joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x37], rax
movups xmm0, xmmword [0x14025e058]
xor r11d, r11d
mov dword [rsp], 0x8b0048
mov dword [rsp + 4], 0x4800c4
mov r12d, 0xffff
movq rax, xmm0
mov dword [rsp + 8], 0x580089
psrldq xmm0, 8
movzx edx, r11w
movq r10, xmm0
mov dword [rsp + 0xc], 0x550008
add r10, rax
mov dword [rsp + 0x10], 0x570056
mov dword [rsp + 0x14], 0x540041
mov dword [rsp + 0x18], 0x550041
mov dword [rsp + 0x1c], 0x560041
mov dword [rsp + 0x20], 0x570041
mov dword [rsp + 0x24], 0x8d0048
mov qword [rsp + 0x28], 0xffffffffffff00a8
mov dword [rsp + 0x30], 0x48ffff
mov dword [rsp + 0x34], 0xec0081
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rbp - 0x79], 0x29000f
mov dword [rbp - 0x75], 0xb80070
mov dword [rbp - 0x71], 0x29000f
mov dword [rbp - 0x6d], 0xa80078
mov dword [rbp - 0x69], 0xf0044
mov dword [rbp - 0x65], 0x400029
mov dword [rbp - 0x61], 0x44ffff
mov dword [rbp - 0x5d], 0x29000f
mov dword [rbp - 0x59], 0xffff0048
mov dword [rbp - 0x55], 0xf0044
mov dword [rbp - 0x51], 0x900029
mov qword [rbp - 0x4d], 0xffffffffffffffff
mov dword [rbp - 0x45], 0xf0044
mov dword [rbp - 0x41], 0x980029
mov qword [rbp - 0x3d], 0xffffffffffffffff
mov dword [rbp - 0x35], 0xf0044
mov dword [rbp - 0x31], 0xa00029
mov qword [rbp - 0x2d], 0xffffffffffffffff
mov dword [rbp - 0x25], 0xf0044
mov dword [rbp - 0x21], 0xa80029
mov qword [rbp - 0x1d], 0xffffffffffffffff
mov dword [rbp - 0x15], 0xf0044
mov dword [rbp - 0x11], 0xb00029
mov qword [rbp - 0xd], 0xffffffffffffffff
mov dword [rbp - 5], 0xf0044
mov dword [rbp - 1], 0xb80029
mov qword [rbp + 3], 0xffffffffffffffff
mov dword [rbp + 0xb], 0x8b0048
mov qword [rbp + 0xf], 0xffffffffffff0005
mov dword [rbp + 0x17], 0x48ffff
mov dword [rbp + 0x1b], 0xc40033
mov dword [rbp + 0x1f], 0x890048
mov qword [rbp + 0x23], 0xffffffffffff0085
mov dword [rbp + 0x2b], 0x49ffff
mov dword [rbp + 0x2f], 0xf9008b
cmp rax, r10
je 0x140079013
mov r9, rax
nop
movzx ecx, dx
movzx r8d, word [rsp + rcx*2]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x140079002
cmp r8w, r12w
je 0x140079002
inc rax
mov edx, r11d
mov r9, rax
jmp 0x14007900e
inc dx
cmp dx, 0x76
je 0x140079042
inc rax
cmp rax, r10
jne 0x140078fe0
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008fde0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rax, r9
jmp 0x140079015
Function at 0x140079050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x20], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rsp], 0x8b0048
mov dword [rsp + 4], 0x4800c4
mov edi, 0xffff
movq rax, xmm0
mov dword [rsp + 8], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rsp + 0xc], 0x480010
add r10, rax
mov dword [rsp + 0x10], 0x680089
mov dword [rsp + 0x14], 0x560018
mov dword [rsp + 0x18], 0x410057
mov dword [rsp + 0x1c], 0x410054
mov dword [rsp + 0x20], 0x410056
mov dword [rsp + 0x24], 0x480057
mov dword [rsp + 0x28], 0xec0081
mov qword [rsp + 0x2c], 0xffffffffffffffff
mov dword [rsp + 0x34], 0x29000f
mov dword [rsp + 0x38], 0xc80070
mov dword [rsp + 0x3c], 0x29000f
mov dword [rsp + 0x40], 0xb80078
mov dword [rsp + 0x44], 0x8b0048
mov qword [rsp + 0x48], 0xffffffffffff0005
mov dword [rsp + 0x50], 0x48ffff
mov dword [rsp + 0x54], 0xc40033
mov dword [rsp + 0x58], 0x890048
