joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070974
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14009fb70
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401b1728]
call fcn.140071f6d
mov eax, 4
imul rax, rax, 1
lea rcx, [0x14019cbb0]
cmp dword [rcx + rax], 0
jne 0x14009fc18
mov dword [rbp + 4], 0xedb88320
mov dword [rbp + 0x24], 0
jmp 0x14009fbc6
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x100
jae 0x14009fc18
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x64], 0
jmp 0x14009fbe6
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 8
jae 0x14009fc06
mov eax, dword [rbp + 0x44]
shr eax, 1
mov ecx, dword [rbp + 0x44]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rbp + 0x44], eax
jmp 0x14009fbde
mov eax, dword [rbp + 0x24]
lea rcx, [0x14019cbb0]
mov edx, dword [rbp + 0x44]
mov dword [rcx + rax*4], edx
jmp 0x14009fbbe
mov eax, dword [rbp + 0x1d0]
not eax
mov dword [rbp + 0x1d0], eax
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0xa8], rax
cmp dword [rbp + 0x1c8], 0
jle 0x14009fcc3
mov eax, dword [rbp + 0x1c8]
mov dword [rbp + 0x194], eax
mov eax, dword [rbp + 0x1c8]
dec eax
mov dword [rbp + 0x1c8], eax
cmp dword [rbp + 0x194], 0
je 0x14009fcbe
mov eax, dword [rbp + 0x84]
shr eax, 8
mov ecx, dword [rbp + 0x84]
and ecx, 0xff
mov rdx, qword [rbp + 0xa8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x14019cbb0]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x194], eax
mov rax, qword [rbp + 0xa8]
inc rax
mov qword [rbp + 0xa8], rax
mov eax, dword [rbp + 0x194]
mov dword [rbp + 0x84], eax
jmp 0x14009fc49
jmp 0x14009fd7b
mov rax, qword [rbp + 0xa8]
movzx eax, byte [rax]
mov byte [rbp + 0x194], al
mov rax, qword [rbp + 0xa8]
inc rax
mov qword [rbp + 0xa8], rax
movzx eax, byte [rbp + 0x194]
mov byte [rbp + 0xc4], al
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x14009fd7b
movzx eax, byte [rbp + 0xc4]
cmp eax, 0x23
jne 0x14009fd46
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009fd46
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14009fd46
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
shr eax, 8
mov ecx, dword [rbp + 0x84]
and ecx, 0xff
movzx edx, byte [rbp + 0xc4]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x14019cbb0]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x84], eax
jmp 0x14009fcc3
mov eax, dword [rbp + 0x84]
not eax
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140070c49
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400b3800
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14019c540]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1401b1728]
call fcn.140071f6d
mov rax, qword [0x14019cb38]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
xorps xmm0, xmm0
movss dword [rax + 0x2d9c], xmm0
cmp qword [rbp + 0x160], 0
jne 0x1400b386f
jmp 0x1400b38c5
mov qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
call fcn.140072215
mov qword [rbp + 0x48], rax
lea rdx, [0x1401651e0]
mov rcx, qword [rbp + 0x160]
call fcn.140070d07
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1400b38a4
jmp 0x1400b38c5
mov r9, qword [rbp + 0x68]
mov r8, qword [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rcx, [rbp - 0x20]
lea rdx, [0x14015df20]
call fcn.140071a77
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.140070f19
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140070f5a
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140148e50
push rbp
push rsi
push rdi
sub rsp, 0x250
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14019c540]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x1401b1a25]
call fcn.140071f6d
lea rcx, [rbp + 8]
call fcn.140071c52
nop
call fcn.140070316
