joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14142ff65
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea rsi, [rsi + rdx + 0x77950fa8]
push r10
jl 0x14145b8e7

Function at 0x1414441ef
Capabilities:
Encode data using base64

Disassembly:
call fcn.14149e940
mov edx, 0x430e1797
jmp 0x14147f8e1
Function at 0x141445214
Capabilities:
Encode data using base64

Disassembly:
lea r10, [rcx + rax*8 - 0x2654afe1]
xor bpl, dil
mov qword [rsp + rdx*4 - 0x2cc], 0x279a5d93
sub r10b, dl
add bpl, 0x19
rol bpl, 1
push rcx
shr byte [rsp + rdx*2 - 0x172], 0xe6
bswap r10
not bpl
inc bpl
rol r10d, 0xbe
xadd dl, r10b
call fcn.14145158a

Function at 0x1414471b8
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sbb ecx, 0x9e36c2a0
neg r8b
movzx ebp, r11b
neg rax
ror ecx, 1
sub ecx, 0x8509c9a0
call fcn.141448a04

Function at 0x141448a04
Capabilities:
Encode data using base64

Disassembly:
jns 0x141472d3f
neg ecx
mov qword [rsp + rax*2 + 0x18], r8
rol ecx, 1
pop r11
mov qword [rsp + rax*4 + 0x10], rdi
and r10b, 0x8b
mov qword [rsp + rax*4 + 8], r8
xor dword [rsp + rax*8 + 0x10], ecx
sub byte [rsp + rax + 8], r10b
mov rdi, qword [rsp + rax + 0x10]
neg qword [rsp + rax + 8]
movsxd rcx, ecx
pop r8
movzx r11d, byte [rsp + rax*8 + 3]
add r9, rcx
ror r10b, 2
xor al, byte [rbp + rsi - 0x105]
lea rsi, [rsi + r11*4 - 6]
sal r11d, 0xdc
je 0x14143c319
xor al, dil
rol al, 1
inc al
xor al, bpl
inc al
xor dil, al
lea r11, [rdx*2 + 0x5b8fae02]
lea rax, [rsp + rax + 0x10]
call fcn.141490808
ror bpl, 1
jmp 0x1414c5a85
movzx r10d, al
not bpl
xor word [rsp + r8*2], r10w
movsx edx, r10b
rol word [rsp + r8 + 4], 0xc7
ror bpl, 1
not qword [rsp + r8*2]
xor dil, bpl
lea rbp, [rsp + rbp + 8]
mov byte [r8 + rbp], cl
add r10b, byte [rsp + r8 + 5]
mov word [rsp + r8*2 + 3], r10w
mov edx, dword [rsi + r8 - 5]
jo 0x14149eb50
call fcn.14142af01

Function at 0x14144c360
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.1414b984c
xor edx, edi
call fcn.14143d058
xor dil, bpl
shr dword [rsp + rdx*2 - 0x1905a], cl
dec qword [rsp + r11*2 - 0x19054]
sub word [rsp + r11 - 0xc823], 0xb1be
lea rbp, [rsp + rbp + 0x28]
neg qword [rsp + r11 - 0xc825]
mov r11d, dword [rbp + r11*2 - 0x19074]
not rdx
lea rbx, [rdx + rbx + 0xc837]
sub rdx, rcx
jl 0x141430f0f
mov qword [rsp + r8 - 0xa4], rdi
jmp 0x14143c10f
pop rdx
xor dword [rsp + r10*2 - 0x1bdb6], ebp
mov rdi, qword [rsp + rdx*2 + 0x7ad6afd0]
movsxd rbp, ebp
push rdx
xor word [rsp + r10 - 0xdedc], 0x9c03
adc r9, rbp
jmp 0x1414c03ac
lea rsp, [rsp + 0x10]
ja 0x14142c094
mov edx, 0x65acb2bd
mov rbp, rsp
lea ecx, [rdx - 0x65acb165]
sal dx, 0xa6
neg edx
xor dx, dx
lea rdx, [rbx + riz - 0x80]
jge 0x141436d77
inc edx
call fcn.14149c6e5

Function at 0x1414566c6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movsx ecx, bp
rdtsc
sal byte [rsp + r10 - 0x499ffed8], 0x65
lea rbx, [rbx + r10 - 0x499ffee9]
shl dword [rsp + r8*2 + 0x66dfa322], 0x95
mov qword [rsp + r8 + 0x336fd18b], rbp
mov dword [r10 + rbx - 0x499ffedd], eax
mov dword [rbx + r10 - 0x499ffee1], edx
pop rcx
pop r8
ja fcn.1414b7384

