joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14153ed18
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x49d4f3f
sub r10, 2
movzx r9d, word [r10]
xor r9w, r11w
shl rdx, 0x81
lea rax, [rsi*8 - 0x10f7d17c]
not r9w
inc r9w
not r9w
sub rax, rax
jge 0x1415eb7f1
sal dx, 0xa1
not bpl
call fcn.1415679cd
sub r10, 1
mov r9d, 0xf8a89497
movzx ebx, byte [r10]
jmp fcn.141606d1c
sbb r9w, 0xd218
dec esi
not r9w
xor r11w, r9w
lea r9, [rsp + r9 + 8]
mov dword [r9 + rax], ecx
call fcn.14158a6bd

Function at 0x141545da6
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx - 0xd4fa], 0x220a8907
xor si, bx
sub rax, 0x7f3ffc35
sbb edi, eax
lea rbx, [rsp + rbx + 0x10]
or word [rsp + rcx - 0xd4ee], di
dec dl
mov cx, word [rbx + rbp]
lea r11, [r11 + rax + 0x7f3ffc33]
call fcn.14154c921

Function at 0x14154697d
Capabilities:
Authenticate hmac

Disassembly:
lea rdi, [rdi + rdx - 0x3998]
call fcn.14157b128

Function at 0x14154c921
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
mov word [r11 + rbp*2], cx
mov qword [rsp + rbp*2], 0xb1e1f2b
shr rax, 0x2f
sar di, 0x83
pop r9
pop rdx
pop rax
jae fcn.141591f03

Function at 0x141555ca5
Capabilities:
Authenticate hmac

Disassembly:
rol ebx, 2
mov qword [rsp + rax*2 - 0x5111c924], r11
xor dword [rsp + rax*2 - 0x5111c924], ebx
Function at 0x141556bb5
Capabilities:
Authenticate hmac

Disassembly:
mov ebp, dword [r10 + rbp*2 - 0x11215b0c]
xor ebp, r11d
mov qword [rsp], rdx
xor byte [rsp + 2], dh
bswap ebp
lea r9, [rdx + rdx*4 - 0x72c3e9df]
sbb ebp, 0xbbac05b2
movzx ebx, byte [rsp + 2]
xor ebp, 0x72a04099
mov eax, dword [rsp + rbx - 0x50]
inc ebp
pop rax
sar bl, 0x81
not ebp
ja 0x14162558f
rol ebp, 1
movzx ecx, r9w
inc ebp
movsx esi, al
ror ebp, 2
push r11
rol dl, 0xa4
add r9w, 0x97a1
lea rax, [rbx + rax*4 + 0x39200d99]
xor dword [rsp + rbx - 0x29], ebp
or rbx, rbx
pop r11
push r9
mov dword [rdi + rbx*2 - 0x56], ebp
movsx ebp, bx
xadd edx, esi
pop rbx
mov ebp, dword [r10 + rcx*4 - 0x1e6dc]
lea r10, [r10 + rcx*8 - 0x3cdb0]
dec r9
xor ebp, r11d
ror ebp, 3
lea ebp, [rbp + rcx*4 + 0x7303d467]
push rbx
and rbx, rax
neg ebx
xor ebp, 0x159bffac
shr dl, 7
not ebp
not word [rsp + rcx - 0x79b5]
lea r9, [rsi + rbx + 0x38aaa28c]
call fcn.1415b4ca8

Function at 0x141556c13
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdi], rsi
lea rdi, [rdi + rdi + 0x2a75113]
mov esi, edi
call fcn.14161da2a
push rsi
push rsi
lea rdi, [rdi + rbx - 0x67ac9dc1]
mov dword [rdi + rbx - 0x67ac9db5], eax
dec bp
mov dword [rdi + rbx - 0x67ac9db9], edx
push rbp
pop rsi
pop rcx
pop rbx
jne fcn.1415ef7a2
xor dword [rsp + rax - 0x53d8], edx