mov r8d, eax
lea rdx, str.FPS:__03d
lea rcx, [rbp + 0x40]
call fcn.140071d5b
call fcn.140070b8b
mov qword [rbp + 0x1d8], rax
mov dword [rsp + 0x20], 0xff
xor r9d, r9d
mov r8d, 0xff
xor edx, edx
lea rcx, [rbp + 0x154]
call fcn.140070b5e
mov rcx, rax
call fcn.1400712fc
mov dword [rbp + 0x1e0], eax
movss xmm2, dword [0x140170c14]
movss xmm1, dword [0x140170c14]
lea rcx, [rbp + 0x184]
call fcn.140071423
mov qword [rbp + 0x1e8], rax
call fcn.140071f22
mov qword [rbp + 0x1f0], rax
mov qword [rsp + 0x40], 0
xorps xmm0, xmm0
movss dword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x1e0]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x1e8]
movss xmm2, dword [0x14015bb40]
mov rdx, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1d8]
call fcn.140071563
lea rcx, [rbp + 8]
call fcn.140070901
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140148fb9
movzx eax, byte [0x14019c513]
test eax, eax
je 0x140148fb9
mov byte [0x14019caa1], 1
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x1b0]
call fcn.140071fef
jmp 0x140148fc0
mov byte [0x14019caa1], 0
lea rcx, [rbp + 8]
call fcn.140071b76
lea rcx, [rbp - 0x50]
lea rdx, [0x140186f20]
call fcn.140071a77
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.140070f19
lea rsp, [rbp + 0x200]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140071180
Capabilities:
Terminate process

Disassembly:
jmp 0x14014d840
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14007149b
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x14010a230
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14019c540]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1401b18c7]
call fcn.140071f6d
call fcn.140071874
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [0x1401a38d8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x2c]
mov ecx, dword [rbp + 0x34]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x30]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rbp + 0x154]
call fcn.140071423
mov rax, qword [rax]
mov rcx, qword [rbp + 8]
mov qword [rcx + 8], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1401a38e0]
mov rcx, qword [rbp + 0x58]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x1401a38e8]
divss xmm0, xmm1
mov rax, qword [rbp + 8]
movss dword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x58]
mov qword [0x1401a38e0], rax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14010a31f
mov dword [rbp + 0x164], 1
jmp 0x14010a329
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x128], cl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14010a35b
mov dword [rbp + 0x164], 1
jmp 0x14010a365
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x129], cl
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14010a397
mov dword [rbp + 0x164], 1
jmp 0x14010a3a1
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x12a], cl
mov rax, qword [rbp + 8]
mov byte [rax + 0x12b], 0
call fcn.14010a680
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0xc8]
test eax, eax
je 0x14010a3dd
mov dword [rbp + 0x164], 0xffffffff
jmp 0x14010a3e8
call fcn.1400711a8
mov dword [rbp + 0x164], eax
mov eax, dword [rbp + 0x164]
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0x74]
cmp dword [0x14019c468], eax
je 0x14010a40a
mov eax, dword [rbp + 0x74]
mov dword [0x14019c468], eax
call fcn.14010a500
lea rcx, [rbp - 0x20]
lea rdx, [0x14017d1c0]
call fcn.140071a77
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140070f19
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140071590
Capabilities:
Execute command

Disassembly:
jmp 0x140081d10
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401b167d]
call fcn.140071f6d
lea rcx, str.Loading...
