joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408af8d3
Capabilities:
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
xor r11d, ebx
neg r11d
lea rbp, [rbp*8 + 0x53905ab5]
xor r11d, 0x83279a37
shr bp, 0x61
and rbp, 0xffffffffed9b2ead
rol r11d, 1
lea rcx, [rbp + rbp*4 - 0x284142dc]
bt ecx, ebp
xor r11d, 0x6516ca93
xor rbp, rbp
not bpl
push rbx
or bp, 0xb4
lea rbx, [rcx + rcx*8 + 0x4ca4f33e]
xor dword [rsp + rbp*8 - 0x7f8], r11d
pop rbx
inc bp
xchg bp, cx
movsxd r11, r11d
btc ecx, 0x82
jae 0x1408bb8b0
mov qword [rdx + rax*2 - 0x8a], rbp
neg rcx
mov qword [rsp + r9 + 0xf], 0xffffffffb1a6c025
cqo
mov eax, dword [rax + rsi - 0x44]
rol edx, cl
mov qword [rsp + rcx - 0x40f58f8e], r9
lea rsi, [rsi + r9*4 + 1]
jp 0x14092dcf9
mov ebp, 0x1e81b5b6
lea r11, [rbp*8 - 0x28e61af8]
mov r11d, dword [rsi + rbp - 0x1e81b5b6]
lea rsi, [rbp + rsi - 0x1e81b5b2]
jmp 0x1408ae5f1
jae 0x1408fc3bb
adc rdi, r11
btr cx, bp
call fcn.1408eebea
mov ecx, 0xb4bb4f90
movzx edi, cx
mov edx, dword [rdi + rbp - 0x4f90]
mov r10d, ecx
lea rbp, [rbp + rdi*4 - 0x13e3c]
call fcn.1408b381c
pop r8
xor eax, ebx
movsx ebp, cx
neg eax
xchg qword [rsp + r8], rbp
ror ecx, cl
shl r11d, 1
add eax, r8d
and bpl, r11b
imul r9w, cx
add bpl, byte [rsp + r8*2 + 0xb]
neg eax
shl dword [rsp + r8 + 0xa], 0xa1
rol r8b, 0x26
sar r8b, 0x42
bswap eax
mov qword [rsp + r8 - 8], rbx
sub rdx, r8
xor dword [rsp + r8 - 8], eax
shr r11w, 3
sbb r11b, r9b
mov rbx, qword [rsp + r8 - 8]
xor r9d, r9d
mov qword [rsp + r8*2 - 0x18], r8
movsxd rax, eax
adc rdi, rax
and word [rsp + r8*2 - 0x15], cx
mov qword [rsp + r8 - 0x10], rdi
ret 8

Function at 0x1408b234a
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov qword [rsp + rcx + 0x10], rbx
pop rsi
cdqe
shr di, 0xe1
xor dword [rsp + rax + 0x16f88dd4], edx
push rax
neg rax
sub edi, 0x129fb39c
mov rbx, qword [rsp + rax*4 - 0x5be23720]
mov qword [rsp + rcx + 0x10], rax
lea r10, [rcx + rdi*2 - 0x2aff0f52]
movsxd rdx, edx
xor byte [rsp + rax*2 - 0x2df11b95], ah
sbb dword [rsp + rcx*2 + 1], 0x69bd070e
sar byte [rsp + rcx*2 + 0xc], 0xe5
adc r11, rdx
call fcn.1409133fc
mov ebp, 0xd2a94bbb
sal ebp, 0xa5
sar ebp, 0xb7
mov edx, dword [rsi + rbp*2 - 0x154]
movsx eax, bpl
movsx r11d, bp
movzx r9d, r11b
lea rsi, [rsi + rbp*4 - 0x2a4]
movsx r8d, bpl
mov ecx, 0x5b1c350f
imul r8d, r8d
xor edx, ebx
xor edx, 0x500bc18
rol edx, 1
shr cl, 0x41
sub bp, cx
sub r9w, cx
bswap edx
je 0x140937849
and r9w, r11w
lea edx, [rdx + rax - 0x56c1923]
jno 0x1408b62a3
ror edx, 1
push rbx
and eax, 0xbd0da21a
xor dword [rsp + rbp - 0xcba3], edx
shr r9, 0x45
inc r8w
pop rbx
or r9w, r11w
movsxd rdx, edx
shr r11d, cl
adc rdi, rdx
mov r9d, dword [r10 + rbp*2 - 0x19746]
mov r8d, dword [r10 + rbp*2 - 0x19742]
mov cl, byte [r10 + rbp*4 - 0x32e84]
xchg r11b, al
btc bp, ax
lea r10, [r10 + r11*2 - 0xe]
sal rax, 0x93
rol r11, 0x18
shrd r9d, r8d, cl
cbw
movsx r8d, ax
lea rdx, [rbp*4 - 0x154a4cd]
mov dword [rbp + r10 - 0xcba1], r9d
movsx r9d, dx
shr r11b, 0x83
shr rax, 0xc
xor r8, rdi
jmp r8

