joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013a213
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push r9
mov ecx, edi
rol edx, 1
neg rdi
jge 0x14015d683
add byte [rsp + r9 + 0x691ffa6], r9b
xor edx, 0x45a3a602
movsx ebx, dil
lea edx, [rdx + r9*8 + 0x5e257ad6]
call fcn.140113376

Function at 0x14013a786
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3

Disassembly:
mov ebx, 0xd30ff8a3
lea r11, [rdi + r11 - 0x5710b538]
call fcn.140132d84
mov edi, 0x5710b53c
lea r9, [rdi*8 + 0x64b2c037]
lea rax, [rdi + rdi*8 - 0x1a4603f1]
mov rdx, qword [rdi + rsi - 0x5710b53c]
jmp 0x140133ed8
mov bp, word [rdi + rdx - 0x5710b53c]
lea rsi, [rsi + rdi - 0x5710b536]
bt di, r9w
push rax
push r9
mov word [rsi + rdi - 0x5710b53c], bp
cdq
movsx ebp, r9b
mov ecx, dword [rbp + r11 - 0x17]
sar dword [rsp + rdi - 0x5710b531], 0xf9
jp 0x14011b15c
xor edi, 0x16a26f90
mov qword [rsp + rdx*4], 0x5718b409
dec rdx
cmovg ax, word [rsp + rdx + 0xb]
mov qword [rsp + rbp - 0x34805e32], r10
xor dword [rsp + rbp - 0x34805e32], edi
shl r9d, 0xd0
jns 0x140157296
push rbp
mov r10, qword [rsp + rbp - 0x34805e2a]
shl r9, cl
neg al
movsxd rdi, edi
sar dword [rsp + rdx*8 + 0xc], 0x84
cwd
mov qword [rsp + rbp - 0x34805e2a], rdx
adc r8, rdi
sub bpl, 0x82
call fcn.14013fa30
mov ecx, 0x9b03d20d
mov edx, dword [r11 + riz]
add r11, 4
movzx eax, cx
movzx ebp, al
xor edx, r10d
cdqe
ror edx, 1
bts ebp, 0x97
bswap rax
push rax
lea edx, [rdx + rcx - 0x3c649e1]
add al, bpl
xor edx, 0x5b8d94a3
cwde
xadd dword [rsp + rax*2 - 0x18], ebp
dec edx
not edx
mov ebx, eax
call fcn.1401168ef
lea rsp, [rsp + 0x10]
jmp 0x14012d8b5

Function at 0x14013c085
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x18]
je 0x140156e02
mov ebx, 0x47a2d437
lea rbx, [rbx*8 - 0x38700d6e]
push r8
lea r8, [0x14014e348]

Function at 0x14013c27f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec rdx
push 0x2fa01724
push 0x309eb26
push 0x4ebb84ba
lea rsp, [rsp + 0x40]
jne 0x1401531a0
mov r9d, 0x9880a6b0
mov edx, r9d
pop rsi
pop r10
inc r9
xor ecx, 0x86948cbf
rol byte [rsp + 0x27], 0x67
jae 0x140130794

Function at 0x14013c600
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push 0xffffffffccbf3fa7
push 0x43153eb1
lea rsp, [rsp + 0x18]
jne 0x14012e5f9
mov edx, 0xa36182a
jmp 0x140120e9b
mov qword [rsp], 0x1a3e123f
cmp ebx, 2
jmp 0x14012cd5d
Function at 0x14013fc65
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
jmp 0x140146c74
jmp 0x140123f8e

Function at 0x14013fc6a
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
xor al, r10b
rol dil, 0x41
neg al
rol rcx, cl
sbb al, 0xb
neg r9w
ror rdx, 0x85
ror al, 1
movzx ebp, di
not dword [rsp + rcx*8 - 0xa114000]
sal rdi, 0xa1
xor al, 0xb8
jmp 0x140144979
mov qword [rsp + rcx - 0x5082], r9
lea r11, [r11 + rcx*2 - 0xa10d]
dec rbx
je 0x140113e33
js 0x1401241a4
mov qword [rsp + rax*2 - 0x71460158], 0x71b8b30c
not ebp
mov qword [rsp + rax - 0x38a300a4], r10
and dil, dl
ror bl, 0xa6
xor dword [rsp + rax - 0x38a300a4], ebp
sub ax, di
xadd word [rsp + rdx - 0xcd63], bx
and ax, cx
mov r10, qword [rsp + rcx*8 - 0x28448]
movsxd rbp, ebp
setae r9b
dec byte [rsp + rax - 0x38a30081]
adc r8, rbp
movzx eax, byte [rax + r11 - 0x38a3007c]
jmp 0x14012ae5d
rol rdi, 0x2a
sbb al, 0x96
sal byte [rsp + rcx - 0x14227f3], 0x43
xor al, 0x29
neg word [rsp + rcx - 0x1422800]
sal word [rsp + rcx*4 - 0x5089ffd], 0xe3
rol al, 1
rol bx, 0xe4
xadd ebx, edx
setnp dl
adc al, cl
ror rcx, 0xb9
xor r10b, al
sub byte [rsp + r9*2 - 0x7146e1f4], 0x37
bswap rdi
lea rax, [rsp + rax + 0x10]
pop r9
movzx dx, byte [rax + rbx*2 - 0xcd4]
pop rdi
movzx eax, bx
xor ecx, 0xb0ba702d
mov word [rsi + rcx*4 - 0x46b9c0b8], dx
js 0x140119e8e
add edi, 0xc0941022
sbb di, ax
lea rsi, [rsi + rcx - 0x11ae7031]
cmovl ecx, eax
dec r9
ja fcn.140146e5c

