joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400060d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000611a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000611a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000611a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000611a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000611a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000611c
xor al, al
add rsp, 0x28
ret

Function at 0x140f88058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f881df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f88089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f8806f
add dl, dl
jne 0x140f88096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f880f6
xor eax, eax
add dl, dl
jne 0x140f880a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f881ad
add dl, dl
jne 0x140f880b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f880c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f880d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f880dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f880ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f8807e
mov eax, 1
add dl, dl
jne 0x140f88106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f88113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f880fb
sub eax, ebx
mov ebx, 1
jne 0x140f8814c
mov ecx, 1
add dl, dl
jne 0x140f8812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f8813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f88123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f88168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f88175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f8815d
cmp eax, 0x7d00
jae 0x140f8819b
cmp eax, 0x500
jb 0x140f88196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8807e
cmp eax, 0x7f
ja 0x140f8819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f881d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f8807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401313b8
Capabilities:
Hash data using fnv

Disassembly:
invalid
xchg rdx, r13
mov dword [rsp + 0x68], 0x7371784f
jne 0x1401313dc
je 0x1401313dc
test r13d, 0x51b9dee9
jl 0x140131162
pop rbp
pushf
cmp r11, rdx
movabs r11, 0x7a02590000029de9
test r13d, 0xfb148c0c
pause
ret
jmp 0x14013167e
mov dword [rsp + 0x5c], 0xf6f6f6f6
mov dword [rsp + 0x6c], 0x81596f78
mov dword [rsp + 0x60], 0xf6f6f6f6
mov dword [rsp + 0x70], 0x71787378
jne 0x1401316d3
je 0x1401316d3
bswap r11
cmp ebx, 0x49c3b027
add r12d, 0xfd0f72e2
jmp rcx
jmp fcn.1401310e4

Function at 0x140131615
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140131636
je 0x1401311bd
invalid

Function at 0x1401325b0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sbb al, 0
add byte [rax], al
add byte [rax], al
test rsi, rbx
cmp r8d, 0xc0ff5cc4
rcr edi, 0xb4
neg rbx
lea r8d, [rdi - 0xd1d5]
rol ebp, 0x17
jne 0x14013077e
movabs rdi, 0x12f3d20000042ce9
jmp 0x140132069
enter 0xffffffffffffbe85, 0xffffffffffffffe9
xor al, 0xfc
invalid
retf 0x9cc6
jg 0x140131b92
int3
leave
add r11d, 0x2abf78db
popf
jae 0x1401316f5
rol ebx, 0x4c
inc r10
jge 0x140131746
rcr r13d, 0xa6
je 0x1401324a6
jne 0x1401324a6
syscall
pause
pushf
mul r13
ror ecx, 0xa4
jmp rax
jmp 0x140132a5d
outsd dx, dword [rsi]
push r14
nop
jmp 0x140132465
jmp rcx
add byte [rax], al
rol r15d, 0xa6
lea r10d, [rcx + 0xcc]
sub esi, 0x15161df6
je 0x14013291c
jne 0x14013291c
lea r9d, [rbx + 0x9ab9]
call rcx
sub ebp, 0x77f67107
pop r13
lea r15d, [rdi + 0x2b48]
cmp r8, rcx
test r8, rcx
jp 0x1401332e5
movabs rsi, 0x175615fffffdcfe9
ror r11d, 1
call rcx
lea esi, [rbp - 0xfe8f]
rcl r10d, 0xb9
dec r9
jp 0x1401327b2
jmp 0x1401326f0
jmp rax
rcr ebx, 0xa4
lea ebx, [rbx - 0xfe89]
lea r13d, [rbp - 0xd2a8]
test edi, 0x1c796978
call rax
jae 0x140131e21
jl 0x140131cbf
jmp 0x1401328e1
Function at 0x180668058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806681df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180668089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18066806f
add dl, dl
jne 0x180668096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806680f6
xor eax, eax
add dl, dl
jne 0x1806680a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806681ad
add dl, dl
jne 0x1806680b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806680c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806680d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806680dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806680ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18066807e
mov eax, 1
add dl, dl
jne 0x180668106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180668113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806680fb
sub eax, ebx
mov ebx, 1
jne 0x18066814c
mov ecx, 1
add dl, dl
jne 0x18066812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18066813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180668123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18066807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180668168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180668175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18066815d
cmp eax, 0x7d00
jae 0x18066819b
cmp eax, 0x500
jb 0x180668196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18066807e
cmp eax, 0x7f
ja 0x18066819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18066807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806681d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18066807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141548e90
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r11], rsi
lea r11, [rcx*2 - 0x6ffccdce]

