joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180031c60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, 0xffffffff
mov rcx, qword [0x1800fe410]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
lea rcx, [0x1800fdff0]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180031d13
mov r9d, 2
mov dword [rsp + 0x58], 0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, rbx
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1800fe410]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180038920
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x180066da0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x140044d0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14007e180]
test rax, rax
je 0x140044d56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140044d56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140044d56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140044d56
cmp dword [rcx + 0x84], 0xe
jbe 0x140044d56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140044d58
xor al, al
add rsp, 0x28
ret

Function at 0x14004f2a4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004f3ec

Function at 0x14004f3ec
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14004f3ec
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004f45b
xor ecx, ecx
call qword [0x14007e180]
test rax, rax
je 0x14004f45b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004f45b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004f45b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004f45b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004f45b
cmp dword [rcx + 0xf8], 0
je 0x14004f45b
mov ecx, ebx
call fcn.14004f324
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004f580
nop
cmp dword [rbp + 0x20], 0
je 0x14004f4a9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004f3b8
int3
Function at 0x1400571a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
test r8, r8
jne 0x1400571c0
call fcn.14004fee4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1400508cc
xor eax, eax
add rsp, 0x28
ret
test rdx, rdx
je 0x1400571a9
test rcx, rcx
jne 0x1400571cf
cmp qword [r8], rcx
je 0x1400571a9
add rsp, 0x28
jmp 0x1400571d8
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140083040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r10d, r10d
mov rdi, r8
mov eax, r10d
mov r11, rdx
cmp rax, 0x20
mov r9, rcx
jae 0x1400572f7
mov byte [rsp + rax + 0x20], r10b
inc rax
cmp rax, 0x20
jl 0x140057202
movzx r8d, byte [r11]
inc r11
mov edx, r8d
mov eax, r8d
shr rdx, 3
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
mov byte [rsp + rdx + 0x20], cl
test r8b, r8b
jne 0x140057216
test r9, r9
jne 0x140057243