Function at 0x14014047f
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdi - 0x8000], rdi
xor cl, r10b
neg cl
lea rax, [rbx*8 - 0x1f5c7676]
mov qword [rsp + rdi - 0x7ff8], rax
ror bl, 0xc5
sbb cl, bpl
bswap rdi
cqo
neg cl
sub cl, dl
neg cl
shl eax, 0xde
xor r10b, cl
xor ebx, edx
mov word [rsp + rdx*4 + 4], ax
lea rcx, [rsp + rcx + 0x10]
mov r9, qword [rdx + rcx + 1]
mov ecx, 0xd9233d82
ror word [rsp + rdx*4 + 7], cl
inc cl
mov qword [rsi + rdx*2 - 0xe], r9
lea rsi, [rsi + rdx*4 - 0xc]
neg dword [rsp + rdx + 2]
pop r9
pop rdx
jns fcn.140146e5c

Function at 0x1401404e7
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
movzx ebp, dil
xor edx, r10d
mov qword [rsp + rbp*2 - 0x10e], rbx
mov word [rsp + rbp - 0x81], bp
movsx r9d, word [rsp + rbp*8 - 0x438]
lea edx, [rbx + rdx - 0x414ee017]
rol di, 0xcf
setb r9b
neg edx
ror bpl, 0x62
ror word [rsp + rbp - 0xde], 0x65
bswap edx
xchg byte [rsp + rbp - 0xe1], bl
or word [rsp + rbp*8 - 0x707], bp
neg edx
call fcn.1401247c4

Function at 0x140140dfb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x38]
je 0x14014c530
push r11
mov ecx, 0x25bb519a
xor rcx, rcx
lea r11, [0x14011d5c8]
Function at 0x140143a33
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
pop r10
shl di, 0xe7
call fcn.14012332e
mov edx, 0x2906793
mov rbx, qword [rdx + rsi - 0x2906793]
movsx eax, dx
lea rcx, [rdx + rdx - 0x5ed649fc]
mov bpl, byte [rsi + rdx - 0x290678b]
ror ax, 0xeb
cdq
lea rsi, [rsi + rdx*2 + 0xa]
xchg rcx, rdx
cdq
shr eax, 0xf5
mov byte [rbx + rdx*4], bpl
mov r9d, 0x7fb40623
ror al, 1
rol rdx, 0x9e
or edx, dword [rdx + r11]
lea r11, [r11 + rax + 4]
bts r9w, cx
movzx ebx, cl
mov ebp, 0xd82d20bd
xor edx, r10d
inc cl
lea edx, [rdx + rbp + 0xd7dc4eb]
call fcn.140157ea4
mov qword [rsp + rbx - 0x31ae5a62], r10
add bl, bl
cbw
xor dword [rsp + rax - 1], edx
xchg ebx, ebp
sal cx, 0xed
jns 0x1401218ef

Function at 0x140143f2a
Capabilities:
Authenticate hmac
Encode data using base64
Hash data using murmur3
Manually build aes constants

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14012d8b5

Function at 0x14014418b
Capabilities:
Encode data using base64

Disassembly:
xor eax, r10d
mov qword [rsp + rbx*2 - 0x4488], r9
inc eax
neg eax
dec dword [rsp + rdx - 0x609a0507]
xor eax, 0x8d0395a3
movsx ecx, r9w
inc rdx
and ecx, ebx
lea eax, [rax + rbx*2 - 0x3f09aeab]
xadd cx, di
and byte [rsp + rbx - 0x2235], cl
not qword [rsp + rbx*4 - 0x8908]
xor eax, 0x90b4ae25
sar qword [rsp + rbx*4 - 0x8909], cl
bswap ecx
mov qword [rsp + rbx*8 - 0x11218], r10
movsx ebp, bx
call fcn.1401367d6

