joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026010
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140026088
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140026088
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140026088
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14002607c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14002609a
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14002606a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14002608a

Function at 0x140027518
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140027562
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140027562
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140027562
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140027562
cmp dword [rcx + 0x84], 0xe
jbe 0x140027562
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140027564
xor al, al
add rsp, 0x28
ret

Function at 0x140030538
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003029c

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rsi
sub rsp, 0x40
and dword [rsp + 0x3c], 0
mov edx, 0x114
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call sub.KERNEL32.dll_VirtualAlloc
mov rsi, rax
lea rax, section..rdata
cmp rsi, rax
jae 0x401047
xor ecx, ecx
cmp rcx, 0x114
je 0x40105d
mov dl, byte [rcx + rax]
mov byte [rsi + rcx], dl
inc rcx
jmp 0x401033
mov ecx, 0x113
cmp rcx, 0xffffffffffffffff
je 0x40105d
mov dl, byte [rcx + rax]
mov byte [rsi + rcx], dl
dec rcx
jmp 0x40104c
lea r9, [rsp + 0x3c]
mov edx, 0x114
mov rcx, rsi
mov r8d, 0x20
call sub.KERNEL32.dll_VirtualProtect
test al, 1
je 0x4010a0
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rsi
xor r9d, r9d
call sub.KERNEL32.dll_CreateThread
mov rcx, rax
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
nop
add rsp, 0x40
pop rsi
ret
Function at 0x1407f9794
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
lea rsp, [rsp + 0x20]
je 0x14081e62d

Function at 0x1407fdc70
Capabilities:
Encode data using base64

Disassembly:
mul r9d
sal word [rsp + r8*2 - 0x1ef], 0x47
movsxd r11, r11d
mov qword [rsp + r8 - 0xe7], r9
adc eax, edx
shr rax, 0xb
add rbp, r11
bts eax, 0x9f
neg qword [rsp + r8*4 - 0x3ea]
imul r9, r9
mov rax, qword [rbx + r8 - 0x101]
lea rbx, [rbx + r8 - 0xf9]
sal edi, 0xdc
xor edx, edi
cmove edx, r8d
mov r8w, word [r10 + r8*4 - 0x3f7]
mov qword [rsp + rdx - 0x6000044e], 0x59b6f4bc
jge 0x140802867

Function at 0x140801458
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffbd9b013e
push 0x59a9c482
lea rsp, [rsp + 0x18]
jne 0x1408128a1

Function at 0x140804dbd
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x69994839
mov word [rbx + riz + 2], dx
mov r8d, dword [r10 + riz]
add r10, 4
xor r8d, esi
ror byte [rsp + 6], 0x41
movzx edx, ax
neg r8d
mov edi, 0xce9a830f
or word [rsp + rdx - 0xfd8b], 0x678b
cdq
ror r8d, 3
movzx r11d, dx
shr qword [rsp + r11 - 0xffff], 0x24
lea r8d, [rdi + r8 - 0x7184b360]
mul dl
bswap r8d
bswap r11
cbw
mov r9d, 0x270e66a5
sbb r8d, 0x9c94701a
lea rcx, [r9 + 0x603e6119]
xor r8d, 0xc33b5506
sar byte [rsp + r9 - 0x270e66a1], 0x47
xor r8d, edx
jmp 0x14085d015