mov r9, qword [rdi]
movzx r8d, byte [r9]
mov edx, 1
mov eax, r8d
mov ecx, r8d
and ecx, 7
shr rax, 3
shl edx, cl
mov r11, r9
test byte [rsp + rax + 0x20], dl
je 0x14005729a
mov rsi, r9
mov bl, r8b
mov r8b, bl
test bl, bl
je 0x14005729a
lea r9, [rsi + 1]
mov edx, 1
movzx ebx, byte [r9]
mov r11, r9
mov eax, ebx
mov ecx, ebx
and ecx, 7
shr rax, 3
shl edx, cl
mov rsi, r9
mov r8b, bl
test byte [rsp + rax + 0x20], dl
jne 0x14005726a
mov rbx, r11
test r8b, r8b
je 0x1400572d5
mov al, byte [r11]
movzx r8d, al
mov edx, 1
mov ecx, r8d
inc rbx
and ecx, 7
shr r8, 3
shl edx, cl
test byte [rsp + r8 + 0x20], dl
jne 0x1400572cf
mov al, byte [rbx]
mov r9, rbx
test al, al
jne 0x1400572a5
jmp 0x1400572d5
mov byte [r9], r10b
mov r9, rbx
cmp rbx, r11
mov qword [rdi], r9
cmovne r10, r11
mov rax, r10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005ade0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.14005ee1c
int3

Function at 0x1400578e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140057908
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140057908
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1403b03cd
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xchg di, ax
dec dword [rsp + r10 - 0x55335671]
inc cx
inc di
js 0x1403bbc34
not cx
ror qword [rsp + rax - 0x7389], 0xdc
call fcn.1403c75dc
mov qword [rsp + rbx*8 - 0x1c780], rsi
adc cl, 0x25
pop rsi
xor dword [rsp + rbx*2 - 0x71e2], ebp
pop rsi
lea rax, [rax + r10*4 + 0x7c924193]
movsxd rbp, ebp
add r9, rbp
lea rbp, [rdi + 0x419271c]
xor r10, r9
jmp r10
Function at 0x1403b165a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not dx
rol r10d, cl
sar rdi, 0x5e
mov qword [rsp + r10*2 - 0x393886], 0xfffffffff009e391
ror dx, 1
xor si, dx
pop rbp
lea rdx, [rsp + rdx + 0x10]
mov rbp, qword [r10 + rdx - 0x1c9c43]
push r10
dec qword [rsp + r10 - 0x1c9c33]
mov edx, r10d
lea r8, [r8 + r10*8 - 0xe4e220]
jg 0x1403e1572
xchg byte [rsp + r10*4 - 0x7270f5], cl
mov qword [r10 + r8 - 0x1c9c43], rbp
movsx ebp, dl
pop rdx
pop rbx
pop rdx
jge fcn.1403c82e3
Function at 0x1403b6fc1
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea r10, [rbp + rbp*4 + 0x110cb5a1]
not ax
adc r9, rcx
mov r10, qword [r8 + rdi]
sub byte [rsp + rdi*4 + 0x17], 4
seto al
mov cl, byte [r8 + rdi + 8]
ror bpl, 1
lea r8, [rdi + r8 + 2]
neg rdx
shr r10, cl
mov qword [rsp + rdi], rdi
mov qword [r8 + rdi*2], r10
call fcn.1403d7bcd

Function at 0x1403b9d7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl ebp, 0x7d
mov qword [rsp + rbx - 0x1b5100], rsi
sar bl, 6
jns 0x1403c0403
adc rbp, r8
sal dx, 7
mov ebx, eax
mov edx, ebx
push 0xfffffffffd1623a7
xor ecx, ecx
push 0xffffffff9e2b1321
cmp ebx, 4
not byte [rsp + 0xe]
