joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004c120
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rdi, rsp
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x180067550]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18004c1a4
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18004c1cd
mov eax, 0xa
jmp 0x18004c307
cmp dword [rsp + 0x88], 0
je 0x18004c23b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18004c239
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x18004c287
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18004c26b
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18004c287
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180053e60]
call fcn.18004f758
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x18004d7f0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18004d85e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18004d85e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18004d85e
xor eax, eax
jmp 0x18004d8a5
mov dword [rsp], 1
jmp 0x18004d86f
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x18004d8a0
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18004d89e
xor eax, eax
jmp 0x18004d8a5
jmp 0x18004d867
mov eax, 1
add rsp, 0x10
pop rdi
ret
Function at 0x18051b5fe
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
lea rcx, [rbp + 0x4a2c4125]
xor dword [rsp + rdi*8 - 0x180babc0], edx
mov qword [rsp + rdi - 0x3017579], rcx
shl dword [rsp + rdi - 0x3017575], cl
setae dil
mov r10, qword [rsp + rdi - 0x30174f9]
mov qword [rsp + rdi - 0x30174f9], rdi
ror rbx, cl
movsxd rdx, edx
adc r11, rdx
neg bx
sar rbp, cl
not dword [rsp + rbx*2 - 0x1fdfe]
mov edx, dword [rsi + rdi - 0x3017501]
je 0x18053b95e
jbe 0x180590d75
pop rcx
or al, ch
mov dword [rdi + rbp], edx
movzx edi, bpl
pop rdx
adc rdx, 0x15351
jmp rdx
je 0x1805bf30c

Function at 0x180521bf6
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [r8 + r9 - 0x5a01]
mov qword [rsp + rax - 0x63948d20], rbp
lea rax, [rbp - 0x20702168]
movzx edx, r9w
lea r8, [r9 + r8 - 0x59fd]
or ax, word [rsp + r9*2 - 0xb3f6]
movsx ebx, dx
xor ecx, r10d
lea ecx, [rcx + r9*4 - 0x72090e14]
bswap ecx
neg ecx
neg ax
mul word [rsp + r9 - 0x59f7]

Function at 0x180527c46
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r9 - 0xa2], r10
shl r9d, 0x33
xor dword [rsp + rdx - 0x26090ba2], ebx
call fcn.18052f9dc
xor edi, 0x30a46500
jmp 0x1805a3dbd
mov rbp, rbx
not rdi
movsx eax, cl
lea rbx, [rbx + r9*4 - 0xdb0]
btr eax, ecx
adc rdi, 0xfffffffff1134a86
mul cx
mov qword [rbx + r9*4 - 0xda8], rbp
shl rax, cl
mul edx
jo fcn.18051ffce
mov edi, 0x6912ec01
push rdi
mov edx, dword [r8 + rdi - 0x6912ec01]
movsx ebx, word [rsp + rdi - 0x6912ec00]
lea r8, [rdi + r8 - 0x6912ebfd]
jmp 0x1805cd245
call fcn.18051b5fe
lea rcx, [r9 + 0x6195bc8d]
bswap edi
lea rdx, [rdx*4 - 0x505baafb]
lea r10, [rdx + rbp - 0x5edf62ea]
ror edi, 2
push r8
movzx r8d, r9w
xor dword [rsp + r8*4 - 0xba24], edi
imul r8w, r8w
pop r8
shr r9d, cl
bt r10, rcx
movsxd rdi, edi
xor r10, r10
adc r11, rdi
lea rdi, [rcx + r10*4 + 0xfa32a9f]
jmp 0x18058797a
bswap rdi
rol dword [rsp + rbx*8 - 0x975e], 0xea
xor edx, r10d
movsx r9d, bx
pop rbx
ror edx, 3
lea edx, [rdx + r9*4 - 0x7da44d40]
ror edx, 1
push rdi
inc edx
shl ebx, 0xb9
ror edx, 1
movzx ebp, r9b
dec byte [rsp + rbx - 0x1fffffe]
lea rdi, [r9*2 + 0x3014fa1]
mov qword [rsp + rdi*4 - 0xc05d5e4], r10
jno 0x1805a0d23
cdqe
pop rcx
jmp fcn.18051ffce