Function at 0x140806391
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
neg r8w
movsxd rax, eax
mov qword [rsp + rcx*4 - 0x7e586620], r8
add rbp, rax
neg r8b
call fcn.140824603
mov r8d, 0x871f2600
jmp 0x14085af40
mov r11w, word [rbx + riz]
movsx r9d, r8w
mov dx, word [r9 + rbx - 0x25fe]
inc r8b
or r11w, dx
lea rcx, [r9 + r9*2 - 0x44dd60df]
not r11w
movzx edx, r8w
mov word [rbx + r9*2 - 0x4bfe], r11w
mov r9d, dword [r9 + r10 - 0x2600]
lea r11, [r8 + r8*8 - 0x2cc419c6]
call fcn.14083bd9e
Function at 0x140806d85
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r9d, r11d
xor edi, esi
imul dx
add rax, 0x1f20d69c
neg edi
lea edi, [rax + rdi - 0x7af050c8]
movzx ecx, r11b
sub r11, 0x7d8f6e82
rol edi, 1
mul cl
rol ax, 0x64
dec edi
xadd r11d, r9d
bswap r11d
neg r9b
not edi
and r11b, 0xa4
btr edx, eax
cdq
push rsi
push rax
xor dword [rsp + rcx - 0x2d], edi
shl dword [rsp + rax + 0x5c26fb3f], cl
cdq
mov rsi, qword [rsp + rax + 0x5c26fb46]
adc dl, byte [rsp + rcx*2 - 0x63]
and r11d, 0xdd8bc89e
movsxd rdi, edi
mul rdx
ror edx, cl
add rbp, rdi
mov qword [rsp + rcx - 0x35], rbp
ret 8
mov qword [rsp + 0x28], 0xffffffffc400703b
movsxd rdx, edx
jp 0x140810653
mov edi, dword [rbx + riz]
mov r11d, 0xd70ad58f
movsx r8d, r11b
not r11b
mov eax, dword [rbx + riz + 4]
call fcn.140809456
mov r8d, 0xd328c59d
lea rdi, [r8 + r8*2 + 0x4139931c]
shl r8, 0x57
mov r9, qword [rbx + riz]
ja 0x14080a5a2
not r9w
bswap ecx
call fcn.140832552
mov edi, dword [r10]
jmp 0x140834c7f
mov rax, qword [rbx + riz + 8]
movzx r11d, r8b
lea rcx, [r8 + r8*8 - 0x55c277dd]
mul r9
sal cx, cl
push rcx
call fcn.14080eb1f
mov r9d, dword [rbx]
mov r11d, 0xba877baa
mov cl, byte [rbx + riz + 4]
jmp 0x14081c4be
neg r11b
mov edx, r11d
adc rbx, 1
mov r8d, 0x74069994
movzx edi, r8w
shr r9d, cl
movzx eax, dil
idiv dl
cqo
mov dword [rdx + rbx], r9d
mov r11d, dword [r10 + rdi*2 - 0x13328]
mov r9d, eax
lea r10, [rdx + r10 + 4]
imul r8
xor r11d, esi
inc r11d
movzx ecx, dil
inc eax
cwd
not r11d
rol r11d, 3
neg r9
not r11d
idiv ax
push rsi
and rdx, rdi
xor dword [rsp + rdx*4], r11d
imul r9b
sar eax, 0x1f
pop rsi
movsxd r11, r11d
bts ecx, r9d
adc rbp, r11
add r9w, dx
or rdx, rbp
jmp rdx
push rsi
movzx esi, dl
sal sil, 0x65
shr sil, 0xe7
xor dword [rsp + r11 - 0x1e0dc410], edi
lea rcx, [rax + rax*2 - 0x407cbd80]
add r10, 4
mov r11d, 0x1e0dc410
mov eax, r11d
movsx r9d, ax
xor edi, esi
cqo
not edi
rol al, 0x85
lea rdx, [r11 + rax*2 + 0x430395af]
btc rdx, 0xd
bswap edi
lea rdx, [r9 + r11*2 + 0xf001db5]
not edi
xor edi, 0xf0845d1a
cwd
shl rdx, 0x44
ja 0x140831adf
call fcn.14083bf94
lea rdx, [rax*4 + 0x68aada25]
div r11b
lea rbx, [rbx + r11*2 - 0x64]
or r11d, edi
cmovno dx, ax
shrd r9d, r8d, cl
rol dx, 0xae
mov dword [rbx + rdi - 0x60d8ec35], r9d
mov edi, dword [r10 + r11 - 0x60d8ec35]
xadd r11w, dx
cdqe
adc edx, edx
lea r10, [rax + r10 + 0x7b46d404]
cwd
js 0x1407f6b18