Function at 0x14154d3b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 2
movsx esi, byte [rsp + r9*2 - 0x1190b]
movsx r10d, al
mov byte [rsp + r9 - 0x8c80], 0xb1
not edx
shl ax, 0xec
adc dword [rsp + r9 - 0x8c82], r9d
jle 0x14158e715
inc edx
rol byte [rsp + r9 - 0x8c7e], 0xe3
bswap edx
pop rax
adc rax, 0x51e2f
jmp rax

Function at 0x141556c22
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rcx, [rcx + r10*2 + 0xd3efbbb]
inc ebx
neg ebx
ror word [rsp + r10*2 - 0xc6], 0xaa
movsx ebp, ax
sbb ebx, 0xb481d90e
not ebx
call fcn.141563dc9

Function at 0x1415584a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor r11d, 0x1b37a98a
mov qword [rsp + r8 - 0xc], r9
sub r11d, 0xea188d0d
ror r11d, 1
movsx edx, r8b
neg r11d
shl r8d, 0xe1
sub edx, 0xed123eae
lea rsi, [rax*8 - 0x7867d270]
ror r11d, 2
not al
mov qword [rsp + r8*2 - 0x28], r8
push rdx
mov qword [rsp + r8 - 8], rdi
call fcn.1415e3c85

Function at 0x1415630b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [rsp + rdx - 0x740f5143], bx
movsx r10d, word [rsp + rbp - 0x740f5112]
inc eax
add dl, bh
xor eax, 0x13360b93
not r10
mov qword [rsp + rbp - 0x740f5115], rsi
pop rbp
inc r10b
xor dword [rsp + rdx - 0x740f5151], eax
pop rsi
lea rdx, [r11 + r11*4 + 0x5f335521]
lea r10, [r10*8 + 0x7db76599]
jmp 0x1415e890b
movsxd rax, eax
add r8, rax
mov eax, 0x5c86d4b1
and bl, 0x9c
call fcn.14157f586

Function at 0x141570831
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec r10d
and r9b, dl
mov qword [rsp + rsi - 0xff0e], rbp
call fcn.1415f3d75
mov edx, 0x810abd11
neg dx
mov r11, qword [rsi]
mov rcx, qword [rsi + 8]
add rsi, 8
movzx r9d, dx
add r9w, r9w
jo 0x1415a33ae

Function at 0x141575f28
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [rbp + riz]
call fcn.1415ae7b7

