joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d480
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x3f0
lea rcx, str.UNLOAD.TXT
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14001d510
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [0x140063d10]
mov qword [0x140063ae0], rax
cmp qword [0x140063ae0], 0
je 0x14001d510
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400092c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140063ae8], rax
cmp qword [0x140063ae8], 0
je 0x14001d4f8
jmp 0x14001d510
mov rcx, qword [0x140063ae0]
call qword [0x140063d08]
mov qword [0x140063ae0], 0
cmp dword [0x14005ebe0], 1
jne 0x14001d5fc
call fcn.140019030
cmp eax, 1
jne 0x14001d5fc
mov qword [rsp + 0x1d8], 0
mov dword [rsp + 0x1d0], 0
lea rdx, [rsp + 0x1d0]
lea rcx, [0x14005cf20]
call fcn.14000ed20
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
je 0x14001d5fc
xor eax, eax
mov word [rsp + 0x1e0], ax
lea rax, [rsp + 0x1e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, str.Runtime_Broker.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1d8]
lea r8, str.__s_s_
mov edx, 0x104
lea rcx, [rsp + 0x1e0]
call fcn.14002356c
mov eax, dword [0x14005ec84]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14005ec80]
mov dword [rsp + 0x20], eax
lea r9, [0x14005ec32]
lea r8, [0x14005ebe4]
lea rdx, str.0BCBAC7A_800C_46ED_BA75_9F3CAE586B1F
lea rcx, [rsp + 0x1e0]
call fcn.140006af0
mov rcx, qword [rsp + 0x1d8]
call qword [0x140063d08]
cmp dword [0x14005ebd4], 0
jne 0x14001d60a
call fcn.14000ea10
cmp dword [0x14005ebd8], 1
jne 0x14001d618
call fcn.14000e690
cmp dword [0x14005ebd4], 1
jne 0x14001d626
call fcn.140017490
mov ecx, 0x15
call fcn.140004a80
cmp dword [0x14005d510], 1
jne 0x14001d6a2
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140063af8], rax
cmp qword [0x140063af8], 0
je 0x14001d6a2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14000d410]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140063b00], rax
cmp qword [0x140063b00], 0
je 0x14001d695
jmp 0x14001d6a2
mov rcx, qword [0x140063af8]
call qword [0x140063ce0]
lea rdx, [rsp + 0x30]
mov cx, 2
call qword [0x1400645c8]
test eax, eax
jne 0x14001d72d
cmp dword [0x14005cddc], 1
jne 0x14001d6ea
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140018320]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400648b0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140020f90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140064da0], rax
cmp qword [0x140064da0], 0
je 0x14001d727
mov eax, 1
jmp 0x14001d732
call qword [0x1400645d0]
mov eax, 1
add rsp, 0x3f0
pop rdi
ret
Function at 0x1337c1053cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1337c1053cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1337c1053cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1337c10585b0
Capabilities:
Execute syscall