Function at 0x141456706
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add dl, 0x9b
movzx r8d, byte [rsp + rcx - 0x711accd2]
xor dil, dl
mov qword [rsp + r8*8 - 0x4f0], 0x66319295
jmp 0x141464c82
Function at 0x14145eb97
Capabilities:
Encode data using base64

Disassembly:
mov r10d, 0x5c9fabb0
mov r8, qword [rbx + r10 - 0x5c9fabb0]
movsx ecx, r10w
push rcx
pop rdx
mov bp, word [r10 + rbx - 0x5c9faba8]
movsx r11d, dx
movzx eax, dx
lea rbx, [rbx + r10 - 0x5c9faba6]
xadd al, dh
ror edx, cl
mov word [rax + r8 - 0xab5b], bp
jne 0x1414b45d2
ja 0x14142e211
xor dword [rsp + rcx - 0x1f31d2d9], r8d
lea rdx, [rdi + rbp*4 - 0x84e02d3]
mov rdi, qword [rsp + rcx - 0x1f31d2d9]
pop rcx
add rcx, 0xc37e
jmp rcx
and r11b, cl
not ecx
lea rsi, [rsi + rcx - 0x5453]
mov ecx, dword [rsi + rax - 0xab5b]
xor ecx, edi
neg rdx
xor dx, 0xda34
movsx r8d, r10w
not ecx
jp 0x14144bb12
mov eax, 0x2a01a791
movzx ebp, al
jmp 0x1414bcff7
lea rsi, [rsi + rax*2 - 0x54034f26]
add bpl, 0x29
lea r8, [rbp + rax*4 + 0x3abd2e1a]
mov edx, dword [rsi + rbp*2 - 0x174]
xor edx, edi
shl bp, 0x61
movzx ecx, al
lea edx, [rdx + rax*2 - 0x1e514d88]
jne 0x14142f506
mov eax, 0xdfb94030
mov ecx, eax
sub rsi, 2
movzx eax, word [rsi]
xor ax, di
movzx edx, cx
movzx ebp, cx
neg ebp
neg ax
mov r8d, ebp
inc ax
dec rdx
ror ax, 1
shl rcx, 0x84
xadd r8, rcx
mov r11d, edx
not ax
call fcn.141441075

Function at 0x141464f07
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
jne 0x1414c39c0

Function at 0x141466812
Capabilities:
Encode data using base64

Disassembly:
xor ebp, edi
inc ebp
xor r8b, r8b
mov edx, r8d
inc word [rsp + 0xc]
ror ebp, 1
mov ecx, 0x717fa09

Function at 0x14146ea45
Capabilities:
Encode data using base64

Disassembly:
and ax, 0xde3f
lea rbx, [rbx + rax - 0x6878a24]
lea r11, [rsp + rax*2 - 0xd0f143c]
lea rbp, [r8 - 0x43c84e45]
setne dl
mov dword [r11 + rax*4 - 0x1a1e28d0], ecx
movzx r10d, r8w
call fcn.1414a449f
lea rbp, [r10 + r10*4 - 0x34e8f872]
add r10w, word [rsp + r10*2 - 0x69583265]
inc r11d
rol r11d, 2
xadd word [rsp + r10*2 - 0x6958e2c8], r10w
lea r11d, [r11 + r10*2 - 0x34cd5e16]
not qword [rsp + r10*2 - 0x6958d2b0]
neg r11d
xchg word [rsp + r10 - 0x34ac6954], bp
mov qword [rsp + r10 - 0x34ac6958], rdi
movsx ecx, bp
xor dword [rsp + r10*2 - 0x6958d2b0], r11d
call fcn.1414b9f39
Function at 0x14147f875
Capabilities:
Encode data using base64