Function at 0x14155df7c
Capabilities:
Authenticate hmac

Disassembly:
mov dword [rsp + rdx*2 - 0x710ba467], r9d
lea r8d, [r8 + rdx*2 + 0x1bfa0315]
and esi, 0x4e8d8295
inc word [rsp + rdx - 0x3885d22a]
setae r9b
neg r8d
sub r8d, 0x9223c4a7
mov qword [rsp + rdx - 0x3885d22d], rbx
xor dword [rsp + rdx*2 - 0x710ba46a], r8d
movsx ecx, ax
pop rbx
mov rbx, qword [rsp + rdx - 0x3885d235]
shl dl, 1
movsxd r8, r8d
je 0x141593ebb
mov qword [rsp + rsi - 0xe8d0200], 0xffffffffd0b03307
mov qword [rsp + rdx*2 - 0x710ba4ec], rdx
adc r10, r8
neg word [rsp + rdx - 0x3885d275]
mov rax, qword [r11 + rdx - 0x3885d27a]
jnp 0x1415bb56d
shl r9b, 1
movsx eax, r9b
mov esi, dword [r10 + r9 - 0x188f376e]
dec ax
xor esi, r11d
mov ebp, eax
or rax, rbp
not esi
push rax
mov ecx, r9d
jne 0x1415b2e7b
mov rcx, qword [r11 + rdx - 0x3885d272]
jno 0x1415c5baf
rol r9b, 0x61
or rax, rcx
rol sil, 0x86
mov qword [rdx + r11 - 0xe8d0200], rax
bswap rdi
mov qword [rsp + rdx*2 - 0x1d1a0400], r10
ret 0x10
xchg rdx, rsi
mov r8d, dword [rsp + rdx*2 - 0x1d1a03fd]
lea r11, [r11 + rdx*2 - 0x1d1a03f8]
ror word [rsp + rdx*2 - 0x1d1a03fd], 0x2f
push rdx
not rax
not rcx
adc sil, 0x24
jp 0x1415bf074
mov edi, 0x11328d22
shl di, 0x81
movsx r10d, di
mov rdi, qword [rbp + rdi*2 - 0x22643488]
lea rcx, [r10*2 + 0xf2bee3c]
lea r9, [r10 + r10 + 0x52aa8104]
mov dl, byte [rbp + r10 - 0x1a3c]
ja 0x141625d69
lea rbp, [rbp + r10*2 - 0x347e]
sub cx, r10w
rol r9, 6
mov byte ss:[rcx + rdi - 0xf2c0880], dl
movzx r8d, cx
call fcn.1415818c0
Function at 0x14155e3c2
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx - 0x10000], rax
rol r9d, 0xf1
ror edx, 1
inc rdi
neg dword [rsp + rcx*8 - 0x7fffd]
setae al
xor edx, esi
sub al, sil
pop r8
mov qword [rsp + rcx*2 - 0x20000], rbx
xor dword [rsp + rcx - 0x10000], edx
push r9
not dword [rsp + rcx - 0xfffe]
mov rbx, qword [rsp + rcx*4 - 0x3fff8]
mov qword [rsp + r9 - 0x151e9e59], rsi
dec eax
movsxd rdx, edx
shr rcx, 0x5c
sub dword [rsp + rcx*2 + 0xb], 0x8298128d
or byte [rsp + rcx + 5], ch
adc r10, rdx
push r9
pop rcx
pop rdi
pop rsi
jmp fcn.1416256a7