Function at 0x1805290f7
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
not word [rsp + 0x19]
lea rsp, [rsp + 0x20]
jne 0x18059d36c
push 0x7998a2ba
mov r8, rax
not byte [rsp + 1]
lea rsp, [rsp + 8]
jmp 0x18054456c
Function at 0x18052d311
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea rbx, [rax + rbx - 0x6bbdffee]
setae dil
shr r10b, 0x45
jae 0x18056e84c
mov qword [rsp + rax - 0x6df8], r8
mov qword [rsp + rax - 0x6e00], rbp
xor dword [rsp + rax - 0x6df8], r10d
bswap ebp
shl al, 0x86
mov r8d, ecx
mov r8, qword [rsp + rdx*2 - 0xddf6]
mul rcx
sal r9d, cl
pop rdx
movsxd r10, r10d
adc r11, r10
mov r10d, ecx
mov ebp, dword [rsi + rdx*4 - 0x1bb28]
xor eax, ecx
adc edx, 0x49bb9d91
mov qword [rsp + rdx - 0x49bc0c5b], r10
lea rsi, [rsi + rax - 0x2a95a2c6]
xor ebp, r8d
ror r10, cl
imul word [rsp + rax - 0x2a95a2c7]
sbb ax, di
dec ebp
shr r10, 0xaf
ror r10, 0xc1
not ebp
ror rcx, 0x41
or eax, edx
xor ebp, 0x96aa3e88
inc edi
cdqe
not ebp
or dx, 0x369d
mov qword [rsp + r9 - 0x32800], r8
bts r10d, ecx
xor al, 5
rol r9w, cl
xor dword [rsp + rdx - 0x49bcffdd], ebp
ror dx, cl
setb dl
pop r8
lea rdx, [r10 + rcx*2 + 0x419c1928]
jb 0x1805257a9
mov dword [rbx + rcx - 0x4587b765], ebp
xadd r9d, r10d
movzx ebp, r9w
seto r10b
jp fcn.18051ffce
mov edi, 0x5a6e6b2
movsx r10d, di
call fcn.18052d9cc
adc al, dil
neg dl
bt rbp, rbx
cwde
bswap ebp
xor r10b, dl
bswap eax
sar rbp, 0xf0
adc rdx, rsp
bt ebx, ebx
mov qword [rdx + rbp*2], r9
ror ebx, cl
bts rcx, rdi
mov eax, dword [r8 + rbx - 0x4c84ed7f]
rol bx, 0xcf
ror bp, 1
lea r8, [rbx + r8 - 0x4c8476bb]
add rbx, rbx
sal bx, 0xa6
sal bl, 0x85
xor eax, r10d
movsx r9d, bpl
not edi
ror eax, 1
jmp 0x1805a10a0
seta r9b
lea rax, [rdx + rcx - 0x160c87f]
add ebp, dword [rdi + rbp]
movsx edi, cx
dec rbx
mov dword [rsi + r9*2 - 0x7ed807f4], ebp
neg byte [rsp + rdx]
lea rsi, [rsi + r9 - 0x3f6c03f4]
mov qword [rsp + r9*2 - 0x7ed80800], r11
ret
rol dil, 0xc1
xor eax, 0x7ab67089
lea rcx, [rcx + rbx*4 + 0x5481f413]
lea rdx, [rcx + rbp*8 - 0x3352116f]
bt bp, di
lea eax, [rbp + rax - 0x1a1d5183]
xadd di, bx
neg eax
bt ebp, 0x32
setae bl
push r10
cmovb r9d, ebx
and r9b, r9b
xor dword [rsp + rdi - 0x55e4229a], eax
add edx, 0xba1aa138
pop r10
push rbx
movsxd rax, eax
add r11, rax
xadd r9, rdx
rol cx, 0x63
mov rdi, qword [rsi + rdi - 0x55e42292]
jne 0x180577cec