Disassembly:
push rbx
push r10
pushfq
mov rbx, rsp
mov r10, rcx
push qword [0x1337c12de068]
lea rax, [0x1337c105862b]
push rax
push qword [0x1337c12de090]
push qword [0x1337c12de080]
sub rsp, 8
mov rax, rsp
push qword [0x1337c12de090]
push qword [0x1337c12de058]
push rax
push qword [0x1337c12de090]
push qword [0x1337c12de070]
lea rax, [0x1337c12de020]
push rax
push qword [0x1337c12de078]
lea rax, [0x1337c1058570]
push rax
push qword [0x1337c12de080]
push qword [0x1337c12de088]
push qword [0x1337c12de090]
pushfq
pop rax
or rax, 0x40000
push rax
popfq
syscall
mov rsp, rbx
popfq
pop r10
pop rbx
ret
Function at 0x1400017e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140042760]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov qword [rbp - 0x39], rcx
add rcx, 0xe0
call fcn.14000b8a0
nop
xor edx, edx
mov rcx, rdi
call fcn.14000c680
nop
lea rax, [0x14002a9a8]
mov qword [rdi], rax
lea rsi, [rdi + 0x1a0]
mov qword [rsi + 0x18], 0xf
xor r15d, r15d
mov qword [rsi + 0x10], r15
cmp qword [rsi + 0x18], 0x10
jb 0x140001860
mov rax, qword [rsi]
jmp 0x140001863
mov rax, rsi
mov byte [rax], r15b
lea rbx, [rdi + 0x1c0]
mov qword [rbp - 0x49], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.140002e70
mov qword [rbx], rax
lea rbx, [rdi + 0x1d0]
mov qword [rbp - 0x49], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov ecx, 0x10
call fcn.14000f130
test rax, rax
jne 0x1400018b6
call fcn.140013674
int3
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
lea rcx, [rdi + 0x1f8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rdi + 0xe8]
mov r8d, 8
lea rdx, str.ACE_BOOT
call fcn.140003da0
mov dword [rbp - 0x29], 0x6c0047
mov dword [rbp - 0x25], 0x62006f
mov dword [rbp - 0x21], 0x6c0061
mov dword [rbp - 0x1d], 0x7b005c
mov dword [rbp - 0x19], 0x370041
mov dword [rbp - 0x15], 0x340042
mov dword [rbp - 0x11], 0x430035
mov dword [rbp - 0xd], 0x360034
mov dword [rbp - 9], 0x38002d
mov dword [rbp - 5], 0x350043
mov dword [rbp - 1], 0x2d0035
mov dword [rbp + 3], 0x460034
mov dword [rbp + 7], 0x410042
mov dword [rbp + 0xb], 0x39002d
mov dword [rbp + 0xf], 0x430045
mov dword [rbp + 0x13], 0x2d0045
mov dword [rbp + 0x17], 0x350035
mov dword [rbp + 0x1b], 0x340036
mov dword [rbp + 0x1f], 0x460031
mov dword [rbp + 0x23], 0x300043
mov dword [rbp + 0x27], 0x330035
mov dword [rbp + 0x2b], 0x440039
mov dword [rbp + 0x2f], 0x7d
lea rcx, [rdi + 0x108]
mov r9, qword [rcx + 0x18]
cmp r9, 8
jb 0x1400019a3
mov rdx, qword [rcx]
jmp 0x1400019a6
mov rdx, rcx
mov rax, qword [rcx + 0x10]
lea r8, [rdx + rax*2]
cmp r9, 8
jb 0x1400019b9
mov rdx, qword [rcx]
jmp 0x1400019bc
mov rdx, rcx
lea rax, [rbp + 0x33]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
call fcn.1400047f0
mov dword [rdi + 0x128], 0x809
mov dword [rdi + 0x130], 0x80d
mov dword [rdi + 0x12c], 0x80b
mov dword [rdi + 0x138], 0x6b17d2d1
mov dword [rdi + 0x13c], 0x1343bed
mov dword [rdi + 0x140], 0xe
mov dword [rdi + 0x144], 6
mov dword [rdi + 0x148], 0x964
mov dword [rdi + 0x14c], 0x3326
lea rcx, [rdi + 0x150]
xor edx, edx
lea r8d, [rdx + 0x50]
call fcn.140012700
mov r8d, 8
lea rdx, [0x14002a9e8]
mov rcx, rsi
call fcn.140003b30
mov word [rdi + 0x220], 0
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14000f290
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000c810
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor dil, dil
mov rsi, rdx
mov rbx, rcx
cmp byte [rcx + 9], dil
je 0x14000c836
mov dil, 1
jmp 0x14000c8bf
mov qword [rsp + 0x50], r14
lea r8, [0x14000c970]
lea r14, [rcx + 0x18]
mov r9, rbx
mov qword [rsp + 0x28], r14
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.140015000
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14000c8ba
test rsi, rsi
je 0x14000c872
mov eax, dword [r14]
mov dword [rsi], eax
lea rcx, [rbx + 0x20]
call fcn.14000c540
lea rcx, [rbx + 0x50]
mov qword [rsp + 0x30], rax
call fcn.14000c540
xor r8d, r8d
mov qword [rsp + 0x38], rax
or r9d, 0xffffffff
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x14000c8b1
mov byte [rbx + 9], 1
mov dil, 1
jmp 0x14000c8ba
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov r14, qword [rsp + 0x50]
lea rcx, [rbx + 0xb0]
call fcn.14000c650
mov rbx, qword [rsp + 0x58]
movzx eax, dil
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000c8f0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rbx, rcx
je 0x14000c95b
sub rcx, 0xffffffffffffff80
mov qword [rsp + 0x30], rdi
call fcn.14000c650
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000c946
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000c934
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
lea rcx, [rbx + 0x80]
call fcn.14000c620
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 9], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14000d9f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x140042760]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r10d, r10d
mov edi, edx
mov r11d, r10d
lea rbx, [rsp]
mov r9, rcx
nop
mov eax, r11d
and eax, 0x80000007
jge 0x14000da31
dec eax
or eax, 0xfffffff8
inc eax
shl eax, 3
mov rdx, r8
movzx ecx, al
shr rdx, cl
xor dl, r11b
inc r11d
mov byte [rbx], dl
inc rbx
cmp r11d, 0x100
jl 0x14000da20
test r9, r9
je 0x14000da79
cmp edi, 1
jb 0x14000da79
mov rdx, rdi
nop
movzx eax, r10b
lea r9, [r9 + 1]
inc r10
movzx ecx, byte [rsp + rax]
xor byte [r9 - 1], cl
sub rdx, 1
jne 0x14000da60
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14000f290
mov rbx, qword [rsp + 0x128]
add rsp, 0x110
pop rdi
ret