Function at 0x141560e6d
Capabilities:
Authenticate hmac

Disassembly:
pop rbx
sub dil, cl
movsxd rdx, edx
sar ax, 0xcf
neg rcx
add r10, rdx
call fcn.141579541
neg edx
sar cx, cl
xor edx, 0x9b958b9c
inc edx
mov qword [rsp + rdi - 0x8527e12], r8
ror edx, 1
inc rcx
pop rcx
push rbx
xor r9, 0x11222e3b
jle 0x1415c28aa
xor dword [rsp + rdi - 0x8527e12], edx
movsx ebx, cx
jmp 0x141544e6e
Function at 0x14157c130
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xffffffffd4b31d05
sub r11, 1
movzx eax, byte [r11]
xor al, sil
inc al
jmp 0x1415a4f3b
lea r9d, [r9 + rdx*8 + 0x682d78ff]
rol edi, 0x8a
jae 0x1415ed573
mov r9d, dword [rbp + riz]
mov ecx, 0x9d1ca299
movzx eax, cx
lea rbp, [rax + rbp - 0xa295]
mov edi, 0x6309231e
xor r9d, ebx
push rcx
movzx esi, cl
dec al
dec r9d
jmp 0x141557fa4
inc word [rsp + 2]
ror al, 1
neg al
inc al
mov edi, 0x722b942c
neg al
shr word [rsp + rdi - 0x722b9427], 0xc8
dec al
movsx r8d, di
neg al
movsx r10d, di
not r10b
xor sil, al
lea rax, [rsp + rax + 8]
jmp 0x141603926
adc rbx, r9
call fcn.1415b182b
sub r10, 4
movzx ebp, dl
sub ebx, ebx
movsx ecx, dl
mov esi, dword [r10 + rbx*2]
movzx eax, dl
lea rbp, [rbx*2 - 0x30cd684d]
xor esi, r11d
inc rax
lea esi, [rsi + rbp*2 - 0x700aea93]
movzx ecx, sil
mov word [rdi + rsi - 0xd59], dx
movzx eax, word [rsp + rsi - 0xd5b]
lea rbp, [rsi + rdi - 0xd59]
dec sil
mov qword [rdi + rsi - 0xd60], rbp
jg 0x1415e8b0d
push rdx
mov qword [rsp + rdi*2 + 8], rsi
push rdx
movsx ecx, di
xor dword [rsp + rdx - 0x2cc4], r9d
sal rcx, 0x35
mov rsi, qword [rsp + rdx*8 - 0x16690]
mov qword [rsp + rdx - 0x2cc4], rdi
add word [rsp + rdx*2 - 0x599c], 0x78b0
movsxd r9, r9d
jnp 0x1415a8f12
mov r9d, 0xe9b1e29
mov ebp, dword [r11 + r9*2 - 0x1d363c52]
movsx edi, r9b
mov ecx, r9d
lea r11, [r11 + r9*2 - 0x1d363c4e]
ror rdi, cl
movzx edi, byte [r10 + r9 - 0xe9b1e29]
sar cx, cl
movsx edx, r9w
lea r10, [r10 + r9 - 0xe9b1e28]
ror ecx, 0x82
xor dil, sil
push rdx
movzx eax, byte [rsp + r9*2 - 0x1d363c50]
ror dil, 1
jmp 0x1415b7bea
movzx edi, r9w
rol r10, 0xd0
mov r9d, dword [r11 + rdx*8 - 0x166a0]
movsx eax, word [rsp + rdx*2 - 0x59a5]
not word [rsp + rdx - 0x2cd4]
xor r9d, esi
shr word [rsp + rdx - 0x2cd0], 0x6a
sets dil
neg qword [rsp + rdx*4 - 0xb350]
dec r9d
not word [rsp + rdx - 0x2ccf]
ror r9d, 1
lea r9d, [r9 + rdx*2 - 0x26061767]
xor ax, ax
inc word [rsp + rdx - 0x2ccf]
ror byte [rsp + rdx - 0x2ccd], 0x86
rol r9d, 1
jmp 0x14160c928
mov dword [rsp + rdi - 0x722b9428], r8d
movzx r9d, r10w
mov edi, dword [rdi + rax - 0x722b942c]
movzx edx, word [rsp + r9 - 0x94d0]
dec r8b
sal word [rsp + r9*2 - 0x129a0], 5
lea rbp, [r9 + rbp - 0x94d7]
sbb word [rsp + r9*2 - 0x129a4], 0x2720
adc r9, qword [rsp + r9 - 0x94d3]
mov dword [rbp + rdx*8 - 0x166a0], edi
lea r10, [r9 + r8*2 - 0x12548af7]
lea r11, [r11 + rdx - 0x2cd8]
jl 0x1415f0cdd
ror rdi, 0x9d
jae 0x14159e865
xor eax, ebx
neg eax
xor r9w, r8w
bswap eax
call fcn.1415be7ca
not dx
movsx ebx, word [rsp + rsi*4 - 0x6ad7]
not r9w
shr si, 0x21
or dx, r9w
movzx r9d, sil
jmp 0x1415b2b7f

Function at 0x14157e467
Capabilities:
Authenticate hmac

Disassembly:
jo 0x141603413
bswap edx
lea rbx, [rax*2 + 0x1ead6601]
xor edx, 0x1e823806
mov qword [rsp + rcx - 0x3c], rbx
xadd ecx, eax
inc edx
shl esi, cl
jb 0x14158276f
rol edx, 1
xchg qword [rsp + 8], rcx
add rcx, 0xfffffffffffd895a
jmp rcx

Function at 0x14157e4f6
Capabilities:
Authenticate hmac

Disassembly:
movzx r8w, byte [rbp + r10 - 0x4ab62d14]
dec r9d
pop rdx
mov cl, byte [rbp + rcx - 0x12]
call fcn.141621d59
Function at 0x141582621
Capabilities:
Authenticate hmac

