joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1813b0332
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc rax, rdx
mov qword [rbp + riz - 8], rax
push 0x51a8e51a
lea rsp, [rsp + 0x18]
mov qword [rbp + riz - 0x10], rsp
push 0x28141f1c
lea rsp, [rsp + 8]
sub rsp, rcx
push 0xffffffffad01e4b6
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
call fcn.18137e156

Function at 0x1813b1005
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bpl, al
lea rax, [rsp + rax + 0x10]
push r11
ror r10d, cl
imul r11w, si
or di, word [rax + rcx*2 - 0x6e54114a]
call fcn.1813f16f7
mov edx, 0x6b8e6801
mov rdi, qword [rdx + rsi - 0x6b8e6801]
mov r9d, dword ss:[rdi + rdx - 0x6b8e6801]
lea rax, [rdx + rdx*2 - 0x175ca1cb]
lea rcx, [rdx*2 + 0x7f1726ac]
lea rsi, [rsi + rdx - 0x6b8e67fd]
add al, dl
mul dl
mov dword [rsi + rdx - 0x6b8e6801], r9d
movzx r9d, al
xchg cl, r9b
jo 0x181386e7e
lea r11, [r11 + r9*2 - 0x160]
mul al
shl ecx, cl
not r9d
mov eax, dword [r11 + rcx - 0x72000000]
movzx edi, dx
jnp 0x18134f2f0
xor eax, ebp
mov r8d, edi
lea rbx, [r8*4 + 0x20318d8c]
neg eax
and rbx, 0x252528ab
ror eax, 1
bswap r8d
bts r9w, 0x1b
dec eax
and rbx, r9
bt r8, rdi
xor eax, 0xf6b7e630
inc edx
add bl, dil
dec eax
imul r8, rdi
neg r8

Function at 0x1813b7479
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edi
bswap ecx
movzx edx, di
pop rdx
xor bx, di
lea ecx, [rcx + rbx + 0x36135920]
not ecx
xadd r9d, ebx
shl dl, 0xe4
mov r8d, 0xf0bbca81
lea ecx, [rcx + rbx*8 + 0x2d7ab82b]
bswap ecx
push rbp
shl r8b, 0x25
call fcn.18135d098
lea r11, [r9 + r11 - 0xe623]
jge 0x18141a91b
lea rax, [rsp + rax + 8]
xor dl, 0x3a
mov qword [rsp + rcx*4 + 0x71eee0ec], rcx
bt r10w, cx
mov rsi, qword [rax + rcx + 0x1c7bb83b]
push rcx
lea r9, [r9 + r10*2 - 0x120447a]
and rdx, qword [rsp + rcx*4 + 0x71eee0f4]
sal byte [rsp + rcx + 0x1c7bb84a], 0xa1
mov qword [rcx + r9 + 0x1c7bb83b], rsi
push rdx
mov ecx, dword [rcx + rbx + 0x1c7bb83b]
sar dl, 0xa1
lea rbx, [rbx + r10 - 0x902235]
bt edi, edi
mov dword [rsp + r10 - 0x90222d], edx
xor ecx, ebp
movzx eax, word [rsp + r10 - 0x902234]
neg ecx
ror eax, 9
sbb rdx, qword [rsp + r10 - 0x902229]
rol ecx, 2
add edx, dword [rsp + r10*4 - 0x24088d4]
btc dx, 0x1f
cqo
xor ecx, 0xe2359a7
mov r11d, 0xabfb51d
call fcn.1813df560
mov ecx, 0x87b8350c
mov r10d, 0x4c354913
mov r11, qword [r10 + r9 - 0x4c354913]
lea rdi, [r10 + rcx*8 + 0x7da0deb0]
sar ecx, 0x5b
ror r10w, 0x43
mov edx, dword ss:[r11 + r10 - 0x4c356922]
call fcn.1813b4c1d
push 0xffffffff9e042726
mov eax, dword [rsi]
sal word [rsp], 0x25
mov edx, dword [rsi + 4]
not eax
sets byte [rsp + 4]
mov ebx, 0xb98ae602
rol dword [rsp + 4], 0x8b
not edx
movzx r9d, word [rsp + 4]
rol word [rsp + r9 - 0xfff], 0x4d
sub dword [rsp + r9*2 - 0x1ffb], 0x2c982980
or eax, edx
xchg bx, r9w
ror r9b, 0x84
dec r9b
mov dword [rsi + r9 - 0xe61b], eax
inc dword [rsp + r9*2 - 0x1cc3e]
lea rcx, [r9 + r9 + 0x2aba8738]
movzx edi, r9b