lea rsp, [rsp + 0x10]
jbe 0x1403c0441
mov edx, 0x13940d1d
rol dx, 0x44
lea edx, [rdx - 0x1394d1cc]
lea ecx, [rbx - 4]
mov eax, 0x69ab282a
shl ecx, 3
sar al, 0x87
sal edx, 3
and rax, rax
add rax, 0x1fae9790
mov rax, rbp
call fcn.1403bf409
lea r11, [r11 + r10 - 0x1927d1b6]
movsx edi, dl
mov ebx, dword [r11 + r10*2 - 0x324fa364]
and dil, r10b
movsx ecx, dl
xor ebx, esi
sub cl, dil
and r10b, dil
lea ebx, [r10 + rbx - 0x795c74a3]
movzx ebp, r10b
add r10b, r10b
xor ebx, 0x6c9d479f
xadd r10d, edx
sub dl, bpl
push rdi
not ebx
inc ebx
dec r10
add qword [rsp + r10 - 0x1927d0e6], rbp
rol ebx, 3
jmp 0x1403e51bb
dec di
xor dword [rsp + rdx*4 - 0x649f4688], ebx
movzx esi, bpl
not cx
pop rsi
xor dl, dl
movsxd rbx, ebx
call fcn.1403c0b11
bswap ebx
or r10, 0xffffffffdd12b0b7
shr bp, 0x6c
lea ebx, [rbx + rcx - 0xb6475d9]
mov qword [rsp + rdx - 0x1927d1a2], rsi
jbe 0x1403d817f

Function at 0x1403bae19
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec ax
pop rbp
mov ebp, 0x5727ec18
not ax
jmp 0x1403d1fc1
mov eax, dword [r11 + rdx*4]
xor eax, esi
xor ebp, edx
inc eax
call fcn.1403b0374
jmp 0x1403d54e9
jmp 0x1403db29c
movzx di, byte [r8]
mov al, byte [r8 + 2]
mov edx, 0x7126a73a
ror dl, 0x82
lea r8, [r8 + rdx - 0x7126a78c]
or dil, al
not dil
movzx eax, dl
mov r10d, eax
mov word [r8 + rax*4 - 0x238], di
lea r11, [rdx + r11 - 0x7126a792]
mov ebx, 0x73a0933d
neg rbx
inc dl
mov eax, dword [r11 + rdx - 0x7126a78f]
jl 0x1403ba44b
xor si, ax
add rax, rsp
shl rbx, cl
push rbx
movzx bx, byte [rax + rcx - 0x35b28b03]
movzx eax, cx
and bp, word [rsp + rcx - 0x35b28b00]
mov r10d, 0x3106a188
lea r8, [r8 + rcx - 0x35b28b05]
shl dword [rsp + rdx + 4], cl
mov word [rcx + r8 - 0x35b28b03], bx
lea r11, [rcx + r11 - 0x35b28b07]
jbe 0x1403cc062
Function at 0x1403bb213
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movsx edx, bl
xor r10d, esi
sub rcx, rcx
bswap r10d
sal bp, 1
sar bpl, 0x66
ror r10d, 1
neg r10d
lea rdx, [rdx + rbp*4 + 0x13dfd96]
push rcx
rol r10d, 1
and ecx, ebx
add rcx, rcx
lea rdx, [rdx + rbp*4 + 0x1224706]
bswap r10d
or qword [rsp + rcx], rsi
and bx, cx
xor dword [rsp + rcx*2], r10d
neg cl
pop rsi
movsxd r10, r10d
lea rdi, [rdx + rbx*4 + 0x6490af37]
shl bx, 0xa6
rol bx, 1
adc r9, r10
mov eax, 0xbfbc7d9f
inc ax
jns 0x1403bf491
mov rdx, qword [r8]
mov eax, 0x772dc7ab
movzx ebx, ax
mov rbp, qword gs:[rbx + rdx - 0xc7ab]
mov qword [rbx + r8 - 0xc7ab], rbp
movsx ecx, bl
lea r11, [r11 + rbx*2 - 0x18f5a]
lea rdi, [rbx + rcx*8 - 0x30c8744a]
mov eax, dword [rax + r11 - 0x772dc7ab]
jmp 0x1403d16f1
mov ebp, dword [r11 + rax - 0x73148419]
xor ebp, esi
sub ebp, 0x300eb594
sal r10b, 0xc4
movsx edi, al
je 0x1403dad39
neg ebp
mov edx, 0xf9ba7a31
