joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x920
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
mov rax, qword [0x18001b040]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rdi, rcx
lea rax, [rsp + 0x90]
xor ecx, ecx
mov rsi, r9
mov r8d, 0x80
nop dword [rax]
nop dword [rax + rax]
mov qword [rax], rcx
mov qword [rax + 8], rcx
lea rax, [rax + 0x10]
sub r8, 1
jne 0x180007ea0
movss xmm13, dword [0x1800183b8]
xorps xmm11, xmm11
movsd xmm10, qword [0x180018430]
movd xmm12, edx
cvtdq2pd xmm12, xmm12
nop dword [rax]
nop word [rax + rax]
xorps xmm6, xmm6
cvtss2sd xmm6, xmm11
movaps xmm1, xmm6
call fcn.180004f80
mulsd xmm0, xmm12
xorps xmm8, xmm8
movaps xmm1, xmm6
addsd xmm0, qword [rdi]
cvtsd2ss xmm8, xmm0
call fcn.180004ed0
xorps xmm9, xmm9
mulsd xmm0, xmm12
addss xmm11, xmm13
xorps xmm7, xmm7
addsd xmm0, qword [rdi + 8]
cvtss2sd xmm9, xmm11
cvtsd2ss xmm7, xmm0
movaps xmm1, xmm9
call fcn.180004f80
mulsd xmm0, xmm12
xorps xmm6, xmm6
movaps xmm1, xmm9
addsd xmm0, qword [rdi]
cvtsd2ss xmm6, xmm0
call fcn.180004ed0
mov rax, qword [0x18001bf78]
mov rbx, qword [0x18001b7b0]
mov dword [rsp + 0x50], 0x3f800000
xorps xmm1, xmm1
mulsd xmm0, xmm12
cvtps2pd xmm2, xmm8
addsd xmm0, qword [rdi + 8]
movsd qword [rsp + 0x20], xmm2
movsd qword [rsp + 0x90], xmm2
movss dword [rsp + 0x30], xmm2
cvtps2pd xmm3, xmm7
cvtsd2ss xmm1, xmm0
movaps xmm0, xmmword [rsi]
movsd qword [rsp + 0x28], xmm3
movsd qword [rsp + 0x98], xmm3
movss dword [rsp + 0x38], xmm3
cvtps2pd xmm4, xmm1
movss xmm1, dword [rsp + 0x24]
movss dword [rsp + 0x34], xmm1
movss xmm1, dword [rsp + 0x2c]
movsd qword [rsp + 0xa8], xmm4
movsd qword [rsp + 0x48], xmm4
movss dword [rsp + 0x3c], xmm1
cvtps2pd xmm5, xmm6
movups xmmword [rsp + 0x54], xmm0
movsd qword [rsp + 0xa0], xmm5
movsd qword [rsp + 0x40], xmm5
test rax, rax
jne 0x180008040
mov eax, dword [0x180017a28]
lea rdx, [rsp + 0x68]
movups xmm0, xmmword [0x180017a08]
mov dword [rsp + 0x88], eax
lea rcx, [rsp + 0x68]
movups xmm1, xmmword [0x180017a18]
movzx eax, word [0x180017a2c]
movups xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x8c], ax
movups xmmword [rsp + 0x78], xmm1
call fcn.180001550
lea r8, [rsp + 0x68]
call fcn.1800012a0
mov qword [0x18001bf78], rax
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbx
call fcn.1800013f0
comisd xmm10, xmm9
ja 0x180007ee0
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.180015a20
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rdi
ret
Function at 0x14000e830
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140048020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rcx + 8]
add rdx, 0x16
cmp rdx, 0x10
jb 0x14000e889
lea rcx, [rsp + 0x20]
call fcn.14000d510
mov qword [rsp + 0x30], 0
mov r8d, 0x15
mov rdx, qword [str._bdtrackersnmh.exe_:]
lea rcx, [rsp + 0x20]
call fcn.14000b340
movups xmm1, xmmword [rbx]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r8, xmm0
movq rdx, xmm1
mov rcx, rax
call fcn.14000b340
mov r8d, 1
mov rdx, qword [0x140040ff8]
mov rcx, rax
call fcn.14000b340
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000e924
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e91f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e937
call fcn.140011160
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140011140
add rsp, 0x50
pop rbx
ret
call fcn.140019074
int3
Function at 0x2fc4c64b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c6eb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e9108]
test eax, eax
je 0x2fc4c6f4a
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e9110]
mov qword [rbp - 8], rax
jmp 0x2fc4c6f2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6f22
cmp qword [rbp - 0x10], 0
je 0x2fc4c6f22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c6ee8
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c6f4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c7050
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c7078
mov eax, 0
jmp 0x2fc4c70c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c70a1
mov eax, 0
jmp 0x2fc4c70c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c70c1
mov eax, 0