Function at 0x18052ef4b
Capabilities:
Encode data using base64

Disassembly:
jmp 0x180534c7f
jmp 0x18052c179
lea rsp, [rsp + 8]
jne 0x18058980e

Function at 0x180535811
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
xor r9d, 0x700cca27
shr r10, 0x76
inc r9d
shl rdx, 0x6c
mov qword [rsp + r10*2], rdx
ror byte [rsp + r10 + 5], 0xc4
mov qword [rsp + r10], r8
movzx r8d, ax
add edi, eax
xor dword [rsp + rdi*2], r9d
cwd
and r8, rdi
cwde
pop r8
movsxd r9, r9d
adc r11, r9
call fcn.18054aa57
mov ecx, 0xa12e1386
movzx ebx, cl
mov rbx, qword [rbx + rsi - 0x86]
call fcn.180538d2d
Function at 0x180535863
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
ror r9d, 1
mov qword [rsp + rbx*4], 0x1c183009
push rdx
sub r9d, 0xb5a351ab
rol qword [rsp + rbx + 8], 0xb0
btr rdx, 0xa9
movzx eax, dl
neg r9d
lea rbx, [rcx*8 - 0x5049635f]
movzx edi, al
lea rbx, [rdi + rax*4 + 0x73a94e04]
mov qword [rsp + rbx - 0x73a95171], r10
movzx ebp, byte [rsp + rdx - 0x6caf]
inc dil
not byte [rsp + rdx*4 - 0x1b2c2]
xor dword [rsp + rdx - 0x6ca9], r9d
movsx r10d, word [rsp + rdx*2 - 0xd95e]
mul byte [rsp + rbx - 0x73a95174]
neg dword [rsp + rdx - 0x6cb1]
mov r10, qword [rsp + rbx - 0x73a95171]
ror bl, 0x41
movsxd r9, r9d
je 0x1805b827e
add r11, r9
shl dil, 0xa6
bt eax, edx
movzx edx, byte [r8 + rdx - 0x6cad]
dec ebp
mov qword [rsp + rax + 8], 0xffffffffc8048916
lea r8, [r8 + rax + 5]
lea r9, [rbx + rbx*2 - 0x6ad260f1]
push rdi
rol bl, 0x27
xor dl, r10b
sub word [rsp + rbx - 0x73a95155], cx
sbb dl, 0x18
xor dword [rsp + rax*2 + 6], 0xa1bc319d
ror dl, 1
or dil, al
adc dl, bpl
rol dl, 1
shr bl, 7
call fcn.18051be15
lea r8, [r8 + rbx*2 - 0xb85c]
inc bx
xor eax, r10d
movsx edx, bp
neg eax
shl dx, 0x8a
rol eax, 1
xor eax, 0xa83edd90
mov edi, ebp
lea eax, [rbx + rax + 0x3fab73e9]
shr dil, 0x65
push r10
xor dword [rsp + rdx*2 - 0x18000], eax
mov r10d, edx
bswap r9
inc dl
pop r10
lea rsi, [rsi + rbx - 0x5c35]
xadd r9b, dil
not r9w
rol bp, 0x4f
mov dword [rsi + rbx*2 - 0xb862], eax
sar dil, 0xe1
mov ecx, edi
mov r9d, dword [r8 + rdx - 0xc001]
lea r8, [r8 + rbx*4 - 0x170c0]
xchg rdx, rbp
imul dx, bx
xor r9d, r10d
movsx eax, bx
cwde