mov dword [rsp + 0x5c], 0x240044
mov dword [rsp + 0x60], 0x4dffff
mov dword [rsp + 0x64], 0xf1008b
mov dword [rsp + 0x68], 0x8b0049
mov dword [rsp + 0x6c], 0x4800f0
mov dword [rsp + 0x70], 0xea008b
mov dword [rsp + 0x74], 0x8b0048
mov dword [rsp + 0x78], 0xf00f9
mov dword [rsp + 0x7c], 0xc00057
mov dword [rbp - 0x80], 0x11000f
mov dword [rbp - 0x7c], 0x240044
mov dword [rbp - 0x78], 0x48ffff
mov dword [rbp - 0x74], 0x51008b
mov dword [rbp - 0x70], 0x480010
mov dword [rbp - 0x6c], 0xc20081
mov qword [rbp - 0x68], 0xffffffffffffffff
mov dword [rbp - 0x60], 0x8d0048
mov dword [rbp - 0x5c], 0x24004c
mov dword [rbp - 0x58], 0xe8ffff
mov qword [rbp - 0x54], 0xffffffffffffffff
mov dword [rbp - 0x4c], 0x4c0090
mov dword [rbp - 0x48], 0x44008b
mov dword [rbp - 0x44], 0xffff0024
mov dword [rbp - 0x40], 0x85004d
mov dword [rbp - 0x3c], 0xf00c0
mov qword [rbp - 0x38], 0xffffffffffff0084
mov dword [rbp - 0x30], 0x48ffff
mov dword [rbp - 0x2c], 0x5c008b
mov dword [rbp - 0x28], 0xffff0024
mov dword [rbp - 0x24], 0x850048
mov dword [rbp - 0x20], 0x7400db
mov dword [rbp - 0x1c], 0xf0000e
mov dword [rbp - 0x18], 0x4300ff
mov dword [rbp - 0x14], 0x480008
mov dword [rbp - 0x10], 0x5c008b
mov dword [rbp - 0xc], 0xffff0024
mov dword [rbp - 8], 0x8b004c
mov dword [rbp - 4], 0x240044
mov dword [rbp], 0x49ffff
mov dword [rbp + 4], 0x8008b
mov dword [rbp + 8], 0xf00f3
mov dword [rbp + 0xc], 0x60010
mov dword [rbp + 0x10], 0x8d0048
mov dword [rbp + 0x14], 0x340041
cmp rax, r10
je 0x1400792d2
mov r9, rax
mov r11d, 0x8c
nop dword [rax]
movzx ecx, dx
movzx r8d, word [rsp + rcx*2]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x1400792c1
cmp r8w, di
je 0x1400792c1
inc rax
mov edx, ebx
mov r9, rax
jmp 0x1400792cd
inc dx
cmp dx, r11w
je 0x140079301
inc rax
cmp rax, r10
jne 0x1400792a0
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14008fde0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, r9
jmp 0x1400792d4
Function at 0x140079a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rbp - 0x39], 0x8b0048
mov dword [rbp - 0x35], 0x4800c4
mov r11d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x31], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rbp - 0x2d], 0x550010
add r10, rax
mov dword [rbp - 0x29], 0x570056
mov dword [rbp - 0x25], 0x540041
mov dword [rbp - 0x21], 0x550041
mov dword [rbp - 0x1d], 0x560041
mov dword [rbp - 0x19], 0x570041
mov dword [rbp - 0x15], 0x8d0048
mov dword [rbp - 0x11], 0x24006c
mov dword [rbp - 0xd], 0x48ffff
mov dword [rbp - 9], 0xec0081
mov qword [rbp - 5], 0xffffffffffffffff
mov dword [rbp + 3], 0x29000f
mov dword [rbp + 7], 0xb80070
mov dword [rbp + 0xb], 0x29000f
mov dword [rbp + 0xf], 0xa80078
mov dword [rbp + 0x13], 0xf0044
mov dword [rbp + 0x17], 0x400029
mov dword [rbp + 0x1b], 0x44ffff
mov dword [rbp + 0x1f], 0x29000f
mov dword [rbp + 0x23], 0xffff0048
mov dword [rbp + 0x27], 0xf0044
mov dword [rbp + 0x2b], 0x900029
mov qword [rbp + 0x2f], 0xffffffffffffffff
mov dword [rbp + 0x37], 0xf0044
mov dword [rbp + 0x3b], 0x980029
mov qword [rbp + 0x3f], 0xffffffffffffffff
cmp rax, r10
je 0x140079b53
mov r9, rax
nop word [rax + rax]
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x39]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x140079b42
cmp r8w, r11w