jmp 0x2fc4c70c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c70cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c714a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c7141
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c7141
mov rax, qword [rbp - 8]
jmp 0x2fc4c715f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c7114
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1418b5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1418b51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1418b5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418b506f
add dl, dl
jne 0x1418b5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418b50f6
xor eax, eax
add dl, dl
jne 0x1418b50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418b51ad
add dl, dl
jne 0x1418b50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1418b50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1418b507e
mov eax, 1
add dl, dl
jne 0x1418b5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418b5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418b50fb
sub eax, ebx
mov ebx, 1
jne 0x1418b514c
mov ecx, 1
add dl, dl
jne 0x1418b512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1418b513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418b5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418b507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1418b5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1418b5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418b515d
cmp eax, 0x7d00
jae 0x1418b519b
cmp eax, 0x500
jb 0x1418b5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418b507e
cmp eax, 0x7f
ja 0x1418b519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1418b507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1418b51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1418b507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4c6390
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c6d92
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e9108]
test eax, eax
je 0x2fc4c6e2a
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e9110]
mov qword [rbp - 8], rax
jmp 0x2fc4c6e0e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6e02
cmp qword [rbp - 0x10], 0
je 0x2fc4c6e02
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c6dc8
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c6e2b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c6f30
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c6f58
mov eax, 0
jmp 0x2fc4c6fa6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c6f81
mov eax, 0
jmp 0x2fc4c6fa6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c6fa1
mov eax, 0
jmp 0x2fc4c6fa6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c6fac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c702a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c7021
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c7021
mov rax, qword [rbp - 8]
jmp 0x2fc4c703f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c6ff4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14139d0e4
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdi*2 - 0x5c8d9606], rax
movsxd rbp, ebp
mov qword [rsp + rdi - 0x2e46cb0b], rax
setae byte [rsp + rdi - 0x2e46caf8]
sar dl, 0x25
add r8, rbp
and r10, rax
shr qword [rsp + r10*2 - 0x1844], 0x7d
mov r9w, word [rsi + r10 - 0xc24]
sete byte [rsp + r10*8 - 0x610e]
neg al
lea rbp, [rax + rdx*4 + 0x240757aa]
movzx eax, byte [r10 + rbx - 0xc20]
sub word [rsp + r10*2 - 0x183f], 0xcba7
lea rbx, [rbx + r10 - 0xc1f]
adc qword [rsp + r10*4 - 0x3081], 0xffffffffef023125
xor al, r11b
dec r10b
sete byte [rsp + r10*2 - 0x1839]
ror al, 1
xadd dil, dl
adc rdx, 0x21a7a932
sbb al, 0xd
ror al, 1
not r10d
rol rdi, 0xe
adc cl, dil
inc al
not dil
add byte [rsp + 0x16], 0x3e
jne 0x1413d2bfd
mov qword [rsp + rdi - 0xc], r11
pop rax
jmp 0x141408f52
xor r11b, al
mov qword [rsp + 0x18], r10
ror qword [rsp + 0xd], 0xec
sub r10w, bp
lea rax, [rsp + rax + 0x20]
xchg byte [rsp + 0x1d], dh
mov byte [rax], r9b
jge 0x1413bffa3
sal r9b, cl
and cl, cl
adc r8, rax
lea rax, [rbp*2 - 0x13de6ee6]
lea r9, [r9 + rdx - 0x4469c857]
inc ecx
movzx r10d, byte [rbx + rcx*2 - 0x4c]
xadd rdi, rax
lea rbx, [rbx + rcx*4 - 0x97]
add rbp, rdi
add rcx, rcx
xor r10b, r11b
sal dil, 0x83
jp 0x1413a2fea