Function at 0x14157d663
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsxd rdx, edx
movzx r10d, bx
adc r8, rdx
mov rdx, rdi
lea rdi, [rdi + rax*2 - 8]
mov qword [rax + rdi], rdx
lea rdx, [r11 + rbx*4 - 0x55e9d1d6]
movzx ecx, al
jmp fcn.141601a1c
push rcx
adc rdi, rax
pop r9
inc r10d
movzx r9w, byte [rbx + rdx - 0x1c5a]
mov qword [rsp + rdx*2 - 0x38b4], r11
shl sil, 0x25
jnp 0x1415a5dd9
sar rax, 0xea
jbe 0x141615e5f
lea rax, [r8*8 - 0x7d712951]
xor dword [rsp + rdx - 0x3e977f23], r9d
mov ecx, eax
pop rdi
not rdx
movsxd r9, r9d
add rbx, r9
sub cl, r8b
jb 0x14161ae64
mov cl, byte [rbx + rdx*2 - 0x38b2]
movsx eax, r11w
call fcn.141602a22
mov edi, dword [r10]
mov edx, 0x6502f785
mov ebx, edx
movzx eax, dl
lea r10, [r10 + rbx - 0x6502f781]
xor edi, r8d
not edi
lea edi, [rdi + rbx*2 + 0x312eaf0c]
call fcn.1415ebf17
dec edx
or eax, eax
lea r11, [rbx*4 - 0x18ec22d3]
mov qword [rsp + rax*2], rsi
xor dword [rsp + rax], edx
pop rsi
xor r11d, ebx
jno 0x14155e59f
push r8
movzx r9d, word [rdx + rbp + 0x3e977f24]
pop r8
add r8w, dx
and rsi, 0x38a4d5a2
lea rbp, [rbp + rdx + 0x3e977f26]
sar al, cl
call fcn.14161b374
Function at 0x14157def8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp + 8], r11d
not cx
pop rdx
bswap rdi
xor r8w, cx
inc dword [rsp + 3]
movsx edx, dil
lea rcx, [rsp + rcx + 8]
mov r11, qword [rcx + rdx*2]
sal rbx, 0x26
or dx, 0x61bb
je 0x1415498e6
lea rsi, [rdx + rsi - 0x61c3]
bswap rbx
lea rbx, [rdx - 0xb71ef4c]
not dx
mov qword [rsi + rbx + 0xb718d91], r11
movsx r11d, dx
lea rax, [r11 + rdx + 0x4bb49dbd]
mov r11d, dword [r10 + rbx + 0xb718d91]
call fcn.1415cfcb1

Function at 0x14157f7d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, r10d
mov qword ss:[rbx + r10*2], rax
lea r9, [r10 + r9 - 4]
mov qword [rsp + r10], 0xffffffffa2a0c093
jp 0x14158de74
mov qword [rsp + r10*2 - 0x9e56c0e], rsi
and rax, 0xffffffff829eae0a
xor dword [rsp + r10*8 - 0x2795b050], ecx
call fcn.1415bd029
mov eax, 0x238e6b89
jmp 0x14158dc48
shld rbx, r9, cl
inc di
lea r9, [rdi + rdi + 0xd9f8218]
mov qword [rsi + rax*2 - 0x471cd712], rbx
sub ax, di
js 0x1415ffcd1
movsx r11d, dl
mov eax, dword [r9 + r10*8]
push rdx
xor eax, esi
mov qword [rsp + r10*2 + 0x10], 0xffffffffc18a3e3f
not eax
sar r10w, 0xac
ror eax, 2
or rdx, 0x4838a0a0
jae 0x1415a05d9
not eax
lea rcx, [r11 + rdx*8 - 0x6c4ebc5d]
neg eax
movzx ebp, r11b
ror eax, 1
call fcn.141578904
pop rbp
movsxd r10, r10d
or rsi, rcx
adc rdi, r10
movzx r9d, byte [r8 + rcx*2 - 0xf83e]
shl r11, cl
mov r10d, ecx
lea r8, [rcx + r8 - 0x7c1e]
xor r10b, r10b
xor r9b, bpl
or r10b, 0x28
bswap edx
xchg r10d, ecx
ror r9b, 1
add r9b, 0xb6
call fcn.1415f81ac
mov edx, dword [r10 + rdi - 0x4917b689]
movsx r11d, dil
xor r9, 0x2a25891d
lea r10, [rdi + r10 - 0x4917b685]
mov ecx, eax
xadd r9b, cl
xor edx, r8d
call fcn.14153ec1c