shl dil, 0xa7
rol ebp, 1
sar al, 0x84
movsx ecx, al
xor ebp, 0xf0b96b32
call fcn.1403debca
mov edi, 0xa8bcb4a8
movsx eax, di
movsx r10d, ax
sub r11, 4
movzx edx, al
movsx ebx, di
mov ebx, dword [r11 + rdx*8 - 0x540]
add edx, edi
shl eax, 0xf3
xor ebx, esi
shl rax, 0x4c
bswap ebx
jns 0x1403d2430
mov r10, qword [r8]
mov rdi, qword [r8 + 8]
mov qword [rsp], rcx
jg 0x1403d5e22
movsx ecx, bl
mov rdi, qword [r8 + rcx - 0x11]
movsx r10d, cx
mov rdx, qword gs:[rdi + rcx*4 - 0x44]
mov qword [r8 + rcx - 0x11], rdx
neg r10
jbe 0x1403e23fe
shl cx, 0x47
jnp 0x1403ce293
mov ebx, dword [r11 + rcx*4 - 0x283d2c00]
jns 0x1403c37bf
lea rdx, [rcx + rcx*2 - 0x3d5c33c2]
rol eax, 1
mov qword [rsp + rcx - 0x528cc2b4], rsi
xor dword [rsp + rcx - 0x528cc2b4], eax
lea r10, [rbx*2 - 0x3fd3e05f]
pop rsi
add rbx, 0xffffffffbdb6be96
movsxd rax, eax
call fcn.1403c022c
jb 0x1403c5683
mov qword [rsp + rbx - 0x20073b32], rbx
mov dword [r8 + rbx*2 - 0x400e7674], ebp
mov qword [rsp + rbx*2 - 0x400e7674], r9
ret 8
xor eax, esi
mov r10d, ecx
movzx ebp, di
xor edi, r10d
bswap eax
inc rcx
call fcn.1403e5786
sal dl, 0xc2
xchg byte [rsp + rbp*4 - 0x52076], bl
mov rsi, qword [rsp + rbp*2 - 0x2902e]
not word [rsp + rbp*2 - 0x2903d]
dec edx
call fcn.1403c8b43
lea rbp, [r10 + r10*4 - 0x5156b0ce]
neg ebx
dec al
not ebx
call fcn.1403c43a8
mov ecx, 0xa0f8e96
movsx r10d, cl
lea r11, [rcx + r11 - 0xa0f8e9a]
jmp 0x1403bf0ab
adc r8, 8
dec qword [rsp]
not r10
not rdi
or r10, rdi
movsx edi, dl
mov qword [r8 + rdi*2 - 0x48], r10
xadd dword [rsp + rdi - 0x23], ecx
sbb edx, 0x953a3f30
mov qword [rsp + rdx - 0x51d609f4], r9
ret
jmp rbx
movsx ebp, cx
lea r11, [r11 + rcx*4 - 0x48]
mov r10d, dword [r11 + rcx*4 - 0x44]
jbe 0x1403b2b23
mov eax, 0x73148419
lea r11, [rax + r11 - 0x7314841d]
mov r10d, 0xed3bb43a
jmp 0x1403baf85
Function at 0x1403bbb9b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jnp fcn.1403c82e3
call fcn.1403b8d6c
and al, 0x5a
mov bh, 0xab
mov dl, 0x6a
mov al, 0xdc
or byte [rbx], bh
mov ecx, 0xbe0b9e45
xor bh, byte [0xebe86023]
scasb al, byte [rdi]
fstp st(3)
adc edi, edi
invalid
dec ebx
mov qword [rsp], 0xffffffffba879a30
lea rsp, [rsp + 8]
jne 0x1403dd0aa
mov rax, qword [rbp + riz]
push 0x1b0f972b
ror dword [rsp + 3], 0xa9
sbb rsp, 0x18
call rax
mov ebx, 0x4b3061b8
mov edi, ebx
sub rbx, 0x460e9f05
mov rsp, qword [rbp + rbx - 0x521c2c3]
mov r11d, ebx
mov rbp, qword [rbp + rbx*2 - 0xa43856e]
mov qword [rbp + rbx - 0x521c2b3], rax
jle 0x1403b633c
jne 0x1403ccc9d
cmp ebx, 1
call fcn.1403d34eb
sub byte [rsp + rbp*8 - 0x48117e8], bpl
not ebx
push r10
lea ebx, [rbp + rbx + 0x3e9d901b]
call fcn.1403e262c
movzx ebx, dil
mov qword [rsp + rdi - 0x4c], rsi
and ax, 0x70be