call fcn.140070eb0
call fcn.140071969
call fcn.140072139
lea rcx, str.FortniteClient_Win64_Shipping.exe
call fcn.14007187e
cdqe
mov qword [0x14019caa8], rax
cmp qword [0x14019caa8], 0
jne 0x140081d8b
lea rcx, [0x14015c99c]
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, str._n_nFortnite_was_not_found._Please_make_sure_its_open__n_n
call fcn.140070eb0
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140081ec1
call fcn.1400717d4
mov qword [0x14019cab0], rax
lea rcx, [0x14015c99c]
call qword [sym.imp.ucrtbased.dll_system]
movzx eax, byte [0x14019cb29]
test eax, eax
je 0x140081e61
mov rax, qword [0x14019caa8]
mov qword [rbp + 0x178], rax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0x108], rax
lea rdx, str.ProcessId:
mov rcx, qword [rbp + 0x108]
call fcn.140070e24
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x188], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x188]
call fcn.1400706a9
mov rax, qword [0x14019cab0]
mov qword [rbp + 0x178], rax
lea rax, [rbp + 0x128]
mov qword [rbp + 0x168], rax
lea rdx, str.BaseId:
mov rcx, qword [rbp + 0x168]
call fcn.140070e24
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x188], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x188]
call fcn.1400706a9
cmp qword [0x14019cab0], 0
je 0x140081e75
cmp qword [0x14019cab0], 0
jne 0x140081eb2
lea rdx, str._nDriver_was_not_mapped
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14007035c
mov qword [rbp + 0x178], rax
lea rdx, [0x14007014f]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x140081ec1
call fcn.140070361
call fcn.1400718ba
call fcn.14007198c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1400715e5
Capabilities:
Read file on windows

Disassembly:
jmp 0x14009f350
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1401b1728]
call fcn.140071f6d
cmp qword [rbp + 0x160], 0
je 0x14009f392
cmp qword [rbp + 0x168], 0
jne 0x14009f3b3
mov eax, dword [0x14019702c]
inc eax
mov r8d, eax
lea rdx, str.C:Users_fromaDesktopdontdeleteinthebinevo.gj_renderImGuiimgui.cpp
lea rcx, str.filename__file_open_mode
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
cmp qword [rbp + 0x170], 0
je 0x14009f3cb
mov rax, qword [rbp + 0x170]
mov qword [rax], 0
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x160]
call fcn.140070d07
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14009f3f0
xor eax, eax
jmp 0x14009f4fc
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
jne 0x14009f42c
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xffffffff
je 0x14009f42c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
je 0x14009f43d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14009f4fc
movsxd rax, dword [rbp + 0x24]
mov qword [rbp + 0x48], rax
movsxd rax, dword [rbp + 0x178]
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.14007093d
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14009f47a
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x14009f4fc
mov r9, qword [rbp + 8]
mov r8, qword [rbp + 0x48]
mov edx, 1
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fread]
cmp rax, qword [rbp + 0x48]
je 0x14009f4ae