Disassembly:
test ebx, ebx
lea rsp, [rsp + 8]
je 0x1415ab42f

Function at 0x141585c58
Capabilities:
Encode data using base64

Disassembly:
movsxd rbp, ebp
adc r8, rbp
mov rbp, qword [rdi + rbx - 0xfbb2f92]
add dx, 0xe927
mov qword [rsp + rbx*2 - 0x1f765f1c], r9
mov rbx, qword [rdi + rbx - 0xfbb2f8a]
shl edx, 0x5a
pop rdx
adc eax, dword [rsp + 3]
lea rdi, [rdi + rax - 0x21eac120]
pop r9
adc rbp, rbx
inc eax
mov qword [rdi + rax - 0x21eac129], rbp
call fcn.1415fcf0c
inc ecx
rol ecx, 2
inc ecx
xor dx, 0xc297
push r11
add ax, bx
jge 0x14160eea7
jno 0x1415569e0
bswap ebp
xor r9b, al
lea rcx, [r9 + rbx*8 - 0x953edf8]
not ebp
lea ebp, [rbx + rbp - 0x206d96b4]
xor ebp, 0xbabc63bc
mov qword [rsp + rbx - 0xfbb2f92], r11
movsx edx, r9b
push rsi
xor dword [rsp + rbx*2 - 0x1f765f1c], ebp
rol word [rsp + rbx - 0xfbb2f8f], cl
and dx, word [rsp + rbx - 0xfbb2f91]
seto r9b
mov r11, qword [rsp + rbx - 0xfbb2f8a]
jnp 0x1415827d0
movsxd rcx, ecx
call fcn.14153d02a
mov rcx, qword [r11]
mov edx, 0xe8b5459f
lea rbp, [rdx + rdx + 0x1a23ee92]
mov edx, dword [r11 + 8]
movsx r9d, bpl
mov edi, r9d
and bp, r9w
adc r11, 0xc
not r9w
lea r9, [rdi*4 + 0x270be702]
sal dil, 0x84
mov dword ss:[rcx], edx
movzx ecx, bp
sub cl, 2
mov ebx, 0xf2ba8017
mov ebp, dword [r10 + rcx*2 - 0xf39c]
mov edx, r9d
call fcn.14162751b
adc r9w, 0xcb13
xor dword [rsp + rbx*8 - 0x2a195768], ecx
add rax, rax
pop r11
jno 0x14160e49e
push 0x5d91960b
lea rsp, [rsp + 0x10]
jbe 0x1415e7f4b
mov edx, 0x2fb9dab7
lea edx, [rdx - 0x2fb9dab3]
jmp 0x1415e7f48

Function at 0x14158690d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rdi - 0x6066c6], 0x2a92a401
xor word [rsp + rdi*4 - 0x1819b13], 0x9fb6
pop rdx
jle fcn.1415e2905
add byte [rax], al
add byte [rax], al
add byte [rax], al
sub byte [rdx - 0x54], bl
fdivr qword [rsi + 0x4abab6a]
cmp esp, dword [rdx - 0x5af46dce]
xor dword [r14 - 0x5158243f], r11d
invalid

Function at 0x141587e10
Capabilities:
Authenticate hmac

Disassembly:
pop r9
pop rbx
pop rcx
pop r9
pop rax
jns fcn.1415ef7a2
mov eax, 0xb223ac09
mov sil, byte [rdi + 8]
push rax
add rdi, 0xa
mov ebx, dword [rsp]
mov byte [rbp + riz], sil
call fcn.14161e15f

Function at 0x14158a279
Capabilities:
Authenticate hmac

Disassembly:
test rdi, rdi
push 0x68eeb0c
push 0x188c0db3
jmp 0x141607fed
lea rsp, [rsp + 0x28]
je 0x1415eca80
call fcn.141628c14

Function at 0x14158edd1
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x10]
and rsp, 0xfffffffffffffff0
call fcn.14160f38f
bswap edi
inc byte [rsp + rax*2]
movzx ecx, word [rsp + rax - 2]
not edi
pop r9
push rsi
lea rsi, [rcx + r9*4 - 0x70436dee]
movzx ebx, ax
sar ecx, 0xde
xor dword [rsp + rax - 2], edi
call fcn.1415fd306
Function at 0x141596b10
Capabilities:
Encode data using xor

Disassembly:
movzx edi, r8b
mov rdi, qword [rbp + rdi - 0x1f]
mov qword [rsp], r8
add byte [rsp + 5], r8b
mov r8, qword [rbp + 8]
adc rbp, 0xc
xor ecx, ecx
push 0x4a11bb3c
test r8, r8
lea rsp, [rsp + 0x10]
je 0x1415f486c
jmp 0x1415b19f9
mov r9d, 0xc8bb631b
dec r9d
push rbx
lea r9, [0x1415f6fc8]
movzx ebx, byte [rdi]
xor ebx, ecx
push 0xffffffffb9bbd127
and ebx, 0xff
mov ebx, dword [r9 + rbx*4]
shr ecx, 8
xor ecx, ebx
xor dword [rsp], 0xc6a3cb14
inc rdi
xor ecx, 0x8e8b6783
dec r8
lea rsp, [rsp + 8]
jne 0x1415b1a0a
call fcn.14157f71d
bswap ecx
movzx edi, word [rsp + rbp + 5]
shl r9w, 0x24
xor ecx, 0x4b36f590
rol ecx, 2
push rbp
lea rdx, [rbp*8 - 0x5ae4d5d4]
sal qword [rsp + rbp + 0x18], 0x6d
dec ecx
xchg edx, r9d
lea rbp, [rbp + rbx - 0xd5fdac5]
add qword [rsp + rbp*4 + 0x357f6b2c], rsi
xor dword [rsp + rbp + 0xd5fdadd], ecx
sal eax, 0x21
mov rsi, qword [rsp + rbx + 0x18]
shl bpl, 0xa3
movsxd rcx, ecx
jnp 0x14161e61d
sub r9, r9
adc r8, rcx
xadd di, bx
xor qword [rsp + rbp + 0xd5fda28], r8
ret 0x18