Disassembly:
call fcn.141460f5e
mov r8d, 0xbc3d550c
movzx eax, r8w
mov eax, dword [rsi + rax - 0x5510]
xor eax, edi
movzx ecx, r8w
jmp 0x141462871
lea eax, [rax + r8 - 0x5d143605]
movsx r11d, cl
sub rcx, rcx
jl 0x1414b9a0c
neg eax
sal rcx, 0x5f
sbb r8w, 0x6a8b
not eax
setg r8b
call 0x1414846af
movsxd r10, r10d
mov qword [rsp + rbp - 0x1680000], 0xffffffffffb7c229
sbb qword [rsp + rdx - 0x50bc412d], 0x6500c5a8
adc r9, r10
mov ebp, dword [rbx + rdx - 0x50bc412d]
xadd ax, cx
lea rbx, [rbx + rdx - 0x50bc4129]
adc dword [rsp + rdx - 0x50bc412a], 0x60b93007
lea rsi, [rsi + r8 - 0x40903b]
shr ecx, 0x1d
sub byte [rsp + r8*2 - 0x812071], r8b
shr al, 0xe7
movzx r10d, byte [rsi + rdx - 0x50bc412d]
sub dl, byte [rsp + r8 - 0x409034]
and dx, r8w
call fcn.1414c8d42
mov eax, dword [rsi + rdx - 0x430e179b]
xor eax, edi
movsx ebp, dl
inc eax
movsx ecx, dx
lea rcx, [rcx + rdx*2 + 0x74aad425]
bswap eax
push rdx
inc eax
mov r8d, dword [rsp + rdx - 0x430e1793]
sal word [rsp + rdx - 0x430e1792], cl
mov r10d, 0x73321395
neg eax
xor eax, 0x84197d2a
lea eax, [rax + rdx*2 - 0x620e489e]
inc r10b
ror edx, cl
mov qword [rsp + r8], rdi
ja 0x1414c34fe
movsx edi, r8b
xor dword [rsp + r8], eax
mov r11d, 0x84b752a0
pop rdi
movsxd rax, eax
shl ebp, 0xbc
neg dx
add r9, rax
inc bp
call fcn.1414578a3
mov qword [rsp + r10*2 - 4], rdi
xor ax, dx
adc r10, 0xffffffffc30e8aae
sal bpl, 0xc5
xor dword [rsp + rdx - 0x428a3f17], r8d
xor dx, bp
neg r10
pop rdi
mov ecx, r11d
sar rdx, cl
movsxd r8, r8d
jbe 0x1414a6c59
mov dword [rbx + r11 - 0x1ff05], r10d
call fcn.1414b6e1e
sub r8, 0xc
shr byte [rsp + 1], 0x43
js 0x141454ebc
mov dword [r8 + 0xc], eax
sub word [rsp + 0x18], bp
mov dword [r8 + 8], ebx
dec dword [rsp + 9]
movsx eax, bp
mov dword [r8 + rax*8 + 4], ecx
sbb bp, word [rsp + rax + 0x18]
mov dword [r8 + rax], edx
mov qword [rsp + rax*2 + 0x18], 0x1f371b34
mov r11, qword [rsp + 0x10]
add r11, 0x69ef0
jmp r11
shl ax, cl
adc r9, r8
rol al, cl
call fcn.14148fc82
xor ebp, 0x8784dca0
xadd r8w, cx
or rcx, rdx
bswap ebp
push rdi
mov edi, r11d
xor dword [rsp + rdx*2 - 0x60a], ebp
xadd r8b, al
sar di, 0x68
setne r8b
pop rdi
cmovns eax, r11d
call fcn.1414c01c3
jmp 0x14149eb94
lea r8d, [r8 + rdx*2 + 0x4a6e56d9]
movsx r10d, r11b
lea rbp, [r10 + 0x5116a4a1]
xor r8d, 0x24aa0c12
neg ebp
mov eax, 0x89822a23
inc r8d
xor r8d, 0x7431c9bf
mov qword [rsp + r10*2 - 4], rdx
jmp 0x14149914b

Function at 0x141482d52
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push 0xffffffffdf0c4e29
not byte [rsp + 1]
pushfq
pop qword [rsp]
call fcn.141490ce9
not r8d
lea r8d, [r8 + r10*8 + 0x213916f0]
ror rcx, cl
ror qword [rsp + rax - 3], 0xa
not r8d
ror r10d, 0xe
call fcn.14148519d

Function at 0x141483c86
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor dil, r11b
rol r10b, 0xe5
mov qword [rsp + r8 + 0x18], 0xffffffffc323e1ad
lea r11, [rsp + r11 + 0x20]
inc r10d
sub r10b, byte [rsp + r8 + 0x1a]
mov byte [r11 + rcx*2], bpl
ja 0x141495ace
mov edx, dword [r8 + rsi - 5]
xor edx, edi
ror ecx, 0x37
not edx
lea rbp, [r8 + rcx - 0x141fc6d]
call fcn.14143fbff
Function at 0x14148729d
Capabilities:
Encode data using base64