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 0x68]
call fcn.140071ba8
xor eax, eax
jmp 0x14009f4fc
cmp dword [rbp + 0x178], 0
jle 0x14009f4d6
movsxd rax, dword [rbp + 0x178]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
add rdx, rcx
mov rcx, rdx
mov r8, rax
xor edx, edx
call fcn.14007181f
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
cmp qword [rbp + 0x170], 0
je 0x14009f4f8
mov rax, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x48]
mov qword [rax], rcx
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x140071649
Capabilities:
Parse pe header

Disassembly:
jmp 0x14014ee60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14014ee80
xor al, al
jmp 0x14014ef01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14014ee93
xor al, al
jmp 0x14014ef01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14014eebd
xor al, al
jmp 0x14014ef01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14014eed1
xor al, al
jmp 0x14014ef01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14014eee3
xor al, al
jmp 0x14014ef01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14014eeff
xor al, al
jmp 0x14014ef01
mov al, 1
add rsp, 0x38
ret
Function at 0x14007187e
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140077da0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14019c540]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1401b1274]
call fcn.140071f6d
xor edx, edx
mov ecx, 2
call fcn.140070ec9
mov qword [rbp + 0x268], rax
mov dword [rbp + 0x10], 0x238
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140071324
test eax, eax
je 0x140077e5c
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140077e48
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
mov qword [0x14019caa8], rax
mov eax, dword [rbp + 0x18]
jmp 0x140077e6b
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140071b53
test eax, eax
jne 0x140077e17
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14015a440]
call fcn.140071a77
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.140070f19
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x140113376
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
bswap edx
mov qword [rsp + r9 + 0x691ffb3], rdi
xor edx, 0xf97e8a3
sar cl, 0x27
ror edx, 1
sar byte [rsp + r9 + 0x691ffb9], 0x85
bswap ecx
and ecx, dword [rsp + r9 + 0x691ffb7]
bswap edx
mov qword [rsp + r9 + 0x691ffbb], r10
sbb ebx, 0x5f0b5f86
add rcx, qword [rsp + r9*4 + 0x1a47fe9c]
lea rbx, [rcx + rbx*2 - 0x45ff036d]
xor dword [rsp + r9 + 0x691ffbb], edx
lea rax, [rbx*4 + 0xea4ca24]
xchg dword [rsp + r9*8 + 0x348ffd2c], ecx
mov qword [rsp + rbx*2 - 0x4f956d2], r9
mov r10, qword [rsp + r9*4 + 0x1a47fea4]
sub rax, 0xffffffffd5263c86
call fcn.14013f62b

Function at 0x14011852f
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ebx, al
lea ecx, [rcx + rax*2 + 0x513574fe]
jbe 0x14011c35d
mov qword [rsp + rbp - 0xffff], r10
inc r9w
btr rdi, rdx
sbb rbx, 0xffffffffda13e2bc
xor dword [rsp + r9 - 0x2bbdf18a], ecx
lea r10, [r9 + rdi*8 - 0x4fd5c670]
sub di, bx
pop r10
xadd dil, dl
dec rbx
movsxd rcx, ecx
rol di, 0xa1
call fcn.140158819
