joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009ab20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x180129400]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18009abcf
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x18009ac97
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x18009ac85
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x18009ac85
shr ecx, 1
je 0x18009ac43
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x18009ac39
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x18009ac30
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.18009a9b0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.18009a610
jmp 0x18009ac9f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.18009acc0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.18009fc10
add rsp, 0xae0
pop rbx
ret
Function at 0x18009ad60
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180129400]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x1800ae220]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x1800ae224]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x1800ae208]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x1800ae218]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x18009ae64
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18009ae18
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x18009ae87
inc ax
mov word [rsp + 0x6a], ax
jmp 0x18009ae33
cmp eax, 0xe7
jne 0x18009ae87
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x18009ae87
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x18009adf8
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18009fc10
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x18009ae69

Function at 0x18009ae90
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x18009aeb0
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x18009aea6
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18009aea6
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18009af3b
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x18009af50
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x18009af24
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.18009ad10
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x18009af60
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x18009af76
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x18009af83
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18009af7b
test rdx, rdx
je 0x18009af7b
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18009afba
cmp dword [rsp + 0x50], edi
jne 0x18009afba
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14088fa0e
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
sar dx, 0x88
mov eax, dword [rsi + rdx - 0x15140019]
mov qword [rsp + rdx - 0x15140019], rcx
mov ebp, 0x4691c790
lea rsi, [rbp + rsi - 0x4691c78c]
shr dx, 0xe1
adc r8d, ecx
xor eax, ebx
and byte [rsp + rbp - 0x4691c78b], dl
and rdx, 0x551ba103
bt r11w, cx
ror eax, 3
rol ebp, cl
sar byte [rsp + rdx - 0x150ffffd], 2
xor eax, 0x53be47a3
push rdx
sar r11b, 0xa6
rol eax, 2
sar dx, 0xc1
or dl, r11b
dec eax
inc r11
neg bp
mov qword [rsp + rdx - 0x150ffff8], rbx
xor dword [rsp + rdx*4 - 0x543ffff8], eax
call fcn.1408cb958
cwde
xor ecx, ebx
imul esi, dword [rsp + rdx*2 + 0x17]
xor ecx, 0x249df894
imul si, word [rsp + rdx + 0x15]
imul dx, r8w
or r8b, byte [rsp + rdx + 0x8016]
lea ecx, [rcx + rdx + 0x58b9499e]
rol ecx, 1
movzx r10d, byte [rsp + rdx*8 + 0x40004]
shr r8, 0x71
call fcn.1408e039d
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x14091c5c7
mov r9d, 0x5b854094
push r9
push r9
mov r9, rax
lea rsp, [rsp + 0x10]
jmp 0x14090dc11
push 0x328be50e
call fcn.14090dc07
mov eax, 0x7128d839
mov rax, qword [rbp + rbx*8 + 0x20]
jmp 0x1408bda63
Function at 0x14089851c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffff8b87ccb5
movsxd rax, eax
mov qword [rsp + 0x20], 0x34812ca9
mov qword [rsp + 8], 0xffffffffb5319faf
jmp 0x1408eeec9
add rdi, rax
call fcn.1408c25ef

Function at 0x140898559
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r8b
cqo
rol r9w, 0x89
xor bl, r8b
lea r8, [rsp + r8 + 0x20]
mov qword [rsp + rdx + 1], rcx
cdqe
call fcn.14088ca5e
mov ebp, 0x2b92bcbe
movsx r8d, bp
mov cx, word [r10 + rbp*2 - 0x5725797c]
movsx r11d, bpl
mov r9w, word [rbp + r10 - 0x2b92bcbc]
or cx, r9w
lea r9, [r8 + r11*4 + 0x2e35591c]
movsx edx, r8w
sub r11, rbp
not cx
dec r11
mov word [rbp + r10 - 0x2b92bcbc], cx
mov r8d, dword [rbp + rsi - 0x2b92bcbe]
xor r8d, ebx
xchg edx, ebp
mov ecx, r11d
sub r8d, 0xf4025733
bswap r11d
xadd r11w, bp
bswap r8d
lea rbp, [r11*4 - 0x13d2e655]
inc r8d
add r11, rcx
xor r8d, 0xaa1cf13d
xor r9w, cx
xchg rcx, r9
inc r8d
xadd rbp, r9
xchg ecx, edx
neg r8d
ror r11w, 0x8c
neg ebp
xor r8d, 0x48ba9536
movzx eax, cx
ror bp, 0x85
push rbx
movzx ebx, r9b
bt dx, cx
xor dword [rsp + rdx*2 - 0x5c6aac5a], r8d
lea rax, [rbp*2 - 0x38d47360]
not r11d
cqo
pop rbx
inc cx
movsxd r8, r8d
ror rax, cl
adc rdi, r8
call fcn.140938a2c
mov rsi, qword [r9]
jmp 0x14093709a
mov edx, 0xfb003281
mov r8d, dword [rsi + riz]
movzx esi, dx
mov dword [r9 + rsi*2 - 0x64fe], r8d
mov r8d, dword [rbp + rsi - 0x3281]
xor r8d, ebx
movzx ecx, dl
inc cl
lea r8d, [r8 + rsi + 0x5f283a06]
not r8d
call fcn.1408e184c