Function at 0x14001a2f4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14001a0c8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a0c8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a0c8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a0c8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a0c8
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a0c8
cmp dword [rcx + 0xf8], esi
je 0x14001a0c8
mov ecx, r14d
call fcn.14001a210
mov ecx, 2
call fcn.1400167b8
nop
cmp byte [0x140044ba8], 0
jne 0x14001a192
mov r15d, 1
mov eax, r15d
xchg dword [0x140044b98], eax
test ebx, ebx
jne 0x14001a13b
mov rdi, qword [0x140042760]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140044ba0]
cmp rcx, rax
je 0x14001a132
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140010450]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140044cd8]
jmp 0x14001a147
cmp ebx, r15d
jne 0x14001a14d
lea rcx, [0x140044cf0]
call fcn.14001ac84
nop
test ebx, ebx
jne 0x14001a164
lea rdx, [0x14002a508]
lea rcx, [0x14002a4e8]
call fcn.14001afc0
lea rdx, [0x14002a518]
lea rcx, [0x14002a510]
call fcn.14001afc0
movzx eax, byte [0x140044ba8]
test esi, esi
cmove eax, r15d
mov byte [0x140044ba8], al
jmp 0x14001a192
mov ecx, 2
call fcn.14001680c
test esi, esi
jne 0x14001a1a9
mov ecx, r14d
call fcn.14001a1c4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001a058

Function at 0x14015f883
Capabilities:
Authenticate hmac

Disassembly:
ror ax, 1
mov qword [rsp + rdx - 0x663bf2b3], rdx
and r9b, byte [rsp + rbp - 0xf2b1]
neg ax
pop rcx
sub ax, 0x3caf
inc r9d
xor r11w, ax
btr dx, cx
movsx r8d, cl
jae 0x14024bcf8
adc rax, rsp
mov edx, dword [rax + rcx - 0x663bf2b3]
ror r8w, 0xea
lea rdi, [rbp + rdi - 0xf2b7]
mov dword [rdi + rbp - 0xf2b3], edx
lea rbx, [rbp + rbx - 0xf2b7]
dec cl
mov ecx, dword [rbp + rbx - 0xf2b3]
xor ecx, r11d
lea rax, [rbp + r9*8 + 0x75bf8235]
rol rbp, 0xd7
not ecx
call fcn.14022a3ba
Function at 0x140168ac0
Capabilities:
Authenticate hmac