je 0x140079b42
inc rax
mov edx, ebx
mov r9, rax
jmp 0x140079b4e
inc dx
cmp dx, 0x40
je 0x140079b72
inc rax
cmp rax, r10
jne 0x140079b20
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14008fde0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
mov rax, r9
jmp 0x140079b55
Function at 0x14007c230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rbp - 0x80], 0x8b0048
mov dword [rbp - 0x7c], 0x4800c4
mov r11d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x78], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rbp - 0x74], 0x550010
add r10, rax
mov dword [rbp - 0x70], 0x570056
mov dword [rbp - 0x6c], 0x540041
mov dword [rbp - 0x68], 0x550041
mov dword [rbp - 0x64], 0x560041
mov dword [rbp - 0x60], 0x570041
mov dword [rbp - 0x5c], 0x8d0048
mov dword [rbp - 0x58], 0xa10068
mov dword [rbp - 0x54], 0x810048
mov qword [rbp - 0x50], 0xffffffffffff00ec
mov dword [rbp - 0x48], 0xfffff
mov dword [rbp - 0x44], 0x700029
mov dword [rbp - 0x40], 0xf00b8
mov dword [rbp - 0x3c], 0x780029
mov dword [rbp - 0x38], 0x4800a8
mov dword [rbp - 0x34], 0x5008b
mov qword [rbp - 0x30], 0xffffffffffffffff
mov dword [rbp - 0x28], 0x330048
mov dword [rbp - 0x24], 0x4800c4
mov dword [rbp - 0x20], 0x450089
mov dword [rbp - 0x1c], 0x4900ff
mov dword [rbp - 0x18], 0xf0008b
cmp rax, r10
je 0x14007c373
mov r9, rax
nop word [rax + rax]
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x80]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x14007c362
cmp r8w, r11w
je 0x14007c362
inc rax
mov edx, ebx
mov r9, rax
jmp 0x14007c36e
inc dx
cmp dx, 0x36
je 0x14007c39e
inc rax
cmp rax, r10
jne 0x14007c340
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fde0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rax, r9
jmp 0x14007c375
Function at 0x14007c3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rbp - 0x49], 0x8b0048
mov dword [rbp - 0x45], 0x4800c4
mov r11d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x41], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rbp - 0x3d], 0x550020
add r10, rax
mov dword [rbp - 0x39], 0x570056
mov dword [rbp - 0x35], 0x540041
mov dword [rbp - 0x31], 0x550041
mov dword [rbp - 0x2d], 0x560041
mov dword [rbp - 0x29], 0x570041
mov dword [rbp - 0x25], 0x8d0048
mov qword [rbp - 0x21], 0xffffffffffff00a8
mov dword [rbp - 0x19], 0x48ffff
mov dword [rbp - 0x15], 0xec0081
mov qword [rbp - 0x11], 0xffffffffffffffff
mov dword [rbp - 9], 0x29000f
mov dword [rbp - 5], 0xb80070
mov dword [rbp - 1], 0x29000f
mov dword [rbp + 3], 0xa80078
mov dword [rbp + 7], 0xf0044
mov dword [rbp + 0xb], 0x400029
mov dword [rbp + 0xf], 0x44ffff
mov dword [rbp + 0x13], 0x29000f
mov dword [rbp + 0x17], 0xffff0048
mov dword [rbp + 0x1b], 0x8b0048
mov qword [rbp + 0x1f], 0xffffffffffff0005
mov dword [rbp + 0x27], 0x48ffff
mov dword [rbp + 0x2b], 0xc40033
mov dword [rbp + 0x2f], 0x890048
mov qword [rbp + 0x33], 0xffffffffffff0085
mov dword [rbp + 0x3b], 0x4cffff
mov dword [rbp + 0x3f], 0x4c0089
mov dword [rbp + 0x43], 0xffff0024
cmp rax, r10
je 0x14007c523
mov r9, rax
nop
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x49]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x14007c512
cmp r8w, r11w
je 0x14007c512
inc rax
mov edx, ebx
mov r9, rax
jmp 0x14007c51e
inc dx
cmp dx, 0x48