Function at 0x141585731
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap r10d
mov qword [rsp + r11 - 0xf004c], rbp
lea r10d, [r10 + r11*8 + 0x4db357d2]
not qword [rsp + r11*4 - 0x3c0130]
rol ebp, 0xbb
push rbp
mov qword [rsp + r11*2 - 0x1e0090], rsi
mov ebx, 0xe91f0480
jae 0x14155ca14
xor dword [rsp + r11*4 - 0x3c0128], r10d
add word [rsp + r11 - 0xf004a], 0x2b8d
mov rsi, qword [rsp + r11*2 - 0x1e0090]
mov qword [rsp + r11*4 - 0x3c0128], rbp
seta al
movzx edx, cl
movsxd r10, r10d
adc r8, r10
mov r10, qword [rdi + r11 - 0xf004c]
jmp 0x1415b7925
sar byte [rsp + r11 - 0xf0042], 3
seta byte [rsp + r11 - 0xf004a]
mov rcx, qword [rdi + r11*4 - 0x3c0128]
sal dword [rsp + r11*4 - 0x3c012d], 0xf8
add ebp, dword [rsp + r11 - 0xf0045]
lea rdi, [rdi + r11 - 0xf0044]
sbb dx, 0xb917
rol byte [rsp + r11 - 0xf0044], 0x81
dec edx
add r10, rcx
neg rax
inc eax
mov qword [rdi + rax*4 - 0x400], r10
mov qword [rsp + rax*2 - 0x200], r8
ret 8

Function at 0x14158a10c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r9, [rsp + r9 + 8]
mov esi, dword [r9 + rsi - 0x5d70b8f8]
call fcn.1415df4a5
add rbp, r9
sal rdi, cl
mov eax, dword [rsi + rbx*2 - 0x166]
lea rbx, [rdx + rcx*4 + 0x4b3a3f29]
cpuid
call fcn.14154f4b0
xor r9w, bp
movzx eax, dl
lea rsi, [rsi + rax*8 - 0x5c193ee]
ror si, 0xa5
ror r9w, 1
push rax
rol word [rsp + rsi - 0x5d70b8f9], 0xac
dec rsi
inc r9w
rol r9w, 1
neg r9w
xor bp, r9w
xchg dx, ax
jmp 0x141540d4d
Function at 0x14158dc68
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx - 0x4523fa15], rsi
shr esi, 0x74
bswap r9d
not r9d
ror r9d, 3
push rdx
mov qword [rsp + rdx - 0x4523fa0d], rdi
push rsi
xor dword [rsp + rsi - 0x442], r9d
neg si
jno 0x1415f420f
jne 0x1415cbbe2
mov edx, 0xca83a522
movsx esi, dx
movzx esi, byte [r8]
add r8, 1
and edx, edx
adc dl, dl
xor sil, bpl
sal dx, 0xa5
sal dx, 0xae
xor sil, 0x9f
inc sil
xadd dl, dh
xor sil, 0x84
add sil, 0x32
ror sil, 1
dec edx
bswap edx
sub sil, 0xb8
bswap rdx
call fcn.14156f300
mov edi, 0x8431abad
movsx ebx, dil
mov r9d, dword [r10]
add r10, 4
xor r9d, r8d
rol r9d, 1
movsx ecx, bl
xchg dil, cl
movzx eax, di
sub r9d, 0xd49906a5
or cx, cx
call fcn.1415d6e7e

Function at 0x14159d199
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x18]
je 0x14155f14a