inc dword [rsp + r10*2 - 0x5afc5e1e]
xor dword [rsp + r10*2 - 0x5afc5e18], edx
dec byte [rsp + r10 - 0x2d7e2f0a]
shl qword [rsp + rdi*2 - 0xa8], 0xa
mov rsi, qword [rsp + r10 - 0x2d7e2f08]
setnp al
add ebx, 0x1126a108
lea rcx, [rax + rbx - 0x22766cf2]
movsxd rdx, edx
adc r9, rdx
movzx bx, byte [r8 + r10*2 - 0x5afc5e20]
jmp 0x1403b856b
movzx edx, r11w
mov r8, rbp
movsx r9d, bl
jns 0x1403bb76b
mov rcx, qword [r8 + rdi*2 - 0x97dc]
neg bpl
setp byte [rsp + rdi*2 - 0x97db]
xor rdx, qword [rdi + r8 - 0x4be6]
xor qword [rsp + rdi*2 - 0x97dc], rdi
or bpl, 0x94
not rax
lea r8, [r8 + rdi - 0x4be6]
ror rdi, 0xdd
adc rcx, rdx
jmp 0x1403ceaeb
shl bl, 0xa1
mov qword [r8 + rax*4 + 4], rcx
sar word [rsp + rax*2 + 4], 0x41
sub ebx, dword [rsp + rbp - 0x720ab4fc]
mov qword [rsp + rax*8 + 8], r9
ret
mov eax, 0x7fa67b9e
mov rax, qword [rbp + rbx*8]
jmp 0x1403bfad3

Function at 0x1403be15f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
movsxd rdx, edx
add r9, rdx
mov rdx, qword [r8 + rcx*2 - 0x2a]
and qword [rsp + rcx - 0x15], rcx
mov rbx, qword ss:[rdx + rcx*8 - 0xa8]
mov qword [r8 + rcx*2 - 0x2a], rbx
sbb qword [rsp + rcx*2 - 0x29], r10
bswap rcx
mov qword [rsp + rdi - 0xc200000], r9
ret 0x10
shl rdi, 0x15
shl rbx, cl
bswap edx
jns 0x1403e3879
xor si, r10w
sal edx, 0x67
not eax
lea r10, [rsp + r10 + 0x18]
mov qword [rsp + rbp - 0x7d8dbf2], rax
mov dword [r10 + rbp*8 - 0x3ec6e010], ebx
bswap ecx
mov qword [rsp + rbp*8 - 0x3ec6e010], r9
ret 0x10
lea edx, [rdx + rax + 0x1ee20c7]
mov qword [rsp + rcx - 0xd], rsi
bswap rbx
mov qword [rsp + rcx - 0x15], rbx
xor dword [rsp + rdi*2 - 0x183ffff8], edx
or dil, bl
sbb byte [rsp + rcx - 0x13], cl
mov rsi, qword [rsp + rcx - 0xd]
jne 0x1403bc561
ror qword [rsp + rbp - 0x7d8dc89], 0x2d
not r10w
and dword [rsp + rbp - 0x7d8dc87], ecx
shr bpl, 0x86
jne 0x1403cefc5
Function at 0x1403bf224
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rsi, qword [rsp + rdx*8 - 0x7d930]
push rdi
jne 0x1403cad13
mov qword [rsp + r10 - 0x364d7f0], rsi
inc dword [rsp + r10 - 0x364d7fc]
xor dword [rsp + r10 - 0x364d7f0], edx
pop rdi
mov rsi, qword [rsp + r10*4 - 0xd935ff8]
sar r10d, cl
lea r8, [r8 + r10*8 - 4]
sar r10b, 0xe7
not word [rsp + r10 + 2]
mov dword [r8 + r10*2], edx
pop r10
pop rax
jbe fcn.1403c82e3
movsxd rbx, ebx
shr bpl, 0x44
xchg byte [rsp + rdx*2 - 0x1f648], al
ror eax, 0x66
adc r9, rbx
xchg qword [rsp + 8], rbp
add rbp, 0x1a1f
jmp rbp

Function at 0x1403bf8cd
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movzx edx, byte [rsp + rdi*2 - 0x12e]
call fcn.1403e4cc2
xor eax, 0xd4237591
pop r10
movsx ebp, dl
dec dx
not eax
sub eax, 0xd912bf85
mov ebx, edx
movsx r10d, bpl
bswap eax
jmp 0x1403d7202
bswap rbx