mov ecx, dword [r11 + r9*2 - 0x1cc42]
jne 0x181378a3b
xor ecx, ebp
mov dword [rsp + r9*8 - 0x730f7], 0xcb2186a8
jmp 0x1813737c7
Function at 0x1813c4404
Capabilities:
Execute anti-debugging instructions

Disassembly:
add di, 0x7a80
sal dl, 0x65
shl rdx, 0xb
cdq
xor di, 0x641a
xor di, dx
btc dx, ax
pop r10
xor bp, di
lea rdi, [rsp + rdi + 0x10]
mov qword [rsp + rax + 0x11ab28db], rdx
sub r11d, ecx
rol word [rsp + rax*2 + 0x235651a6], 0xaa
mov edx, dword [rdi + rax + 0x11ab28d3]
dec word [rsp + r11*4 - 0x144]
mov dword [r9 + rax*2 + 0x235651a2], edx
inc cx
lea rdi, [rax*4 - 0x475e9972]
cmovs rdi, rsi
movzx edi, byte [rax + rbx + 0x11ab28d9]
sub rcx, 0xffffffff9c38330c
add sil, 0xa8
lea rbx, [rbx + rax*2 + 0x235651ad]
mov r10d, dword [rsp + rax + 0x11ab28de]
xor dil, bpl
movsx edx, byte [rsp + rax*2 + 0x235651a9]
jmp 0x1813cb75c

Function at 0x1813c74a1
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
inc eax
add rax, r9
rol edx, 1
push rbp
movsx ebp, bl
sal r9, 0x22
xor dword [rsp + rax - 0x4445e579], edx
neg r8
xchg r8, rbp
pop rbp
ror bx, 0xc7
sub r8b, al
shr bx, 0xa9
movsxd rdx, edx
sal bx, 7
xadd r9d, edi
shr rbx, 0x39
adc r10, rdx
or r8w, 0x7828
adc rbx, r10
jmp rbx
ror r10d, 2
mov esi, 0xe0008514
neg rcx
inc r10d
xor edx, eax
rol dl, 0xa7
push rbp
neg cl
xor dword [rsp + rax - 0x28a0], r10d
movzx edi, cx
pop rbp
movsxd r10, r10d
lea r11, [rsi*8 - 0x54d14eed]
neg rdx
neg cl
add r8, r10
jmp fcn.1813818a2
mov qword [rsp + rax - 0x4d00efac], rsi
add r8, r10
btc rsi, rdi
pop rcx
movzx eax, byte [rbx + rax - 0x4d00efa8]
neg r11b
xor al, bpl
rol r11d, 0xef
add di, di
xor r11b, dl
dec al
not al
and cl, 0x9d
movsx r10d, cl
and ecx, 0xeb84e732
neg al
sub r11b, cl
adc al, 0x80
xchg dl, dil
xor bpl, al
mov word [r9 + r11*2 - 0x146], ax
sub r11b, sil
lea rax, [rsi*8 - 0x44f6eeff]
movzx esi, byte [rbx + r11 - 0xdf]
not r11w
lea rbx, [r11 + rbx - 0xff15]
sal r11b, 0x21
dec cx
sar edi, 0x22
xor sil, bpl
xadd edx, r11d
bts rax, rcx
adc dil, 0xb2
inc sil
add edx, eax
and edi, edx
sbb r10, r11
neg sil
push rdx
pop r11
add sil, 0xba
bswap r11
neg sil
lea rdi, [rax*8 - 0x34dc154f]
jmp 0x181419245
sub sil, 0xa9
or dl, dil
cdq
not sil
sub cl, dl
xor bpl, sil
add rsi, rsp
neg cl
mul dx
mul ax
mov edi, dword [rsi + rdx*4]
and eax, eax
mov dword [r9 + rdx*4 - 6], edi
neg r10
rol al, 0x87
movsx edi, cl
lea r9, [r9 + rdx - 6]
mul rax
jno fcn.18134300b
mov rcx, qword [r10 + r11*2]
mul dword [rsp + r11 + 0xa]
mov qword [rax + r9 - 0x3dcad7e4], rcx
rol eax, 0x32
and dword [rsp + rax - 0x5f50f721], r11d
lea r9, [r9 + rax - 0x5f50f73b]
pop rax
pop r11
jle fcn.18134300b
mov dx, word [rsi]
mov ecx, 0x71ab7726
mov r8w, word [rsi + rcx - 0x71ab7724]
sal cl, 0xe3
mov eax, ecx
movsx ebx, al
lea rsi, [rax + rsi - 0x71ab772e]
and dx, r8w
lea rdi, [rbx*2 - 0x4dd38851]
btc ecx, edi
sar rax, 0x45
not dx
lea r9, [rax*2 + 0x552a282e]
mov word [rcx + rsi - 0x71abf730], dx
jae 0x18139b8a4