Function at 0x1415aedfa
Capabilities:
Encode data using base64

Disassembly:
neg r9
jle 0x1415c13d6
sub edx, 0xbcaeca07
xor ebx, 0xd29864be
add dl, r9b
jl 0x1415ce9a1
mov dword [r11 + r10 - 0x658eb198], eax
jb 0x1415373db
mov qword [rsp + r11 - 0x658eb198], rdi
ret
sbb rcx, rcx
neg di
not dx
xor r11, 0x238b5b8
xor di, cx
push r9
add word [rsp + rcx*4 + 4], dx
xor r8w, di
sar word [rsp + rcx + 6], 0xe4
call fcn.141605d05
shl r9, 0xa4
push r8
xor dword [rsp + r11*4 - 0x14d4c], ebx
sal dl, 0x87
lea r8, [r11*4 + 0x7026c105]
not r11d
pop r8
mov eax, 0x1d95b0b0
js 0x1415db7ff
jmp 0x14160307f
xor edx, eax
movsxd rbx, ebx
jbe 0x1415e99a2
xor rdx, rax
adc rbp, rbx
mov ecx, dword [rdx + rsi - 0x4351dc80]
lea rsi, [rsi + rax - 0x1d95b0ac]
xchg r9b, r11b
xadd rax, r9
movzx edx, byte [r9 + r10 - 0x1d95b0b0]
lea r10, [r9 + r10 - 0x1d95b0af]
movzx edi, r9b
add r11b, al
xor dl, r8b
neg r11d
neg al
lea rbx, [rdi + rdi*4 + 0x260d44a3]
neg dl
ror di, 0xac
sar rbx, 0xc8
xor dl, 0x96
neg dl
xor dl, dil
xor r8b, dl
sar r9d, 0x66
call fcn.14158fc5a
xor ecx, r8d
mov qword [rsp + rdi - 0x6f364d7b], rdi
push rdi
neg edi
rol ecx, 3
shl word [rsp + 0x10], 0x21
xor ecx, 0x3d99bba6
call fcn.141600c35
movsx r9d, r11w
mov r9d, dword [r11 + r10 - 0x4f3ae694]
bswap r11d
add r10, 4
xor r9d, r8d
ror r9d, 3
bswap r9d
movsx edx, r11b
neg r9d
ror r11b, 0x27
lea rdi, [r11 + r11*4 + 0x1a1e4f37]
rol r9d, 3
movsx eax, dl
push r8
movzx ebx, dx
sar rax, 0x60
mov ecx, edi
xor dword [rsp + rdx - 0x4f], r9d
call fcn.14160f2d8
shl rcx, 0xf7
mov qword [rsp + rdx + 0x18], 0x5621ae2f
mov qword [rdx + r10], rbx
and word [rsp + rdx], ax
mov qword [rsp + rdx], r8
ret 0x30
mov eax, 0xe9a7bb3a
movzx esi, word [rbp + riz]
movzx r8d, al
movsx ecx, r8w
jmp fcn.1415e895c

Function at 0x1415b5570
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ecx, ecx
cmp ebx, 4
lea rsp, [rsp + 8]
jbe 0x1415b55a7
mov eax, 0x3d816a19
shr al, 0xc2
dec ax
lea edx, [rax - 0x3d816a01]
lea rcx, [rax + rax*2 - 0x5653bc44]
xadd rax, rcx
lea ecx, [rcx + rbx - 0x3d816a09]
shl ecx, 3
call fcn.141619c76
movzx ecx, r8w
lea rbp, [rbp + rcx*2 - 0x18b14]
neg r8
movzx eax, cl
xor edx, edi
inc edx
movsx esi, r8b
add al, ch
ror edx, 1
inc edx
movsx r11d, cl
not edx
lea r9, [r8 + rax*8 + 0xe183382]
jmp 0x141550630
Function at 0x1415b7342
Capabilities:
Encode data using base64

Disassembly:
xor r11d, ebp
mov r10d, edx
push rdx
movzx r9d, ax
inc r11d
ror dx, 4
mov qword [rsp + rax*2 - 0x206970f6], rdx
neg r11d
or dword [rsp + r9 - 0xb87a], r10d
add dword [rsp + rax - 0x1034b87e], r10d
dec al
bswap r11d
ror word [rsp + rax*2 - 0x206970f4], 4
shr word [rsp + r9 - 0xb876], 0x25
sub r11d, 0xd687d616
call fcn.14157fdc7
xor dword [rsp + rax], ecx
pop rsi
ror eax, 0x2f
bswap rdx
movsxd rcx, ecx
xor dx, r10w
bswap r11
add rbx, 0x6f97fc39
adc r8, rcx
shr ax, 0x24
jae 0x14160de46
neg rdx
xor rax, r8
jmp rax