Disassembly:
ror eax, 1
mov qword [rsp + r8*2 - 0x360d00], r11
bswap rcx
xor dword [rsp + rdx], eax
jmp 0x1401cd13d
xadd bpl, r9b
pop r11
inc rcx
xadd rdx, rsi
ja 0x140214e94
movsxd rax, eax
sbb sil, 0x12
setnp dl
add r10, rax
jmp r10

Function at 0x14016a029
Capabilities:
Authenticate hmac

Disassembly:
sbb edx, 0xafbddc0f
neg bpl
xor edx, 0xc3852d1b
pop r10
inc edx
and r9d, dword [rsp + r9 - 0x338b632c]
movzx r10d, word [rsp + r9*8 + 0xa]
bswap edx
jbe 0x1402ce3d6
call fcn.14015f2d1
mov qword [rsp + r9*2 + 8], rsi
adc dword [rsp + r9 + 4], ecx
xor dword [rsp + r9*8 + 8], edx
shr dword [rsp + r9], 0x86
jnp 0x140300248
pop r8
pop r8
jmp fcn.1401f1629
mov rsi, qword [rsp + r9 + 8]
movsxd rdx, edx
cdqe
mov qword [rsp + r9 + 8], rax
add rdi, rdx
jmp 0x1402eab46

Function at 0x140174995
Capabilities:
Encode data using base64

Disassembly:
bt r8w, 0x13
mov qword [rsp + rax - 0x5fb1c987], r8
neg edx
neg word [rsp + rax - 0x5fb1c987]
setno byte [rsp + rax - 0x5fb1c985]
not edx
mov qword [rsp + rax - 0x5fb1c987], r9
lea r9, [rax*4 + 0x6680d2b0]
xor dword [rsp + rax - 0x5fb1c987], edx
call fcn.140193741
Function at 0x140176855
Capabilities:
Encode data using base64

Disassembly:
mov r11, qword [rsp + rcx*2 - 0x148]
mov qword [rsp + rcx - 0xa8], 0xffffffffaaa57529
movsxd r8, r8d
add r10, r8
xchg dword [rsp + rcx - 0xa8], esi
xor dword [rsp + rcx*2 - 0x14e], 0x2d8bf8a6
mov qword [rsp + rcx - 0xa0], rbp
mov rcx, qword [rdi + rcx - 0xa8]
cbw
movsx r8d, dl
mov r8, qword ss:[rax + rcx - 0x12]
mov qword [rdi + rax - 0x12], r8
ja 0x14018e9c9
neg edi
mov edx, dword [rsp + r11*2 + 3]
ror edi, 3
ror dword [rsp + r11 + 0xc], 0x53
xchg bpl, cl
mov qword [rsp + r11*4 + 8], r9
jae 0x1402e2a3e
mov ecx, dword [rdi]
add rdi, 4
mov eax, 0x94b776b7
mov edx, eax
mov ebx, 0x969acf08
xor ecx, r10d
movsx ebp, bl
movzx esi, bx
call fcn.14024a00a
xchg dx, r11w
xor dword [rsp + r11*4 - 0x44], edi
movsx r9d, dl
lea rsi, [rcx - 0x3acafffa]
mov r9, qword [rsp + r11*8 - 0x90]
mov qword [rsp + r11 - 0xb], rcx
neg edx
movsxd rdi, edi
sar r11d, 0x73
lea rax, [rdx*2 - 0x7f5e11f1]
adc rbx, rdi
rol rbp, 0xbd
lea rbp, [rbp - 0x65444d6f]
pop r11
pop rbp
jae fcn.1402b7d1c
Function at 0x1401837cb
Capabilities:
Authenticate hmac