Function at 0x18053593e
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
add rdi, r11
jmp rdi
mov qword [rsp + rax - 0x37160304], rdi
or r9, rbp
rol edx, 0x85
add edx, ecx
not dx
mov qword [rsi + rdx*2 - 0x3e57afe2], r9
mov ebp, dword [r8 + rax - 0x37160304]
cbw
xchg byte [rsp + rcx - 0xc765f60], dil
lea r8, [r8 + rax*2 - 0x6e2c0004]
xor ebp, r10d
lea ebp, [rax + rbp + 0x5d768a2a]
shr cx, 0xa7
jb 0x1805d077b
movsxd r10, r10d
div word [rsp + rdi - 0x1d91f4fb]
shr r9d, cl
add r11, r10
xor dil, byte [rsp + r9 - 0x1ef23b28]
shr ecx, cl
mov rdi, qword [rdi + rbx - 0x1d91f546]
ja 0x180551daa
mov cl, byte [rbx + r9 - 0x1ef23b28]
sub dword [rsp + r9 - 0x1ef23b28], ebp
mov qword [rsp + r9*2 - 0x3de47654], rax
inc rax
sal rdi, cl
rol edx, 0x87
sbb qword [rsp + r9*4 - 0x7bc8ecb9], rbp
mov qword [r9 + rbx - 0x1ef23b2e], rdi
mov edi, dword [rsp + r9*2 - 0x3de47651]
lea rbx, [rbx + rdx - 0x9fc]
imul r9b
cdqe
mov qword [rsp + rax*2 + 0x2aaa0514], r11
ret 0x10
xadd byte [rsp + rax - 0x3715fffd], ah
xor ebp, 0xa9868714
not ebp
btc edi, ecx
rol ecx, 0xb1
lea ebp, [rbp + rax*2 + 0x55e3ab04]
mov r9d, edi
mov qword [rsp + rdx - 0x1f2bd7f1], r10
jb 0x1805a8587
sbb edi, r9d
ror r9w, 0x42
xor dword [rsp + rax*2 - 0x6e2c0008], ebp
add r9d, ecx
pop r10
movsxd rbp, ebp
and r9w, ax
adc r11, rbp
div r9d
jmp 0x18051c69d
Function at 0x1805361e6
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.180558a4f
cmp ebx, 2
push 0x26a46c23
jmp 0x180560266
mov rdx, rax
call fcn.180577ce2
cmp ebx, 1
lea rsp, [rsp + 0x18]
jne 0x180528add
mov ecx, 0xc23e96a6
jmp 0x1805a7b6e
jmp 0x1805a7bc9
push 0x26298f95
lea rsp, [rsp + 0x10]
jne 0x180557a10
mov edx, 0xea3d4c81
bswap edx
jmp 0x18052ef77
mov rcx, rax
jmp 0x180523c0c
cmp ebx, 3
push 0xffffffffaf29961e
call fcn.180534acd
mov edi, 0xfd2ab910
movsx edx, di
call fcn.18055b5fb
inc dword [rsp + 3]
dec qword [rsp]
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
sub rsp, rcx
and rsp, 0xfffffffffffffff0
call fcn.1805b40e7

Function at 0x1805407b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc rax, rcx
neg edi
not edi
mov qword [rsp + rax + 0x6579f1b3], rbx
lea r9, [rcx + rbp*2 + 0x3eb92189]
bswap edi
mov qword [rsp + rax + 0x6579f1bb], r10
xchg r9d, eax
movsx r10d, byte [rsp + rbp + 3]
rol dword [rsp + rbp], cl
xor dword [rsp + rcx + 0x657a00ed], edi
mov r10, qword [rsp + rcx + 0x657a00ed]
movsxd rdi, edi
add r11, rdi
mov qword [rsp + rbp*2 + 8], r9
cdq
shl byte [rsp + rcx + 0x657a00ed], 0xe5
mov si, word [rcx + rsi + 0x657a00e5]
movzx edi, word [rsp + rcx + 0x657a00ed]
sal byte [rsp + rbp*2 + 0xb], 5
adc word [rsp + rbp*2 + 0xe], r9w
pop rcx
pop r9
jne fcn.1805a7402

Function at 0x1805409fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r8, [r8 + rbx*4 - 0x4eb1f8f0]
xor ebp, r10d
inc r9d
mov qword [rsp + rbx*2 - 0x2758fc7a], 0xffffffffcb1a9d84
lea ebp, [rbp + rdi - 0x664d97f1]
ror ebp, 3
xor ebp, 0x29c7e2c
lea rcx, [rdi*2 + 0x521e8f28]
movsx eax, bx
bswap ebp
mov qword [rsp + rbx*2 - 0x2758fc7a], r10
xor dword [rsp + rbx - 0x13ac7e3d], ebp
and di, 0x849a
movzx r10d, bx
xchg r9b, bl
pop r10
mov edx, r9d
div rbx
movsxd rbp, ebp
mul eax
add r11, rbp
cwd
mov ebx, dword [rsi + rdi*2 - 0x27580830]
shl cx, 0xe4
ja 0x18054e06b
push rdi
mov r10, qword [rsp + rdi*8 + 8]
movsxd rax, eax
add r11, rax
sar qword [rsp + rdi], 0x49
movzx ecx, byte [rsp + rdi + 4]
mov qword [rsp + rdi*2 + 8], 0xffffffffd097108b
xor qword [rsp + rdi*2], r11
ret 8