Function at 0x1415c36e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x1e7a], r8
mov qword [rsp + rcx*4 - 0x50], rbx
pop r8
xor dword [rsp + rcx*2 - 0x28], edi
sub dx, 0x3eac
pop r8
mov eax, r9d
call fcn.141606a25

Function at 0x1415d0232
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x10]
je 0x1415e9eb2
lea rdx, [0x1415ddc80]
mov ecx, 0x2981601
movzx ecx, byte [r8 + rcx - 0x2981601]
call fcn.14157ec92
ror r10d, 3
shr rsi, 0xec
inc r10d
ror rcx, 0x26
sal cl, 0xc1
not r10d
mov edx, ecx
ror r11, 2
sar eax, 0xed
ror r10d, 3
call fcn.141551d94
mov r11d, 0xc230ea87
push r11
add word [rsp + 3], 0xafae
not esi
not byte [rsp]
neg byte [rsp + 6]
movzx r8d, r11b
mov dword [r10 + r8 - 0x87], esi
mov qword [rsp + r8*4 - 0x21c], rbx
ret

Function at 0x1415d043e
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rax - 0x46b62e94], rax
movsx esi, word [rsp + rax - 0x46b62e91]
movsxd rcx, ecx
jne 0x1415f4bee
adc rbx, rcx
or word [rsp + rax - 0x46b62e92], 0xa406
mov ecx, r8d
call fcn.14157cd4f

Function at 0x1415d0697
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r11], 0xfffffffff89da590
add rbx, r8
xchg edx, eax
sar word [rsp + rax*2 - 0x731229fc], 0xa9
rdtsc
mov r8d, 0x90ca3a7
add byte [rsp + r11 + 5], cl
lea r10, [rsi + r10 - 0x454279ae]
inc cl
and rsi, 0xffffffff8e96563c
mov dword [r10 + rsi - 0x4025020], eax
mov dword [rsi + r10 - 0x4025024], edx
xadd cl, r9b
pop r8
jae fcn.141546700

Function at 0x1415d1a0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1415389cc
mov rbp, qword [rsp + rsi + 7]
movsxd rdx, edx
jne 0x1415584a3

Function at 0x1415d5b3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, ebp
and edx, 0xff
mov edx, dword [rbx + rdx*4]
shr ebp, 8
xor ebp, edx
inc rcx
xor ebp, 0x75b0a937
dec rax
jmp 0x1415ea990
jmp 0x14155360d

Function at 0x1415d83aa
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rsi*2 - 0x2b07dffe], rdx
add rdi, r11
pop rax
movzx r11d, sil
mov rbx, qword [rbx + rsi - 0x1583efff]
ror cl, 0x43
or al, r11b
sal cl, 0xc1
jno fcn.1415d976e
Function at 0x1415d842b
Capabilities:
Encode data using base64