Disassembly:
mov qword [rax + rbx - 0x47b4a393], r11
neg r10b
xchg r10, r8
mov r8, qword [rbx + r10 - 0x47b4a393]
mov ecx, 0xe3a561f
lea rbx, [rbx + rax - 0x47b4a38b]
movsx edx, al
ror rdx, 0x22
movzx r10d, word [rax + rsi - 0x47b4a397]
xor r10w, di
sub cl, 0xbd
mov r11d, 0x380f0aa3
xor r10w, 0xab9f
inc r10w
jmp 0x14147e8bd
call fcn.141470f27
rol bp, 1
movzx eax, byte [rsp + 8]
neg bp
movzx r8d, cx
call fcn.1414aa9db
mov eax, 0x47b4a395
mov r11d, eax
mov r11, qword [rax + rbx - 0x47b4a395]
mov cl, byte [rbx + rax - 0x47b4a38d]
mov r8d, eax
lea r10, [r8*2 - 0x3dcba4de]
shr r11, cl
jmp 0x1414c12ea
jmp 0x14142eeab
Function at 0x14148d9b9
Capabilities:
Encode data using base64

Disassembly:
add r11, rsp
add dx, r10w
xadd bp, dx
sbb ebp, ebp
mov cx, word [r11 + rcx*4 - 0x3fcc8]
mov word [r10 + rbx - 0x5b4d5381], cx
movsx r11d, dl
lea r8, [rax + rbx - 0x6284a7fa]
shl dl, 0x27
adc dl, 0x80
jg 0x14149eb77
mov qword [rbx + rax - 0x6284a802], r8
lea rbx, [r10 + rbx - 0x5b4d5389]
mov eax, dword [r11 + rsi - 0x39]
mov ecx, r11d
lea rsi, [r11 + rsi - 0x39]
call fcn.1414487eb
rol r10, 0x1c
sbb rsi, 4
jmp 0x141479fc6
movzx r11d, word [rsi + rcx*4 - 0xb2]
sar rbp, 0xc5
xadd cl, bpl
xor r11w, di
not cx
pop rbp
movsx edx, cx
neg r11w
movzx ebp, cx
movsx eax, dl
lea r10, [rax*4 + 0x6284a730]
inc r11w
inc rbp
ror r11w, 1
not r11w
xchg r10d, eax
xor di, r11w
sub r10d, 0xa4b2acb3
jb 0x141428f5d
lea eax, [r11 + rax - 0x2aaab25f]
xor ebp, ecx
bswap eax
lea r10, [rbp*4 - 0x61646ef1]
push rdi
jl 0x1414b2006
adc r11w, 0x340b
or dl, 0xaa
xor dword [rsp + rdx - 0x7f1266ab], eax
call fcn.1414ca517

Function at 0x14148fb12
Capabilities:
Encode data using base64

Disassembly:
shr r11, 0x76
sal rcx, 0xe7
add qword [rsp + r11*2 + 0x10], rdi
jmp 0x1414a2f21
mov rdi, qword [rsp + r11 + 0x10]
neg r10d
sal word [rsp + r11*2 + 9], 0x67
movsxd r8, r8d
adc r9, r8
sub r11w, word [rsp + r11*2 + 8]
sal byte [rsp + r11 - 0xff38], 0xe1
pop rdx
pop rax
pop rdx
jae fcn.1414b7384
sal r11b, 0x21
neg r8d
not rcx
rol r11w, cl
mov qword [rsp + rax*4 - 0x3fef4], rdx
inc r8d
jmp 0x141433cf3
neg cx
and eax, 0x69024e0b
xor dword [rsp + r11 + 0x10], r8d
jmp 0x14147f848
Function at 0x141493b6b
Capabilities:
Encode data using base64