Function at 0x14089928e
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg al
call fcn.140915b29
mov r8d, 0xc2d8291
mov edx, dword [rbp + r8*8 - 0x616c1488]
xor edx, ebx
not edx
ror edx, 2
neg edx
mov r10d, r8d
sub r8, 0xffffffffeeb2850d
call fcn.1408b4c62
mov edx, 0x67853fac
mov r9, qword [r10 + rdx - 0x67853fac]
sub dx, 0xcfab
add rdx, 0x598b4990
mov r8b, byte [r10 + riz + 8]
movsx r11d, dx
mov eax, edx
mov ebp, r11d
adc r10, 0xa
mul dx
xadd rbp, r11
mov byte [r9 + riz], r8b
movzx r8d, ax
add r11d, 0xa5adb693
imul ax, ax
mov r8d, dword [rsi + r8*2 - 0x1c842]
adc rsi, 3
shl rbp, 0xaa
dec r11b
xor r8d, ebx
mul rax
movsx r9d, dl
adc ax, dx
ror r8d, 1
call fcn.14092cde3

Function at 0x1408994c1
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
shl r8, cl
ror al, 1
mov qword [rsp + r11*2 - 0x6e56cc76], r11
lea rdx, [rdx*4 + 0x1d268920]
mov qword [rsp + r11 - 0x372b6633], r9
dec al
rol al, 1
btr r11, rbp
sbb al, 0x8d
push r9
xor al, 0x2b
jmp 0x1408b5060
jmp 0x1408eea79
Function at 0x140899c30
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
btr r10, 0x84
pop rdi
pop r10
jb fcn.1408dc1c2
xor dil, dl
xor bl, dil
xchg byte [rsp + rdx + 0x11], dl
mov qword [rsp + rdx*4 + 0x418], rbp
mov qword [rsp + rdx + 0x110], r11
pop rdx
movzx ebp, word [rsp + rdx*4]
bts rdx, rdx
xor qword [rsp + rdx*4 - 4], rbx
add edx, ebp
or rbp, r9
mov ebx, edi
mov edx, ebx
push 0xffffffffd8ae152c
ror byte [rsp + 5], 1
xor ecx, ecx
cmp ebx, 4
call fcn.1409213da
movsxd rbp, ebp
mov qword [rsp + rdx - 0x616fff8], 0xffffffffc68b6b33
and cl, 0x17
adc rdi, rbp
cwde
inc r9w
pop rcx
pop rbp
jno fcn.1408f7a06
rol r8, 1
neg edx
xor rbx, r8
xchg rcx, rdi
mov qword [rsp + rsi + 0x4a90bda7], rcx
mov qword [rsi + r9 + 0x4a90bd97], r8
xchg byte [rsp + rax*4 + 0xa], dl
lea r8, [rdx + r10*4 + 0x263faf8a]
btr esi, r10d
lea r9, [rax + r9 - 0x10]
neg byte [rsp + rax*4 + 2]
jnp 0x140896dfd
Function at 0x14089b4d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
mov qword [rsp + rax - 0x1de], rbx
mul rdi
jae 0x1408bc333
mov r8d, 0x7a9ffbba
mov ecx, r8d
mov r8d, dword [rsi + r8 - 0x7a9ffbba]
jmp 0x140907bf7
call fcn.1408d5fff
xor bl, cl
call fcn.1408f81da
mov r11d, 0x349ff90f
movzx r8d, r11b
mov edx, dword [r10 + r11 - 0x349ff90f]
btc r8, r11
movzx ebp, r11w
movzx r11d, byte [r8 + rsi - 0x800f]
xor r11b, bl
movzx ecx, bp
xor r11b, 0x1b
movsx r9d, cx
sub r11b, 0xad
ror r11b, 1
dec r11b
sub r8, r8
sal r8d, 0x19
neg r11b
or r8d, r8d
not r9w
xor bl, r11b
lea r9, [rcx + r8*4 - 0x85f6249]
add r11, rsp
call fcn.140908dec
lea rsi, [rsi + rcx - 0x7a9ffbb6]
movsx ebp, cl