Function at 0x1408091f2
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140813ba3
lea rsp, [rsp + 0x18]
mov qword [rbp + riz - 0x10], rsp
jmp 0x14081bc49
sub rsp, rcx
and rsp, 0xfffffffffffffff0
call fcn.14083eeec
Function at 0x140809456
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
or di, word [r10 + rdi*2]
xor di, si
push r8
dec r9b
xor di, 0x3a25
ror di, 1
neg di
add di, 0x2618
xadd r8b, r9b
ror di, 1
neg byte [rsp + 0xe]
sub r11, qword [rsp + 5]
jp 0x1408218d0
xor si, di
lea rax, [r9*4 - 0x53cf1461]
sar r9d, 0xce
lea rdi, [rsp + rdi + 0x10]
ror cx, 0xcb
setne r11b
sar word [rsp + r9 - 0xdc63], 0xc4
mov dword [rdi + r9 - 0xdc67], edx
ror word [rsp + r9 - 0xdc5a], cl
sbb word [rsp + r9*2 - 0x1b8c4], r11w
lea rdx, [r8 + rcx*4 + 0x669d160c]
mov edx, dword [r10 + r9 - 0xdc65]
sal byte [rsp + r9*4 - 0x3718d], 0xc7
call fcn.14082d27d
movsx r9d, r8b
lea rcx, [r9*4 - 0x84aa352]
mul edi
lea r9, [r11 + r8*8 + 0x600f148e]
mov qword [rsp], r8
mov dword [rbx + riz], edx
mov dword [rbx + riz + 4], eax
ror rcx, 0x73
mov edx, dword [rbx + riz]
dec byte [rsp + 6]
add r8, qword [rsp]
movzx edi, cl
lea rbx, [rbx + rdi + 4]
shl r11b, 0x81
jne 0x140806603
not edi
jp 0x14083c91f
lea r10, [r10 + rax + 0xde]
xor dl, sil
or dword [rsp + rax*2 + 0x1b7], r9d
sal r8w, 0x4c
adc al, 0x19
xor dl, 0x2f
rol byte [rsp + rax*8 + 0x5f9], 0x62
neg dl
sub dl, 0x2d
dec r11d
xor dl, 0x21
neg r8d
xor sil, dl
shl byte [rsp + r8 - 0x7ff9], 0xa3
not r8b
jns 0x1408591cf
mov word [r8 + rbx - 0x80f9], dx
shl rcx, 0x5d
lea rbx, [rbx + r8*2 - 0x101f8]
xor byte [rsp + r8*2 - 0x101fb], r9b
mov qword [rsp + r8 - 0x80ff], rbp
ret 8

Function at 0x14080c11d
Capabilities:
Encode data using base64

Disassembly:
mov r11d, dword [rax + r10 + 0x1e809de8]
dec rdx
lea r10, [r10 + r8*4 + 4]
pop r8
xor r11d, esi
cqo
sub r11d, edx
xor r11d, edx
mul rax
bts ecx, 0x15
call fcn.14085cbd4
xor edx, esi
neg edx
rol edx, 3
movzx r9d, r8w
sal r11w, 0x41
neg edx
pop rdi
xchg word [rsp + r8 - 0x709af90d], r11w
shl byte [rsp + r11*2 + 0x17b39f6a], 0xc6
rol edx, 2
xchg byte [rsp + r8 - 0x709af90b], dil
shl r11b, 0x43
mov qword [rsp + r8 - 0x709af90e], rsi
push r11
jne 0x140836772
xor dword [rsp + r8 - 0x709af906], edx
sar r9b, 0xe6
mov eax, r8d
xor r11w, 0xe480
mov rsi, qword [rsp + r11*8 + 0x5ec95888]
movsxd rdx, edx
call fcn.14087568f
ror cx, 1
sub cx, 0x3cb4
btc edi, r8d
jb 0x140848d0d
add qword [rsp + rdi - 0xef], rdi
not cx
dec byte [rsp + rdi*2 - 0x1f1]
mov edx, dword [rsp + rdi*2 - 0x1fb]
bts di, 0xe
neg cx
xor cx, 0xe33
cwde
call fcn.14081ec24
Function at 0x14080df86
Capabilities:
Authenticate hmac
Encode data using base64
Manually build aes constants

Disassembly:
mov rsi, qword [rsp + r10 - 0x7018151a]
mov qword [rsp + r10 - 0x70181522], r8
mov rbp, qword [rsp + r10 - 0x70181512]
imul cx, r11w
mov qword [rsp + rcx - 0x7018ce7c], r8
mov r10, qword [rsp + r8 - 0x150a]
dec r8w
mov qword [rsp + rcx - 0x7018ce6c], rcx
mov ecx, dword [r10 + r8*4 - 0x5484]
lea r9, [r11 + r11*4 - 0x1fd186e8]
shr byte [rsp + r8*8 - 0xa8e9], 0xe4
lea rdx, [r11 + r9 - 0x5570e5f3]
lea r10, [r10 + r8*4 - 0x5480]
not r8
xor ecx, esi
movzx edi, r8b
inc word [rsp + r8 + 0x152f]
dec ecx
btr r11w, 0xbd
ror ecx, 1
pop r9
add di, r9w
inc ecx
pop rdi
movzx eax, r8b
xor ecx, 0x6c29eb9e
neg al
lea ecx, [rcx + r8 - 0x221a86f6]
not rdi
bts r11w, 0x21
mov qword [rsp + r8*2 + 0x2a4c], rsi
xor dword [rsp + r8 + 0x152a], ecx
cbw
call fcn.14084f03b
Function at 0x1408154d5
Capabilities:
Authenticate hmac