Function at 0x1413a3bf8
Capabilities:
Authenticate hmac

Disassembly:
mov rsp, qword [rbp + riz - 0x10]
call fcn.1413d3f38
xor eax, 0x8f16af3b
sal ebp, cl
mov qword [rsp + rcx*8 - 0x7fd78], r11
movzx r11d, word [rsp + rcx*2 - 0x1ff5d]
bswap r10d
xor dword [rsp + rcx*2 - 0x1ff58], eax
mov r11, qword [rsp + rcx*4 - 0x3feb8]
mov qword [rsp + rcx - 0xffa8], r9
movsxd rax, eax
add r8, rax
shr r9b, 0x66
call fcn.1413accc7

Function at 0x1413a5d31
Capabilities:
Authenticate hmac

Disassembly:
add r10b, bpl
not eax
mov ecx, 0x5bbaec14
dec eax
not eax
not rdx
sub r10w, 0xf097
xor eax, 0x618fa795
xchg bpl, r9b
inc eax
neg ecx
mov qword [rsp + r9*4 - 0x162ad868], r11
dec r10b
xor dword [rsp + r9*8 - 0x2c55b0d0], eax
and r10d, 0x4013b834
pop r11
push r9
neg ecx
rol edi, cl
movsxd rax, eax
adc r8, rax
neg dil
movzx r10d, byte [rbx + r9 - 0x58ab61a]
mov byte [rsp + r9*8 - 0x2c55b0ca], bpl
lea rbx, [rbx + r9*8 - 0x2c55b0cf]
xor r10b, r11b
sub edx, edi
lea rbp, [rdi + r9*8 + 0x79c9124]
xor r10b, 0x15
jmp 0x1413ea44d
Function at 0x1413a8934
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea r9d, [r9 + rdi - 0x60bb6a3f]
xor r9d, 0x1d03743b
ror r9d, 1
mov qword [rsp + rcx - 0x49698100], rcx
and dword [rsp + rbp - 0x31b56a0a], 0xcd887691
inc r9d
rol r9d, 3
pop rbp
rol dil, 0x41
lea r9d, [r10 + r9 - 0x597fe2b3]
adc rdi, 0xffffffffdbbb4caf
bswap r9d
or r10b, 0x2b
ror r9d, 1
movsx edx, cl
xor r9d, 0x236e638
inc bp
sub bp, 0x1ab2
jno 0x141409ad0
pop rdi
lea r9, [rdi*4 - 0x1f789beb]
neg eax
movsx ecx, dil
or di, word [rsp + rdi*2 - 0x31]
not eax
jge 0x1413bba28
adc byte [rsp + rdi - 0xfff3], r10b
dec eax
ror eax, 1
jmp 0x1413c7325
neg word [rsp + rdi*4 - 0x3ffeb]
mov ebp, r10d
mov qword [rsp + rdi - 0xfff6], r11
neg edi
xor dword [rsp + r10 - 0x773b463c], eax
pop r10
pop r11
call fcn.1413ae6e9
movzx eax, byte [rbx]
mov r9d, 0x36b2a692
xor al, r11b
movzx edx, r9w
lea rbp, [rdx*4 - 0x316cf478]
movsx ecx, r9w
xor al, 0x15
sal cx, 0xa9
movzx edi, cl
inc al
neg al
jmp 0x14140c1a4
neg r9d
or rax, rbp
xor r9d, 0x8f16af3b
neg r10w
adc bpl, 0x9d
push r11
adc edx, 0xef1cc3a3
jle 0x1413df50b
rol r9, 6
dec r9
movzx edi, byte [rsp + rax - 0x7ffffffc]
movzx r10d, dil
not word [rsp + rax - 0x7ffffff2]
xor r11, r9
xadd dword [rsp + rcx - 0x7ffffffb], edi
mov qword [rdi + rsi - 0x5d000006], r9
not ecx
jns 0x1413e11c9
add al, 0xb6
add ecx, 0xb2a4db07
xor r11b, al
dec bp
jl 0x14140fe70