bts ebp, 0x17
ror rbp, 0x46
xor r8d, ebx
lea r9, [rbp*2 - 0x20642950]
btc ebp, ebp
rol r8d, 3
movzx eax, bp
neg r8d
or rbp, 0x7f82a33b
xadd ax, r9w
rol r8d, 2
dec ebp
xor r8d, 0x1ead5b0f
dec bpl
dec r8d
ror bpl, 0x46
or cl, 0xb7
push rbx
mov edx, eax
and bp, 0xdf1e
imul rax, rax
xor dword [rsp + rbp - 0x7fffdf16], r8d
movzx ebx, bp
inc ebp
pop rbx
sal ax, 0xa6
jne 0x140930e38
mov eax, 0x88ad4a8d
cqo
sal al, 0x23
movzx r8d, byte [rsi + rdx*4]
lea r9, [rdx + rdx*8 - 0x10fe6b46]
push rdx
xor r8b, bl
sal rdx, 0xb7
sal qword [rsp + rdx*2], 0x57
rol r8b, 1
cwd
shr rdx, 0xd2
mov ecx, dword [rsp + rdx + 4]
not r8b
movzx ebp, r9b
xchg cl, dl
lea r11, [rax + rbp*2 - 0x75ea9a64]
dec r8b
xadd bpl, cl
xor r8b, 0x25
shr rdx, 0xd0
sar edx, cl
xor bl, r8b
lea r8, [rsp + r8 + 8]
sub dword [rsp + rdx + 2], r11d
shr rax, cl
sar cl, 0x41
mov cl, byte [r8 + rax*2]
bts rdx, 0x3d
adc r11b, r9b
mov word [r10 + rax*4 - 2], cx
xor r9, rax
shr word [rsp + rax + 1], 0xcb
btc rax, 0xa9
or eax, dword [r10 + r9 + 0x10fe6b44]
or edx, 0x9730f382
lea r10, [r10 + r9*4 + 0x43f9ad1a]
xchg dword [rsp + r9 + 0x10fe6b4a], r11d
mov dword [rsp + rbp*4 - 0x2e4], 0xa42ae282
movzx ecx, byte [rsi + r9*2 + 0x21fcd68d]
xadd qword [rsp + r9 + 0x10fe6b46], r11
adc dword [rsp + r9*2 + 0x21fcd68d], r11d
xor cl, bl
xor cl, 0x1b
push r9
pop rdx
sub cl, 0xad
ror cl, 1
dec cl
or word [rsp + rdx*4 + 0x43f9ad1c], 0xb230
neg cl
push rdx
jmp 0x1408e9241
movzx r11d, cx
movsxd r8, r8d
adc rdi, r8
sal dl, 0x61
rdtsc
lea r8, [r9 + r9*8 - 0x45690d2]
dec r11w
ror bp, 1
lea r10, [rcx + r10 - 0x7a9ffbc7]
adc r8w, 0xa110
mov dword [rcx + r10 - 0x7a9ffbbb], eax
and r11, rcx
movzx eax, r9w
mov dword [rcx + r10 - 0x7a9ffbbf], edx
jno fcn.1408f7a06
Function at 0x1408a16c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0xffffffffafa681a6
neg byte [rsp + 2]
mov ecx, dword [rbp + riz]
mov edi, 0xf28460b
movzx eax, di
lea rbp, [rbp + rdi - 0xf284607]
sbb byte [rsp + rdi*2 - 0x1e508c11], al
setnp byte [rsp + rdi - 0xf28460a]
xor ecx, ebx
movsx r8d, byte [rsp + rdi - 0xf284608]
inc di
movzx edx, ax
xor ecx, 0x99ae1593
mul rdi
lea ecx, [rdi + rcx + 0x58885001]
not r8w
shl qword [rsp + rdi - 0xf28460c], 0x62
sal qword [rsp + rdi*8 - 0x79423060], 0xb
xor ecx, 0x7b92c1bc
bswap edi
ror ecx, 1
inc ecx
imul edi, edi
mov qword [rsp + rdx], rbx
lea r10, [rdx - 0x717dd373]
adc edx, 0x8da90690
xor dword [rsp + r10 + 0x717dd373], ecx
sub r8b, 0xaa
pop rbx
movsxd rcx, ecx
shl dx, 0x67
sub rdi, rdx
movsx esi, ax
add r11, rcx
ror r10w, 1
not dx
ror sil, 7
mov r9, qword [r9 + rdi*2 + 0x6e612f3e]
jae fcn.1408dc1c2