Disassembly:
xor dx, 0x5fab
push r8
sal al, 0x84
dec dx
neg dx
xor dx, 0x95bb
sub qword [rsp + r11 - 0xe242], rbp
rol qword [rsp + r11*2 - 0x1c490], 0x57
xor r9w, dx
lea rdx, [rsp + rdx + 0x10]
neg r11b
call fcn.1401ad2db
lea r10, [r10 + rbp*2 + 0x6286c076]
mov qword [rsp + r11*4 - 0x98], r11
lea rdi, [r11 + rdi - 0x28]
xadd r11w, r8w
movzx edx, word [rdi + r11*4 - 0x38928]
jne 0x14030a5bc
mov r8d, dword [r9]
add r9, 4
mov ebp, 0xa811633a
mov r10d, 0x93ee13
xor r8d, edi
mov ecx, 0x7e20de34
lea r8d, [rbp + r8 - 0xb63569d]
neg r8d
movsx eax, cx
dec r8d
not r8d
push rdi
shr cx, 0xc7
lea rdx, [rax*8 + 0x7736a501]
xor dword [rsp + r10 - 0x93ee13], r8d
pop rdi
movsxd r8, r8d
not rcx
jmp 0x1401a451c
add r11, r8
movzx esi, word [r9 + rcx + 0x7e2001bd]
rol cx, cl
call fcn.140161bee
bswap eax
call fcn.1401d2bf1
dec rbp
xor dx, r9w
jmp 0x140180dbb

Function at 0x1401978f7
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + rsi - 0x1bc2c694], r8d
mov qword [rsp + rsi - 0x1bc2c69c], rax
inc dword [rsp + rsi*4 - 0x6f0b1a6f]
dec sil
mov r11, qword [rsp + rsi - 0x1bc2c693]
shr cx, cl
lea rdi, [rdi + rsi - 0x1bc2c69f]
not cl
lea rdx, [rax + rbp*2 - 0x64e2995a]
mov dword [rsi + rdi - 0x1bc2c69b], r8d
lea rbx, [rbx + rsi - 0x1bc2c69f]
movsx r8d, cx
inc ecx
sar rax, cl
mov ebp, dword [rsi + rbx - 0x1bc2c69b]
xor ebp, r11d
neg si
rol ebp, 1
dec ebp
jmp 0x14029983f
mov qword [rsp + rsi - 0x1bc2395d], 0x678d0c20
add r10, rbp
shr r9d, 0xa
sal word [rsp + rcx + 2], 0xc3
and cx, r9w
pop rsi
pop rcx
jge fcn.14020409d
movsxd rbp, ebp
cdq
jge 0x140292754
rol ebp, 1
xor ebp, 0xc993609
dec ebp
mov qword [rsp + rsi - 0x1bc2395d], r11
sar ecx, 0x6d
movzx r9d, word [rsp + rsi - 0x1bc23961]
xor dword [rsp + rsi - 0x1bc2395d], ebp
sar r9, 0xa0
neg byte [rsp + rcx]
mov r11, qword [rsp + rcx*2 + 8]
jb 0x14030b8dd
jp 0x14029286c
rol r11d, 1
dec r11d
div ebp
sub edx, edx
bswap r11d
cdq
shr edx, 0xd5
ror r11d, 1
bts ebp, 0xb1
push r9
btc eax, 0x90
not r8b
btc bp, ax
xor dword [rsp + rbp - 0x369bf13a], r11d
pop r9
not ax
movsxd r11, r11d
add rsi, r11
movsx r11d, dl
sar ebp, 0x39
jmp rsi