Function at 0x1413b9f59
Capabilities:
Authenticate hmac

Disassembly:
movsx eax, dil
ror dl, 1
mov qword [rsp + rbp - 0x2f11], rbp
dec dl
neg dl
inc dl
dec eax
mov qword [rsp + rbp - 0x2f19], 0xffffffffd09a1882
sal di, 0xc
neg dl
not dl
not r10
sub byte [rsp + r10*2 + 0x119], r9b
xor dl, 0x89
rol dl, 1
mov qword [rsp + rbp*2 - 0x5e22], 0x65b00916
xor r11b, dl
call fcn.1413b6f87

Function at 0x1413bdce3
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1413eb4d2
mov r9d, 0x283ffb95
mov ebp, dword [rsi + r9*2 - 0x507ff72a]
movzx r10d, byte [rbx + r9 - 0x283ffb95]
mov edx, 0x4db3e926
jmp 0x1413bca59
xor r10b, r11b
lea rcx, [rdx*8 - 0x76c38878]
ror r10b, 1
movsx edi, r9b
movsx eax, dx
jmp fcn.1413d5d01
lea rax, [rsp + rax + 0x18]
mov r9d, dword [rax + r10]
and dil, dil
sar qword [rsp + r10 + 0x10], 0x59
mov qword [rsp + r10], 0xffffffffc2a9cfb4
mov dword [rsi + r10*4 + 4], r9d
jnp 0x1413adcba

Function at 0x1413c3b6a
Capabilities:
Authenticate hmac

Disassembly:
pop rcx
xchg word [rsp + rax - 0xdfea], r10w
mov word [rsi + r9 - 0x14ee6266], bp
lea rsi, [rsi + r9*2 - 0x29dcc4c8]
shr word [rsp + r9*2 - 0x29dcc4be], 0xe2
sar r10b, 3
pop rdi
pop rbp
pop rdi
jns fcn.1413f9e24
Function at 0x1413c4412
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg al
push rdi
movsx r10d, word [rsp + rbp + 0xffe4]
inc al
push rbp
sub dx, bp
shr dword [rsp + r10 - 0x61a], 0xbc
neg al
inc qword [rsp + rbp + 0xffe4]
not al
xor al, 0x89
sub cx, 0x401e
shr ecx, 0xcf
rol al, cl
xor r11b, al
lea rax, [rsp + rax + 0x20]
mov qword [rsp + rbp + 0xfff4], 0x6b9548b3
mov rbp, qword [rax + rbp*4 + 0x3ff90]
or r10b, dil
mov qword [rsi + r10 - 0x621], rbp
jnp 0x141398ec3
sub r10w, 0x46b8
mov rax, qword [rbx + rcx - 0x1abfc]
mov ebp, 0xec885199
inc edx
sal rdx, 0xae
lea rbx, [rbx + rcx - 0x1abf4]
lea rdx, [rcx + rcx*2 + 0x442e1c9a]
shr word [rsp + rcx*4 - 0x6aff8], cl
xchg byte [rsp + rdx - 0x4433207e], bpl
xor rax, r11
inc rax
add qword [rsp + rcx*4 - 0x6afec], 0x51327fb5
bswap rax
rol rax, 6
dec rax
neg word [rsp + rcx*8 - 0xd5ffa]
mov r9d, 0x4b3c1c0e
and r10b, bpl
xor r11, rax
mov qword [rsi + rdx - 0x443320a9], rax
sal r10w, 0xac
lea rsi, [rcx + rsi - 0x1ac0d]
sar r10, cl
shr r9b, cl
pop r10
pop rax
pop rbp
pop rcx
jno fcn.1413f9e24