Disassembly:
neg rcx
sal rax, 1
inc rcx
neg rcx
xor rdi, rcx
mov qword [rbx + rbp - 0x3821fef0], rcx
jmp 0x14148652e
push r8
mov r11d, dword [rsi + r11 - 0x244e4149]
shl dword [rsp + rbp - 0x3821fefb], 0x65
and r8, 0xffffffffbdaecc98
xor al, r8b
lea rsi, [rbp + rsi - 0x3821ff0d]
movsx ecx, al
xor r11d, edi
add dword [rsp + rbp - 0x3821fef6], eax
inc r11d
and ax, word [rsp + rbp - 0x3821fefe]
add rdx, qword [rsp + r8 - 0x4080c88]
xor word [rsp + r8*4 - 0x10203237], cx
bswap r11d
shl byte [rsp + rbp - 0x3821fefa], 0xc2
pop rax
inc r11d
rol qword [rsp + r8*2 - 0x8101920], cl
setae r8b
setb byte [rsp + rbp - 0x3821fefd]
neg r11d
sar bp, 1
xor r11d, 0x84197d2a
inc r8b
jne 0x1414bcac0
lea rbx, [rbx + rbp*2 - 0x7043fdf0]
jmp 0x141482842
bswap edx
inc r8b
lea rax, [rax + rcx*4 - 0x3c4fdf7c]
mov qword [rsp + rcx*2 - 0x10e], 0xffffffffa19eef24
xor dil, r8b
xadd bp, dx
add rbp, 0x25b6ba0e
lea r8, [rsp + r8 + 0x10]
lea r11, [rbp*2 - 0x41e8ae7e]
mov word [r8 + rcx*2 - 0x10e], r10w
sub rcx, 0x782f061e
pop rdx
mov qword [rsp + rcx + 0x782f0597], r11
mov r8, qword [rbx + rdx + 0x5e6110de]
sar ecx, 0x9c
sets al
jnp 0x1414a3644
mov r10d, 0x721f3e96
call fcn.1414b84b2
mov qword [rax + r11 - 0x162a0f12], r8
lea rbp, [rax - 0x4e4b496d]
mov rcx, qword [rbx + rax*4 - 0x58a83c38]
sub bp, bp
shl eax, 0x6c
movzx eax, byte [rsi + rbp + 0x3821ffff]
xor al, dil
dec al
push rbp
xor al, 0x27
lea r11, [rbp*2 - 0x537ab1dc]
lea r8, [rbp*2 + 0x748d2f2e]
sub al, 0x86
neg al
movsx edx, r11w
not bpl
sub al, 0x8c
bswap r11d
xor dil, al
not dword [rsp + rbp + 0x3821ff05]
lea rax, [rsp + rax + 8]
neg word [rsp + r11 - 0x244e4137]
mov qword [rax + r11*2 - 0x489c8278], rcx
mov rcx, qword [rsi + rbp*2 + 0x7043fdf9]
sbb r8b, 0x9a
xor rcx, rdi
xor word [rsp + rbp + 0x3821ff06], bp
not ebp
rol rcx, 5
mov eax, 0xc190c81d
jmp 0x141474be1
mov rdx, qword [rbx + rdx + 0x5e6110e6]
mov qword [r8], rdx
adc word [rsp + 6], 0x2331
setns cl
setl bpl
mov rax, qword [rsi - 9]
inc byte [rsp]
xor rax, rdi
shl dword [rsp + 4], 0xa6
push r11
rol rax, 5
neg rax
movsx r10d, cl
mov edx, dword [rsp + r10 + 7]
add rax, r10
or r11w, 0x62ad
jne 0x141442b03
lea r11d, [r11 + rbp - 0x141418f0]
mov qword [rsp + r8 - 0x4080c01], rdi
xor dword [rsp + rbp*2 - 0x7043ff00], r11d
add r8, 0xffffffffc22af19a
sub bp, bp
pop rdi
movsxd r11, r11d
lea rax, [rdx + rax - 0x12feea7c]
adc r9, r11
jmp r9

Function at 0x141495608
Capabilities:
Encode data using base64

Disassembly:
movsxd r11, r11d
mov qword [rsp + rbp*4 - 0x2cc90], r8
ror r10d, 0x5d
call fcn.141457d8a
Function at 0x14149561c
Capabilities:
Encode data using base64

Disassembly:
shr qword [rsp + r11 - 0x77], 0x9b
lea rbx, [rbx + rdx - 0x28b27ee2]
sub word [rsp + rdx*2 - 0x5164fdb9], r10w
lea rbp, [rsp + rdx*2 - 0x5164fd90]
movzx r8d, byte [rsp + r11*2 - 0x11c]
mov byte [rbp + rdx - 0x28b27ee8], al
sbb word [rsp + r11 - 0x92], r8w
and r8, r8
jp 0x14149aa45
xor r11d, 0x8838131f
dec rbp
lea rsp, [rsp + 0x20]
jne 0x1414b7704
pop rbx
not r11d
mov r8d, 0xfd1eb82c
call fcn.141427ec7
xor r8d, 0x648b0b35
lea r8d, [rdx + r8 - 0x2d3b52bf]
sar qword [rsp + rdx*2 - 0x120], 0xeb
neg r8d
add qword [rsp + rdx*2 - 0x120], rdi
xor dword [rsp + rdx*2 - 0x120], r8d
mov rdi, qword [rsp + rdx - 0x88]
push r11
movsxd r8, r8d
mov qword [rsp + rdx - 0x80], rdx
add r9, r8
push rbp
xadd r10b, dl
mov ax, word [rbx + rdx*8 + 4]
lea rdx, [rbp*8 + 0x28b27a30]
js 0x1414861c8
mov r11d, 0xa8b7a321
call fcn.1414a6e23
mov qword [rsp + rdx*2 - 0x5164fdd0], r9
ret 0x20
mov ebx, 0x6325e905
movzx ebx, byte [r8 + rbx - 0x6325e905]
call fcn.1414c75ed