btc bp, r9w
bt dx, di
not eax
lea rdx, [r9 + rcx*4 + 0x813e892]
lea rbx, [rdx*8 + 0x4086e506]
push r10
not rdx
bswap ebx
xor dword [rsp], eax
not bp
pop r10
neg r9w
movsxd rax, eax
rol bl, 0xc1
shl dx, 0x65
adc r8, rax
inc bp
jne 0x14015a5ea
lea rax, [rdx + rdx*8 + 0x4186d4a9]
mov rdi, qword [rsi + riz]
mov ebp, dword [rsi + riz + 8]
ror eax, 0x5d
lea rsi, [rsi + rax - 0x459bff43]
mov dword [rax + rdi - 0x459bff4f], ebp
jmp r8

Function at 0x140119deb
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0xffffffffb52c041d
xor edi, r10d
sub edi, 0x4aa12d1e
ror edi, 1
mov ecx, 0x5092a695
dec edi
mov dword [rsp + rcx - 0x5092a693], ecx
ror edi, 2
pop rbx
movzx ebp, bx
push r10
lea r10, [rbp + rbp*2 - 0x3cc57bdb]
xor dword [rsp + rbp - 0x41d], edi
pop r10
movsx eax, bp
movsxd rdi, edi
add r8, rdi
inc bl
btc rcx, rbx
push rax
rdtsc
shl bp, 0x6a
movsx r9d, word [rsp + rcx*2 - 0x21254d28]
lea rdi, [rcx*2 - 0x4cc035f]
lea rsi, [rsi + rcx*4 - 0x424a9a5c]
or dword [rsp + rcx - 0x1092a692], ebx
mov dword [rsi + rcx*2 - 0x21254d26], eax
neg word [rsp + rcx*2 - 0x21254d28]
neg cl
not dword [rsp + rcx - 0x1092a66b]
mov dword [rsi + rcx*4 - 0x424a99ac], edx
seta byte [rsp + rcx*2 - 0x21254cd6]
not qword [rsp + rcx - 0x1092a66b]
pop r9
jno fcn.140146e5c
Function at 0x14011f97c
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [rsi], ecx
push 0x663afc1a
mov ebx, 0x8cb4e791
movzx ebp, bx
mov edi, dword [r11 + rbp - 0xe791]
lea r11, [r11 + rbp*2 - 0x1cf1e]
movsx r9d, word [rsp + rbp*8 - 0x73c84]
call fcn.140114ab1
Function at 0x14011faaa
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
rol ecx, 1
mov qword [rsp + rax - 0x2f2a0007], rbx
dec ecx
neg word [rsp + rax - 0x2f2a0002]
not ecx
sbb ecx, 0xda359c30
mov qword [rsp + rax - 0x2f2a0007], r10
xor dword [rsp + rax - 0x2f2a0007], ecx
or rbx, 0xffffffffc90b6a94
pop r10
jae 0x1401539ba
mov edx, dword [r11]
add r11, 4
mov ebx, 0x5b0fc09a
xor edx, r10d
movzx eax, bl
btc eax, 0x91
neg edx
not edx
inc edx
call fcn.140133050
shl byte [rsp + 0xe], 0xe3
or edx, ebp
not byte [rsp + 3]
jmp 0x14014d3b6
cdqe
ror ebx, 3
not ebx
mov qword [rsp + rax + 0x7f4e0ff], 0xfffffffffa240d18
add dil, byte [rsp + rax*4 + 0x1fd38403]
jp 0x140119ea3
mov rcx, qword [rsi + rbp - 0x7f800001]
shl rbp, 0x4d
bts edi, 0x22
mov r9, qword [rsi + rdi*2 - 0x197b1426]
sub al, dh
lea rdx, [rbp*8 - 0x52442b4b]
xadd bl, bpl
lea rsi, [rsi + rbx*2 + 0x10]
jge 0x140145eb5
adc rcx, r9
movzx r9d, dil
and edx, r9d
btr r9w, ax
mov qword [rsi + rdi*2 - 0x197b142e], rcx
btc ebx, edi
jmp r8
jmp 0x14015225b
add byte [rsp + 2], bl
not edx
call fcn.14015f001
dec eax
rol ecx, 0xb7
not eax
neg word [rsp + rdx*2 - 4]
dec eax
mov qword [rsp + rdx*4 - 0xc], r10
mov ebp, r9d
xor dword [rsp + rdx + 3], eax
mov r10, qword [rsp + rdx + 3]
ror cx, cl
movsxd rax, eax
adc r8, rax
mov edx, dword [rsi + rdx - 5]
mov qword [rsp + 8], rbp
mov ebp, dword [rsi + riz + 4]
jmp 0x140120522
btr edi, ebp
or ebp, ebp
movsxd rcx, ecx
xadd rdi, rax
adc r8, rcx
and al, 0x23
not ax
jp 0x140145df1
mov r9d, 0xc60ecf05
movsx eax, r9w
movsx ebx, r9b
mov eax, dword [r11 + rbx*8 - 0x28]
push rbx