Function at 0x1408bb54b
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push 0x1c0521be
jmp 0x1408de65a
Function at 0x1408bb8d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rcx*2 - 0xa6], rbx
add cl, r10b
imul cx
xor dword [rsp + rcx - 0x57], edi
xadd r10w, cx
cwde
cbw
pop rbx
bts rdx, rcx
not rdx
or rsi, 0xffffffffca9a858b
movsxd rdi, edi
sbb r10b, r10b
lea rdx, [r8 + 0x78aa010b]
adc r11, rdi
inc ax
btc esi, eax
btr edx, ecx
jb fcn.1408dc1c2

Function at 0x1408bdc1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r9, [r9 + r10*2 - 0x30]
movsx edx, di
adc r10b, dl
and cl, al
not cl
jmp 0x14090eb7c
call fcn.1409098d7
mov eax, 0x28b85e19
movzx edi, al
movsx r10d, dil
movzx cx, byte [r9 + rax*2 - 0x5170bc32]
shl rdi, 0x9d
mov al, byte [r9 + rax - 0x28b85e17]
adc dil, 0x3a
btr r10d, edi
jae 0x1408b42a4
movsx r8d, di
mov word [r9 + r10*2 - 0xa6], cx
shr r8, 0xd7
mov edx, dword [r10 + rbp - 0x53]
movsx ecx, di
lea rbp, [rbp + r10*2 - 0xa2]
dec r8d
call fcn.1408fe2ab
mov edi, 0xc631a895
lea rcx, [rdi + rdi*4 - 0x1bd23e41]
movsx edx, di
mov r10d, dword [rbp + riz]
sal rdx, cl
lea rsi, [rdx*8 - 0x64c376d4]
sbb rbp, 0xfffffffffffffffb
shr sil, 0x64
xor r10d, ebx
shr rdx, 0x67
not r10d
shl si, 0x24
lea rdi, [rdi*2 + 0x368f791f]
ror r10d, 2
mov r8d, edi
neg r10d
xchg cl, r8b
sar cx, cl
or rdx, rsi
ror r10d, 1
lea rax, [rsi + rsi*8 + 0x7e25169f]
neg r10d
xchg r8d, eax
push rbx
btr r8, rcx
shr cx, cl
ror edx, 6
xor dword [rsp], r10d
mul ecx
pop rbx
inc eax
push rax
shl r8w, 0xce
movsxd r10, r10d
and word [rsp + rax*8 - 0x67800002], di
jbe 0x140915c5e
Function at 0x1408be96c
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov ebp, dword [rsi + riz]
movzx r11d, dx
rol r11w, 0xd
xor ebp, ebx
lea rax, [rdx + rdx + 0x588d461d]
mul r11
inc ebp
cdq
bswap ebp
sal dx, 0xa4
rol ebp, 2
mov r8d, 0x3db25512
and al, ch
xor r11w, cx
inc ebp
not ebp
imul r11w, r8w
push rbx
jo 0x1408ba5a0
neg r8b
cqo
inc r8b
xchg rdi, rax
xor bl, r8b
neg edi
ror dx, 0x61
sbb rdx, rax
add r8, rsp
sar esi, 0xff
add r10b, dil
mov rcx, qword [r8 + rsi*2]
bts r10w, ax
mov qword [rsi + r9 - 8], rcx
xor eax, 0x4628c301
jne 0x1408dcf75
adc r11, rdx
lea rdx, [rcx + rdi - 0x435ffc74]
cdq
not rdi
movzx edi, word [rbp + rsi*2 - 0x3fec80]
push rdx