je 0x14007c54e
inc rax
cmp rax, r10
jne 0x14007c4f0
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14008fde0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rax, r9
jmp 0x14007c525
Function at 0x14008d940
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rbx, qword [0x14025da30]
mov rdi, qword [0x14025da38]
cmp rbx, rdi
je 0x14008d9eb
mov rax, qword [rbx]
cmp byte [rax + 9], 0
je 0x14008d9e2
mov ecx, 8
call fcn.140090510
test rax, rax
je 0x14008d985
mov qword [rax], rbx
jmp 0x14008d988
mov rax, rsi
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14008d7a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14008d9fb
cmp dword [rsp + 0x38], 0
je 0x14008da0a
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14008da0a
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
add rbx, 8
jmp 0x14008d95f
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rsp + 0x38], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14008e8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x37], rax
movups xmm0, xmmword [0x14025e058]
xor r11d, r11d
mov dword [rbp - 0x59], 0x8b0048
mov dword [rbp - 0x55], 0x4800c4
mov r15d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x51], 0x580089
psrldq xmm0, 8
movzx edx, r11w
movq r10, xmm0
mov dword [rbp - 0x4d], 0x55ffff
add r10, rax
mov dword [rbp - 0x49], 0x570056
mov dword [rbp - 0x45], 0x540041
mov dword [rbp - 0x41], 0x550041
mov dword [rbp - 0x3d], 0x560041
mov dword [rbp - 0x39], 0x570041
mov dword [rbp - 0x35], 0x8d0048
mov qword [rbp - 0x31], 0xffffffffffff00a8
mov dword [rbp - 0x29], 0x48ffff
mov dword [rbp - 0x25], 0xec0081
mov qword [rbp - 0x21], 0xffffffffffffffff
mov dword [rbp - 0x19], 0x29000f
mov dword [rbp - 0x15], 0xffff0070
mov dword [rbp - 0x11], 0x29000f
mov dword [rbp - 0xd], 0xffff0078
mov dword [rbp - 9], 0x8b0048
mov qword [rbp - 5], 0xffffffffffff0005
mov dword [rbp + 3], 0x48ffff
mov dword [rbp + 7], 0xc40033
mov dword [rbp + 0xb], 0x890048
mov qword [rbp + 0xf], 0xffffffffffff0085
mov dword [rbp + 0x17], 0x4cffff
mov dword [rbp + 0x1b], 0xffff008b
mov dword [rbp + 0x1f], 0x890048
mov dword [rbp + 0x23], 0x240054
mov dword [rbp + 0x27], 0x4cffff
cmp rax, r10
je 0x14008ea24
mov r9, rax
nop dword [rax + rax]
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x59]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x14008ea13
cmp r8w, r15w
je 0x14008ea13
inc rax
mov edx, r11d
mov r9, rax
jmp 0x14008ea1f
inc dx
cmp dx, 0x42
je 0x14008ea4f
inc rax
cmp rax, r10
jne 0x14008e9f0
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008fde0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rax, r9
jmp 0x14008ea26
Function at 0x14008fcd0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x14008fcdb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x140090c00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140090c4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140090c4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140090c4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140090c4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140090c4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140090c4c
xor al, al
add rsp, 0x28
ret
Function at 0x1409a4c47
Capabilities:
Authenticate hmac