Function at 0x140198415
Capabilities:
Authenticate hmac

Disassembly:
pop rcx
mov qword [rsp + rdx - 0x43a97880], rcx
add rbx, rsi
cbw
lea r8, [r8 + rax - 1]
mov bpl, byte [rax + r8]
call fcn.1401ff628
mov qword [rsp + r11*4 - 0x3c], 0x17b65810
xor esi, r9d
bswap esi
movsx eax, dl
movzx edi, byte [rsp + r11*4 - 0x3a]
movzx ecx, ax
inc esi
xor esi, 0x9c96d496
dec esi
shr rax, cl
xor esi, 0xdc06a701
push rcx
mov qword [rsp + r11*4 - 0x34], r9
neg r11d
and qword [rsp + rax], 0x3210d329
xor dword [rsp + rax*2 + 8], esi
neg r11
movzx ebp, cl
sal edx, 0xe7
mov r9, qword [rsp + rax + 8]
neg dx
movsxd rsi, esi
jne 0x14016d968
Function at 0x14019889a
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx*2 - 0x400000], r9
neg ebp
call fcn.1402d30e5
mov ebp, 0x253aef36
jmp 0x14030147a
movsx r8d, ax
lea rbx, [rbx + rbp*2 - 0x4a75de68]
movzx ecx, r8w
xor edx, esi
xchg r8, rax
movzx r10d, al
push rax
neg edx
lea edx, [r8 + rdx + 0x1bbae873]
ror edx, 3
bswap rcx
not r10
neg edx
add r10w, 0xe8a0
add word [rsp + rbp - 0x253aef34], ax
sbb edx, 0xde16f80d
mov qword [rsp + rbp*2 - 0x4a75de6c], rsi
jmp 0x1401b897a
lea rax, [rbp + rbp*2 + 0x6031a398]
mov edx, dword [rbx + rbp - 0x253aef36]
jmp 0x1401d846d

Function at 0x140198b0f
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x722513b], rbx
movzx bp, byte [r10 + rbx - 0x722513b]
xadd word [rsp + rbx*2 - 0xe44a275], bx
mov al, byte [r10 + rbx*4 - 0x1c888942]
lea r10, [rbx + r10 - 0x722224f]
lea rdx, [rbx*8 - 0x2a715edb]
or bpl, al
jmp 0x14030d7b8
sbb ebx, ecx
xor qword [rsp + rdx*2 - 0xee71876], r11
pop r11
bswap ebx
add cl, dh
btc rdx, rcx
lea ebx, [rbx + r8*2 + 0x7826cea1]
not ebx
push r9
mul al
xor dword [rsp + rdx - 0x773ac3b], ebx
pop r9
movsxd rbx, ebx
call fcn.1401d2b49
xchg qword [rsp + rbx - 0x7222251], rdx
bt edx, 0x2a
not bpl
mov r8d, 0x313148b6
movsx ecx, word [rsp + rbx*2 - 0xe44449e]
mov word [r10 + rbx - 0x7222251], bp
mov r11d, ebx
lea rdi, [rdi + rbx - 0x7222255]
inc cx
mov ebx, dword [rbx + rdi - 0x7222251]
xor ebx, r9d
neg byte [rsp + rdx*2 - 0xee71871]
neg ebx
movzx eax, r11w
bts r11, rdx
adc r11w, word [rsp + rdx - 0x7738c3b]
bswap ebx
not r8b
jle 0x1402e6c57
Function at 0x140198d9b
Capabilities:
Authenticate hmac