mov dword [r8 + rdx - 0x9f65], eax
call fcn.1403dffce
jmp 0x1403d5bc8
sub rcx, 0xffffffff8d1c7838
push rsi
xadd bp, bx
xor dword [rsp + rdx*4 - 0x27d94], eax
neg r10b
movzx edi, dl
jbe 0x1403d1727
pop rsi
movsxd rax, eax
xchg ebx, edi
add r9, rax
dec bpl
mov eax, dword [r8 + rdx*4 - 0x27d94]
mov cl, byte [r8 + rdx*2 - 0x13ec6]
or rdi, rbx
add r10d, ebp
lea r8, [r8 + rdx*2 - 0x13ec8]
and di, 0x3aa4
sar r10, 0x95
js 0x1403dd3ad
shr eax, cl
jmp 0x1403e46ef
mov ebx, 0x941bf226
mov ebx, dword [r8]
mov edi, 0x9c3e4715
mov ebp, dword [r8 + 4]
movsx r10d, dil
inc r10
lea r8, [r8 + r10*4 - 0x54]
mov ecx, 0x5935e707
and ebx, ebp
movzx edx, r10b
not ebx
call fcn.1403d592a
mov rbx, qword [r8]
mov edi, 0xf62a8634
movzx ebp, dil
lea rdi, [rbp*2 - 0x4bc041c7]
lea r8, [rbp + r8 - 0x2c]
xor edi, ebp
lea r11, [r11 + rbp*2 - 0x69]
mov ecx, ebp
movzx edi, byte [r11 + rbp - 0x34]
jae 0x1403e1b73
mov ebp, 0x5816e7ae
lea r11, [rbp + r11 - 0x5816e7b2]
call fcn.1403b855c
jmp 0x1403cde09
lea rbp, [rbx*2 - 0x4b59255a]
ror edi, 1
neg edi
sal r10b, 0x25
js 0x1403c0f16
sbb bp, ax
rol edi, 1
sal bl, 0x46
sbb bp, bp
bswap edi
bswap ebx
push rsi
xor dword [rsp + rbp - 0x799d0000], edi
dec eax
js 0x1403b07e0
ror ecx, 1
lea ecx, [rcx + rax - 0x7b583336]
mov qword [rsp + rbx - 0x23], rbx
not ecx
rol ecx, 1
shr dword [rsp + rax - 0x7a2b8921], 0x15
shr bx, 0xcf
mov qword [rsp + rax - 0x7a2b8923], rsi
xor dword [rsp + rbx], ecx
pop rsi
ror r10, 0x2c
movsxd rcx, ecx
movzx edx, bl
adc r9, rcx
mov edi, r10d
mov rbp, qword [r8 + rbx*4]
ror dl, 2
sub dx, di
adc bl, byte [r8 + rbx*4 + 8]
movsx ecx, r10b
ror dx, 0x69
lea r8, [rax + r8 - 0x7a2b8919]
bswap r10d
jb 0x1403bf8c0
mov byte es:[r10 + rbp - 0x3092], bl
push rdi
movzx ebx, cx
mov qword [rsp + rax - 0x7a2b8923], r9
ret
movzx r10d, bpl
xor dil, sil
lea rdx, [rcx + rcx*4 + 0x27a3baa2]
jmp 0x1403e3f7b
inc dil
call fcn.1403d9301
jmp 0x1403c6e14
Function at 0x1403bf93a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [r11 + rbp*8]
mov qword [rsp + rbp*4], rax
mov qword [rsp + rbp*2 + 8], rdx
add ebp, edx
xor ecx, esi
neg ecx
call fcn.1403b03b4
jmp 0x1403c16f4
mov r10d, edi
ror bp, 1
xor si, bp
inc r10b
add rdi, rbx
inc edi
lea rbp, [rsp + rbp + 8]
cmovnp rax, qword [rsp + rbx*2 - 0x185c6e6a]
sar word [rsp + rbx*2 - 0x185c6e6a], 0xe9
mov cx, word [rbp + rbx*2 - 0x185c6e6a]
lea r8, [r8 + rbx - 0xc2e3737]
mov word [r8 + rbx*4 - 0x30b8dcd4], cx
ja 0x1403be8af
push rax
Function at 0x1403c1d74
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movzx ecx, bpl
rol r10d, 2
dec r10d
ror dil, 0x85
ror r10d, 1
movzx eax, cx
push rdx
lea r10d, [r10 + rbx*2 - 0x4899eb55]
not byte [rsp + rbp - 0x5a97549a]
and bx, word [rsp + rbx*4 - 0x4e7f]