Function at 0x1413c6116
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 8]
jmp 0x1413af612

Function at 0x1413c6cc6
Capabilities:
Authenticate hmac

Disassembly:
mov rcx, qword [rbp + r9 - 0xff]
ja 0x1413cec45
pop rdx
movzx r9d, byte [rsp + rbp*2 - 0x1e6]
mov qword [rsi + rbp - 0x101], rcx
lea rsi, [rsi + rbp*2 - 0x200]
pop rcx
pop rax
pop rax
pop rcx
pop rdx
jge fcn.1413f9e24

Function at 0x1413c6cf9
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdi - 0x61b86d2b], rax
pop rax
pop rax
pop r9
pop r9
pop rdx
jne fcn.1413f9e24
mov eax, 0xcf2ac399
movzx r9d, al
movzx edi, ax
mov rdi, qword [rsi + r9*2 - 0x132]
mov edx, eax
movsx ebp, dl
mov ax, word ss:[rdi + r9 - 0x99]
bswap r9
shr r9b, 0xe2
neg edx
mov word [rsi + rdx - 0x30d53c61], ax
ror rdx, 0x9f
jae 0x141407826
xor dword [rsp + rdx*2 - 0xc354f18], eax
push r11
and byte [rsp + rdx*4 - 0x186a9e2f], r9b
xchg byte [rsp + rdx - 0x61aa788], dl
mov r11, qword [rsp + rdx - 0x61aa6f8]
call fcn.141395405
mov qword [rsp + r10 - 0xb764], r8
ret 0x10
mov rdx, rsi
mov r10d, 0x4bad139b
mov rax, rdx
lea rdi, [r10 + r10*8 - 0x566c2842]
mov ecx, dword ss:[rax + r10 - 0x4bad139b]
dec r10d
call fcn.14139ed42
mov rax, qword [rsi + 8]
sub rsi, 0xfffffffffffffff0
call fcn.141405e44
mov eax, dword [rbx]
sal r9b, 0x67
lea rdi, [r9 + r9*4 - 0x76cb9b4e]
xor eax, r11d
dec eax
not eax
bswap eax
mov ecx, edi
xchg ch, cl
shr rdx, cl
xor eax, 0xfda56a87
add ebp, 0x5c95448a
push r11
movsx r11d, cl
or rdi, rcx
jle 0x1413c99f9
jmp 0x1413f53bd
Function at 0x1413c87df
Capabilities:
Encode data using base64

Disassembly:
lea rdi, [rsp + rdi + 0x18]
mov dword [rdi], edx
lea rbp, [rsi + 4]
mov edx, ecx
mov qword [rsi + rdx*8 - 0x78a32944], rbp
sub word [rsp + rdx*8 - 0x78a32931], r10w
mov edi, dword [rbx + rdx - 0xf146527]
xor edi, r11d
xadd rcx, rax
shr rdx, 0x85
bswap edi
call fcn.1413f34fb
or r9b, dil
movsx eax, word [rsp + rdx*2 - 0xb]
xchg rdx, rax
push rcx
mov word [rsi + rdx + 2], r9w
inc word [rsp + rdx*2 + 8]
not rcx
sar rcx, cl
adc cl, byte [rbx + rdx + 4]
lea rbx, [rbx + rdx + 5]
dec eax
xor cl, r11b
neg cl
ror cl, 1
dec cl
inc byte [rsp + rdx*4 + 0x2a]
shl dword [rsp + rdx + 0x1b], 0x3d
sar qword [rsp + rdx + 0x16], 0xf1
neg cl
inc cl
neg cl
xor dword [rsp + rdx + 0x2b], edx
not cl
xor cl, 0x89
rol cl, 1
sal al, 0x62
movsx ebp, r10w
pop rdi
xor r11b, cl
shl bp, 0x86
jns 0x1413aa3f6