lea r11, [r11 + rax*2 - 0x71ab776]
and edi, 0xb4064cae
mov edx, dword [rcx + r11 - 0x71abf730]
neg bx
xor di, r9w
xor edx, ebp
neg rcx
movsx r8d, ax
shl cx, 0x82
inc edx
ror r9d, 0x47
ror edx, 1
dec dil
xor edx, 0x33970a07
jmp 0x1813979f9
Function at 0x1813c7810
Capabilities:
Parse pe header

Disassembly:
mov dword [r9 + riz + 4], r11d
mov qword [rsp], rcx
call fcn.1813a9260
Function at 0x1813ce6a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub di, 0xd002
movzx edx, bl
add ebx, 0x64073227
lea rax, [rbx + rdx*2 - 0x195503cb]
ror di, 1
not di
lea rcx, [r8*4 - 0x6ef0b963]
xor bp, di
add rdi, rsp
sal rdx, cl
jp 0x1813b04f5
movsx ecx, r8w
lea r11, [r11 + rdi - 0x46180ebe]
not dil
neg rcx
mov r9d, dword [r11 + rdi - 0x46180e45]
xor r9d, ebp
inc r8b
call fcn.181330804
mov eax, 0x273b8cbe
movsx esi, ax
rdtsc
sub r9, 8
mov dword [r9 + riz + 4], eax
mov dword [r9 + riz], edx
jmp 0x1813d06a9
sub r11, 4
mov r9d, 0x8988826
mov r8d, dword [r11 + r9 - 0x8988826]
movzx ebx, r9w
movsx edx, bx
lea rdi, [rdx + rdx*4 + 0x1d0e0505]
xor r8d, ebp
movzx ecx, bx
xor rcx, rdi
ror r8d, 1
btc edi, edx
inc bx
mov eax, 0xa63c0109
lea r8d, [r8 + rbx*2 - 0x5eb5ffeb]
adc edx, ecx
sal cl, 0x47
rol dl, 0x61
ror r8d, 1
cwd
not r8d
btc cx, bx
rol r8d, 3
sal rdx, 0xb0
call fcn.18138d0bc
mov r9d, 0x2501f322
lea rcx, [r9 + r9*2 - 0x3edf90d4]
movzx eax, r9w
lea r11, [r9 + r11 - 0x2501f326]
mov r8d, dword [r11 + rcx - 0x30264892]
inc ax
shl rax, 0x9a
xor r8d, ebp
and r9b, r9b
bt rcx, rcx
xadd eax, r9d
dec r8d
not r9
bswap r8d
lea rdi, [r9*8 - 0x7c4ff070]
lea r8d, [r9 + r8 - 0x33037b6]
shl ecx, cl
jnp 0x18139add4
movsx ebx, dil
neg r8d
push rbp
not r9
xchg bx, cx
xor dword [rsp + rcx - 0x2248ff88], r8d
bt edi, ecx
sar di, cl
push rcx
mov rbp, qword [rsp + rcx - 0x2248ff80]
movsxd r8, r8d
sub bl, r9b
and bl, r9b
adc r10, r8
push rcx
mov r8d, dword [rcx + rsi - 0x2248ff88]
shl r9d, 0xab
shl bx, 0x45
sbb ax, bx
mov eax, dword [r9 + rsi + 4]
sar r9w, 0xc1
bswap ebx
mul r8d
mov qword [rsp + r9 + 0x10], rbx
xor qword [rsp + r9 + 0xc], r9
btr r9d, r9d
mov dword [r9 + rsi], edx
mov edx, ebx
sbb r9w, word [rsp + r9*2 + 6]
mov dword [r9 + rsi + 4], eax
push rdx
setl r9b
lea r8, [rdi*8 - 0x7c4644c3]
mov qword [rsp + r9], r10
ret 0x18
add rbx, 4
push rcx
jmp 0x1813de939
jmp 0x18134f953
mov byte [rbx + rdi - 0x64077f56], r9b
lea r9, [rbx - 0x26edad5f]
lea r11, [r11 + rbx - 0x64077f5a]
ror edx, cl
add r10d, 0x4aa6d40c
bt r11, r11
xor r11, rsi
not r10d
movsx edi, cx
lea r10d, [rcx + r10 - 0xa2dbb92]
xor r10d, 0x5bb9c921
dec esi
jns 0x181399396
jge 0x18134d83f
push rbp
jns 0x181351963
cdqe
sub edx, 0x811d5c27
xor dword [rsp + rax + 0x8004], r10d
shl rax, 0xd0
pop rbp
movsxd r10, r10d
call fcn.1813d322d
mov edx, dword [rbx]
mov ecx, 0xdaa86429
jmp 0x18135ef65
mov qword [rsp + rcx - 0x449f7613], r10
xor al, 0x11
pop rcx
dec al
rol al, 1
sub r11, 0x5106f8bf
xor bpl, al
shl r11b, 0xa1
adc rax, rsp
bts si, 0x1e
bts r10w, 0x8f