Function at 0x140144c22
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rdx
jne 0x140140c0b
movsxd rbp, ebp
adc byte [rsp + 5], r9b
add r8, rbp
sub byte [rsp + 0x13], 0x91
pop r9
pop rbp
pop rbx
jmp r8
movsx ecx, r9b
not dword [rsp + 9]
dec ebp
ror ebp, 1
push rcx
not ebp
pop rbx
sal byte [rsp + 0xf], 0x25
mov qword [rsp + 0x18], r10
pop r10
xor dword [rsp + 0x10], ebp
mov qword [rsp + 8], 0xffffffffb01668bf
sub dl, byte [rsp + 2]
mov r10, qword [rsp + 0x10]
jo 0x1401188fb

Function at 0x140145ea1
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rsp + rcx - 0x453ba814], 0xffffffffa7a75fb6
lea r11, [r11 + rdi - 0x453ba810]
movsx eax, word [rsp + rcx - 0x453ba810]
xor r9d, r10d
sub r9d, 0xb4a168a0
push rdi
mov edx, 0xd4a54d86
xor r9d, 0xc638801e
lea rbx, [rax*8 + 0x1fa4f23e]
neg r9d
add r9d, eax
bswap r9d
add di, word [rsp + rdi - 0x453ba80d]
sar dword [rsp + rcx - 0x453ba808], cl
lea r9d, [r9 + rcx*2 - 0x5949cd1d]
sub dil, byte [rsp + rdi - 0x453b5e13]
btc ecx, edx
xor r9d, 0xe8a1ecbb
neg edi
call fcn.14012d413
call fcn.140113672
mov eax, 0x151bf839
call fcn.140116fb3
mov ebp, 0x52a00503
lea rdi, [rbp*4 - 0x23d44852]
mov r9d, dword [rbp + r11 - 0x52a00503]
lea rcx, [rbp + rdi + 0x69be3486]
add ebp, ecx
lea r11, [r11 + rbp*2 - 0x6b541488]
mov ebx, edi
xor r9d, r10d
lea rax, [rcx + rbp*2 + 0x52208436]
inc r9d
not r9d
Function at 0x140146962
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x18]
jbe 0x140146981
mov edx, 4
mov eax, 0x911bfdae
movzx ecx, al
lea ecx, [rbx + rcx - 0xb2]
sal ecx, 3
mov eax, 0x4187233a
push rax
shl edx, 3
lea rax, [rax + rax + 0x318b963d]
ror rax, 0x6f
push rax
mov rax, rbp
push 0x6c17e10f
adc rax, rdx
sal qword [rsp + 4], 0xcc
rol word [rsp + 4], 0xc7
jne 0x14014f421
mov qword [rbp + riz - 8], rax
jnp 0x1401403b4
jb 0x14012cffc
lea rsp, [rsp + 0x18]
mov qword [rbp + riz - 0x10], rsp
jp 0x1401544e7
Function at 0x140146b54
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
cmp ebx, 3
call fcn.14015a1e1
jmp 0x1401475ee
push 0xffffffffcebe3c91
lea rsp, [rsp + 8]
jne 0x14015cbca
mov edx, 0xc799bbaa
jmp 0x14015e992
mov dword [rbx + rsi - 0x6ea9489e], r9d
mov ecx, 0x533671a4
mov r9d, ebx
add rax, r8
jmp rax
adc edx, 0x388a37a9
jmp r8
not di
ror di, 1
mov qword [rsp], 0x66379624
push 0x2338eca8
xor di, 0x5e2d
ror di, 1
mov r9d, 0x280bd122
lea rax, [r9*4 - 0x7749c045]
movzx edx, r9b
xor r10w, di
lea rdi, [rsp + rdi + 0x10]
call fcn.14014d58b
xor cl, r10b
rol cl, 1
sal bl, 0x43
call fcn.140117923
xchg r9d, eax
pop r10
btr r9, rdx
btr ecx, ecx
and r9, r9
movsxd rbp, ebp
push rdi
btc di, r9w
add qword [rsp + rax], 0xffffffffa92de424
add r8, rbp
cdqe
mov rcx, qword [rsi + rax*2]
sar dx, 0x87
call fcn.1401299c9
mov r9d, 0x783768bc
lea rbp, [r9 + r9 + 0x7eb78a09]
mov edi, dword [r11 + r9 - 0x783768bc]