Function at 0x180542942
Capabilities:
Authenticate hmac

Disassembly:
cdqe
lea r9, [rsp + r9 + 0x18]
mov qword [rsp + rbp - 0xaa200f], rbp
and rbp, 0x3b303f88
and r10w, word [rsp + rbp*2 - 0x40400c]
mov dword [r9 + rbp - 0x202008], edx
sbb word [rsp + rbp*2 - 0x403ffc], bp
mov edx, dword [rsi + rbp - 0x202006]
ja 0x1805711e7

Function at 0x18054297e
Capabilities:
Authenticate hmac

Disassembly:
adc r11, rbx
lea rcx, [rax*8 + 0x4fb4dc85]
mov ebx, 0x3407fb96
ror eax, cl
or rdi, r11
jmp rdi
ror r9b, 0xa7
mov qword [rsp + r9 - 0x7fff9d69], r10
dec di
inc r9b
xor dword [rsp + rdi*4], ebx
pop r10
sal eax, 0xe
lea r9, [r9 + rdi*2 + 0x4daac21a]
movsxd rbx, ebx
sar cx, 0xa7
js 0x18052333f
mov r9d, 0x97b83b93
movzx edx, r9b
mov edi, dword [r8 + rdx*2 - 0x126]
push r9
call fcn.1805c651a
Function at 0x180542f26
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
rol r9, 6
push rbp
xor r10, r9
cwd
dec ax
mov qword [rsi + rdx*4 - 0x40006], r9
lea rsi, [rsi + rdx*4 - 0x40006]
setp cl
imul dx
xchg qword [rsp + rdx], rdx
pop r9
pop rcx
jae fcn.1805a7402

Function at 0x180542f56
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rax + rbx - 0x1e3b001c], edx
pop rax
jae fcn.18051ffce
mov ebx, 0x7bbb153c
lea rcx, [rbx + 0x413c433f]
mov bx, word [rsi + rbx - 0x7bbb153c]
jmp 0x1805c5918
and bpl, dl
adc r9b, 0xa3
not r9b
jmp 0x18058b2e8
sub dx, 0xec1d
xor r10b, r9b
bt ecx, eax
xchg cx, ax
adc r9, rsp
btr bp, cx
call fcn.18058f4f1
lea r9, [rcx + rcx*8 + 0x8b7cf20]
btr rcx, 0x86
adc rsi, 1
xchg ecx, r9d
rol cl, 0xc3
mov eax, 0x69a2d835
movzx r9d, byte [r8 + rax - 0x69a2d835]
lea r8, [r8 + rax - 0x69a2d834]
xor r9b, r10b
add r9b, 0x97
lea rax, [rax*2 + 0x33313d92]
movsx edi, ax
not r9b
mov edx, 0x2785642d
btr edx, eax
movzx ebp, dx
ror r9b, 1
btr rdi, rcx
sub r9b, cl
sub cx, bp
ror dl, 0x83
ror r9b, 1
cqo
jmp 0x180581dc4