Function at 0x141598171
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea r11, [r11 + rbp*2 - 0x20000]
neg edx
mov word [rdx + r11], di
pop r9
pop rdx
pop r9
jns fcn.141591f03
mov ecx, dword [r10 + rcx*2 - 0xefb9010]
jae 0x1415d9f03
and dword [rsp + rdx*2 - 0x17239], r9d
lea ecx, [rcx + rdx*4 - 0x19a823b3]
xor ecx, 0x583cad22
add byte [rsp + rdi - 0x6ab9b917], r9b
bswap ecx
lea r10, [r9*8 + 0x1385d21e]
not word [rsp + rdi - 0x6ab9b919]
ror ecx, 2
sar r10, 0x14
mov qword [rsp + rdx*2 - 0x1723a], rsi
xor dword [rsp + rdx*2 - 0x1723a], ecx
call fcn.1415fb7a7
jnp 0x141561caa
jne 0x1415d7fa6
push 0xffffffffef8df430
sub r11, 4
mov edi, 0x6ab9b91d
mov ecx, dword [r11 + rdi - 0x6ab9b91d]
movzx edx, di
mov r9d, dword [rsp + rdi - 0x6ab9b91b]
xor ecx, esi
jmp 0x14155a74b
xor dword [rsp + rbp - 0x7b], edi
mov rsi, qword [rsp + rbp - 0x7b]
shr ebp, 0x19
movsxd rdi, edi
push rcx
dec bp
adc r8, rdi
mov qword [rsp + rbp*2 - 0x1fff6], 0x24910527
movsx r9d, bp
mov rdi, r11
shr cl, 0x84
jne 0x14153ea0d
mov ecx, 0x3bee404
add rcx, rcx
jnp 0x14155a63e

Function at 0x14159d3b0
Capabilities:
Authenticate hmac

Disassembly:
adc byte [rsp + 0x23], 0xa5
pop rdi
pop r9
pop rax
pop rsi
pop rax
pop rcx
pop rax
jbe fcn.1416256a7

Function at 0x14159f962
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
movsx r9d, bx
bswap eax
ror eax, 1
shl bp, 0xae
mov qword [rsp + rbp*4 - 0x6c710000], rbx
mov edx, ebp
not eax
rol byte [rsp + rbx - 0x1b1c58b3], 0x83
ja 0x1415e9c7d
Function at 0x14159f988
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov rdi, r9
push 0xffffffff862eba96
cld
xor qword [rsp], 0xffffffffa333558c
call fcn.141540a2a
mov eax, 0x778c4705
neg ax
sar eax, 0xa
mov rax, qword [rbp + rbx*8 + 0x20]
ja 0x141628a31
setge byte [rsp + rcx + 0x5ad3d6ed]
xchg qword [rsp + r9*8 - 0x1bda0], rsi
bswap eax
not eax
lea eax, [rax + r9 - 0x10b29ed6]
sub word [rsp + rbx*4 - 0x2cf], 0x71ba
sal word [rsp + r9 - 0x37ae], 0x65
xor eax, 0xbabc63bc
mov qword [rsp + r9*2 - 0x6f68], r11
lea rcx, [rcx + rdx - 0x5bc35b4b]
mov ebp, 0xcb88bfbd
xor dword [rsp + r9 - 0x37b4], eax
pop r11
movsxd rax, eax
neg rcx
setno sil
lea rdx, [rbp + rbp*4 - 0x5d74b77d]
add r8, rax
sal r9w, 0xcb
xor rcx, 0xffffffffe02efc87
jl 0x1415a617d
push rax
lea rax, [rsp + 8]
mov esi, 0x4e160e02
movsx ecx, sil
push rsi
lea ecx, [rsi - 0x4e160cf2]
add word [rsp + rsi - 0x4e160e01], si
mov r9d, esi
mov qword [rsp + r9 - 0x4e160dfa], rsi
lea r9, [r9 + rdi - 0x4e160e82]
and r9, 0xfffffffffffffff0
shl esi, 0xb0
sbb r9, rcx
push rsi
jmp 0x1415f6f76
jmp r8
pop rsi
mov rsp, r9
push rsi
lea rsi, [rsi + rsi*2 - 0x55d7086a]
mov qword [rsp + rsi + 0x2bd1086a], rdi
mov edi, 0x9309d301
pushfq
bswap rdi
mov rsi, rax
jmp 0x1415480c5
jns 0x14158b844