Disassembly:
add rcx, r10
jmp rcx
lea r8, [r8 + rcx + 6]
mov word [r8 + rcx*2], r11w
movsx eax, bpl
js 0x14016699f
mov qword [rsp], r11
call fcn.14022b4bb
push 0xffffffffb239ef96
mov ebp, dword [rsp + 2]
mov ebx, dword [r8]
mov eax, ebp
add r8, 4
xor ebx, r10d
ror ebx, 2
and qword [rsp], 0x5fa47da9
dec ebx
shr qword [rsp], 0xec
jne 0x1401e5399
rol ebx, 1
mov esi, ebp
call fcn.14030ce8b
and edi, ecx
movzx eax, dx
shr r11w, 0x4e
sbb rdx, qword [rsp + rdx*4 - 0x20a3004c]
mov dword [rbp + r8 - 0x3ea5], edi
ror edx, 0x9b
dec word [rsp + rbp - 0x3ea2]
jge 0x14014ec8c
lea rsi, [rsi + rbp*4 - 0xfa98]
not al
sub bpl, bpl
jae 0x1402fe551
mov r10d, dword [r9]
add r9, 4
mov ecx, 0x18bc5491
xor r10d, edi
jmp 0x14019e3b4
bswap ecx
mov qword [rsp + rdx - 0x24], rdx
pop r9
xor word [rsp + rdx*2 - 0x54], 0xfdb6
inc ecx
cwd
mul word [rsp + rdx*4 - 0x3ffef]
not ecx
rol ecx, 1
imul edx, dword [rsp + rdx - 0xeaad]
neg ecx
or edi, eax
xchg word [rsp + 0xd], di
sbb ecx, 0xba39331e
pop rax
mov qword [rsp], rbx
xor dword [rsp], ecx
pop rbx
not dil
movsxd rcx, ecx
mov r11d, 0x43b0a819
sal rax, 0x95
add r10, rcx
sal rdx, 6
movsx ecx, dl
mov rax, qword [r8 + r11 - 0x43b0a819]
movzx ebp, di
or r11, 0xffffffffb517d532
movsx r9d, dil
mov r11w, word ss:[rax + r11*2 + 0x1090058a]
ror r9w, 0xc6
jnp 0x14016df31
movsx edx, cx
not r10d
lea rax, [rdx + rcx*4 - 0x11cbd1ee]
lea rbp, [rdx + rax*4 - 0x3c4d734b]
xor r10d, 0xb98489ac
lea r8, [rdx + rax + 0x34171513]
push rdx
lea rsi, [rdx*4 + 0x7d8f1bba]
ror r10d, 3
ror rax, cl
not r10d
lea r10d, [r10 + rcx*2 + 0x1b96b508]
jb 0x1402489a4
mov r8d, 0xe2370da0
mov ebx, r8d
jmp 0x14017919b
btr r11, 0x31
imul r11d, r11d
bswap ecx
sar word [rsp + rsi - 0x1f9b2f35], 0xe5
pop rsi
neg ecx
movzx ebp, word [rsp + rsi - 0x1f9b2f36]
mov ecx, dword [r8 + rsi*2 - 0x3f365e70]
neg dword [rsp + rsi*4 - 0x7e6cbcdc]
add dx, word [rsp + rsi*4 - 0x7e6cbcdc]
lea r8, [r8 + rsi*2 - 0x3f365e6c]
lea r11, [rbp*2 - 0x69ea3c4d]
xor ecx, r10d
jmp 0x1401d4096
mov eax, dword [rbp + rsi - 0x3e00]
xor eax, ebx
call fcn.1402ed309

Function at 0x1401aacd9
Capabilities:
Authenticate hmac

Disassembly:
shl rsi, cl
not edx
cwde
bts ax, si
sar cx, 0x2c
mov qword [rsp + 8], r9
xchg cx, si
ror r11w, cl
jbe 0x14018885c
xor dword [rsp + 8], edx
mov qword [rsp], rax
call fcn.14026ef60
mov dword [r11 + r8*4 - 0x160], edx
and qword [rsp + r8 - 0x58], r8
mov r9d, dword [r8 + rbx - 0x58]
setne r8b
lea rbx, [rbx + r8*4]
xor r9d, esi
sub r9d, r8d
bswap r9d
mov ecx, r8d
jmp 0x1401c1cdc
jmp 0x14028ca62
lea r9d, [r8 + r9 - 0x40a88d03]
rol r9d, 3
sub qword [rsp + r8 - 1], rax
cwde
xor r9d, 0x3931db93
rol r9d, cl
xchg byte [rsp + r8 + 5], r10b
sub r9d, 0x853caeb6
ror al, 5
movzx ebp, word [rsp + r8*4]
not r9d
jae 0x1401734ce
Function at 0x1401b588d
Capabilities:
Parse pe header