Function at 0x18054dfa2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal word [rsp + r9 - 0x83ed], 0x2e
xor ebp, r10d
xor dword [rsp + r9*2 - 0x107e6], edi
rol rbp, 0xe8
sbb rdx, qword [rsp + r9*2 - 0x107ee]
xadd ebp, r9d
mov r8, qword [rsp + r9*2 - 0x4e]
mul bpl
shl bpl, 0xc5
or ax, cx
movsxd rdi, edi
btc rbp, 8
lea rdx, [r9 + r10*4 - 0x127a92f6]
adc r11, rdi
or word [rsp + rax - 0x5383fff6], 0xd083
pop rbp
pop rax
pop rcx
pop rax
jl fcn.18051ffce
mov ecx, 0xf0ba4c20
movzx ecx, byte [rsi + riz]
mov r10d, 0x401471a2
lea rax, [r10*4 + 0x161e8d98]
mov edi, eax
xor cl, r8b
not r10w
xor eax, edi
movsx edx, ax
rol cl, 1
dec al
js 0x1805be414
mov ebp, eax
xor cl, 1
lea r9, [rbp + rdx - 0x2ccc6300]
div ebp
ror cl, 1
call fcn.18055f3e8
Function at 0x180552390
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r10 - 0x2475ffff], rdi
bswap r9d
not r9d
or word [rsp + rcx*2 - 0x43], ax
mov qword [rsp + r10*2 - 0x48ebfffe], r8
not rcx
mul edx
shl dx, 0xce
xor dword [rsp + r10 - 0x2475ffff], r9d
lea rax, [rcx*8 - 0x5340e800]
pop r8
rol r10b, 0x27
neg r10
setno r10b
movsxd r9, r9d
js 0x18055d416
mov ebx, 0xe51c3d84
movsx eax, bx
mov ecx, eax
mov ax, word [rsi + rax - 0x3d84]
movsx edx, bx
mov cl, byte [rcx + rsi - 0x3d82]
lea rsi, [rsi + rdx - 0x3d82]
movzx ebp, dx
shl ax, cl
sub rbp, rdx
mov word [rdx + rsi - 0x3d84], ax
and dx, bx
setb dl
sal ebp, 1
mov eax, dword [r8 + rdx - 0x3d00]
lea r8, [r8 + rdx - 0x3cfc]
xor eax, r10d
jmp 0x18058de32
dec al
add r11, r9
mov rax, qword [rbx + r10 + 0x2475ffff]
xadd rdi, rcx
mov rdx, qword ss:[rax + r10*2 + 0x48ebfffe]
mov qword [rbx + r10 + 0x2475ffff], rdx
sal di, 0x84
movzx edx, cx
jmp r11
push rbp
bswap eax
not byte [rsp + rdx*8 - 0x1e800]
dec eax
add dword [rsp + rdx*4 - 0xf3ff], 0x352c6d19
mov edi, 0x832d5b2a
shr bx, 0x25
xor eax, 0x679c0dbd
lea eax, [rax + rbx - 0x5d61f7bb]
shl rbx, 0x7d
push rdx
mov qword [rsp + rbx*8 + 8], r10
xor dword [rsp + rdx*2 - 0x79f8], eax
shl rbx, 0x72
movsx r10d, word [rsp + rbx + 4]
mov r10, qword [rsp + rdx - 0x3cf8]
call fcn.18055bfff
movsxd rax, eax
mov r9d, 0xe983f53d
btc dx, bp
call fcn.1805b7c6e

Function at 0x180559f0c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
imul di, di
mov dword [rsi + riz], r9d
pop rbp
mov edi, dword [r8 + riz]
mov ecx, 0x1a36b05
movsx eax, cl
cbw
lea r8, [rcx + r8 - 0x1a36b01]
sar ax, 1
jbe 0x18054e17e

Function at 0x180562b90
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r8, [r8 + rax - 0x281a0f2e]
xor edi, r10d
movzx ecx, ax
mov qword [rsp + rax - 0x281a0f32], 0xffffffff9a85ff1b
cwde
not edi
xadd qword [rsp + rax*2 - 0x1e64], rcx
movsx ebx, byte [rsp + rax*8 - 0x798d]
movzx ebp, al
lea edi, [rax + rdi - 0x5523394b]
sar bp, 0xac
call fcn.1805407b9
mov eax, 0x7a10cd23
rdtsc
jmp 0x1805cdfbf
sub rbx, 8
mov edi, 0x68a63e30
movzx r9d, di
xor r9b, dil
mov dword [rdi + rbx - 0x68a63e2c], eax
mov dword [rdi + rbx - 0x68a63e30], edx
movzx edx, r9w
mov ecx, r9d
mov ebp, edi
mov r9d, dword [rdi + rsi - 0x68a63e30]
lea rbp, [rdx*8 + 0x7d34332a]
setg cl
lea rsi, [rsi + rdi - 0x68a63e2c]
xor r9d, r8d
lea rax, [rdx + rcx + 0x7202163f]
ror r9d, 3
sar rax, 0x34
ror rbp, 0x16
shl ecx, 0x9f
dec r9d
mov r10d, eax
bswap r9d
sar ax, 0xe7
cwd
btr r10d, edi
inc r9d
xor r10b, 0x16
sub bp, cx
setnp al
xor r9d, 0xa63fcdb0
neg rax
push r8
neg ax
mul rax
cmovae di, r10w
xor dword [rsp + rdx + 0x1fffe], r9d
xor bpl, r10b
sub ebp, ecx
pop r8
or r10, 0x249fd49a
btc edi, ebp
sar r10d, 0x85
movsxd r9, r9d
inc r10d
dec rdx
add r11, r9
neg eax
jge fcn.18051ffce
Function at 0x180569fea
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx], rax
lea rbx, [rbx + rdx*2 + 8]
imul r9d, edx
movzx r10d, word [rdx + rsi]
lea rsi, [rdx + rsi + 2]
sal dword [rsp + rdx*2 + 3], 0xf3
jbe 0x180558d73
push 0x819a88d
shl byte [rsp + 2], 0x66
cmp ebx, 2
jmp 0x18057e8da
jmp 0x1805bb76e