Disassembly:
imul r11w, word [rsp + rdx + 0x15]
jae 0x1408476f6
mov edi, 0xb0a89929
movsx edx, di
lea r8, [rdi*2 + 0x64bb4015]
movzx r11d, byte [r10 + riz]
movsx ecx, r8b
mov eax, edi
lea r10, [r10 + rcx - 0x66]
not r8b
btc di, cx
xor r11b, sil
neg edi
neg r11b
inc r11b
lea r9, [rax*8 - 0x2042567f]
ror ax, 0xce
rol cx, 0xa1
ror r11b, 1
ror al, 0xc5
neg rax
and r8w, di
inc r11b
not di
div r9b
neg r11b
mul ecx
mul rax
xor sil, r11b
div eax
or eax, 0x6a97ac18
cwde
adc r11, rsp
bswap edx
sar r9b, 0x23
mov r9d, dword [r11 + rdx*2]
adc rcx, 0xffffffffeb9ed285
push rax
lea rbx, [rbx + rdx*4 - 4]
sar dl, 0x26
adc dil, al
jl 0x14084e4de
cdq
ror di, 1
xor r11b, r9b
xor si, di
dec word [rsp + r8 - 0x29a9f3a3]
mul r11b
push r9
lea rdi, [rsp + rdi + 0x10]
movzx cx, byte [rdi + r8*2 - 0x5353e74e]
mov word [rbx + r11 - 0x201dc7a], cx
lea rbx, [rbx + r8*2 - 0x5353e758]
inc dl
jle 0x14085900d
neg r8
dec r11b
shl ax, 0x41
or r9w, 0x683e
ror cl, 4
xor sil, r11b
not edi
mov word [rdx + rbx + 0x1b1ffb2b], r11w
add rax, rdx
lea rbx, [rbx + rdx*4 + 0x6c7feca6]
or qword [rsp + rdx + 0x1b1ffb29], rbp
ret 8
mov dword [rcx + rbx + 0x14612cad], r9d
and qword [rsp + rdx*2], 0x77039623
cmovge r8, qword [rsp + rdx]
mov edi, dword [rdx + r10]
shr word [rsp + rdx + 2], 0xa7
lea r9, [rdx + rdx*4 - 0x64e250e0]
js 0x14087625b
lea r10, [r10 + rdx*2 + 4]
call fcn.14086b1ce
sub eax, 0xe3b01484
movzx edi, cl
shr ecx, cl
xor dil, 0x2d
push rsi
movsx esi, dx
cmovb di, si
xor dword [rsp + rcx*4], eax
not r9d
pop rsi
neg edi
cmovb di, dx
sar r9b, 0xe5
movsxd rax, eax
lea r11, [r8 + rdx*2 - 0x50e60d54]
add rbp, rax
push rdi
movzx eax, word [rsp + r9 - 1]
mov eax, dword [rbx + r9*2 - 6]
ror r11b, 0xa2
shr cl, 0x41
movzx r8d, byte [r10 + r9*8 - 0x14]
shl r9b, 0x61
lea r9, [rdi + rdx*2 + 0x351f41ac]
xor r8b, sil
lea rcx, [r11*4 - 0x22f0925a]
and edx, r11d
neg r8b
shl r9d, cl
adc r8b, 0x8e
neg r8b
or r9b, r11b
adc r8b, 0xb9
not rcx
imul r11d, edi
not r8b
dec byte [rsp + r11*2 - 0x213680c4]
xor r9, 0xfffffffff48865a1
pop r11
xor sil, r8b
add r8, rsp
shr rcx, cl
bswap r9
xor rdx, r11
mov dword [r8 + rdx - 0x73ff1477], eax
call fcn.1407f9fef
lea edx, [r11 + rdx - 0x4c369861]
lea rax, [r8 + r11*8 - 0x705a70f6]
ror r11d, 0x2d
mov qword [rsp + r8*2 - 0x5353e746], rsi
xor dword [rsp + rcx*8 - 0xbc00], edx
dec cx
and word [rsp + r8 - 0x29a9f3a1], cx
mov rsi, qword [rsp + rcx - 0x1778]
movsxd rdx, edx
btr eax, 0x8f
cmovae rax, rcx
btr r11, 0x1b
add rbp, rdx
pop rcx
movzx edi, word [r10 + r8*2 - 0x5353e742]
shr ecx, 0x2a
lea r10, [r10 + r8 - 0x29a9f399]
shl rax, 0xe0
xor di, si
mov qword [rsp + r11 - 0x201dccc], 0xffffffffa1bcc28b
cqo
dec cl
sub di, dx
lea rax, [rdx + r11*4 - 0x2ceb7341]
xor di, dx
or al, ah
setns byte [rsp + r11 - 0x201dcc9]
adc di, ax
rol qword [rsp + r11*8 - 0x100ee660], cl
jae 0x14084c600
lea rax, [r9*2 - 0x7cc81464]
pop r8
pop r8
je fcn.140847ec1