sub r11, rcx
mov dword [rax + riz], edx
movsx eax, r11w
mov r10d, dword [rbx + riz + 1]
xor r10d, ebp
lea rdx, [r11*2 + 0x42a6a385]
div cl
rol sil, 0x85
ror r10d, 2
cwd
jmp 0x1813b88f5

Function at 0x1813d1752
Capabilities:
Authenticate hmac

Disassembly:
inc dil
sar rax, cl
xor dil, 0xaa
cbw
rol dil, 1
mov qword [rsp + rax], rcx
inc dil
inc dword [rsp + rax + 1]
pop rcx
sub word [rsp + rax + 4], cx
neg dil
call fcn.1813edffb
Function at 0x1813d44ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg rcx, rax
sbb dil, 1
inc dx
cwde
neg dil
xor bpl, dil
inc eax
lea rdi, [rsp + rdi + 8]
mov qword [rsp + rax*2 - 0xb2], r11
setp dl
mov dword [rdi + rax*2 - 0xb2], esi
pop rcx
jns fcn.18134300b
mov esi, 0xf93bb728
rdtsc
sub r9, 8
movsx edi, si
mov dword [r9 + riz + 4], eax
movzx r10d, si
mov dword [r9 + r10*4 - 0x2dca0], edx
mov esi, dword [rbx + r10 - 0xb728]
movsx r11d, di
not di
movsx edx, r11w
lea rbx, [rbx + r10*4 - 0x2dc9c]
xadd rdi, rdx
push rdx
mov dword [rsp + r10 - 0xb725], r10d
xor esi, ebp
dec esi
lea rax, [r11*2 - 0x1e6ac57e]
bswap esi
not esi
xor esi, 0xc4a6b887
lea esi, [rsi + r10 + 0x62014367]
ror al, 5
mov qword [rsp + r10*2 - 0x16e50], rbp
dec r11w
push rax
xor dword [rsp + r10 - 0xb720], esi
jmp 0x18137716e
Function at 0x1813da3ea
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
pop rbp
movsxd rsi, esi
neg ecx
add r8, rsi
call fcn.181371a17
mov r8d, eax
mov ebx, r8d
xor bp, cx
call fcn.1813baa1f
lea r11, [r11 + rax*2 - 0x170]
mov edi, dword [r11 + rax - 0xb6]
movzx ecx, dx
inc bx
xor edi, ebp
call fcn.1813ca975
call fcn.1813e9f4d
jmp 0x1813f2a26
bts eax, 0x2c
inc esi
mov r11, qword [r9 + r11*4 - 0x18058]
jb 0x1814161c4
mov ecx, 0x8dbfa3ac
lea r11, [rcx*4 + 0x1606e3b8]
mov eax, 0x760975b5
mov r11d, dword [rax + rbx - 0x760975b5]
lea rsi, [rax + rcx - 0x53446e6b]
xor r11d, ebp
rol r11d, 3
mov r10d, ecx
rol r10, 0xb5
inc r11d
dec esi
js 0x1813fe021
dec ebx
not byte [rsp + 6]
jmp 0x1813f34e1
bswap r11d
movzx edi, cl
inc r11d
bts ecx, ecx
xor r11d, 0xc32ec190
call fcn.181383587
mov r9d, 0x78275fb6
mov rcx, qword [rsi + r9 - 0x78275fb6]
movzx eax, r9b
mov r9b, byte [rsi + r9 - 0x78275fae]
movsx edi, ax
movzx edx, al
lea rsi, [rax + rsi - 0xac]
lea r8, [rdi - 0x7e5f52d0]
shl r8, 0xd4
btc di, ax
mov byte ss:[rcx + rax - 0xb6], r9b
mov ebx, 0x5a2736b9
jae 0x1813944e9
mov eax, 0x389dc0b
cbw
mov esi, dword [rax + rbx - 0x389000b]
mov edi, 0xdc2bcd32
lea rbx, [rbx + rax*4 - 0xe240028]
movzx r10d, ax
mov edx, eax
dec r10
xor esi, ebp
btc rdx, rax
dec dl
btc r10w, dx
ror esi, 1
xor r10w, r10w
jbe 0x18139e13e
mov r10d, 0x82adfc90
lea r10, [r10*4 + 0x763f5801]
mov r11d, r10d
mov cx, word [r9 + riz]
shr r10b, 0xa2
bt r11w, r11w
mov si, word [r9 + riz + 2]
not cx
movzx edi, r11w
btc di, r10w
inc dil
not si
shr r10d, 0x6b
or cx, si
mov word [r9 + r10*2 - 0x203dd0], cx
mov eax, 0x521a2488
not r11w
neg r11
mov esi, dword [rbx + r10*2 - 0x203dd2]