not r8
lea rbp, [rbp + rsi*4 - 0x7fd8fe]
push rax
inc eax
xor di, bx
mov r10d, esi
sar esi, cl
mul r8w
neg di
btr eax, 0x32
pop rsi
rol di, 1
xor di, 0x623e
sub di, 0x3c81
cdq
not di
or rax, qword [rsp + rsi - 0xbd]
ror ecx, 0xdc
xor bx, di
jmp 0x1408f424e
push r8
movzx r9d, al
xor dword [rsp + r11 - 0x9780], ebp
cdqe
dec dl
mov rbx, qword [rsp + r11 - 0x9780]
movsxd rbp, ebp
btc rcx, r8
sal r9d, cl
shl r9w, 0xeb
adc rdi, rbp
add dx, cx
jne 0x140924722
pop rax
inc ebp
xor word [rsp], dx
pop r8
neg ebp
btc r8w, 0x26
bswap ebp
push rbx
jb 0x1408e33b9
xor r8b, bl
lea rax, [rdi + rsi*8 + 0x45971525]
movzx r10d, al
ror r8b, 1
dec r8b
inc esi
jge 0x1408b2f88
mov byte [rsp + rdi - 0x9a16b9b], ch
mov qword [rsp + rdi - 0x9a16b9c], rbx
movzx r8d, dil
xor dword [rsp + rax - 0x9d], esi
btc di, 0x8a
mov edx, r8d
add r10d, 0xc981378d
pop rbx
div r10w
movsxd rsi, esi
rol r10d, cl
div rdi
add r11, rsi
rol di, 0x82
neg dil
movzx edx, byte [rbp + rdi*2 - 0x13437d1e]
cmovo rdi, rax
dec r8w
ror r8, cl
lea rbp, [rbp + rdi*2 - 0x13437d1d]
call fcn.1408d66b9
mov ecx, 0xc08f60b2
mov edx, ecx
jmp 0x140898e0a
movzx eax, word [rsi + rbp + 1]
xor ax, bx
movzx ecx, si
xchg dil, r10b
not ax
lea r10, [r10 - 0x76c096a]
movsx r8d, dx
push rsi
rol ax, 1
call fcn.1408dbe62
sal esi, 0x89
cwde
lea rdi, [rsp + rdi + 8]
dec al
adc ecx, 0x6a1eb6ad
mov ecx, dword [rdi + rsi*2 - 0x2f400]
ror word [rsp + rsi*4 - 0x5e7fe], 0x61
adc r10d, r10d
lea r9, [r9 + rsi*4 - 0x5e804]
add qword [rsp + rsi - 0x17a00], 0x3f07232d
mov dword [r9 + rsi*2 - 0x2f400], ecx
cdqe
idiv ax
pop r10
jmp fcn.1408dc1c2
add cx, 0xa528
movzx r11d, byte [rsi + r11*8 - 0x4bc3c]
shl rcx, cl
xadd r8b, r9b
lea rsi, [rsi + r8*2 - 0x7b64aa1f]
mov qword [rsp + rax + 0x38fd0f08], r8
adc r9d, 0xb41e0788
xor r11b, bl
rol r11b, 1
rol edx, 0xbf
not r11b
shr byte [rsp + rax*2 + 0x71fa1e01], 0x21
xchg byte [rsp + r8*2 - 0x7b64aa19], dl
adc r11b, 0x2d
rol qword [rsp + rax*2 + 0x71fa1e08], 0x91
rol r11b, 1
pop r8
inc qword [rsp + r8*2 - 0x7b645424]
xor bl, r11b
lea r11, [rsp + r11 + 8]
call fcn.14090fb8a
neg r11b
mov bpl, byte [rdx + r10 - 0x413a]
neg ecx
sub r11b, cl
shr dx, 0xef
mov byte ss:[r9 + rcx - 0x3ee8a8f1], bpl
call fcn.1408c19b4
Function at 0x1408c1690