Function at 0x1408a423e
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea r9, [r9 + rsi*2 - 6]
pop rcx
pop rcx
jnp fcn.1408dc1c2
sub rsp, rcx
push 0x411e9928
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
call fcn.140933a35
Function at 0x1408a58a0
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov dword [r9 + riz + 4], ecx
sar dil, 0x42
mov r10d, dword [rbp + riz]
mov esi, 0x99d2b09
pop rax
lea rbp, [rbp + rsi - 0x99d2b05]
xor dil, 0xa6
xor r10d, ebx
rol r10d, 3
xor r10d, 0xcb17cf1c
movsx ecx, di
lea rax, [rcx + rdx + 0x42282e93]
not r10d
xadd dx, r8w
cdqe
neg cx
lea r10d, [r10 + rsi + 0xcf25aff]
bswap r8
shl r8d, cl
sar dil, 0xc2
push rbx
setns sil
xor dword [rsp + r8], r10d
pop rbx
mul si
movsxd r10, r10d
adc rdx, rdx
jns 0x140905886
neg r10w
btr edx, 5
call fcn.14092a37b
lea r10, [r10 + rbp*2 - 2]
pop r9
neg r8w
sar rbp, 0x41
mov word [r10 + rbp*2], ax
pop rdx
pop r11
jge fcn.1408f7a06
mov r11d, 0x2eaea936
movzx ebp, r11w
mov r11, qword [r10 + r11*2 - 0x5d5d526c]
mov rdx, qword [rbp + r10 - 0xa92e]
mov eax, ebp
movsx ecx, bpl
add r11, rdx
lea rdx, [rbp - 0x606f6df7]
mov qword [rbp + r10 - 0xa92e], r11
mov r8d, dword [rsi + rbp - 0xa936]
xor cl, 1
movzx r11d, dl
jne 0x14092adf9
lea r8, [r9 - 0x56f02154]
not eax
bswap r8d
dec eax
ror r9b, cl
sar edx, cl
push rbx
push rdx
or cx, 0x32aa
movzx r11d, word [rsp + rbp*8]
xor dword [rsp + rbp*4 + 8], eax
jmp 0x1408e3b7e
inc word [rsp + rbp*4 + 6]
mov rbx, qword [rsp + rbp*2 + 8]
bt r9, r8
movsxd rax, eax
mov qword [rsp + rdx], r8
add rdi, rax
movzx ecx, word [rsi + rdx*8 - 0x40]
rol word [rsp + rbp*8 + 7], 3
lea rsi, [rsi + rbp*8 + 2]
movsx eax, r9b
xor cx, bx
push r9
xor cx, 0xe114
sal r9w, 6
dec cx
xor cx, 0x560a
cdq
add cx, dx
xchg r8, rdx
sar eax, 0xa8
ror cx, 1
cbw
sub cx, r8w
cbw
xor bx, cx
xor r11d, 0x8d19a318
lea rcx, [rsp + rcx + 0x18]
shl r11b, 6
mov ax, word [rcx + rbp]
jns 0x1408c0d57
shl r8d, cl
adc r11, r10
inc dl
not di
lea r8, [r8 + r9 + 4]
mov r10d, ecx
jl 0x140932688
mov edx, dword [rbp + riz]
mov r10d, 0xb0aa3eae
add rbp, 4
call fcn.1409369f2
lea rsi, [rsi + rbp*4 - 0x2a4d4]
sar rcx, 0x51
lea r11, [rbp*2 - 0x755248e4]
xor r8d, ebx
lea r9, [r11 + rax - 0x315b5562]
bt ebp, r11d
adc r8d, 0xb2b50309
call fcn.1408b58fb
mov qword [r9 + rsi*4 - 0x2674ac08], r8
rol si, 0xe
and sil, r10b
bts ecx, 0xad
lea r9, [r9 + rax*4 - 0x1eec9574]
jae fcn.1408dc1c2
mov eax, 0x9b31fc8b
lea rcx, [rax + rax*8 + 0xfa376a1]
mov eax, dword [rsi + riz]
add rsi, 4
xor eax, ebx
movzx ebp, cl
bswap eax
movsx edx, bp
lea r9, [rcx + rdx*2 + 0x6a89f1ad]
neg eax
sub bpl, bpl
jle 0x1408c19e2