Function at 0x18056df3b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
dec r9w
not r9w
mov edi, ebx
sub r9w, 0x362b
btc ecx, ecx
mov qword [rsp + rdx + 0x4c129e5b], 0x5f3265bf
not r9w
inc rax
adc r9w, 0xb386
neg dword [rsp + rdx + 0x4c129e5d]
xor r10w, r9w
lea rcx, [rdx + rcx*4 - 0x7ac315e7]
push rdx
cdq
lea r9, [rsp + r9 + 0x10]
movzx bx, byte [r9 + rbp + 0x4cd653f7]
mov ax, bx
movzx r9d, bpl
jmp 0x1805827df

Function at 0x1805723a8
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
lea r10d, [rcx + r10 + 0x2f2b3a81]
xor ax, bp
movzx edx, al
mov qword [rsp + rcx - 0x2c], rdi
mov qword [rsp + rcx - 0x2c], r8
shr dl, 0xc1
sub al, al
bswap r9d
xor dword [rsp + rcx*2 - 0x58], r10d
cdqe
mov r8d, edi
pop r8
imul rax, rdi
push rcx
setae dl
movsxd r10, r10d
adc word [rsp + rcx - 0x27], dx
adc r11, r10
shl bpl, 0xc4
shl bp, 0xeb
cqo
mov ecx, dword [rsi + rcx - 0x2c]
movsx r10d, r9b
lea rsi, [rdi + rsi - 0xd9955d0]
pop rax
cwd
xor ecx, r8d
btr r10d, 0x3c
cbw
dec ecx
cwd
shr di, 0xc8
call fcn.18058b4e2

Function at 0x18057540e
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xffffffffb387979f
movzx ax, byte [rbx]
pop rcx
lea r9, [rcx*8 + 0x22fb3a]
mov dl, byte [rbx + rcx + 0x4c786863]
lea rbx, [rbx + rcx + 0x4c786863]
add al, dl
push r9
push r9
sal word [rsp + rcx + 0x4c78686b], 0xac
mov word [rbx + rcx + 0x4c786861], ax
mov r10d, ecx
mov edi, dword [rsi + rcx + 0x4c786861]
lea rcx, [r10 + rcx*8 - 0x394bcd53]
adc rsi, 3
inc qword [rsp + 2]
neg cx
pop rbp
xor edi, r8d
ror edi, 1
or cx, cx
sar dword [rsp + 1], 0x1a
inc edi
mov dword [rsp + 1], 0xda138d90
not edi
xor edi, 0xfa039f8f
xadd dword [rsp + 2], ecx
adc bp, bp
mov qword [rsp], r8
shl r10b, 0xc5
xor dword [rsp], edi
or rbp, r9
rol r9w, cl
sbb r10b, 0x9a
pop r8
movsxd rdi, edi
movzx edx, r10b
jle 0x180530a7a
ror r9b, 0xc7
adc r11, rdi
call fcn.1805229a4
mov ecx, 0x19020e0f
movsx edx, cl
mov r10d, dword [rsi + rcx*2 - 0x32041c1e]
ror edx, cl
lea rsi, [rsi + rdx*4 - 0x77fffc]
movzx r9d, dl
xor r10d, r8d
xor r10d, 0x61b9092c
call fcn.18056e8f4