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
mov rbx, qword [rsp + rcx*2 - 0xa0fe]
movsxd r8, r8d
mov qword [rsp + rcx*2 - 0xa10e], rdx
cbw
cwd
add r11, r8
shl sil, cl
cwde
mov esi, dword [rax + rbp - 0x2c]
dec rdx
mov qword [rsp + rax - 0x20], 0xffffffffd6942a93
jne 0x14092f17a
mov edi, 0xca136780
movsx r10d, di
mov eax, dword [r9 + r10 - 0x6780]
mov edx, r10d
lea r9, [r9 + r10 - 0x677c]
movzx edi, word [rbp + r10*2 - 0xcf00]
inc r10b
lea rbp, [rbp + r10 - 0x677f]
mov esi, edx
sar dl, 3
xor di, bx
not rsi
lea rcx, [rdx + r10*4 + 0x299f7218]
neg di
dec si
rol di, 1
sub rcx, rsi
shr sil, 0x81
dec di
ror dl, 0xc5
movzx r8d, dl
sbb r8, rdx
rol di, 1
call fcn.1408d5177
mov r10w, word [r9]
mov esi, 0x1c3f18a8
mov r8w, word [r9 + rsi - 0x1c3f18a6]
movzx edi, si
add dil, 0x27
mov cl, byte [rsi + r9 - 0x1c3f18a4]
lea rsi, [rsi + rsi*4 + 0x42b1ec37]
push rdi
lea r9, [r9 + rdi*4 - 0x6338]
sar esi, 0xca
shld r10w, r8w, cl
lea rcx, [rsi + rsi*4 - 0xdd3357a]
shr qword [rsp + rdi - 0x18cf], 0x1f
sar qword [rsp + rdi*4 - 0x633c], 0xc7
mov word [r9 + rdi*2 - 0x319e], r10w
movzx eax, word [rsp + rdi*2 - 0x319b]
movzx r10d, ax
push r10
mov ecx, dword [rdi + rbp - 0x18cf]
sets dil
shl r10b, 0x63
lea rbp, [rbp + rdi*8 - 0xbffc]
xor ecx, ebx
rol al, 0xa6
neg ecx
sub ecx, 0xa69ee8b0
sal esi, 0x8c
neg ecx
dec ecx
lea rdx, [rdi + 0x1b9319a4]
bswap ecx
bt ax, r10w
rol rdi, 0x1a
lea ecx, [rcx + rax*4 - 0x2481d0a1]
ror word [rsp + rax + 0xb], 0x6a
jae 0x1408b080f
xor dil, bl
movsx r10d, r8b
or r8b, r8b
call fcn.1408dd155
lea rbp, [rbp + rcx*4 - 0x14214]
rol r10d, cl
xor esi, ebx
shl edi, cl
imul dword [rsp + rax*4 - 0xba]
sal ecx, cl
sbb esi, 0xd82a7a8b
call fcn.140909405
mov bpl, byte [r10 + rax - 0x5808c8ba]
idiv r9d
lea r10, [r10 + rax - 0x77e061]
idiv r8b
bt r9, 0xbf
and r11b, bpl
cdqe
not r11b
bt eax, 0x39
lea rcx, [r9*4 - 0x224b3bc2]
lea rbp, [rax + r8 + 0x37828db2]
mov word [rax + r10 - 0x77ff77], r11w
shr bpl, 0xa1
not rdx
mov eax, dword [rsi + rax - 0x77ff77]
lea r9, [r9*8 + 0x53927782]
bt rcx, rdx
lea rsi, [rsi + rdx*2 + 0x16]
movsx r11d, bpl
xor eax, ebx
shr r8d, cl
not eax
lea r8, [rdx + rcx*2 + 0x5cb97c09]
xor ebp, 0x6e3761bd
neg eax
and cl, 0xa5
shl r11, 0xab
sets dl
lea eax, [r9 + rax + 0x81027c7]
inc r9w
neg eax
call fcn.1408b28db