Function at 0x1415a101d
Capabilities:
Encode data using xor

Disassembly:
test rsi, rsi
lea rsp, [rsp + 0x10]
je 0x1415a1080
mov eax, 0xbfa9caaa
push r11
lea r11, [0x141552698]
movzx eax, byte [rdx]
push 0xffffffff9587353f
xor eax, edi
and eax, 0xff
mov eax, dword [r11 + rax*4]
shr edi, 8
shr dword [rsp], 0x33
xor edi, eax
inc rdx
xor edi, 0xd1206a1e
xor dword [rsp + 1], 0x37b3aa2f
dec word [rsp + 6]
dec rsi
lea rsp, [rsp + 8]
jne 0x1415a1039
mov eax, 0x9fb82f92
pop r11
mov ecx, 0x2a92ef3e
lea rax, [rcx + rcx*2 - 0x65b836d]
call fcn.1415706e1
mov ecx, 0x2e894197
movsx ebp, cx
call fcn.141624269
or r9w, r10w
dec edx
mov r8d, ecx
rol edx, 1
inc edx
lea rax, [r10 + r9*8 + 0x29a1f1e]
lea rdi, [r9 + 0x5e96952c]
sar r8b, 0x43
rol edx, 1
bswap edx
push rsi
sal eax, cl
xor dword [rsp + r10 - 0x50865758], edx
shl r9, 0x1c
pop rsi
dec r8
sar r10w, 0x6d
movsxd rdx, edx
adc cl, 0xb9
add cx, 0xa580
lea rcx, [rdi + 0x3619158f]
add rbx, rdx
lea r8, [r9 + rax + 0x471336b7]
jmp rbx

Function at 0x1415b1551
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax - 0xb3], rax
ror edx, 1
sar bpl, 3
add word [rsp + rax*2 - 0x15f], di
bswap edx
sub byte [rsp + rax - 0xb2], al
mov qword [rsp + rdi*4 + 0x10], rsi
xor dword [rsp + rax*2 - 0x156], edx
ror dword [rsp + rdi + 7], 0xf6
lea rcx, [rbp*2 + 0x2bb94192]
mov rsi, qword [rsp + rax*2 - 0x156]
movsxd rdx, edx
sbb rbp, 0xffffffffeb29652f
push rdi
movsx r9d, di
add r8, rdx
mov qword [rsp + rax - 0x9b], rcx
bswap r9
rdtsc
shr di, 0xcd
jbe 0x14161eef3
lea r11, [r11 + r9*8 - 8]
mov dword [r11 + rdi + 4], eax
xchg rdi, r9
mov dword [rdi + r11], edx
pop r9
pop rdi
pop rbx
pop rcx
jp fcn.141591f03
Function at 0x1415bc403
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffee0123b1
sub r11, 4
mov edx, dword [r11]
mov r9d, 0xf38582a5
jmp 0x1415ba0c1
pop r9
xor ebp, r11d
and rsi, rax
bswap ebp
lea r9, [rsi*4 - 0x6177e9d1]
inc si
sbb ebp, 0xacb4929c
xor esi, 0x94b39a96
bswap ebp
xor al, 0x2e
jnp 0x1415e7e40
jmp 0x141559cf5
dec ebp
push r11
push rax
call fcn.1415ea3f3

Function at 0x1415c3edf
Capabilities:
Authenticate hmac

Disassembly:
rol esi, 1
push rdx
sar r8w, 0xc5
dec esi
call fcn.1415b871e
jmp 0x1415f0d66
mov qword [rsp + r8 - 0x58499580], rbx
ret 8
lea r10, [r10 + rcx*4 - 0xd0]
movzx eax, bx
movsx ebp, bl
xor edx, esi
movzx r9d, cx
sub cl, 0x80
neg edx
dec edx
rol al, 0xc2
neg edx
jmp 0x1415fd910
xadd cl, r9b
push rbp
not edx
sub rbp, rbp
xor edx, 0x62014615
shl qword [rsp + rcx*8 - 0x750], cl
neg r9d
mov qword [rsp + rcx*4 - 0x3a8], rsi
inc cx
movsx edi, bl
rol cl, 0xe6
xor dword [rsp + rcx - 0xfa], edx
pop rsi
shr rbp, 0xf4
not bl
not r9b
movsxd rdx, edx
adc r8, rdx
movzx edx, bl
push rdi
mov bx, word [rbx + r10 - 0xca]
pop r9
lea r10, [r10 + rcx - 0xf8]
xor bx, si
and edi, edi
or dil, dil
adc bx, 0x9812
xchg ch, al
push rdx
rol bx, 1
jmp 0x141608bf0
not dword [rsp + rcx - 0xd4fa]
sub bx, 0x8a9a
xchg dword [rsp + rcx*4 - 0x353e8], edx
not bx
call fcn.141545da6
jbe 0x1415ddd1c

Function at 0x1415c49df
Capabilities:
Authenticate hmac

Disassembly:
lea r11, [r11 + r10 - 0x4d3682a5]
mov r9d, dword [r11 + r10 - 0x4d3682a1]
xor r9d, esi
mov r8d, r10d
sub r9d, 0xae0f3033
xor r9d, 0xba9da63c
mov edi, 0x61155628
mov qword [rsp + r10 - 0x4d3682a1], 0x13977a3b
bswap r9d
inc r9d
not r9d
jmp 0x1415c86f9
mov qword [rsp + r10 - 0x4d3682a1], rsi
movzx esi, r10w
movsx ecx, r10w
xadd r10d, r8d
xor dword [rsp + rsi*4 - 0x20a84], r9d
call fcn.1415fc90d