ror qword [rsp + rbp - 0x5a97549e], cl
bswap r10d
push rbp
shl dword [rsp + rbx*2 - 0x25f9], 0xd
mov qword [rsp + rbx - 0x12f8], rsi
not edi
xor qword [rsp + rcx - 0x9e], rdi
xor dword [rsp + rbp - 0x5a975496], r10d
mov rsi, qword [rsp + rbp - 0x5a975496]
movsxd r10, r10d
xchg ah, dl
add r9, r10
jmp 0x1403e4f40
lea rdi, [rsp + rdi + 0x28]
movsx ebp, r10b
mov al, byte [rdi + r10*2 - 0x7fffffce]
mov qword [rsp + r10 - 0x3fffffdf], r10
shl qword [rsp + r10 - 0x3fffffdf], 0x62
lea r8, [r10 + r8 - 0x3fffffe9]
mov word [r8 + r10*2 - 0x7fffffce], ax
push rbp
mov eax, ebp
pop rdi
pop rcx
pop rdi
pop rbx
pop rdx
pop rcx
js fcn.1403c82e3
mov edx, 0x5a97549d
mov r10, qword [r8 + rdx - 0x5a97549d]
push rdx
jmp 0x1403d72d8
movzx ebp, dl
mov rdx, qword [rdx + r8 - 0x5a975495]
mov cl, byte [r8 + rbp*8 - 0x4d8]
mov ebx, ebp
inc qword [rsp + rbp - 0x9d]
lea r8, [r8 + rbp*8 - 0x4de]
pop rbp
and rbx, rbx
shld r10, rdx, cl
mov qword [rbp + r8 - 0x5a97549e], r10
lea r11, [r11 + rbx*8 - 0x4ec]
ror ebx, 0x5b
movsx r10d, bl
mov r10d, dword [rbx + r11 - 0x13a0]
mov edi, ebp
xor r10d, esi
mov edx, ebp
jmp 0x1403bee22
Function at 0x1403c550c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
neg rax
call fcn.1403e2979
mov r10d, 0xe169013
movzx ebx, r10b
lea r11, [r11 + r10*8 - 0x70b4809c]
shr bx, 0x4b
movzx eax, bl
movsx edx, al
mov r10d, dword [r11 + r10*8 - 0x70b48098]
xor r10d, esi
add eax, edx
jge 0x1403dab25
mov r14d, 0xf0b43a8e
mov rsp, r8
movsx ebx, r14b
ror bx, 0x86
pop rbp
pop r11
push rbx
mov rbx, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
dec qword [rsp]
mov r9, qword [rsp + 0x20]
movsx edx, r14w
movsx eax, r14w
push qword [rsp + 0x28]
popfq
call fcn.1403da57a

Function at 0x1403c5b44
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jbe 0x1403de21e
mov qword [rsp], 0x7fbd8e11
cld
jmp 0x1403e6ac9
rep movsb byte [rdi], byte [rsi]
mov esi, dword [rsp + 2]
bswap esi
dec byte [rsp]
push qword [rsp + 8]
popfq
mov rsi, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
call fcn.1403c721e

Function at 0x1403c5d23
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
not edi
mov qword [rsp + r10 - 0x2e8bebf8], 0x39231291
neg edi
rol eax, 0x26
xor edi, 0x3793fa8c
pop rbx
add rbx, 0xffffffffffff8e29
jmp rbx
xor edi, esi
sar bp, 0xc7
mov qword [rsp + rdx*2 - 0x1e], 0xfffffffffa321334
not edi
dec dl
rol edi, 1
shl dword [rsp + rdx], 0x56
sbb ax, ax
lea edi, [rdi + r10*4 + 0xb84168c]
mov qword [rsp + r10*2 - 0x5d17d7f0], rax
mov qword [rsp + r10 - 0x2e8bebe9], rbp
jge 0x1403c1c2a
mov ebx, 0x2b93e423
lea r11, [rbx + r11 - 0x2b93e427]
rol bl, 0xe1
movzx r10d, bl
mov ebx, dword [r11 + rbx*2 - 0x5727c88c]
lea rcx, [r10*2 + 0x5a055626]