Function at 0x14081677d
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sal r11w, 0x8b
movsxd r9, r9d
jp 0x140852a01
add rbp, r9
mov r11w, word [r8 + rbx - 0x200ec]
pop rcx
add rcx, 0x19428
jmp rcx
Function at 0x140818648
Capabilities:
Encode data using base64

Disassembly:
ror dil, 1
inc word [rsp + rdx*8 + 0x15]
movzx ecx, r8w
jnp 0x1408756cb

Function at 0x14081874c
Capabilities:
Encode data using base64

Disassembly:
and rdx, rdi
movsxd r11, r11d
and r8b, r9b
adc rbp, r11
movzx r11d, r9b
add r11d, dword [rbx + rdx*2 - 0x11000414]
sub r8w, ax
or al, byte [r10 + rdx - 0x8800204]
lea r10, [r10 + rdx - 0x8800203]
push rdx
bt rdi, r8
xor al, sil
push rdx
neg al
add dl, 0x9e
call fcn.14085c300
mov edi, dword [r10]
mov r9d, 0xa3b6881b
add rbp, rdi
movzx r11d, byte [r10 + rax - 0x50a]
lea r10, [r10 + r9*2 - 0x1aed7]
rol rax, cl
push rdx
add r9, rax
xor r11b, sil
cdqe
pop rcx
mov qword [rsp + rax + 0x79000000], 0x38bc7d81
dec r11b
rol r11b, 1
bts r8, r8
btc eax, 0x8d
sbb r11b, r8b
not qword [rsp + r8 - 1]
shr r9, 0xb9
rol r11b, 1
xadd byte [rsp + r9 + 3], r9b
adc r11b, 0x99
xor sil, r11b
push rcx
mov word [rbx + r9*2 - 0x18e], r11w
push r9
not word [rsp + r9 - 0xba]
call fcn.14083e7a2
mov edx, 0x943d528e
movzx r11d, dx
lea r9, [rsp + r11 - 0x5176]
movsx eax, r11b
mov eax, dword [r9 + r11*8 - 0x29470]
mov dword [rbx + r11 - 0x5292], eax
not rdx
mov r11d, dword [r10 + r11*8 - 0x29470]
mov eax, edx
mov edi, 0x3a9ad818
xor r11d, esi
movzx r9d, dl
not r11d
lea r8, [rax + rdx*4 + 0x11841717]
bt dx, r8w
bswap r11d
and eax, 0x6a225207
sbb rax, rax
not r11d
cdq
xadd di, r9w
xor r11d, 0xf0845d1a
sar r9b, 0xa6
cbw
push rsi
xor dword [rsp + rdx], r11d
imul r8d
lea rdx, [r9*4 + 0xc9ee38d]
bswap edi
pop rsi
jae 0x140802496
Function at 0x14081bdef
Capabilities:
Encode data using base64