Function at 0x1415cb182
Capabilities:
Authenticate hmac

Disassembly:
lea r10, [r10 + rbp - 0x50e04733]
jle 0x1415a12a6
xor edi, esi
movsx edx, r9w
dec rbp
sub edi, 0xab90cd26
xor edi, 0x3cb57f90
or r9w, 0x8e0d
sal r9d, 0x5f
lea edi, [rdi + rbp*4 - 0x6e5774bf]
xor edi, 0x840bdf13
add ebp, 0xe11ba8b6
lea rbp, [r9 + rax*4 - 0x52fc6252]
shr edx, 0x5c
mov qword [rsp + rdx + 1], rsi
xor dword [rsp + r9 - 0x7ffffff0], edi
mov rsi, qword [rsp + r9 - 0x7ffffff0]
and bl, bpl
movsxd rdi, edi
pop rbp
adc r8, rdi
pop rdx
sar r9d, 0x18
push rbx
pop rbp
pop r9
js fcn.141591f03

Function at 0x1415d07f6
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 1
jmp 0x141590321

Function at 0x1415d27ea
Capabilities:
Authenticate hmac

Disassembly:
push 0x488f9382
lea rsp, [rsp + 8]
sub rsp, rcx
push 0x13cbb32
call fcn.14158edd1
mov edi, 0xa192ef19
movzx ax, byte [r11]
mov bpl, byte [r11 + 2]
add r11, 2
lea rcx, [rdi + rdi*4 + 0x6f97458a]
movsx edx, cl
lea r9, [rdi*8 - 0x1f4ee25b]
or al, bpl
not al
add cx, di
inc r9d
shr r9b, 2
mov word [rdx + r11 - 7], ax
mov edx, dword [rdx + r10 - 7]
call fcn.1415837a0
lea rsp, [rsp + 0x10]
mov qword [rbp + riz - 0x10], rsp
jmp 0x14153d153
Function at 0x1415d2bc2
Capabilities:
Authenticate hmac

Disassembly:
adc r8, rbx
movsx ebx, bpl
mov bp, word [r11 + rbp*4 - 0x1de40]
shr eax, cl
not r9d
mov cl, byte [r11 + rcx*2 + 0x5a7fb594]
inc rax
push r9
xor dx, dx
lea r11, [rdx + r11 + 0x1c800002]
inc r9d
lea rdx, [rdx + r9*4 - 0x4ff7015b]
and di, di
shr bp, cl
call fcn.1415d5667
mov edi, 0xed82801f
mov ebp, dword [r10]
mov ebx, edi
bswap edi
call fcn.14155db85
mov qword [rsp + r9 - 0x45ad773b], r9
lea rdi, [r9 + rdi - 0x45ad7739]
not ax
shr bp, 0x26
not cx
lea rdx, [r9*2 + 0x6f27aa91]
setb dl
and ax, cx
mov word [rbx + rdi - 0x45ad773b], ax
and bpl, bpl
inc byte [rsp + rbp]
jp 0x1415e0f74
lea r10, [rbp + r10 - 4]
push rbp
mov eax, 0xf8a0f0b5
sar byte [rsp + r9 - 0x45ad7739], 0x47
mov edx, dword [r9 + r10 - 0x45ad773b]
call fcn.14159a07c
lea r9, [rdi + rcx*2 + 0x829e536]
xchg ch, cl
not ebx
shr ebp, 0xf2
inc r9b
dec ebx
not cx
xor ebx, 0x951b8718
mov edx, ecx
inc edi
rol ebx, 1
push rbp
inc rdx
bswap ebp
sub ebx, 0x9793d021
lea rax, [rdx*4 - 0x2d435ec1]
xor qword [rsp + rdi - 0x513640b6], rsi
xor dword [rsp + rdi - 0x513640b6], ebx
ror ecx, 0xbd
sar r9d, 0xb7
adc bp, 0x778f
pop rsi
add rcx, rax
movsxd rbx, ebx
xor rax, 0x313df90d
or rdx, rax
jae 0x14158f843

Function at 0x1415dddb1
Capabilities:
Encode data using base64

Disassembly:
setb r10b
neg rcx
movsxd r8, r8d
add rbx, r8
mov rdi, rbp
lea rbp, [rax + rbp - 0x5ea2df20]
mov qword [rsp + r9 - 0x6a], 0x5a8e1030
rol edx, 0x8a
mov qword [r9 + rbp - 0x7a], rdi
mov qword [rsp + rax - 0x5ea2df10], rcx
pop rdx
pop r9
pop rdx
jae fcn.1415e2905
mov edi, 0x17068581
movzx r8d, di
mov rdi, qword [rdi + rbp - 0x17068581]
mov r8, qword [r8 + rbp - 0x8579]
mov r9d, 0x1218a58a
movsx edx, r9b
lea rbp, [rbp + r9*2 - 0x24314b0c]
xadd rdx, r9
movsx r10d, dx
movsx eax, r10w
not rdi
xadd r10d, eax
not r8
jl 0x1415d98db