lea rcx, [r10 - 0x8ebda68]
lea rbx, [rbx + r10*2 - 0x203dce]
xchg ch, al
not r10w
xor esi, ebp
sal rdi, 0x81
imul cl
lea r11, [rdi + rcx*4 + 0x596cd12]
neg esi
sar r10d, 0x3a
cdqe
bswap esi
lea esi, [rsi + r11 + 0x257ae103]
xor esi, 0x6bea8ad
dec r10d
je 0x1813fed39
ror esi, 3
and edi, eax
push rbp
adc r11w, r11w
xor dword [rsp + r11 + 0x1dd6f8d0], esi
xchg dil, r10b
jmp 0x181385ec6
and cx, word [rsp + rbx*4 - 0x2729b]
seta byte [rsp + rbx - 0x9ca4]
rol eax, 1
lea eax, [r8 + rax - 0x6773eb3d]
ror eax, 1
xadd ecx, edi
lea eax, [rax + rdx - 0x60d43ca6]
inc rcx
sar di, 0xca
mov qword [rsp + r8 - 0x6dac606e], rbp
lea rbp, [rdi*8 + 0x26072a29]
xor dword [rsp + r8 - 0x6dac606e], eax
jmp 0x181403d10
pop rbp
movsxd rax, eax
add r10, rax
xadd r8b, cl
bt cx, dx
jb fcn.181381c17
add r9d, edi
mov r9, qword [rsi + r9 - 0x53afd200]
ror edi, cl
mov r8w, word [rdi + rsi + 8]
lea rbx, [rcx + rdi*8 - 0xb7beafa]
mov qword [rsp + rdi*2 + 0x10], rbx
lea rsi, [rsi + rdi + 0xa]
sub dil, dil
mov word [r9 + rdi*2], r8w
sub dword [rsp + rdi + 0x13], 0xb099e0bb
mov qword [rsp + rdi*2], r10
ret 0x10
Function at 0x1813dd484
Capabilities:
Authenticate hmac

Disassembly:
xadd byte [rsp + rdx + 0x49aa0001], dil
call fcn.18135969d
xor si, 0x9e2d
push rcx
dec si
xor si, 0x6b0e
xor qword [rsp + r10 - 0xff17224], 0xffffffffcf95868c
bts cx, dx
ror si, 1
xor bp, si
xor rdx, rcx
movzx r11d, r10b
sar dword [rsp + r10 - 0xff17223], 0xa8
lea rsi, [rsp + rsi + 8]
sar r11b, cl
mov byte [rsi + r10*4 - 0x3fc5c890], al
push rdx
mov r10d, dword [rbx + r10*4 - 0x3fc5c88e]
setbe byte [rsp + rdx - 4]
lea rbx, [rbx + rdx + 1]
lea rax, [rdx*4 - 0x326d99fa]
or rdx, 0xa9109af
jae 0x1813d069a
mov edi, 0x732d9493
mov ebx, dword [r11 + rdi - 0x732d9497]
xor ebx, ebp
movzx r9d, dil
push rdi
mov byte [rsp + rdi - 0x732d948e], dil
lea ebx, [rbx + rdi*2 - 0x3050a119]
movzx r8d, di
xadd word [rsp + rdi - 0x732d9490], di
mov ecx, r9d
bswap ebx
imul cx, word [rsp + rdi - 0x732d0072]
xchg dword [rsp + rdi - 0x732d0071], r9d
not ebx
jo 0x18133d60b
not eax
xor dl, dil
lea rbx, [rcx + rcx*8 + 0x1e9f94b5]
adc qword [rsp + rdx + 0x49a9012e], 0xffffffffbe9f3b87
dec eax
xor dx, dx
sub dword [rsp + rdx + 0x49aa0003], ecx
inc dil
not eax
dec byte [rsp + rdx + 0x49aa0000]
dec qword [rsp + rdx + 0x49aa0000]
adc word [rsp + rdx + 0x49aa0005], 0x7e2d
rol eax, 1
jmp 0x181330832
movzx edx, r8b
rol dword [rsp + r8 - 0x9490], cl
lea ebx, [rbx + r8 + 0x3c0aea89]
mov qword [rsp + rdi - 0x732d0073], rbp
xor dword [rsp + rdi - 0x732d0073], ebx
jmp 0x1813d48b9
xor r10w, bp
lea rax, [rcx + r11*2 - 0x5cf0395d]
mov qword [rsp + rdi - 0x4c81], 0xffffffffa0364a16
cbw
add r10w, 0x626
btc edx, ecx
ror r10w, 1
xor dword [rsp + rdi*2 - 0x98ff], r11d
adc r10w, 0x7a80
xor r10w, 0x641a
call fcn.18140e27a
mov r10d, 0x2fa89986
imul r10d, r10d
movzx di, byte [r10 + r9 - 0xff17224]
movsx eax, r10w
mov cl, byte [r9 + r10 - 0xff17222]
movsx edx, al
shl dil, cl