lea rax, [rbp*4 + 0x6c077db6]
lea rbx, [rbp*4 - 0x5d4987f6]
lea r11, [r11 + r9 - 0x783768b8]
rol al, 0x81
xor edi, r10d
sal r9, 0xfa
sbb bx, bx
movsx ecx, r9w
adc edi, 0xba8b5e9a
inc bx
neg edi
inc r9d
bts eax, r9d
shr bp, 0x46
sbb edi, r9d
xchg bx, ax
bswap edi
sub ebx, ebx
xor r9w, cx
cdq
neg edi
push r10
sub ecx, ebp
xor dword [rsp + r9 - 1], edi
movzx r10d, cl
cqo
add rdx, 0xffffffffa8aae106
pop r10
dec cl
ror r9, 0xa0
rol r9d, cl
movsxd rdi, edi
sub bx, 0x282b
lea rdx, [rbp*2 + 0x2282df8b]
add r8, rdi
inc r9
lea rdi, [rcx*8 - 0x9408c5a]
btr r9, r9
mov cx, word [r9 + rsi - 1]
jb 0x1401545c2
setae al
not bp
mov ax, word [rsi + r9*2]
bts edx, ebx
shl bpl, 2
lea rsi, [rsi + r9*2]
adc cx, ax
xchg dx, bx
ror di, 0x4c
mov eax, edx
mov word [r9 + rsi - 1], cx
jb 0x1401393b4
lea rsp, [rsp + 0x18]
jne 0x14011b477
push 0xffffffffd617da9a
call fcn.140141a37
cmp ebx, 2
jmp 0x14012e4e8
mov dword [rax + rsi - 0x120ffff], r9d
or ebx, dword [rsp + rax - 0x120fffc]
pop rbx
btr edi, ebx
jb fcn.140146e5c
bt rcx, 0x16
not ebx
xor word [rsp + rcx*2 - 1], dx
call fcn.1401559c9
rol ebp, 3
rol di, 0xc3
dec ebx
pop rdi
not ebp
lea rdx, [r9*2 + 0x5f204133]
sub r9, rdx
push rdi
mov qword [rsp + rcx - 0x6ea9489f], r10
jnp 0x14012975b
jle 0x14015eb85
mov rdx, qword [rsi]
mov rbx, qword [rsi + 8]
or rdx, rbx
mov r9d, 0xab96e40b
movsx edi, r9w
not rdx
neg r9w
mov qword [rsi + riz + 8], rdx
call fcn.14013eb6b
jmp 0x140114208
xor dword [rsp + rdi + 0x25f84878], ebp
pop r10
xadd r9, rdi
xchg dx, di
movsxd rbp, ebp
add r8, rbp
movzx eax, di
shr eax, 0xf9
mov r9d, dword [rcx + rsi - 0x6ea9489f]
mov cl, byte [rsi + rax + 4]
lea rsi, [rsi + rbx - 0x6ea9489c]
adc rdx, rax
cqo
not rdx
sal r9d, cl
cwd
jmp 0x140132ce4
Function at 0x140146c91
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsx ebx, bp
mov rax, qword [rsi + rbp - 0x5cb1faa2]
lea rdx, [rbx + rbp*2 + 0x5595031d]
mov r9d, ebp
movzx bx, byte ss:[rax + r9 - 0x5cb1faa2]
push rdx
ror qword [rsp + r9 - 0x5cb1faa2], cl
jb 0x14014d942
lea rsi, [rbp + rsi - 0x5cb1fa9c]
mov word [rbp + rsi - 0x5cb1faa2], bx
sub rbp, qword [rsp + r9 - 0x5cb1faa2]
add cx, bp
mov ebx, dword [rsp + r9 - 0x5cb1faa0]
mov edx, dword [r9 + r11 - 0x5cb1faa2]
lea r11, [r9 + r11 - 0x5cb1fa9e]
not dword [rsp + r9 - 0x5cb1faa0]
rol ecx, 0xa1
xor edx, r10d
pop rax
call fcn.14012de95
neg bl
ror dword [rsp + rdx + 0x10], 0x1f
movsx ecx, r9b
movzx edi, word [rsp + rdx + 0x13]
ror bl, 1
movzx ebp, word [rsp + rdx*2 + 0x14]
inc byte [rsp + rdx + 0xd]
not bl
cwde
cwde
js 0x14012ea2d
xor r10b, bl
cwde
sal byte [rsp + rcx*2 - 0xc6], 0xe3
cwde
lea rbx, [rsp + rbx + 0x18]
push r9
cdqe
xor rdx, qword [rbx + rax*2 + 0x8df2]
xor rbp, 0xffffffffb6345109
xchg r9d, edi
neg rcx
mov qword [rsi + r9*4 - 0xec], rdx
setae dil
movzx edx, word [rsp + r9 - 0x28]
call fcn.14013c0fd