Function at 0x1408a8666
Capabilities:
Encode data using base64

Disassembly:
shr ecx, 8
rol qword [rsp + 8], 0x12
xor ecx, ebx
push 0xffffffffe89ee703
mov qword [rsp + 8], 0x1588c937
jmp 0x1408dda87
inc rdx
and byte [rsp + 0xd], 0xae
jge 0x1409109fe
Function at 0x1408a9763
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
movsx edi, r8w
mov qword [rsp + rdx*2 - 0x2e942e86], rdi
mov rbx, qword [rsp + rdx - 0x174a173b]
lea rax, [rdx + r8*2 + 0x54225eb2]
bts rdx, 0x15
lea rsi, [rax*8 - 0x17640f78]
movsxd r10, r10d
adc r11, r10
sub r8b, al
jno 0x1408d975e
movzx r8w, byte [r9 + rdx - 0x176a1743]
mov qword [rsp + rdx*2 - 0x2ed42e7e], 0x6900c938
sal dword [rsp + rdx - 0x176a173b], 0x9b
mov dil, byte [r9 + rdx - 0x176a1741]
or rdx, 0xffffffffc819c432
lea r10, [rsi - 0x25fe7bcc]
not r8b
cdq
xor dil, dl
dec rdx
or r8b, dil
bt edx, 0xc
rol dword [rsp + 7], 0xbf
mov word [r9 + riz + 2], r8w
sbb rdx, rsi
movzx r8d, byte [rbp + riz + 4]
xadd dword [rsp + 9], eax
lea rbp, [rbp + rax*2 - 0x17ffffb]
push rsi
neg qword [rsp + rax*4 - 0x2fffffe]
call fcn.14088ddaf

Function at 0x1408a9f23
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x1a9a1b35
lea rsp, [rsp + 8]
add rsp, rcx
push 0x77a72626
sub qword [rsp], 0xffffffffd482a4b5
ror qword [rsp], 0x8e
test ebx, ebx
push 0xffffffff9c119da6
push 0xffffffffaa0a4c33
lea rsp, [rsp + 0x18]
je 0x14090840b
mov eax, 0xf2882da8
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
call fcn.140912e0e
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
jmp 0x1408a72dd
push 0xffffffffbf3a3e28
mov rax, qword [rbp + riz]
push 0xffffffff9b1b1302
push 0x26b89bb2
sub rsp, 8
call fcn.1408e2815

Function at 0x1408ab673
Capabilities:
Authenticate hmac

Disassembly:
xor ecx, ecx
mov qword [rsp], 0x738940b3
add word [rsp + 1], 0x5a39
cmp ebx, 4
lea rsp, [rsp + 8]
jbe 0x14089907e
mov ecx, 0x14264aa9
lea edx, [rcx - 0x14264aa5]
movzx eax, cl
bswap rcx
lea ecx, [rax + rbx - 0xad]
shl ecx, 3
shl edx, 3
push 0xffffffff8e21e99c
mov eax, 0xfd085534
mov rax, rbp
inc qword [rsp]
setle byte [rsp + 4]
add rax, rdx
mov byte [rsp + 6], 0x92
mov qword [rbp + riz - 8], rax
rol byte [rsp], 0x84
not qword [rsp]
shl byte [rsp + 5], 0xe5
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
jp 0x1408c850f
mov ecx, 0xe02e0a09
movzx r10d, cx
lea rdx, [rcx*8 + 0x5b138c9f]
mov r10d, dword [r9 + r10*2 - 0x1412]
mov edi, dword [r9 + riz + 4]
mov cl, byte [r9 + riz + 8]
movsx r8d, dx
and r8b, 0xa5
movsx eax, dx
adc r9, 6
call fcn.140920e32
jae 0x140899043
jns 0x140932862
mov rax, r10
sub r10, 4
mov ecx, 0xe3011e09
mov dword [r10 + riz], eax
mov edx, dword [rsi + riz]
lea r9, [rcx + 0x13bcffaa]
add rsi, 4