Function at 0x141497396
Capabilities:
Encode data using base64

Disassembly:
movsxd r10, r10d
adc r9, r10
mov qword [rsp + r8*2], rax
lea r10, [rax*8 - 0x54540b68]
call fcn.141464954
push r11
lea rbp, [rsp + rbp + 0x30]
xor word [rsp + r11*2 - 0x631d5956], 0x32ab
mov qword [rsp + r11 - 0x318eaca4], rax
movsx edx, r11w
mov r8d, dword [rbp + r11 - 0x318eacac]
call fcn.1414a81ef

Function at 0x1414973d8
Capabilities:
Encode data using base64

Disassembly:
movsx r10d, cx
xadd rbp, rcx
xor dword [rsp + rcx - 0xffbd], r11d
call fcn.14145495f
jmp 0x14149eaf6
mov eax, 0x45169d3a
mov r11d, 0x4216f016
mov edx, dword [rbx + rax - 0x45169d3a]
movzx r10d, r11w
sal r10d, 0x37
lea rbp, [rax*8 - 0x11f657de]
mov eax, dword [rbx + rax - 0x45169d36]
neg r11d
movsx ecx, r11b
and cx, 0x6783
mov r10d, dword [rbx + r10*8 - 0x57fffff8]
lea rbp, [r11 + rbp*8 + 0x6d16250d]
dec cl
push r11
div r10d
call fcn.14145422b

Function at 0x1414a0234
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rax], 0xffffffffa60e6913
ror word [rsp + rax*2 + 4], 0xee
mov qword [rax + rdx], rbp
xadd byte [rsp + rax + 6], r8b
neg cx
mov ebp, dword [rsi + rax - 5]
adc r11b, byte [rsp + rax + 5]
lea rsi, [rax + rsi - 5]
call fcn.14148301f

Function at 0x1414a41b8
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
mov edx, ebp
pop rbp
call fcn.141429682

Function at 0x1414a4c5f
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea r11, [rsp + r11 + 0x28]
mov dword [r11 + r8], ebp
mov r11w, word [r8 + rbx + 4]
mov ebp, dword [rsp + r8*8 + 0x13]
lea rbx, [r8 + rbx + 6]
sub cl, bpl
mov bp, word [rsi + r8*4 - 3]
xor bp, di
sub r8b, 6
ror bp, 1
shl r8w, cl
jb 0x14145d74c
dec bp
xchg qword [rsp + 8], r10
add r10, 0x103a
jmp r10
Function at 0x1414ace51
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ecx
call fcn.1414abbd0
lea rbx, [rbx + rdx - 0x1ec744]
mov qword [rsp + rdx*2 - 0x3d8e9c], r9
ret 0x10
not cl
xchg dword [rsp + r8 - 0x35e8fff5], r11d
sbb cl, bpl
inc r8b
or r8b, al
not cl
adc dword [rsp + r8 - 0x35e90008], 0xd2157ab3
sbb qword [rsp + r8 - 0x35e9000b], rdx
shr ax, 0xcc
adc cl, bpl
xadd dword [rsp + r8 - 0x35e9000a], edx
jo 0x14144e2db
jnp 0x14148a4fa
xor dil, cl
lea rcx, [rsp + rcx + 0x18]
call fcn.14149d96c
not bp
add r8w, 0xbe11
pop rcx
neg rdx
and word [rsp + rbp*2 - 0x1740dbcb], r10w
neg r8w
call fcn.141454c3d
not r10d
inc r10d
bswap r10d
add qword [rsp + r11 + 0x10], rdi
mov qword [rsp + r11], r8
call fcn.14145aa03
not byte [rsp + rbp*4 - 0xbba2]
not cx
add dword [rsp + rbp*8 - 0x1773d], 0xc188a704
movzx eax, r10w
rol al, 0x22
xor di, cx
mov qword [rsp + rbp*2 - 0x5dc2], 0x60a1b194
lea rcx, [rsp + rcx + 0x18]
xchg dword [rsp + rbp*4 - 0xbb95], ebp
neg bp
mov dx, word [rcx + rax*2 - 0x53a2]
mov word [rbx + rax*2 - 0x53a6], dx
mov r11d, dword [rsi + rax*2 - 0x53aa]
add r8w, r8w
js 0x1414caaa9
lea rsi, [rsi + rax*2 - 0x53aa]
xor r11d, edi
movzx edx, bpl
movzx ecx, bp
ror dword [rsp + rax*4 - 0xa73e], 0xa
adc r11d, edx
add qword [rsp + rax - 0x29c3], rcx
shr bpl, 0xe5
ror r11d, 3
pop rcx
lea r11d, [r11 + rax - 0x32b79d5d]
and word [rsp + rax*2 - 0x53a2], dx
rol r11d, 1
or ax, 0xb438
xor word [rsp + rax - 0xbdf0], cx
not bpl
mov qword [rsp + rax*8 - 0x5efc0], rdi
xor dword [rsp + rax - 0xbdf1], r11d
rol word [rsp + rax*2 - 0x17bef], 0x4e
sal dx, cl
sub rdx, 0x7b8e50a7
mov rdi, qword [rsp + rax - 0xbdf1]
movsxd r11, r11d
add r9, r11
ror bp, cl
mov ax, word [rax + rbx - 0xbdfd]
sar edx, 0x95
mov cx, word [rbx - 2]
js 0x1414cb190
push r8
or ax, cx
mov byte [rsp + 9], dl
not ax
mov word [rbx - 2], ax
mov qword [rsp + 0x10], 0x5085cf07
shr r8w, 0x44
adc rbx, 0xfffffffffffffffe
call fcn.1414b520c
or r11b, al
jge 0x141499566
mov ebp, 0xd4127b96
movzx r8d, bp
mov rcx, qword [r8 + rbx - 0x7b96]
sub r8w, r8w
mov r10d, ebp
movzx r11d, bp
lea rbx, [rbx + r8*2 + 8]
shl r10w, 1
movsx eax, r8w
not r10
movzx r10d, word [rsi + rax*2 - 2]
movsx edx, ax
xor r10w, di
dec dx
add r11d, ebp
call fcn.1414a7c43

