx - 0x3253], r8d
mov qword [rsp + rdx - 0x326b], 0xfffffffff93d7807
or dword [rsp + rdx - 0x325f], 0xc4a1338b
sar word [rsp + rdx - 0x325b], 0xb
mov rbp, qword [rsp + rdx*4 - 0xc994]
sar r9w, 0xae
sal dword [rsp + rdx - 0x3268], cl
movsxd r8, r8d
bswap ecx
add r11, r8
not rdx
add word [rsp + rdx*2 + 0x64e5], 0x8ab
jne 0x140beea36
mov r9, qword [rbx]
mov ecx, 0x933689bb
lea r10, [rcx + rcx*8 + 0x2687ad31]
mov rdx, qword gs:[r9 + riz]
mov qword [rbx + riz], rdx
lea rax, [r10*8 - 0x5edcde74]
jmp 0x140c10222

Function at 0x140c1b6c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdx
sbb cl, 0x98
mov qword [rsp + rsi*8 - 0x491a8], rdx
neg cl
mov qword [rsp + rsi - 0x9226], 0x827aeb6
rol cl, 1
btr edx, edx
sbb cl, r9b
call fcn.140c0789a

Function at 0x140c1b741
Capabilities:
Execute anti-debugging instructions

Disassembly:
add word [rsp + rcx - 0xffffff3], r10w
lea rdx, [rsp + rdx + 0x18]
lea rcx, [r10 + r10*2 + 0x34964034]
dec eax
shl esi, cl
mov word [rdx + rcx - 0x34964034], r9w
call fcn.140bf5667
dec ecx
bts r8d, r10d
bt r10, rax
lea rax, [rax + 0x8092e92]
bswap ecx
push r9
bswap rdx
shl qword [rsp + rax - 0x19132e13], 0x52
mov qword [rsp + rax - 0x19132e13], rbp
xchg r10d, eax
imul r9w, dx
movsx esi, r10b
xor dword [rsp + r8*4 - 0x4426bf38], ecx
sar dl, 0x85
div r10d
dec dl
pop rbp
shl r10b, 0x85
call fcn.140c1afca

Function at 0x140c1b7b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, esi
mov r9d, dword [rdi + riz]
movzx r10d, dl
mov eax, 0x21ae602a
cdqe
lea rdi, [rdi + r10*2 - 0x126]
mov ecx, 0xfd00d1b6
rol si, 0x81
add edx, r10d
xor r9d, ebp
bswap esi
imul rcx, rsi
dec r9d
neg r9d
btr ax, dx
bswap rcx
ror ecx, 0x4b
rol r9d, 1
jmp 0x140c21d49
mov qword [rsp + rsi*4 - 0x35c], rsi
imul rsi, rsi
neg edx
mov qword [rsp + rax - 0x4394f0f8], r8
mov qword [rsp + rsi - 0xb489], rbp
push rsi
call fcn.140c00a7d
seto byte [rsp + rcx + 0xd]
bswap edx
inc edx
mov qword [rsp + rcx + 0x10], rbp
mov r8d, 0x538a1c0c
xor dword [rsp + rcx + 0x10], edx
and dword [rsp + rcx*4 + 4], 0xbc85a804
dec dword [rsp + rcx*2 + 0xb]
mov rbp, qword [rsp + rcx*8 + 0x10]
jl 0x140bf0a05
mov esi, 0xff90cc95
jmp 0x140bf736e
add al, r10b
setge r10b
inc r9d
call fcn.140c0b565