mov word [r9 + r10*2 - 0x1fe2e446], di
xchg r10b, dl
bts ax, dx
and dl, ah
mov ax, word [r10 + r9 - 0xff17222]
lea rsi, [rdx + 0x5b8843be]
jns 0x1813f2f98
bts si, dx
lea r9, [r9 + r10*2 - 0x1fe2e444]
movzx ecx, r10b
movzx esi, word [rbx + r10 - 0xff17224]
xor si, bp
jmp 0x18133092c

Function at 0x1813edabd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd dword [rsp + r8 + 8], r8d
lea rsi, [rsi + r8 - 0x5aa7b53f]
not rbx
pop r9
pop rdx
pop rax
jge fcn.181381c17
and edx, 0x6330621
bswap r9d
push rdx
rol r9d, 2
idiv rcx
sub r9d, 0xa43132a6
and word [rsp + 0x10], dx
mov qword [rsp + 0x10], rbp
and edx, dword [rsp]
xor dword [rsp + rdx*8 - 0x200000f0], r9d
mov rbp, qword [rsp + rdx - 0x4000010]
movzx r8d, bx
shl r8b, 0x64
and edx, dword [rsp + rdx*8 - 0x200000fd]
movsxd r9, r9d
jl 0x181396f75
adc r10, r9
movsx r9d, word [rsp + rdx + 2]
mov qword [rsp + r8 + 8], 0x5aa7b52f
rdtsc
mov dword [r9 + rsi - 0x40d], eax
or dword [rsp + r8 + 8], r8d
mov dword [r8 + rsi - 0x10], edx
xor dil, cl
jns 0x1813e4095
Function at 0x1813f023f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor bp, r8w
mov qword [rsp + rdx*8], rdx
lea r8, [rsp + r8 + 0x10]
shl rax, 0xcf
sub byte [rsp + rdx*2 + 0xa], al
mov dword [r8 + rdx], edi
pop rdx
movzx r8d, word [rsp + rdx*2 + 2]
add r8, qword [r11 + rdx*4 - 0xa]
sal dword [rsp + rdx*8 + 1], 0xd9
inc ax
movzx ecx, r9b
xor r8, rbp
lea rbx, [r9 + rdx*8 + 0x6a039e0b]
ror r8, 6
and eax, 0x7da1d70f
neg rdx
lea r8, [r8 + rdx*8 + 0x3daf4d1]
sbb word [rsp + rdx], dx
or qword [rsp + rdx], rax
div qword [rsp + rdx]
neg r8
lea rdi, [rax + rcx*2 + 0x271d433f]
inc r8
xadd qword [rsp + rdx - 0x45a08001], rdx
neg byte [rsp + rax + 5]
call fcn.1813fe2e5
Function at 0x1813f642b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1813e7562
push 0x1f80a91c
mov edx, 0xdea2f124
mov eax, dword [rbx + riz]
shl byte [rsp + 7], 2
xadd word [rsp + 5], dx
call fcn.181347f4b
lea rsi, [rsi + rdi*2 - 0x672]
adc r8, 0x662ee7b5
btc rdi, 0x9a
mov word [rsi + rdi - 0x4000338], bx
shr r8w, cl
movzx eax, dil
ja fcn.181381c17
rol rax, cl
mov word [rsi + rcx*2 - 0x20], r8w
mov eax, dword [rdi + r11 - 5]
sbb cx, 0x7d31
mov ebx, r9d
lea r11, [r11 + rdi - 5]
jbe 0x18133c167
mov edx, 0xfe9b79b5
movzx edi, dl
movzx cx, byte [rdi + rsi - 0xb5]
lea r9, [rdi - 0x655d4a42]
movzx eax, di
mov bl, byte [rsi + rdi*4 - 0x2d2]
lea r8, [rax + r9 - 0x4f5ad9dd]
cwde
or cl, bl
not cl
push r8
mov word [rsi + r9 + 0x655d498f], cx
add edi, r8d
movsx ebx, byte [rsp + rax*8 - 0x5a4]
bts rdx, r9
mov edx, dword [rdi + r11 - 0x4b47de04]
call fcn.1813a5c10
sete dil
xor eax, ebp
imul r9w, dx
seto bl
xor eax, 0x7497e59d
not ecx
inc eax
bt r9w, 0xc
rol eax, 3
movsx r8d, bl
xor eax, 0x8df817
inc rdx
push rdx
mov qword [rsp + rdi], rbp
shl edi, 0x23
neg edi
xor dword [rsp + rdi*2], eax
pop rbp
movsxd rax, eax
neg r8d
adc r10, rax
btc rdx, rdx
lea rax, [rdx + rbx + 0x5daa9612]
movzx ax, byte [rdi + rsi - 2]
shr di, 0x61