Function at 0x1414b969b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movzx r8d, r11w
neg qword [rsp + r11 - 0x20]
mov dword [r11 + rbx - 0x2c], ecx
mov edx, r8d
and r10, r8
lea rbx, [r11 + rbx - 0x2c]
pop rbp
pop rbp
jp fcn.1414b7384

Function at 0x1414b96bc
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov word [r10 + rcx*2 - 4], r8w
lea rsi, [rsi + rcx*8 - 0x14]
lea r11, [r11 + rax*2 + 0x4cbd2321]
mov ebp, dword [rdx + rsi - 0x60101db2]
call fcn.141452e8a
Function at 0x1414b98c0
Capabilities:
Encode data using base64

Disassembly:
not edx
mov qword [rsp + r11 - 0x26], r10
mov qword [rsp + r11*4 - 0x90], rcx
sub dword [rsp + r11 - 2], ecx
mov dword [rbx + r11*4 - 0x90], edx
mov eax, dword [rsp + r11*8 - 0x10e]
mov qword [rsp + r11 + 2], rax
lea rbx, [rbx + r11*2 - 0x44]
mov eax, dword [rsi + r11*4 - 0x9e]
movsx edx, byte [rsp + r11 + 0xe]
dec rdx
movsx ebp, r10w
lea rsi, [rsi + r11*2 - 0x52]
xor eax, edi
lea r8, [r10 + 0x5f1715b7]
inc eax
pop r11
sal qword [rsp + rcx*4 - 0x73937713], 0xc
xor eax, 0x8d0a109b
mov word [rsp + rcx - 0x1ce4dda3], 0xbb4
ror word [rsp + rcx - 0x1ce4dda1], cl
dec eax
sal qword [rsp + rcx*2 - 0x39c9bb7a], cl
neg eax
shl ebp, 0xee
xchg ebp, edx
mov qword [rsp + rcx*4 - 0x73937710], rdi
movsx edi, word [rsp + rdx*2 - 0xf48000]
xor word [rsp + rcx - 0x1ce4ddc6], bp
ror di, 0x81
xor dword [rsp + rcx - 0x1ce4dda6], eax
mov rdi, qword [rsp + rdx*4 - 0x1e8ffd8]
movsxd rax, eax
add r9, rax
and r11d, 0x7e0c9894
or rcx, 0x26234e1d
call fcn.1414c837a