Function at 0x1408abacc
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop rax
lea r9, [rdi + r9 - 0x9bf9]
neg r8d
jbe 0x1409153e9
Function at 0x1408acca4
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ebp, byte [rdx + rsi - 0x22a74734]
add dx, word [rsp + rdx*2 - 0x454e8e60]
lea r8, [rax + rdx*8 + 0x6d856609]
rol qword [rsp + rdx - 0x22a78e60], 0x32
lea rsi, [rsi + rdx - 0x22a78e67]
imul qword [rsp + rdx*2 - 0x454f1cc8]
jno 0x1408d5b8b
xor bpl, bl
movsx ecx, ax
call fcn.1408ef192
mov r10w, word [rax + r9 - 0x2f09ba85]
adc al, 0xb3
movzx ecx, al
lea r9, [r9 + rax - 0x2f09ba37]
or cl, al
movsx esi, al
mov word [rax + r8 - 0x2f09ba41], r10w
movsx edi, al
setae dil
not al
mov edx, dword [rax + rbp - 0x2f09babe]
setb al
lea r8, [rax*8 - 0x68deffda]
lea rbp, [rbp + rax*2 - 0x5e1373fc]
sar di, 3
xor edx, ebx
sal r8d, cl
lea r10, [rdi + 0x7819f584]
bswap edx
xor edx, 0xbf24fa2a
inc edx
push rsi
or qword [rsp + rax*2 - 0x5e137400], r10
bswap edx
bt cx, 0x1a
mov qword [rsp + rax - 0x2f09ba00], rbx
adc rdi, 0x5110b9a1
sbb r8b, al
cmovl esi, r10d
xor dword [rsp + rax - 0x2f09ba00], edx
call fcn.1408eeb02

Function at 0x1408ad1db
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
div r8d
movsxd r11, r11d
cdq
add rdi, r11
mov qword [rsp + r9*4 - 0x274], rcx
cwde
dec qword [rsp + r9 - 0x9d]
add rax, r10
dec word [rsp + r9*8 - 0x4e7]
sub r8w, 0xb22c
lea r10, [r10 + r9 - 0xa5]
neg rdx
call fcn.1408e8c0e
rol eax, 1
sub eax, 0xc53ae914
neg eax
mov qword [rsp + rdi*2 - 0x3266], rbx
mov qword [rsp + rdi - 0x193b], rdi
xadd qword [rsp + rdi*2 - 0x326e], r10
xor dword [rsp + r10 - 0x45826516], eax
mov rbx, qword [rsp + r10 - 0x45826516]
bswap rsi
call fcn.140906c60
mov ecx, dword [rsi]
mov r9d, 0x721a4b12
movsx edx, r9b
movzx r8d, r9b
lea rsi, [r9 + rsi - 0x721a4b0e]
xor ecx, ebx
bswap ecx
movsx eax, r8w
neg ecx
ror r8d, 0x5a
btr r9w, 0x36
cbw
xor ecx, 0xfe19e727
imul eax, r9d
xadd r9b, al
sar r8, 0x81
inc ecx
imul r8d, eax
jo 0x14090c45b
lea r11, [rax + r9 + 0x3386623e]
push rbx
xor dword [rsp + rdx*4 - 0x48], ecx
lea rbp, [r11*8 - 0x1afe086a]
bt r8, rbp
pop rbx
add r8b, r11b
cdqe
cqo
lea r10, [r10 + rdx - 4]
push r8
or word [rsp + rdx*2], bp
add r8b, r9b
mov dword [r10 + rdx*8], ecx
cwde
mov r9d, dword [rsi + rdx*8]
neg r11
and word [rsp + rdx + 2], r11w
movsx ecx, r8w
lea rsi, [rsi + rdx*2 + 4]
setno dl
dec qword [rsp + rdx*2 - 2]
dec r8w
xor r9d, ebx
cdq
lea r9d, [r11 + r9 - 0x4888628d]
neg r8b
bswap r9d
xchg dl, r8b
inc r9d
xor qword [rsp + rdx - 0x85], rbp
xor r9d, 0xaa1cf13d
inc r9d
div cx
bswap eax
neg r9d
xor r9d, 0x48ba9536
mul rax
lea rcx, [r8*2 + 0x2dba289c]
cqo
mov qword [rsp + rdx], rbx
shl bp, 0xae
idiv r11w
not r8d
xor dword [rsp + rdx], r9d
mov ebx, 0x9683cb9f
pop rbx
sar r8w, 0xe5
neg rbp
cwde
movsxd r9, r9d
ror rdx, cl
xchg r8d, eax
add cx, 0x5e39
add rdi, r9
jmp fcn.1408f7a06