mov cl, byte [rsi + rdi]
push rdi
sar rdi, 0x73
adc al, cl
sal rdx, 0x2b
js 0x18141b32d
mov ecx, 0x4b9c608c
call fcn.181400892
mov rax, qword [rsi + rdx*2 - 0xcd02]
push rdx
lea r9, [rdx + 0x1f8fde81]
bts rdx, rdi
lea rsi, [rsi + rdx*4 - 0x19a8c]
mov ebx, 0x7d1dd10d
or r8, rax
xor word [rsp + rdx - 0x66a0], cx
not r8
neg r9d
mov qword [rsi + rdx*4 - 0x19a94], r8
dec edi
rol r9b, 0x26
shl byte [rsp + rdx*4 - 0x19a91], 0x83
lea r11, [r11 + rdx*2 - 0xcd4e]
mov edx, dword [r11 + rdx*2 - 0xcd4a]
xor edx, ebp
push rdi
not byte [rsp + rdi - 0x7b]
add ebx, ebx
not edx
neg rcx
sar word [rsp + rdi - 0x76], 0x2d
inc edx
jmp fcn.1813da251
mov dword [r9 + rdi - 0x139fbaba], eax
push r11
movsx eax, dl
mov eax, dword [rbx + r11 - 0x593f807]
or sil, 0xa0
pop r10
lea rbx, [rbx + rdi - 0x139fbab6]
adc dword [rsp + rdi - 0x139fbab7], esi
add dword [rsp + rdi - 0x139fbab9], 0xf2dd7bb
xor dword [rsp + rdi - 0x139fbab9], 0xfb2e309
xor eax, ebp
imul rdi, r11
push r11
add r11w, 0x12
neg eax
add r10w, 0x5288
xor eax, 0xf21ff034
movzx ecx, di
rol eax, 1
and r10d, 0x9bb7e63b
adc eax, 0xe08e07a0
shr r10d, cl
jp 0x181407115
push rdi
xchg byte [rsp + rdi - 0x139fba89], dil
mov r11d, 0x593f807
lea r9, [r9 + rdi*2 - 0x273f756e]
mov edx, r11d
shrd eax, esi, cl
mov esi, edx
jmp 0x181395eeb
jb 0x18139b9ae
push 0xb0f4808
lea rsp, [rsp + 0x10]
sbb rsp, rcx
jmp 0x1813343c9
mov word [rsi + rdi], ax
xadd word [rsp + rdi*2 + 3], r9w
movsx ecx, dx
or qword [rsp + rdi], r10
ret
Function at 0x1813f8703
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
lea rsi, [rsi + rdx - 0x67033776]
sar edx, cl
mov dword [rdi + rdx*4 - 0x67033780], ebx
push r8
movzx eax, cl
lea r11, [r11 + rdx*4 - 0x67033784]
adc dx, r8w
lea rbx, [rcx + rax - 0x52fb13de]
mov edi, dword [r11 + rdx*4 - 0x6700bbb8]
setns byte [rsp + rax - 0x7f]
xor edi, ebp
xor edi, 0x3226fe9a
rol edi, 1
neg bx
lea edi, [rdi + rdx*8 + 0x26bbae3b]
sub qword [rsp + rdx*4 - 0x6700bbb8], rdx
dec qword [rsp + rax - 0x82]
rol edi, 1
xchg qword [rsp + rdx - 0x19c02eee], rdx
mul byte [rsp + rax*2 - 0xff]
mov qword [rsp + rax], rbp
jae 0x1813ca939
mov qword [rsp + r8 - 0x5aaf921e], 0xffffffffb200903b
imul rax, r8
xor dword [rsp + r8 - 0x5aaf9216], ebx
dec word [rsp + r8 - 0x5aaf921a]
movzx ecx, byte [rsp + rdi - 0x248efd]
mov r9d, 0x25345d15
mov rbp, qword [rsp + rdi - 0x248ef8]
and al, r9b
mov qword [rsp + rdi*4 - 0x923bf8], r9
sal cx, 7
movsxd rbx, ebx
xadd qword [rsp + r8 - 0x5aaf9216], rax
sal eax, 0x49
cmovns di, word [rsp + rcx*2 - 0xb1f7]
adc r10, rbx
bts rcx, 0xe
setae r8b
movzx ecx, byte [rax + r11 - 0x68ba2a05]
xor cl, bpl
inc cl
mov ebx, dword [rsp + rdi*4 - 0x909854]
xchg byte [rsp + rax - 0x68ba29f6], bl
inc r9b
not cl
rol rax, 0xbf
shl r9b, 5
neg rdi
adc cl, al
dec rdi
inc word [rsp + rax*2 - 0x68ba29f3]
neg cl
cqo
xor bpl, cl
sal r9b, 0x41
jns fcn.181409d9d
lea rcx, [rsp + rcx + 0x10]
push r8
adc dword [rsp + r8 - 0x5aaf91f5], edi