Disassembly:
xchg cx, di
shr dil, 0x82
pop rsi
xchg al, r11b
movsxd r9, r9d
lea rdi, [r8*4 + 0x122c2bbc]
adc di, 0x53af
adc rbp, r9
cbw
sar cx, 0xca
not cx
mov r11d, dword [rdx + rbx - 0x3801b596]
mov eax, dword [rbx + rdx - 0x3801b592]
lea rbx, [rdx + rbx - 0x3801b592]
not r11d
adc dl, 0x8d
bswap rcx
jb 0x1408659be
and r11d, eax
neg dx
sal r8, 0xd7
mov dword [rbx + rdx - 0x38014add], r11d
mov r9d, ecx
mov eax, edx
cwde
add r9, rbp
jmp r9
movzx edx, byte [r10 + r8*2 - 0xed70]
rol r9, 0xe6
xor dl, sil
mov qword [rsp + r8 - 0x76b8], 0xffffffff9495fea1
or r9b, 0x9e
push r9
adc dl, 8
xor byte [rsp + r8 - 0x76b3], 0xa1
not dl
ja 0x140834bbd
inc dl
movsx r11d, r9b
ror r8d, 0xf7
xadd r11b, r8b
xor dl, 0x9f
rol dword [rsp + r8 - 0xed70bb], 0x79
xor sil, dl
or r11d, 0xa48b9930
movzx eax, byte [rsp + r8 - 0xed70b7]
and al, 9
lea rdx, [rsp + rdx + 0x10]
mov byte [rdx + r8 - 0xed70be], dil
mul r8
mov ecx, dword [r10 + r8 - 0xed70bd]
adc word [rsp + r8 - 0xed70ba], r11w
jnp 0x140856398
movsx eax, di
lea rbx, [r9 + rbx - 0x3886e997]
not r11w
call fcn.140812a5f
xor ecx, esi
dec ecx
inc dl
bts rax, r9
setae byte [rsp + r8 - 0xed70bb]
not ecx
call fcn.14082af92
mov di, word [rbx]
mov ax, word [rbx + 2]
mov edx, 0xde81ac81
mov r9d, 0xe78a3cb6
add di, ax
mov eax, r9d
mov r8d, eax
mov word [rbx + riz + 2], di
xchg r8w, ax
mov eax, dword [r10 + riz]
movsx ecx, dx
add edx, r9d
bt r8, rdx
xor eax, esi
mov r11d, 0x13ab6910
lea eax, [r9 + rax - 0x6f83c429]
push rcx
xor eax, 0x229b042b
neg eax
sal r9w, cl
xor r8w, 0x32ab
inc eax
neg eax
mov qword [rsp + r11*4 - 0x4eada440], r8
shr byte [rsp + r11 - 0x13ab6910], cl
xadd dword [rsp + r11*2 - 0x2756d21e], r9d
bswap eax
sar word [rsp + r9*2 - 0x1cf12], cl
sets r8b
rol eax, cl
mov qword [rsp + r9 - 0xe78a], rsi
xor dword [rsp + r9 - 0xe78a], eax
movsx esi, r9w
xor r9b, sil
pop rsi
movsxd rax, eax
inc rdx
adc cl, dl
adc rbp, rax
add r8, r11
movzx eax, word [r10 + r9*8 - 0x737fc]
call fcn.140877b28
xor r9d, esi
lea r11, [rax*4 + 0x2222f2b4]
btr ax, ax
pop r8
not r9d
xor dil, 0xaf
movzx r8d, al
lea r9d, [r9 + rdx*2 + 0x4901870]
rol r9d, 1
not r9d
idiv dl
neg r9d
sub r11d, r8d
cmovo ecx, r11d
add cx, ax
push rsi
xor r11w, dx
bt r8w, di
sub r11b, dl
xor dword [rsp + rdx - 0x3801b596], r9d
jmp 0x14080c3c4
not eax
jl 0x140810a1a
Function at 0x14081e4db
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx r9d, r11w
mov r9, r8
movzx ecx, byte [rsp + 0x11]
mov edx, dword [rsp + rcx*4 - 0x396]
add rdi, 0xffffffffcc07b9a4
mov di, word ss:[r9 + rcx*2 - 0x1d4]
mov eax, 0x7727820a
mov word [rcx + rbx - 0xdc], di
cbw
lea rbx, [rbx + rcx - 0xdc]
mov qword [rsp + rcx*8 - 0x750], rax
mov r11d, dword [r10 + rcx*2 - 0x1d4]
cdq
cdqe
ror dx, 0x88
lea r10, [r10 + rcx*8 - 0x74c]
jne 0x14082f18a
rdtsc
call fcn.1408384f3
movsx edi, cx
xor r11d, esi
inc r11d
mov r9d, ecx
neg r11d
push r9
btr ecx, r9d
inc r11d
or ecx, 0xfd0a85b3
sar qword [rsp + rdx + 0xf], cl
push rax
bswap r11d
and cl, byte [rsp + rdx + 0x24]
sal edx, 0x55
dec eax
lea r11d, [r11 + rax + 0xc595b03]
pop rdx
rol r11d, 1
xchg r9d, edi
sub r11d, 0xf4b4f6b1
not qword [rsp + rdx - 0x77270009]
sar qword [rsp + rdx - 0x7726fff3], cl
btc rax, rdi
mov qword [rsp + rdi - 0xd2], rsi
cdq
xor dword [rsp + rdi*8 - 0x738], r11d
inc dword [rsp + rdx + 0x14]
mov rsi, qword [rsp + rdx + 0x18]
rol rdi, cl
movsx r8d, byte [rsp + rdx*4 + 0x13]
movsxd r11, r11d
or ax, word [rsp + rdx + 0x13]
btr r9d, ecx
adc rbp, r11
mov qword [rsp + rdx + 0x18], 0xffffffffcf8428b0
mov qword [rsp + rdx*2], rbp
ret 0x18