Function at 0x14014771a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push rdi
sub ax, dx
movsx ebp, byte [rsp + rcx*8 + 0x12]
dec rdx
jle 0x14014a089
rol ax, 1
dec r9
sub r9w, bp
neg ax
neg dword [rsp + rcx + 2]
xor r10w, ax
rol dil, 0x42
mov qword [rsp + rcx*4 + 8], rdx
lea rax, [rsp + rax + 0x18]
lea r9, [rbp + rdx*4 - 0x3253f8f1]
btc r9w, 0x9e
adc rcx, qword [rax + rcx*4]
mov qword [rsi + rdx*4 - 0x3ffffff8], rcx
add qword [rsp + rdx*8 - 0x7fffffe0], 0x5c8edd03
movsx ebx, bp
inc bpl
mov qword [rsp + rdi*4 - 0xaa4c], r8
ret 0x10

Function at 0x14014899e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor r9d, r10d
sub byte [rsp + rbp - 0x852b], bh
mov edi, ebp
neg r9d
ror r9d, 1
bswap r9d
sar word [rsp + rbp*8 - 0x429f4], 0xeb
sub bpl, 0x83
rol byte [rsp + rbp*2 - 0x10b6b], 0xe1
lea r9d, [r9 + rbx - 0x11fb2d2e]
lea rcx, [rbp + rdi*8 + 0x79be2317]
mov qword [rsp + rbp - 0x85ac], r10
mov r10d, edx
mov eax, dword [rsp + rbp*4 - 0x216e7]
or r10w, di
xor dword [rsp + rbp*2 - 0x10b68], r9d
call fcn.14012c06d
mov r9d, 0x5822fa82
movzx edi, r9w
mov rdx, rsi
mov ecx, edi
sal rdi, 0x82
lea rsi, [rsi + rdi*4 - 0xfa822]
movzx eax, dil
mov word [r9 + rsi - 0x5822fa82], dx
neg r9d
mov ebp, dword [r11 + rdi*2 - 0x7d410]
lea r11, [r11 + rdi - 0x3ea04]
lea rdx, [rax + rax + 0x28aa9682]
lea rbx, [rax*4 - 0x2253a154]
call fcn.140117a87
mov edx, 0x6784db90
mov rdi, qword [rdx + rsi - 0x6784db90]
movzx r9d, dx
push r9
mov rbp, qword [rsi + r9*2 - 0x1b718]
call fcn.140135ef0
cdq
mov word [rdx + rsi], cx
cdqe
call fcn.14012ac25
push 0xffffffff9b288691
push 0x79201682
mov dx, word [rsi]
not qword [rsp + 8]
mov cl, byte [rsi + 2]
mov ebx, 0xbaac853e
sub byte [rsp + 1], 0x3b
or byte [rsp + 0xe], bl
adc rsi, 2
movzx ebp, bx
shl dx, cl
inc rbp
btr ebp, ebp
push rbx
mov word [rsi + rbp - 0x853f], dx
mov r9d, dword [r11 + rbp*2 - 0x10a7e]
movzx edx, byte [rsp + rbp*4 - 0x214ec]
lea r11, [rbp + r11 - 0x853b]
jae 0x14012ba48
bswap ebp
rol ebp, 2
lea rdx, [rdx*4 + 0x4e1d1b80]
bts r9, rdx
inc ebp
neg ebp
jmp 0x14014ba65
Function at 0x140149620
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shl dword [rsp + 0xc], 0xe2
lea rsp, [rsp + 0x10]
mov qword [rbp + riz - 0x10], rsp
call fcn.14015b229

Function at 0x14014a80c
Capabilities:
Encode data using base64

Disassembly:
sbb bl, byte [rsp + rbx*4 + 0xf]
call fcn.14012d60c

Function at 0x14014a815
Capabilities:
Encode data using base64

Disassembly:
lea edi, [rdi + rbp*2 - 0xda81041]
ror edi, 1
btc rcx, 0x81
mov qword [rsp + rbx - 0x54], r10
shl dl, 1
xor dword [rsp + rbx*4 - 0x168], edi
add ebp, 0x81b147b0
push rcx
push rbx
mov r10, qword [rsp + rbx*2 - 0xa0]
movzx eax, bp
call fcn.140124b45