Disassembly:
xor r15b, 0x53
and r15d, dword [rsp + 0x38]
bswap r8
and r15, r14
lea r8, [r8*2 + 0x64db19b2]
cmp r15b, 0xa7
bswap r15
not dword [rsp + 0x38]
call fcn.140ad76f9

Function at 0x1409a4c6e
Capabilities:
Authenticate hmac

Disassembly:
bswap ebp
jl 0x140a6813a
add r8d, 0x7ed87c12
sub bpl, 0x8f
cmp r8b, bpl
push qword [rsp + 0x48]
popfq
mov rbp, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
lea rsp, [rsp + 0x58]
ret

Function at 0x1409f8435
Capabilities:
Authenticate hmac

Disassembly:
cmp r13, 0x34cf6ebd
call fcn.140a64224
push r10
push rdx

Function at 0x140a06d90
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x140a103b4
xor rcx, 0x3aa7ac1
cmp cl, 0x5c
setne cl
mov rcx, qword [rsp + 0x28]
add qword [rsp + 8], 0xffffffffff858825
call fcn.141157d8b
call fcn.1410c9995

Function at 0x140a085f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor qword [rsp + 0x18], 0x76c26e31
sub r14b, 0xeb
mov word [rsp + 0x30], r14w
sub dword [rsp + 0x30], 0x2dcd7a5f
je 0x14123b0c9
or r14, 0x41e7581f
add r14b, byte [rsp + 0x34]
test qword [rsp + 0x30], 0x158d6ada
lea rsp, [rsp + 8]
ret 0x10

Function at 0x140a23db2
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x1410c3c54
neg r11b
or ebx, 0x2b8c42a8
setg r15b
or byte [rsp + 0x50], cl
lea rbx, [rbx + r10*4 + 0x44472482]
call fcn.14115b54b
mov ecx, 0x55dc2639
jg 0x140a23e29
xor eax, 0xde21fde8
cmp byte [rdi - 0x7b], ch
xchg esp, eax
rcr dh, 1
mov ch, bl
xchg esp, eax
std
mov ah, 0x98
jb 0x140a23e4e
xchg ebp, eax
mov ch, 0x20
popfq
and byte [rax], dl
clc
shr ah, cl
ficom word [rsi + 0x2ee45247]
fldl2t
rol byte [r8 + 0x76], cl
adc edi, dword [rcx - 0x2f02366c]
cmp ch, byte [rdi]
or dword [rcx + rdi*2], 0x13
add rcx, r10
cld
sub dword [rsi], esp
invalid
invalid
or al, 0x97
mov dword [rax - 0x7e], ecx
pop rsi
jg 0x140a23e79
retf
xor ch, bl
invalid

Function at 0x140a271f9
Capabilities:
Authenticate hmac

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.14137a16e

Function at 0x140a27208
Capabilities:
Authenticate hmac

Disassembly:
mov rcx, r12
push r8
mov r8, r12
lea r12, [r8*4 + 0x3730272d]
push r8
cmovl r12w, r8w
cmp word [rsp], cx
lea r12, [r12 + r12*2 + 0xab90af2]
push rbp
movabs rbp, 0x568a458c4462087e
setbe cl
mov word [rsp + 8], cx
cmp word [rsp + 8], 0x7865
push r13
push r15
not byte [rsp + 0x18]
jae 0x14110634e
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0x7cb604fb
test bp, bp
movabs r15, 0x260357972b51612c
movsx r13w, bp
movsx r8w, cx
push rdx
push rbx
lea r13, [r13*4 + 0x350428c7]
movabs rbx, 0x45b07eb711da4ebb
setg r13b
push r8
xor byte [rsp], 0x3f
xor word [rsp + 0x30], 0x4f67
cmp byte [rsp], r8b
mov r15, rcx
cmovae r8, r15
lea r8, [r8 + r15*4 + 0x34b602d6]
test qword [rsp], 0x5ee7256f
not r13b
je 0x14115d01b
add r8b, r8b
mov bl, 0x6a
or dword [rsp + 0x30], 0x3c66760a
call fcn.1409e73e2
movsx edi, cx
not cx
jl 0x140a613bc
invalid