Function at 0x14081fed7
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x939c6ea5
movzx ecx, dx
xor r9d, esi
mov qword [rsp + rcx - 0x6e9d], rcx
bswap ecx
pop r8
not r9d
movsx edi, dl
sub r9d, 0xb6828fbc
movsx r11d, di
lea rax, [rdi*4 + 0x550a0b3b]
ror r9d, 1
neg qword [rsp]
jg 0x14083f0fb
sbb r9d, 0x109d1720
mov qword [rsp], rsi
shr eax, 0xbe
xor dword [rsp + rax*4 - 4], r9d
call fcn.140830697
mov ecx, 0x21ae3126
mov edi, 0x3ea15c93
push rcx
mov r11w, word [rcx + rbx - 0x21ae3126]
movzx r9d, byte [r10 + rdi*2 - 0x7d42b926]
call fcn.14082a518
mov dword [rbx + r8*2 - 0x3b20f744], edx
call fcn.1407fc66f
mov r8d, dword [rdi + rbx - 0x37]
movsx r11d, dx
imul r9w, r9w
inc edi
add ecx, r8d
xadd r9d, r11d
add r11, 0x28a566a8
mov dword [rbx + rdi - 0x38], ecx
or edx, r9d
mov edx, dword [rdi + r10 - 0x3c]
lea r10, [r10 + rdi*2 - 0x74]
xor edx, esi
and r9, r11
shr r9d, 0xd7
call fcn.140843afa

Function at 0x140820d21
Capabilities:
Encode data using base64

Disassembly:
push rax
xor qword [rsp + rdx*4], rsi
xor dword [rsp + rdx], edi
pop rsi
not dx
movsxd rdi, edi
bt dx, 0x13
xadd rax, rcx
adc rbp, rdi
call fcn.140874060
call fcn.1407f60d5
add dil, r11b
mov byte ss:[rax + rdx*2 - 0x6c1a2d06], cl
mov edi, dword [r10 + rdx*2 - 0x6c1a2d06]
lea rcx, [r8 - 0x4bca456d]
sar r8d, cl
movzx eax, r9b
lea r10, [r10 + rdx - 0x360d167f]
shr ax, cl
xor edi, esi
lea rcx, [rcx + rcx*4 + 0x7986a321]
jmp 0x1408687a1
rol r11, cl
xor edi, 0x1ca8dbb4
lea r9, [rcx + r11*2 - 0x32ea0948]
shr r11b, 0xa6
neg edi
btc r11w, dx
mul rdx
bswap edi
xor edi, 0x4424dc11
jmp 0x140808aec
Function at 0x140824188
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov r8d, 0xbe9d1610
movzx r11d, word [r10 + riz]
mov qword [rsp], r8
movsx edi, byte [rsp]
or r8w, 0x9ebd
xor r11w, si
ror di, 0xaf
setb r8b
movsx edx, word [rsp + rdi - 0x20]
xor r11w, 0xbb80
lea r9, [rdx*8 + 0x2091a809]
not r11w
dec r11w
movzx ecx, r9w
xor r11w, 0x9baf
or r9w, 0x21bb
xor si, r11w
lea r11, [rsp + r11 + 8]
add qword [rsp + rdi - 0x20], 0x55059103
jge 0x140801ca2
mov ecx, 0x4eabb281
movzx edi, cl
mov edx, dword [r10 + rcx - 0x4eabb281]
jmp 0x1408520f8

Function at 0x140825a7e
Capabilities:
Encode data using base64

Disassembly:
sub dil, r8b
mov qword [rsp + rdi - 0x3fc7b769], rsi
xor dword [rsp + rdi*2 - 0x7f8f6ed2], eax
pop rsi
xor dil, 0x80
sal di, 0x2d
shl r8, cl
movsxd rax, eax
cmovp r11, r8
cmovns r9w, r8w
btr dx, r8w
adc rbp, rax
mov rcx, qword [rbx + r9 - 0x12850000]
btc rdx, r9
call fcn.140873882
mov edx, 0xc6191428
movsx r8d, dx
movzx eax, r8w
mov ax, word [r10 + r8*4 - 0x50a0]
movsx r11d, r8w
mov r9d, 0xd8022219
add edx, edx
lea r10, [r10 + r8*2 - 0x284e]
shl r9b, 0x22
mov ecx, r8d
xor ax, si
ror r8b, 0x61
btc r11w, dx
xadd r11, r9
Function at 0x1408299c2
Capabilities:
Encode data using base64