Function at 0x1415df614
Capabilities:
Authenticate hmac

Disassembly:
dec rbp
sub dil, 2
rol dword [rsp + rbp - 0x88], 0xef
or word [rsp + rbp*8 - 0x47f], dx
not dil
mov qword [rsp + rbp - 0x91], 0xffffffffc080b390
shl dword [rsp + rbp*4 - 0x23a], 0xb7
xor sil, dil
call fcn.1415b5cf4
Function at 0x1415f1577
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, byte [rsi + rdi - 0x827c]
jg fcn.141604f2e
jg 0x14160b158
sub eax, eax
lea rdi, [rdi + rax*2 + 4]
call fcn.14159b782
mov ebx, 0x7496f281
mov ebp, 0xdd904518
xadd bp, bx
mov rcx, qword [rdi + rbx - 0x74964518]
lea rdi, [rdi + rbx - 0x74964510]
movsx esi, bx
movzx r9d, si
lea r10, [rbx + r10 - 0x7496451a]
mov si, word [r10 + rbx - 0x74964518]
mov edx, ebx
setb bl
xor si, r11w
ror si, 1
shr rbx, 0x6c
xor si, 0x19b7
inc si
neg si
shr r9b, 0x63
xor dword [rsp], r9d
pop r11
bswap ecx
movzx esi, dx
movsxd r9, r9d
add r8, r9
jmp 0x141616ef9
inc r9d
mov ecx, ebp
neg bx
ror r9d, 1
mov qword [rsp], rbp
inc word [rsp]
xor r9d, 0x6997489e
xadd ebx, eax
rol dword [rsp + rbx*2 - 0x6dbd5698], 0xc8
shl dl, 2
dec r9d
ror r9d, 2
sar byte [rsp + rbx - 0x36deab47], 0xe1
sbb ebx, 0x7e8dda9a
shr byte [rsp + 4], 0x22
mov qword [rsp], r11
jae 0x141588c2e
bswap ebp
or esi, 0xdb802f85
ror ecx, cl
movsx ebx, word [rsp + r9 - 0xb9423a2]
rol ebp, 1
or word [rsp + r9 - 0xb9423a5], r9w
xchg qword [rsp + r9 - 0xb9423a5], rbx
mov qword [rsp + r9*2 - 0x1728474a], r11
xor dword [rsp + r9 - 0xb9423a5], ebp
or bl, cl
sar ecx, 0xee
sbb si, bx
pop r11
or rdx, rbx
setb dl
inc si
movsxd rbp, ebp
cmovge bx, cx
adc r8, rbp
not dx
xchg dx, cx
xadd rbp, rdx
mov bx, word [rdi + rsi - 0x9e84]
cmovge bp, dx
lea rcx, [rcx + rsi - 0x495cdfea]
not ecx
mov dx, word [rdi + rsi*8 - 0x4f41e]
and si, cx
ja 0x141548d2f

Function at 0x1415fc42e
Capabilities:
Authenticate hmac

Disassembly:
lea rdi, [rcx + rdi - 4]
mov qword [rsp + rcx], rbp
mov dword [rdi + rcx*4], edx
call fcn.14159379a
push 0xffffffffd8377096
jmp 0x141556ba6

Function at 0x141600675
Capabilities:
Encode data using xor

Disassembly:
jmp 0x15b160183
in eax, 0xb3
jnp 0x140da216f
popfq
cmpsd dword [rsi], dword [rdi]
adc ecx, 0x91d755b1
invalid
push rsi
pushfq
movabs rsi, 0x7db6738330b2f30c
mov rsi, qword [rsp + 8]
xor byte [rbx + 0x487db673], al
mov esi, dword [rsp + 8]
mov qword [rsp + 8], 0x58426773
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1415a1323
imul dword [rdx + 0x49]
out 0xfe, eax
xchg edi, eax
push rax
adc ah, dh
jns 0x140da2206
out 0x83, eax
out 0x2f, eax
sbb ch, byte [rbx]
in eax, 0xeb
in eax, dx
in al, 0xb3
mov byte [rdx - 0x786be5f6], ah
mov r13d, 0x2e16441e
cld
cmp eax, esp
wait
jae 0x140da21e0
sbb dword [rdx], 0x120b254c
push rsp
mov esp, 0xef8a2f04
pop rbx
sbb dword [rax], eax
sbb byte [r10 + r14*8], r14b
wait
fist word [rbx]
hlt
mov qword [rsp], 0x1f992a15
movsxd rcx, ecx
adc r8, rcx
lea rsp, [rsp + 8]
jmp 0x140da21ff