Function at 0x14014da97
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
call fcn.140123a2d
mov ebx, dword [r11]
add r11, 4
mov ebp, 0xb2350c09
xor ebx, r10d
inc ebx
lea rdx, [rbp + rbp*8 - 0x315a3bc4]
rol ebp, 0x87
movzx ecx, bp
not ebx
bt ecx, 0x2c
movsx r9d, cx
xor ebx, 0x36396e3e
jmp 0x140153306

Function at 0x14014e7ab
Capabilities:
Authenticate hmac

Disassembly:
not ebp
inc ebp
mov qword [rsp + rdi - 0x6df3303a], 0x9b942bc
sal byte [rsp + rdi - 0x6df33039], 0xc6
cdqe
xor ebp, 0x16807ba9
xchg byte [rsp + rdi - 0x6df33033], dh
pop r9
push r10
cqo
jmp 0x14015cfb8
Function at 0x14014f100
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop rdi
add rdi, 0xfffffffffffdf38d
jmp rdi
xor dl, 0x11
shl dil, 0xc4
shr ebp, 0x21
ja 0x14015a565
neg dl
xor r10b, dl
call fcn.1401263ab
mov edi, 0x1a1f8bb7
movzx r9d, byte [r11 + rdi*4 - 0x687e2edc]
lea rdi, [rdi*4 + 0x5f8d8a00]
xor r9b, r10b
sub r9b, 0x2a
not r9b
push rdi
neg r9b
sub r9b, 3
jmp 0x14015234b
mov dword [rsp + rcx + 0x18], 0x78ba961b
lea rsi, [rsi + rax*2 - 0xa]
lea rbx, [rax + 0x5b81ee9e]
and bl, bpl
pop rbx
pop rax
pop rbx
pop r9
jl fcn.140146e5c
mov r9d, 0x18b8ff1e
bt r9w, r9w
mov rcx, qword [rsi + r9*2 - 0x3171fe3c]
mov edi, 0xb0b65719
movzx edx, di
mov r9d, dword [rcx + r9 - 0x18b8ff1e]
lea rax, [rdi*2 - 0x4c5b5ffa]
lea rsi, [rsi + rdx*2 - 0xae2e]
mov dword [rsi + rdx - 0x5719], r9d
movsx r9d, di
mov ebx, dword [r9 + r11 - 0x5719]
lea rcx, [r9 + 0x529c7c15]
lea r11, [r11 + rdx - 0x5715]
sub dil, 0x2d
xor ebx, r10d
not ebx
shl rdx, 0xef
btc ecx, 0xb7
jae 0x14011da06
ror ebx, 1
bt dx, 0x83
lea ebx, [rbx + r9*8 - 0x753e26db]
and r9w, ax
call fcn.1401284e8
rol cl, 1
inc di
sar dword [rsp + rbx - 0x7b8dd6ad], 0x91
xor r10b, cl
shr dx, 0xe7
not byte [rsp + rbx - 0x7b8dd6ac]
lea rcx, [rsp + rcx + 8]
movzx di, byte [rcx + rbx - 0x7b8dd6ae]
movsx ecx, byte [rsp + rbp - 0xae]
ja 0x14015452a
lea rsi, [rsi + rbp*4 - 0x2ba]
mov word [rdx + rsi - 0x7b8d01ac], di
inc dword [rsp + rbp*2 - 0x159]
setbe bl
call fcn.14012877e
shl ebx, 0x9a
xor ebp, r10d
bswap ebp
sub r9, rcx
xor ebp, 0xd0212002
and cx, ax
ror ebp, 3
bt r9w, bx
sar bl, 0xa7
not ebp
push r10
lea rdx, [r9 + r9 - 0x73c258dc]
neg eax
xor dword [rsp + r9 + 0x7ba48d6c], ebp
and ecx, 0x5ea6fc01
neg r9b
btr ax, 0x1d
pop r10
movsxd rbp, ebp
ror edx, 0xe8
and rax, rax
sub rcx, 0x78bc3b21
add r8, rbp
cdq
mov rcx, qword [r9 + rsi + 0x7ba48d94]
xadd rax, rdx
lea rsi, [rsi + r9 + 0x7ba48d9c]
movsx edi, dl
movzx edx, byte [r9 + r11 + 0x7ba48d94]
and bx, 0x9610
adc r9b, al
adc ebx, 0x890f6099
lea r11, [rbx + r11 - 0x790f6098]
xadd rdi, rax
lea rax, [rdi + rax*8 - 0x15c26be6]
xor dl, r10b
shr dil, 0x85
cbw
inc di
xor dl, 0x22
lea rbp, [r9 + r9*2 - 0x6f7f8cee]
inc r9d
ror dl, 1
cdqe
dec dl
not dl
xadd r9, rdi
jae 0x14011e77f