Function at 0x140a34a82
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.141068423
mov rcx, qword [rsp + 8]
and rbp, 0x788978b1
jae 0x1409b4928
Function at 0x140a476ac
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
not r9d
jb 0x140a03c23
lea r9, [rdx*2 + 0x42b3580e]
or r9b, 0x3f
setns dl
mov rdx, qword [rsp + 0x38]
or edx, r9d
or r9b, byte [rsp + 0x3c]
test edx, 0x7c4301e8
jle 0x141236dd7
or dl, r9b
add qword [rsp + 8], 0x6ee8e2
xor edx, 0x10785b2e
mov word [rsp + 0x38], 0x3826
or r9w, 0x20e7
neg r9w
cmovbe rdx, qword [rsp + 0x38]
Function at 0x140a786ce
Capabilities:
Encode data using xor

Disassembly:
and byte [rsp + 0x20], 0x14
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
pop rax
call fcn.14137a16e
test qword [rsp + 0x30], r8
movsx cx, r8w
bswap r8d
call fcn.141118bff
mov edx, 0xde45d2e0
sbb byte [rdx], cl
insb byte [rdi], dx
mov edx, 0x2693e408
xor al, 0x89
and dh, byte [rax]
xor r11d, dword [r11]
mov cl, 0xcc
mov edx, 0x22fcc81b
sbb r9b, r9b
jrcxz 0x140a786dc
pop qword [r8 - 0x15bacd78]
out dx, eax
retf 0xba64

Function at 0x140a7ed95
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], 0x7e15b7a
lea rdi, [r15*2 + 0x65b8785b]
push r10
mov rdx, r15
movsx bp, r9w
cmovb r15w, word [rsp + 0x2e]
or dl, byte [rsp + 0x29]
not byte [rsp + 0x28]
sub byte [rsp + 0x28], r15b
bswap r15d
not di
or r9, qword [rsp + 0x28]
push rsi
mov rcx, rbp
mov rdi, qword [rsp + 0x40]
lea rcx, [r9 + rdx*2 + 0x439656cb]
lea rbp, [rdx*4 + 0x5e3c2c4e]
bswap r15
mov r10, qword [rsp + 0x30]
or dword [rsp + 0x30], 0x126d58d3
xor bp, dx
movzx r9, word [rsp + 0x30]
sub bpl, r9b
js 0x140a7ede8
seta byte [rsp + 0x30]
setns r9b
movabs rsi, 0x16206943378400d
lea rcx, [r9 + rbp*4 + 0x1dc64c3c]
not r9w
add qword [rsp + 0x18], 0xffffffffff92b3bf
and esi, 0xabb201c
setbe bpl
not r10w
add qword [rsp + 0x30], 0x4c6c5595
xor r15, qword [rsp + 0x30]
pop rsi
pop r10
ja 0x1410bd8d6
jge 0x1410f09f1
add qword [rsp], 0xfffffffffff67235
sub rcx, 0x6cbc3109
and r13d, 0x20e97fb5
test byte [rsp + 0x28], 0x3f
lea rcx, [rcx + 0x650d3274]
ret 8
not cl
lea rsp, [rsp + 8]
ret
Function at 0x1410c3cac
Capabilities:
Execute anti-debugging instructions

Disassembly:
sete r10b
movsx r11d, r11b
cmp r11w, word [rsp + 0x42]
mov word [rsp + 0x48], di
not r10b
mov edi, dword [rsp + 0x48]
not qword [rsp + 0x40]
lea r11, [rdi*4 + 0x3fbd2c04]
jo 0x14115c6e7
setb r8b
ja 0x14111a3bb
mov ebx, r10d
call fcn.14114cce1
xor bh, bl
adc ecx, edx
iretd