Function at 0x1414befb7
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rcx - 0x3600fa2f], rbp
lea rcx, [r10 + rcx - 0x1675cd54]
neg r11w
rol bpl, 0x23
dec r8
xchg rbp, rcx
xor di, r11w
lea r11, [rsp + r11 + 8]
mov rbp, qword [r11 + rcx*4 - 0x1e4]
lea rax, [r10 + rdx - 0x7fe9f37a]
xadd word [rsp + rcx - 0x73], dx
dec rcx
mov qword [rcx + rbx - 0x80], rbp
call fcn.1414583ab
Function at 0x1414c39b5
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rax*4 - 0x110], r8d
jmp fcn.141466593
mov eax, 0x5991df15
not ax
mov rax, qword [rbp + rax - 0x599120ea]
sub rsp, 0x20
call fcn.141439eb2
cpuid
lea rbp, [rbp + r10*4 - 0xc]
sar r8d, 0x49
sbb r10, 0x3197b85
mov dword [rbp + r8*4 - 0x9c7840], eax
inc r8w
jno 0x14146d460
xchg byte [rsp + r11*2 - 0x5e17f3fe], r10b
movzx ebp, byte [rsi + rcx*2 - 0x1f570]
shr r11w, 0x6b
and qword [rsp + r11*2 - 0x5e160036], r8
xor bpl, dil
ror bpl, 1
call fcn.141454dea
mov r10d, 0x7932af97
mov rax, qword [r10 + rbx - 0x7932af97]
lea rbp, [r10 - 0x20e07fcf]
mov r10, qword gs:[rax + r10 - 0x7932af97]
mov qword [rbx + rbp - 0x58522fc8], r10
call fcn.14147eb3f
mov r8d, dword [rax + rsi - 0x44]
xor r8d, edi
push rbp
lea rcx, [rax - 0x44d7c5e0]
neg r8d
dec word [rsp + rax*2 - 0x83]
lea r8d, [r8 + rax*8 + 0x23ae2770]
xchg qword [rsp + rax*4 - 0x110], rdx
ror r8d, 1
movzx r10d, byte [rsp + rax - 0x42]
inc ebp
inc r8d
sub qword [rsp + rax - 0x44], rdx
mov qword [rsp + rax - 0x44], rdi
movzx r11d, bp
jno 0x14144f803
mov eax, r8d
neg al
lea rbx, [rbx + rcx + 0x3143b5e2]
or r8b, al
mov qword [rsp + rcx + 0x3143b5e0], r9
ret 0x28
adc r9, rax
pop rbp
pop rbp
pop rbp
pop rbp
pop rdx
pop rbp
jmp fcn.1414b7384
mov dword [rbp + r8 - 0x271e0c], ebx
mov dword [rbp + r8 - 0x271e10], ecx
movsx ecx, r10b
movzx ebx, r11w
mov dword [rbp + r8*4 - 0x9c7850], edx
pop rbx
jns 0x1414be5dd
jp 0x14146799a
call fcn.141432b42
mov eax, dword [rsi - 4]
xor eax, edi
mov r10d, 0xe3c8eb4
xor eax, 0x18d9026
mov r8d, 0xe9270b3c
lea eax, [r10 + rax - 0xe09f21b]
movzx ecx, r10b
ror eax, 1
jmp fcn.141485c35
not r10
mov rbx, rbp
js 0x1414687b3
xor r8b, 0x99
jae fcn.1414b7384
lea rsp, [rsp + 0x10]
je 0x141464f12
mov rax, qword [rbp + rbx*8]
call fcn.141491fb1
mov ebp, 0xb92618a0
movsx ecx, al
mov qword [rsp + rax*4], r9
ret 0x10

Function at 0x1414c8d42
Capabilities:
Encode data using base64

Disassembly:
call fcn.141439564
call fcn.141490a57
xor r10b, dil
dec r8w
ror r10b, 1
mov qword [rsp + rdx - 0x50bc0008], 0x786dfb4
neg r10b
neg r8b
rol r10b, 1
add r10b, 0x18
shl byte [rsp + r8*2 - 0x81218b], cl
rol r10b, 1
inc qword [rsp + r8 - 0x4090c2]
xor dil, r10b
jmp 0x1414b0b10
Function at 0x14000493c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004986
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004986
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004986
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004986
cmp dword [rcx + 0x84], 0xe
jbe 0x140004986
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004988
xor al, al
add rsp, 0x28
ret

Function at 0x14000984c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009678

Function at 0x1400125b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400125d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400125d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001a18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a64
xor al, al
add rsp, 0x28
ret

Function at 0x140005c1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005a0c