mov byte [rsp], dil
rol r9b, 1
xor r10b, r9b
mov ecx, edi
lea r9, [rsp + r9 + 8]
xadd dword [rsp + 4], edi
push rdi
sbb di, di
movzx ax, byte [rdi + r9]
movsx ebx, byte [rsp + rdi*4 + 0xb]
call fcn.140126859
xor ecx, r10d
dec ebp
neg qword [rsp + rbx - 0x423dac00]
xor ecx, 0x85ac1538
xor eax, 0x832db187
push r9
adc qword [rsp + rbp*2 - 0x1f4], 0x13352da5
bswap ecx
shr rbp, 0x8e
or word [rsp + rbx - 0x423dabf8], 0xe330
dec ecx
bts r9w, 0x3b
ror ecx, 1
mov qword [rsp + rbp + 8], r10
mov edx, 0xf0206bb8
shr ax, 0x6f
rol word [rsp + rbx - 0x423dabfd], 0x28
xor dword [rsp + rbp*2 + 8], ecx
not word [rsp + rbx - 0x423dabfd]
xchg edx, eax
sal r9, 0xff
mov r10, qword [rsp + rbx - 0x423dabf8]
movsxd rcx, ecx
add r8, rcx
shl r9w, 0xaf
sets dl
mov qword [rsp + r9*2], r8
ret 8
Function at 0x14014f91b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov ecx, 0x63100304
lea rcx, [rcx + 0x30341712]
movzx ecx, byte [rbp + riz]
push 0xfffffffff20aed32
push 0x18876d81
shl word [rsp + 9], 7
xor ecx, r9d
push 0x79bd3aa6
rol word [rsp + 0x12], 0x82
call fcn.140142e68
movsxd rbp, ebp
call fcn.140148dde
mov eax, 0xaa0c7592
movzx r9d, al
sar rax, 0x72
mov rdi, qword [rsi + rax*8]
movsx ecx, ax
add rax, qword [rsi + rax + 8]
mul rdi
movzx edi, cx
mov ebp, ecx
mov qword [rsi + r9*2 - 0x124], rdx
mov qword [rsi + r9 - 0x8a], rax
lea rbx, [rdi + rbp*4 + 0xda62c8b]
xchg di, r9w
or ebp, dword [r9 + r11]
call fcn.14012a6a7
xor dx, 0xe527
jmp 0x14014866c
xchg rbx, rax
add dx, 0x9ea5
xor dx, 0x7e9a
xor r10w, dx
movzx ebp, r9b
and r9d, 0xaf167b22
adc r9, rbp
adc rdx, rsp
bt ebx, 0x9b
cwde
ror r9d, 0x11
mov word [r9 + rdx - 0x28000], cx
add ebx, dword [r11 + r9 - 0x28000]
movzx ecx, r9w
dec ax
neg rax
lea r11, [r11 + r9*2 - 0x4fffc]
xor ebx, r10d
lea rcx, [r9*4 + 0x1f907889]
xor ebx, 0x9b24cc99
bswap ecx
bt r9d, 7
lea ebx, [rax + rbx + 0x1de157a2]
push rcx
call fcn.14014a761
lea rsp, [rsp + 0x50]
jne 0x140140e17
pop r11
mov ebx, 0x51a4093b
call fcn.140122e77
lea r9, [rsp + r9 + 8]
sub cx, ax
jge 0x1401532ea
mov edi, 0xcf1bb7a3
movsx ecx, di
movzx r9d, di
mov ax, word [rsi + r9*2 - 0x16f46]
mov cl, byte [rsi + r9 - 0xb7a1]
lea rsi, [r9 + rsi - 0xb7a1]
dec edi
bt r9w, 3
movzx ebp, dil
sal ax, cl
mov word [r9 + rsi - 0xb7a3], ax
mov ebx, edi
or bl, dil
mov ecx, dword [r11 + r9*2 - 0x16f46]
sbb r9d, 0xc19dd81b
lea rdx, [rdi + rbx*4 - 0x6cc95d51]
lea r11, [r11 + rbp*2 - 0x140]
movzx eax, r9w
xor ecx, r10d
neg ecx
dec rax
and bx, bx
or al, ah
ror ecx, 1
bt r9d, eax
lea rdi, [rdi + rbp*4 + 0x53964837]
sbb rax, rax
bswap ecx
lea ecx, [rdi + rcx - 0x7a00aa51]
push r10
cwde
shl rdx, 0x5e
movzx r10d, ax
xor dword [rsp + r9 - 0x3e62df88], ecx
cqo
pop r10
movsxd rcx, ecx
xor bpl, 0x8a
xadd dx, r9w
sal dl, 0xa2
adc r8, rcx
inc ax
xadd di, bx
jmp r8
jmp 0x14014c523