Function at 0x1410c3e76
Capabilities:
Authenticate hmac

Disassembly:
push rcx
cmp word [rsp + 0x10], 0x6e4e
movabs r14, 0x348d427536976dd3
mov r13, r12
sete r14b
push rsi
mov r14, qword [rsp + 0x48]
jge 0x1411600dc
jno 0x1411600d4
jge 0x140a32b4e
or byte [rsp + 8], r12b
seta r12b
sub dword [rsp + 8], 0x428931eb
add qword [rsp + 0x10], 0xffffffffff9495a5
mov cx, 0x4dfd
test byte [rsp + 8], 0x41
mov rsi, rcx
not r13w
not word [rsp + 8]
call fcn.1409fe993
sub r8w, bx
movabs r8, 0x69c55d05036b1038
mov r12, rbx
lea r8, [r8 + rbx*8 + 0x78fd3d76]
sub r8, 0x5d4c3f59
cmp bx, 0xbb2
push r9
push rcx
push rdi
mov r8, qword [rsp + 0x20]
mov r12, qword [rsp + 0x18]
lea rsp, [rsp + 0x30]
ret 8

Function at 0x1410c5276
Capabilities:
Encode data using xor

Disassembly:
add al, 0
movsx r11, sil
sub r10, 0x367e71de
bswap r13
jno 0x1410a9be0
jb 0x140a36470
movabs dword [0x52b79f5484567e20], eax
xchg esi, eax
push rsi
scasd eax, dword [rdi]
invalid
je 0x141130f9d
or r13b, 0x78
jae 0x140a36473
lea r8, [r8 + r10*8 + 0x398730aa]
pop r10
not r8
not byte [rsp + 0x10]
cmovno cx, word [rsp + 0x3b]
sub r8b, 0x64
js 0x1410bd21a
pop rsp
ret 0xfff8
push rdi
pushfq
movabs rdi, 0x385d09d3107e16c9
sub dil, 0xb7
xor di, di
neg dil
lea rdi, [rdi + rdi*4 + 0x7475edf]
and di, di
not di
xor edi, 0x7f375927
test dil, 0x78
push rdi
lea rdi, [rdi*4 + 0x3f5e1cac]
movsx di, dil
js 0x141130fd4
sub dil, byte [rsp + 1]
push rcx
neg byte [rsp + 8]
call fcn.141124853
jge 0x141131009
or al, ch
cmp dil, r15b
dec dword [rbx + 0x7d]
neg dword [rax]
wait
invalid
sbb byte [rbx + 0x1842bc62], bl
loopne 0x141130fba
invalid

Function at 0x1410d9060
Capabilities:
Authenticate hmac

Disassembly:
jae 0x1410f396a
mov r13w, 0x3ef1
sete r13b
mov rcx, r12
cmp ecx, r8d
movsx rsi, word [rsp + 0x38]
jg 0x14114d934
sub r13d, 0x4fa23851
bswap r8
neg r13b
or esi, 0x35c01a33
test cx, si
call fcn.141135980
call fcn.1409cd626
fsubr qword [rax]
fisttp qword [rbx - 0x2a]
mov r9d, 0x9037b30c
mov ebp, 0xae274ce8
int1
fisttp dword [rbx - 0x54]
fnstcw word [rdi + 0x1e]
mov bl, 0xd2
and esi, dword [rsi + 0x23]
mov ah, 0x75
mov eax, 0xfb4cf350
or al, 0x51
mov ecx, 0xe69f0a4b
or eax, 0x1022b7b3
out dx, eax
movabs rdx, 0x4f23f867b3138753
mov ah, 0x4a
in eax, dx
xor bl, ah
and qword [rax - 0x564cf8cc], r12
invalid

Function at 0x1410e3c74
Capabilities:
Encode data using xor

Disassembly:
push r15
movabs r15, 0xca01a954b4b1e17
push r11
pushfq
mov r11, r15
lea r11, [r11*4 + 0x37a64ea7]
lea r15, [r15 + r15*2 + 0x2cd77452]
and r15d, 0x53db04a0
add qword [rsp + 0x18], 0xffffffffff946559
xor r11d, 0x2d9518d5
sub r11d, 0xa3b386a
push r9
not r11
je fcn.1410e3c74
push rbx
mov r15, qword [rsp + 0x20]
mov r11, qword [rsp + 0x18]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
ret