Disassembly:
neg ecx
rol ecx, 1
not ecx
rol r8d, 0xb4
dec dx
push rsi
mov esi, edi
xor dword [rsp + rdi - 0x498], ecx
ror r11d, 0x3e
xor edi, 0xad05452e
movzx eax, si
pop rsi
xadd r9w, dx
or r11b, 0x14
movsxd rcx, ecx
dec dil
sal r11, 0xd
adc rbp, rcx
neg di
xor dx, r8w
cbw
jmp rbp
lea r9, [r11*8 + 0x7a846a04]
pop r11
xor dx, si
bt r9d, 0x3e
xor r8w, ax
adc dx, 0x2f07
sub r9, 0x2b04472d
jb 0x1408142b9
ror dx, 1
dec r8b
add cx, ax
and r8, rax
inc dx
shr r9w, cl
shr eax, cl
ror dx, 1
inc dx
lea r11, [rcx*8 + 0x5abcc929]
push rax
xor dx, 0xc99b
call fcn.1408051b0
lea rbx, [rbx + r8 - 0x72bffe90]
movzx edi, dl
push rcx
jmp 0x14083ce22
popfq
movzx r11d, di
movzx ecx, di
mov ecx, dword [r10 + rdx - 0x98]
lea r9, [r11 + rdi*4 + 0x73247d3e]
bts di, 0x8a
ror dx, 0x6b
lea r10, [r10 + r8 - 0x72bffe94]
ror r11b, 0x41
push rdi
xor ecx, esi
bswap ecx
xor ecx, 0xeda5e495
mov byte [rsp + rdx - 0x12f9], r8b
dec r11w
sub r11, qword [rsp + rdx*2 - 0x2600]
bswap ecx
sbb byte [rsp + r8 - 0x72bffe91], 0x92
shr r11, 0xe1
pop r11
ror ecx, 1
imul r11d, r8d
jb 0x14080b4a4
movzx edx, byte [r10]
xor dl, sil
mov r8d, 0x84ad7688
mov r9d, 0x3b3e772b
add dl, 0xbb
mov ecx, r9d
bts rcx, 0xa2
neg dl
dec rcx
inc dl
mov eax, 0xe90762ac
jmp 0x140842586
sal eax, 0x91
ror dl, 1
push r9
xor sil, dl
sal word [rsp + r9 - 0x3b3e7725], cl
bt r9, 0x2a
lea rdx, [rsp + rdx + 8]
lea rdi, [r9*8 + 0x683950b7]
btr r8w, ax
mov r9d, dword [r9 + rdx - 0x3b3e772b]
btc edi, edi
or rdi, rcx
mov dword [rbx + riz - 4], r9d
jo 0x1407f73a0
mov edi, dword [r10 + riz + 1]
pop r11
movsx edx, r8w
lea r10, [r10 + r11 - 0x3b3e7726]
shl dx, cl
add cx, r11w
idiv rax
xor edi, esi
inc edi
not edi
dec edi
and edx, r8d
bt ax, 0xf
mul dl
neg edi
lea r8, [r11 - 0x2bd20e7d]
shl edx, 0x2b
push rsi
lea r9, [rdx + rax + 0x6c9e4a20]
btc edx, ecx
sub edx, 0x30bc38a7
xor dword [rsp + r8*8 - 0x7b634570], edi
call fcn.140810702
inc dword [rsp + r8 - 0x3787840a]
sub edi, 0xf4b4f6b1
mov qword [rsp + rax - 7], rsi
movzx r9d, ax
lea r8, [rcx + 0x593749bf]
xadd r8d, eax
xor dword [rsp + r8 - 0x48a7f9], edi
pop rsi
ror rcx, 0x37
movsxd rdi, edi
lea r11, [rax + r9*2 + 0x26b45f3b]
shl r8d, 0xfc
add rbp, rdi
movsx edx, cx
movsx edi, r9w
cdqe
mov rdi, qword [rbx + rax - 0x48a7f2]
call fcn.140864d05

Function at 0x14082cf34
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
sal r11, 0x41
dec r8
adc rbp, rax
push rdx
mov r9d, 0x42360820
movzx eax, word [rcx + r10 + 6]
bts ecx, r9d
setb byte [rsp + r8 - 0x39a2fffc]
jae 0x1407f68fd
dec rdx
rol eax, 2
shl r11, 0x71
neg eax
and word [rsp + r8 + 8], 0x63b5
shl r11b, 0x47
rol eax, 2
mov qword [rsp + r8*4], rdi
xor eax, 0xfbb98e0b
shl r8w, 0x81
adc qword [rsp + r8*2 + 8], rsi
sar r11d, 0x7a
imul r8w, r8w
xor dword [rsp + r8 + 8], eax
pop rdx
add r8, 0x39a3af8e
not r11w
pop rsi
and r8w, di
movsxd rax, eax
jp 0x1407f97f1