Disassembly:
inc eax
neg dil
neg eax
ror rbp, cl
shl rbp, cl
lea eax, [rax + rdi - 0x6f264cec]
mov qword [rsp + rdi*4 - 0x266f0], 0x6cb0ce83
rol qword [rsp + rdi - 0x99bc], 0xc9
jp 0x1402fa727
lea r8, [r8 + r9 - 0x8476]
bt r9w, ax
inc edx
mov byte [rbp + r9*2 - 0x10900], dil
sbb ecx, edx
jg 0x14024a2db
rol byte [rsp + rbp*4 + 7], 0x43
mov qword [rsp + rbp], r8
ret 8
movsx r8d, bp
bswap ebx
dec dx
dec ebx
sal r8b, 0x62
rol ebx, 2
and rax, 0x69912417
inc ebx
cwde
cwd
push r9
movsx r9d, al
jmp 0x14024385c
mov qword [rsp + rdi*2 - 0x13378], rbx
mov r11d, ecx
xor dword [rsp + r9*2 - 0x1fc], eax
call fcn.1401f3418
call fcn.1401d06cc
ror ecx, 2
neg sil
mov qword [rsp + r9 - 0x60032068], r11
dec esi
xor dword [rsp + rbp*2 - 0x6003268], ecx
mov r11, qword [rsp + r9 - 0x60032068]
call fcn.1401923ce
call fcn.140221ef5
mov r11, qword [rsi]
xor r11, rbx
movzx edi, dx
shl rdx, 0x1e
lea r11, [r11 + rdi*8 - 0x68cd5681]
shr rdx, 0x5a
movsx ecx, dl
shl di, 0x62
rol r11, 2
inc r11
ror r11, 2
bt cx, dx
xadd di, cx
neg r11
bswap r11
xor rbx, r11
movsx ebp, cl
lea r8, [r8 + rdi*2 - 0x89a0]
jmp 0x14026b4e4
shr rdx, 0x2b
xor dword [rsp + rdx], ebx
call fcn.140194b2c
mov r9d, 0xd41716b6
mov r9, qword [r10]
mov r8d, 0xdc09a802
mov bp, word [r10 + 8]
add r10, 0xa
movsx edx, r8b
mov word ss:[r9 + rdx - 2], bp
lea rdi, [rdi + rdx*4 - 0xc]
movsx esi, dl
mov esi, dword [rdi + rsi*8 - 0x10]
xor esi, r11d
rol esi, 2
lea rbp, [r8 + rdx - 0x75e539d1]
add dl, dl
bswap r8
lea esi, [rsi + rdx*8 - 0x48bb67c8]
push r8
neg esi
xor word [rsp + rdx*8 - 0x1f], r8w
movzx eax, bpl
push rax
rol esi, 1
cbw
dec esi
sar word [rsp + rdx*4 - 0xc], 0x41
mov qword [rsp + rdx + 4], r11
sbb bpl, 0x87
cqo
xor dword [rsp + rdx*4 + 8], esi
jmp 0x14027d9d4
jmp r10
mov qword [rdi + r8 - 0x44cc], r11
lea rsi, [rsi + rdi - 0x44d0]
call fcn.1402ce12d
mov edx, 0x649558b3
mov r9d, dword [rsi + rdx - 0x649558b3]
lea rsi, [rdx + rsi - 0x649558af]
xor r9d, ebx
dec r9d
movsx ecx, dl
movsx r8d, dx
not r9d
lea r9d, [rcx + r9 - 0x58d9519b]
movzx edi, r8b
ror r9d, 3
mov eax, edx
push rbx
xor rax, rcx
xor dword [rsp + rdx - 0x649558b3], r9d
cqo
div ecx
movzx ebx, di
pop rbx
bt edi, 8
movsxd r9, r9d
adc rbp, r9
call fcn.140177ead
ror eax, 3
sar ecx, 0x2e
movzx r9d, cl
bswap eax
jne 0x14020e399
movsxd rdi, edi
cwd
sete cl
mov qword [rsp + rcx + 0x40422b10], rdx
adc rbx, rdi
movsx edi, al
call fcn.1401de5ea
movsx eax, cl
lea ebx, [rbx + rax*8 - 0x66a00f6f]
jmp 0x1401f7793