Function at 0x140150a72
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bl
sub bl, 0x3e
inc rbp
cmovne edx, ebp
mov qword [rsp + rdx - 0x2209ac59], 0x7e177db2
xor r10b, bl
pop rbp
btc rcx, 0x38
or rdx, r9
lea rsi, [rsi + rax*2 + 0x7af699ee]
bt cx, 0xa8
push rcx
mov dword [rsi + rax*2 + 0x7af699f2], ebx
bt rbp, rax
dec rdx
pop rbx
jno fcn.140146e5c

Function at 0x140152153
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.140121962
push 0x50a4d187
pop r9
movsx ecx, r9b
movzx ax, byte [rsi + r9 - 0x50a4d187]
movsx edx, r9w
mov r9b, byte [rsi + r9 - 0x50a4d185]
add rsi, 2
call fcn.14011b02d
bswap ecx
sal bp, 0xc4
jbe 0x140144354
Function at 0x140152b48
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx ebp, di
dec cl
pop rax
rol cl, 1
mov qword [rsp + rbx*2 - 0x96a8], 0x5e3c821f
neg cl
not cl
mov qword [rsp + rbx - 0x4b4c], 0xffffffff9416c29a
neg dil
neg cl
not cl
not byte [rsp + rbx*8 - 0x25aa0]
movsx eax, byte [rsp + rbx*2 - 0x96a3]
xor r10b, cl
btc rbp, 0x9c
rol al, 1
sub qword [rsp + rbx - 0x4b4c], rbp
lea rcx, [rsp + rcx + 0x10]
rol bpl, 0x67
dec bpl
cdqe
mov byte [rbx + rcx - 0x4b54], dl
setae byte [rsp + rbx*2 - 0x96a2]
mov ebp, dword [r11 + rbx - 0x4b54]
lea rcx, [rdi + rdi + 0x719e783b]
movzx edx, cx
add rdi, rax
lea r11, [r11 + rdi + 4]
ror rbx, 0xc1
cqo
cwd
xor ebp, r10d
push rax
ror ebp, 1
dec qword [rsp + rbx*2 - 0x4b52]
lea ebp, [rbp + rdi + 0x210f6990]
add dword [rsp + rbx - 0x25a2], 0x8d953d8b
xadd word [rsp + rbx*8 - 0x12d3a], ax
jl 0x14015c810
mov ebp, 0x9f17c3ad
movzx eax, bp
lea rbx, [rbp + rax + 0x3a05dc8a]
mov edx, dword [r11 + rax*2 - 0x1875a]
lea r9, [rbx + rax*8 - 0x7276ffe4]
jmp 0x14013b578
ror ebp, 3
inc ebp
rol ebp, 2
sal qword [rsp + rbx*2 - 0x4b48], 0xcf
lea ebp, [rbp + rbx*2 - 0x589a4fed]
not ebp
shl r9, 0xa8
ror word [rsp + rbx - 0x2596], 0xa1
rol ebp, 2
dec rdx
sal bl, 0x65
mov qword [rsp + rbx - 0x2530], r10
btc edx, eax
mov r10d, edx
xor dword [rsp + rbx - 0x2530], ebp
pop rax
mov r10, qword [rsp + rbx - 0x2538]
push rdx
movsxd rbp, ebp
btc bx, di
mov qword [rsp + rbx - 0x2531], 0x45345d2f
adc r8, rbp
shl qword [rsp + rbx*2 - 0x4a80], cl
setnp dil
add edx, dword [rsp + rbx - 0x2530]
mov qword [rsp + rbx*4 - 0x9504], r8
ret 0x10

Function at 0x14015306a
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
bswap r14d
pop rcx
mov r8, qword [rsp + rdi - 0x3136d753]
push r9
mov qword [rsp + rdi*2 - 0x626daeee], rdi
pop rdi
mov rdi, qword [rsp + rdi - 0x39]
pop rbp
cbw
cqo
mov rdx, qword [rsp + r9*2 - 0xc2]
mov r9, qword [rsp + r9 - 0x31]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov qword [rsp + 0x10], r14
movsx r10d, r14b
mov r11, qword [rsp + 0x78]
pop r14
pop r10
push r14
mov r10, qword [rsp + r14 - 0x11]
not dword [rsp + r14 - 0x83]
jmp 0x140155a90
mov r14, qword [rsp + r14*8 - 0x3c8]
call fcn.140130e00