mov eax, 0x12315501
xor ebx, esi
mov edx, eax
movzx ebp, r10b
lea rdi, [rbp + rcx*8 + 0x3aa8a41d]
xor ebx, 0x738e2a07
xadd edi, eax
shl r10d, cl
inc ebx
xor ebx, 0x76a3ba20
add r10b, dl
call fcn.1403e4760

Function at 0x1403c6dcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp + rax + 9], edi
not edx
lea edx, [rdx + rbp + 0x41e29974]
mov qword [rsp + rax + 6], rsi
xor dword [rsp + rax*2 - 4], edx
mov rsi, qword [rsp + rax + 6]
push rbp
movsxd rdx, edx
add r9, rdx
call fcn.1403b7fa2
mov edi, 0x691d269e
push rdi
or dword [rsp + rdi - 0x691d269d], 0xc7ad1913
lea r11, [r11 + rdi - 0x691d26a2]
call fcn.1403b7907

Function at 0x1403c70f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x1403c173c

Function at 0x1403c7ff9
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rdi, qword [r8 + rbx - 0x796252c8]
and r10d, 0xf9b969a0
jge 0x1403ddf87
sub al, 0x13
mov bp, word ss:[rdi + rbx - 0x796252c8]
pop rdx
adc rdx, 0x3264
jmp rdx
Function at 0x1403c8f39
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r11, [r11 + rdx + 0x3695f67a]
mov edi, dword [r11 + rdx*2 + 0x6d2becfc]
lea rax, [rcx*2 + 0x4222cd90]
xor edi, esi
lea rax, [r10*2 - 0x2e53856d]
mov qword [rsp + rbx*2], rdx
lea edi, [rdi + rdx*2 + 0x409cedcb]
sal byte [rsp + rdx*2 + 0x6d2becfe], 0xa7
and bl, ah
not edi
dec edi
xor edi, 0x3a2695bd
mov qword [rsp + rdx*2 + 0x6d2bed04], rsi
xor dword [rsp + rdx + 0x3695f686], edi
pop rsi
pop rsi
movsxd rdi, edi
add edx, edx
jle 0x1403dee22
sub r11, 4
mov ecx, 0xae86cc80
mov ebx, 0x4e388389
movsx eax, cl
mov ebp, dword [rbx + r11 - 0x4e388389]
mov edx, 0x373ada0d
xor ebp, esi
dec ebp
lea r10, [rcx*2 - 0x247b0c1]
lea rax, [rbx + rbx + 0x5d0af426]
lea rax, [rcx + r10*8 + 0x4a3b038b]
ror ebp, 1
lea rdi, [rax + rcx*2 - 0xbff24d5]
call fcn.1403bc9e7
call fcn.1403d8331
xadd rcx, rbx
adc r9, rdi
ror ebx, 0xb
push r10
pop rbx
jae fcn.1403c82e3

Function at 0x1403cadc7
Capabilities:
Execute anti-debugging instructions

Disassembly:
sar rcx, 0xe9
pop rbx
pop rbp
pop rcx
pop r10
pop rax
jae fcn.1403c82e3
jmp 0x1403c2b4a
mov ebp, 0x238e2b15
lea rcx, [rbp*8 - 0x5c49835c]
lea r11, [r11 + rbp - 0x238e2b19]
call fcn.1403d4f02
not dl
movzx eax, bp
sub bpl, 0x16
ror dl, 1
pop rdi
dec qword [rsp + rax - 0xf3f3]
sar dword [rsp + rbp - 0x408bf4d6], 0x76
xor sil, dl
sal al, 0x41
rol r10b, 0xa1
lea rdx, [rsp + rdx + 0x28]
lea rcx, [r10 + rax*2 - 0x2e725fc4]
neg r10w
lea rbx, [rbp + rax + 0x66918ba3]
mov bp, word [rax + rdx - 0xf402]
setg cl
lea r8, [rax + r8 - 0xf404]
or dword [rsp + rax - 0xf3ee], 0x60107f96
xadd byte [rsp + rax*8 - 0x79fef], bh
xor qword [rsp + rax*2 - 0x1e7e4], 0xffffffffe83f9917
mov word [r8 + rax*2 - 0x1e804], bp
js 0x1403b7b9c