xor eax, r10d
or qword [rsp + rbx - 5], rbx
lea rcx, [r9 + 0x67337818]
jle 0x14012e2bf
inc eax
shl rbx, cl
push r9
movzx edx, word [rsp + 8]
xor eax, 0x98a9e384
jmp 0x14014bf62
Function at 0x14012034a
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3

Disassembly:
pop rax
mov qword [rsp + rbp - 0x7b18cd10], r10
mov r10d, 0xda1ee73b
add r10d, edi
xor dword [rsp + rbp - 0x7b18cd10], r9d
inc r10w
mov r10, qword [rsp + rbp - 0x7b18cd10]
call fcn.14014f755
mov ecx, ebx
mov rax, qword [rsi + riz]
shr cx, 0xac
lea r9, [rbx*8 + 0x7383340a]
or cl, byte [rsi + riz + 8]
mov edi, r9d
add rsi, 2
bt ebx, r9d
shr rax, cl
movsx ebp, bl
mov qword [rsi + riz], rax
mov r9d, dword [r11 + riz]
add r11, 4
call fcn.14015dc6f
mov edx, 0x5fad0d97
mov cx, word [rsi + rdx - 0x5fad0d97]
movsx r9d, dx
lea rax, [r9 + rdx*2 + 0x14a1bb37]
sal r9b, 0x81
mov dx, word [rsi + rdx - 0x5fad0d95]
not cx
not dx
lea rax, [r9 + r9*4 + 0x4186a983]
movzx ebx, r9w
and cx, dx
lea rbp, [rax + rax*8 + 0x569c75b4]
mov word [rsi + r9 - 0xd2c], cx
btr r9, rax
sbb bl, 0xa
sal r9b, 0x24
mov ebx, dword [r11 + r9*4 - 0x3780]
btc ebp, 3
lea rcx, [rax + rax*2 + 0x68a2dc91]
xor ebx, r10d
inc r9b
sub ebp, 0x780e883
bswap ebx
call fcn.14011adcd
shr cx, 0xca
je 0x1401497ce
lea rax, [rdx + rax + 0x17212dbe]
xor r9d, r10d
xchg rcx, rdi
bswap r9d
sal rdx, cl
lea r9d, [r9 + rcx - 0xcda4c01]
rol qword [rsp + rbx*8], cl
bts ebx, ecx
neg r9d
push rdx
lea r9d, [r9 + rdi - 0x1f49e1f5]
push rcx
ror eax, 0xea
lea rax, [rcx + rbx*2 + 0x6196bf89]
ror r9d, 1
call fcn.140113bac
xor eax, r10d
movzx edx, r9b
lea rdi, [rdx + rbp*8 + 0x62fbeb0]
ror rbp, 0x95
inc eax
movsx ecx, r9b
sub rbp, rbp
neg eax
sar bp, 0x86
call fcn.140140790
not edi
ror edi, 1
or bpl, 0x91
bswap edi
jg 0x14015bad1
inc rax
push r10
xor dx, 0x4f83
jns 0x14011a812
xor dword [rsp + r9*2], edi
or ax, bp
pop r10
lea rbp, [rbx + 0x11a0d314]
sbb bpl, r9b
and rax, rax
movsxd rdi, edi
not bp
sar r9w, 0x81
adc r8, rdi
jmp fcn.140146e5c
adc r11, 1
shr word [rsp + 3], 0x4e
movsx ecx, word [rsp + 1]
xor dx, r10w
add dx, 0x69b7
call fcn.140114fbd
mov eax, 0x13ba6528
movsx edi, al
lea rdx, [rax + rax*8 - 0x6542a47e]
mov eax, dword [rax + r11 - 0x13ba6528]
dec rdx
ror edi, 0xae
jbe fcn.14013d465
lea r11, [r11 + rdi - 0x9ffffc]
movzx r9d, di
movzx ecx, di
xor eax, r10d
shl dx, 0xe2
rol eax, 2
dec eax
not eax
dec dl
ror eax, 1
add di, dx
lea rcx, [rdx*8 + 0x4b27388d]
inc eax
xadd r9b, dil
push r9
movsx ebx, word [rsp + rdi - 0xa0a6fe]
mov qword [rsp + rdx - 0x4c4aa7a3], r10
dec dx
movzx r10d, dil
xor dword [rsp + rdi*2 - 0x1414e00], eax
movsx ebp, dil
pop r10
movsxd rax, eax
add r8, rax
and di, 0x9e92
inc di
mov rcx, qword [rsi + rdi - 0xa08601]
ja 0x140134855
call fcn.140120eaf
mov edx, 0xee2fb520
push rdx
mov rax, qword [rsi + riz]
not qword [rsp]
mov ebp, 0xa18714a1
add rsi, 8
movzx edx, word [r11 + riz]
xadd word [rsp + 5], bp
jbe 0x14014f442
mov r9d, 0x320f7896
mov ebx, r9d
movzx eax, r9b
mov eax, dword [r11 + r9 - 0x320f7896]
lea rbp, [rbx + r9*8 - 0x64e102fd]
shl r9w, 0x88
lea r11, [r11 + rbx - 0x320f7892]
lea rbp, [rbx*2 + 0x292c8c17]
jne 0x140149127