Disassembly:
add rdi, 0xc
jmp 0x1415c8e94
sar r10w, 0x23
not bl
ror bl, 1
xor sil, bl
jmp 0x14155de21
sar edx, 0xa2
add rbx, rsp
mov rcx, qword [rbx + r10 - 0x531ef873]
mov eax, r11d
lea rdi, [rdi + r10 - 0x531ef87b]
shr edx, 0x56
mov qword [rdi + rdx*4 - 0xf18], rcx
adc r11b, r10b
lea r9, [r9 + rdx*8 - 0x1e34]
mov r11d, dword [r9 + rdx*2 - 0x78c]
movzx ecx, al
xor r11d, esi
dec r10
rol r11d, 3
not r11d
xor r11d, 0xab920f0d
mov ebx, 0x82940299
not r11d
rol r11d, 2
xor bl, al
not r11d
jle 0x141586071
mov edx, dword [r10]
mov r11d, 0xa2818e94
add r10, 4
neg r9w
xor edx, r8d
neg edx
not edx
neg edx
movzx ebx, r9w
rol edx, 3
mov eax, r9d
not rax
sar ebx, 0x33
push r8
mov ecx, 0x4f0acc36
xor dword [rsp + rbx*4], edx
not r11b
shr eax, 0xf5
pop r8
push r11
movsxd rdx, edx
adc rbp, rdx
rol dword [rsp + rbx + 4], cl
mov rdx, qword [rsi + rbx*2]
sal r9d, 0x7f
xchg byte [rsp + r9 - 0x7ffffffa], cl
mov di, word [r9 + rsi - 0x7ffffff8]
lea rsi, [r9 + rsi - 0x7ffffff6]
rol dword [rsp + r9 - 0x7ffffffe], 0xc8
lea rbx, [rax + r11*4 + 0x6f96aa8e]
ja 0x1415ed174
xor ebx, ebx
shr qword [rsp], 0xc9
test rax, rax
lea rsp, [rsp + 8]
je 0x1415485e9
mov r11d, 0xe9f9294
push rsi
shr r11d, 0x1d
ror r11b, 0x41
jo 0x1415a82bc
lea r11, [0x141568ee0]
xor dword [rsp + 0x10], edx
not qword [rsp + 8]
movzx ebp, r11b
mov rsi, qword [rsp + rbp*2 - 0x13a]
movsx ebx, bpl
xadd word [rsp + rbp*2 - 0x142], r11w
mov qword [rsp + rbp - 0xa5], rbx
movsxd rdx, edx
mov qword [rsp + rbp*2 - 0x13a], 0xffffffffbb8853b2
add r8, rdx
neg dword [rsp + rbp*8 - 0x522]
bswap r10d
ror rbp, cl
sbb r9, 2
movzx eax, bl
pop rbx
sar bl, 0xa4
movzx ecx, word [rax + r9 - 0xa5]
xadd bp, r10w
xor cx, si
add cx, 0x9e1f
not rax
movsx edx, word [rsp + rax*2 + 0x14d]
xor qword [rsp + rax + 0xad], rbx
ror cx, 1
inc cx
and ax, word [rsp + rax + 0xb2]
xor cx, 0xcc9f
add eax, dword [rsp + rax + 0xab]
ror cx, 1
lea r11, [rbx*2 + 0x683d6086]
neg word [rsp + rax - 0x4d05ff58]
jno 0x141613945
mov ecx, 0x9599d814
mov eax, ecx
not cx
mov rcx, qword [rdi]
add ax, ax
mov rax, qword [rdi + 8]
push 0x14af4512
jne 0x141540e06
shr eax, cl
lea r11, [r9*8 - 0x6b5df343]
lea rbx, [r11 + r11 + 0x7197552f]
sar ebx, 0x89
mov dword [rdx + rsi - 0x1688], eax
dec dx
adc dl, 8
ror dx, 0xec
mov edi, dword [r10 + rdx - 0x6901]
lea rcx, [rbx + rdx*8 + 0x598cd21f]
call fcn.14157ee7e
sub r9, 1
mov edx, 0xc61fceb6
push rdx
pop rcx
movzx ebx, byte [r9]
movsx r11d, cl
bswap r11
shl cx, 0xea
xor bl, sil
mov r10d, 0x531ec39c
ror bl, 1
sub r11, r10
xor bl, 0x10
rol bl, 1
jmp 0x1415ff222
sal rdx, 0xad
xor cx, 0x6282
call fcn.1415f2c70
mov r11d, 0x4cad9510
mov edx, dword [r11 + rbp - 0x4cad9510]
lea rbp, [rbp + r11 - 0x4cad950c]
xor edx, edi
movsx esi, r11b
movsx ecx, r11b
jmp 0x14157e46f
mov word [rdx + r9 - 0x80000000], di
pop rdx
sar r11d, 0xbf
jmp rbp
neg cx
inc bl
jmp 0x1415531aa
dec cx
shr byte [rsp + rax - 0x4d05ff58], 0x23
jp 0x1415eaa63

Function at 0x1415dfaf5
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rbp + rcx*2 - 4]
movsx ebp, cl
push rbp
lea rdi, [r10 + rdi - 0x40800008]
rol bx, cl
inc qword [rsp + rcx - 2]
call fcn.1415d8eef