Function at 0x1413c8e07
Capabilities:
Authenticate hmac

Disassembly:
sar dword [rsp + rdi - 0x442a620d], 0xcc
js 0x141405930
lea r9, [rdi*2 - 0x184a426b]
ror cl, 1
mov qword [rsp + rdi - 0x442a6211], 0xffffffffb83cbb11
dec cl
jmp 0x14139e93e

Function at 0x1413cbdae
Capabilities:
Authenticate hmac

Disassembly:
pop rdx
mov qword [rsp + rcx*4 - 0x50], r11
ror bp, 8
pop rax
movsx r10d, cx
xor dword [rsp + rcx*4 - 0x58], edi
pop r11
or cl, bpl
call fcn.1413c1d59

Function at 0x1413d0e50
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [rdx + r10*2 - 0x39527e79]
lea rdi, [rsp + rdi + 8]
jbe 0x1414072f4
setb dil
sub ebp, edi
adc r8, rcx
mov qword [rsp + r10*2], 0x3130be00
lea r9, [rbp*8 - 0x965ae48]
shr word [rsp + r10 + 5], 0x6f
movzx edi, byte [r10 + rbx + 4]
lea rbx, [r10 + rbx + 5]
xor dil, r11b
xor dil, 0x31
and dword [rsp + r10], r10d
rol r10d, 0xb5
xadd word [rsp + r10*2 + 1], r10w
sbb dil, 0xc
jmp 0x1414094ab
or edx, dword [rdi + rax*2 + 0x72a4fcf2]
inc r9
mov dword [rsi + r10 + 4], edx
neg word [rsp + rax + 0x39527e7f]
lea rsi, [rax + rsi + 0x39527e7d]
sal r9, 0x65
adc byte [rsp + rax*2 + 0x72a4fcf6], 0x19
movzx edi, byte [rsp + rax + 0x39527e7b]
mov qword [rsp + rax*2 + 0x72a4fcf2], r8
ret
rol byte [rsp + r10 + 5], 0x63
rol ax, 0x49
not dil
sbb dil, 0xa4
and bp, r9w
shl rdx, 0x3a
movzx ecx, ax
xor r11b, dil
and word [rsp + rdx + 6], r9w
jae 0x1413964c4
add rbx, 4
ror word [rsp + 6], 0xd
xor eax, r11d
sar word [rsp + 3], 0x21
sub word [rsp], 0x99b7
mov r10d, r9d
sbb eax, 0x973d9311
mov ecx, edi
bswap eax
ror edi, 0x4f
ror eax, 2
shl byte [rsp + 1], 0x65
xor eax, 0x762c98b4
xor qword [rsp], rdx
adc di, r9w
mov qword [rsp], r11
dec r10b
jae fcn.1413f24e8
call fcn.1413b0ff6
mov rdi, qword [rsi]
mov al, byte [rsi + 8]
add rsi, 0xa
call fcn.141391ef0
add bpl, 0x14
sal al, 0x61
setb byte [rsp + rax - 0x7e8]
xor r11b, bpl
lea rbp, [rsp + rbp + 8]
and qword [rsp + rax - 0x7ea], 0xffffffffa1212a97
and rax, 0x5f863580
mov word [rbp + rax*2 - 0xb00], dx
neg r9
mov r10w, word [rsi + rax - 0x57e]
xchg ecx, edi
call fcn.1413fdc70