adc rdx, qword [rsp + rax*2 - 0x68ba29f0]
movzx r8w, byte [rcx + rax - 0x345d1500]
movzx ecx, bx
mov word [rax + rsi - 0x345d1502], r8w
sar edx, cl
sar r9w, 8
movzx ecx, byte [rax + r11 - 0x345d1506]
lea r11, [rax + r11 - 0x345d1506]
pop r8
sar bl, 0x21
xor cl, bpl
xor r8b, 0xb0
cwde
adc cl, 0xa4
call fcn.1813fb22a
mov edx, 0x67033782
lea r8, [rdx + rdx*4 - 0x5244b47d]
movzx edi, dl
mov rdi, qword [rsi + rdi*8 - 0x410]
movsx ebx, dl
movsx ecx, bx
mov ebx, dword [rsi + rdx - 0x6703377a]
jmp 0x181397172
Function at 0x1813fdc96
Capabilities:
Execute anti-debugging instructions
Manually build aes constants

Disassembly:
imul eax
rol cl, 1
not cl
mul dl
not rdi
cqo
adc cl, 6
movsx r9d, dx
ror cl, 1
xadd r9b, bl
inc cl
mov qword [rsp + rdi + 0x22a5148a], rdi
sal r9w, 0x68
mov r8d, dword [rsp + rbx - 0x3f9398ff]
xor bpl, cl
sal dword [rsp + rdi + 0x22a5148a], 0xfe
lea rcx, [rsp + rcx + 8]
adc di, word [rsp + rdi*2 + 0x454a291a]
div rax
add qword [rsp + rdi + 0x22a5148a], 0x6c1fdeb7
mov r8, qword [rcx + rbx - 0x3f939900]
mov qword [rsi + rbx - 0x3f939908], r8
mov r9d, dword [r11 + rdi + 0x22a51485]
neg byte [rsp + rdi*2 + 0x454a291a]
xor r9d, ebp
ror r9d, 3
lea rdx, [rbx*4 + 0x110f159e]
movzx ecx, bx
neg ebx
lea r9d, [rdi + r9 + 0x4950de18]
movzx r8d, byte [rsp + rdi + 0x22a5148d]
sal rbx, 0x6d
bt rdx, rax
not r9d
ror r9d, 2
shr ax, 0x41
mov qword [rsp + rdi*2 + 0x454a2914], rbp
add bl, r8b
lea rbp, [rbx*4 - 0x434541f9]
js 0x18140122a
mov edi, 0x5e88f894
mov r11d, dword [rbx + rdi - 0x5e88f894]
movsx esi, dil
lea rbx, [rbx + rdi - 0x5e88f890]
ror si, 0x2a
xor r11d, ebp
movzx ecx, si
lea r11d, [rcx + r11 - 0x5700ea53]
movsx eax, di
neg r11d
rol r11d, 2
not cx
inc r11d
lea r10, [rcx + rcx*4 - 0x3878e9d2]
push rbp
imul al
call fcn.18141c5d8
xor dword [rsp + rax], r9d
pop rbp
and r8, rdx
sar r8d, 0x13
movsxd r9, r9d
adc r10, r9
mov rdx, qword [rsi + rdi*2 + 0x454a290c]
sub di, 0x122c
xor edi, 0xf184deab
sal r8, 0x81
add r8b, byte [r11 + rdi*2 - 0x59bc0fc8]
sub rax, rdi
jp 0x1813bc379
movzx r9d, di
lea r11, [r11 + rdi*2 - 0x59bc0fc8]
push rcx
btc r9, rcx
xor r8b, bpl
inc dil
sub ax, word [rsp + rax + 0x2cde07e3]
sbb r8b, 0x90
xor r8b, 0x25
inc r8b
shr r9w, 0x8a
mov qword [rsp + rax + 0x2cde07e1], rcx
xor r8b, 0x2c
inc dword [rsp + rcx - 0x98fe]
js 0x1813a1061
ror di, 0x8b
xor bpl, r8b
sar r9d, 0xc6
xadd word [rsp + rdi*2 - 0x59bdf87f], cx
lea r8, [rsp + r8 + 8]
shl qword [rsp + rdi*2 - 0x59bdf880], cl
imul rbx, qword [rsp + rax*2 + 0x59bc0fc2]
mov qword [r8 + rdi*2 - 0x59bdf880], rdx
mov qword [rsp + rdi - 0x2cdefc40], r10
ret

Function at 0x1814037ff
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
pop r11
jo fcn.18134300b
imul eax, r11d
mov r9, qword [r9 + rdx*8]
mov qword [rsp + rdx], rdi
jb 0x1813f86fb
mov al, byte [rsi + rdx*4 - 0x406921e6]
bt dx, dx
or cx, 0x4c81
sbb dil, 4
lea rsi, [rsi + rdx*4 - 0x406921e6]
ror dil, 0xa5
dec edx
add bl, al
not rdx
jmp 0x181413c3d