Function at 0x1408c34e0
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x1408da54f
mov r8, rax
call fcn.1408c54c6
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0x140938437
mov rdx, rax
jmp 0x14090dc11
call 0x14088fa0e
movsxd rdx, edx
cdqe
add r11, rdx
movzx edx, r8w
jmp fcn.1408dc1c2
jmp 0x1408a3f20
cmp ebx, 3
push 0xffffffffe42f5ea8
lea rsp, [rsp + 8]
jne 0x1408db523
mov r8d, 0x1582f2b2
not r8d
jmp 0x1408aba2e
Function at 0x1408cc94d
Capabilities:
Encrypt data using aes mixcolumns step
Manually build aes constants

Disassembly:
pop r8
push r11
call fcn.14089354b

Function at 0x1408d0ab9
Capabilities:
Encode data using base64

Disassembly:
ror eax, 3
mov qword [rsp], rdi
movsx edx, di
movzx r10d, r8w
xor eax, 0x1a1cf6a9
xor eax, r8d
xchg rdi, rdx
lea rcx, [r10*2 - 0x6756f1ce]
call fcn.1408b0f77
push 0xffffffffe62b1324
mov ecx, dword [rsi]
mov r8d, 0xa12f8caf
add rsi, 4
movsx edx, r8b
mov word [rsp + 4], dx
movsx eax, byte [rsp + 3]
xor ecx, ebx
cqo
add dx, ax
jae 0x1408d5803

Function at 0x1408d27df
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r9*2 - 0x1c280000], rax
mov r9d, dword [rsi + r9*2 - 0x1c280000]
xor r11, qword [rsp + rax]
btc ebp, ebp
lea rsi, [rax + rsi + 4]
mov ecx, r11d
or r8d, eax
xor r9d, ebx
neg r9d
mov edx, ebp
lea r8, [rcx*8 + 0x4480bfbf]
call fcn.1408fadec
jmp 0x14092165f
mov r8d, 0xe70dfbb7
push r8
mov r8d, dword [rsi + riz]
add rsi, 4
mov eax, 0xda1ac8b6
movzx r11d, word [rsp + 2]
imul qword [rsp + r11*2 - 0x1ce1a]
xor r8d, ebx
movzx ecx, byte [rsp + r11 - 0xe709]
mov r9d, eax
rol r8d, 3
neg r8d
inc cx
rol r8d, 2
cwde
push rax
xchg r9w, r11w
xor r8d, 0x1ead5b0f
mul r11
bswap ecx
jno 0x1408bb9b4

Function at 0x1408d417d
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec r8
call fcn.1408b7100
mov r10d, dword [rbx + r10*4]
shr esi, 8
jmp 0x1408ff2d4
add r10d, 0xea1d8723
xor esi, ebx
xor esi, 0xba031017
neg word [rsp + rdi - 0x148097af]
mov esi, dword [rbp + rdi*4 - 0x52025ed0]
xor dx, dx
mov r8d, dword [rsp + rdi - 0x148097b2]
movzx eax, r10b
lea rbp, [rdi + rbp - 0x148097b0]
lea rcx, [r10 + rdx*4 + 0x7abc4f1f]
jae 0x1408d57ad
mov qword [rsp], 0xffffffffc82941ae
xor esi, r10d
push 0xffffffffcf86f980
ror byte [rsp + 0xd], 0xa1
inc rdi
xor esi, 0x74895a2a
sub word [rsp + 8], 0xbf39
jp 0x1408e6531
jb 0x1408b4c5a
ror r11d, 1
dec r11d
jmp 0x1408e0916
Function at 0x1408d77a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dword [rsp + r10 - 0x48f0], eax
push rcx
mov rbx, qword [rsp + r10*2 - 0x91e8]
add byte [rsp + r10 - 0x4900], 0xa6
shr dl, 0x64
mov qword [rsp + r10 - 0x48f8], 0xffffffffb293b496
movsxd rax, eax
dec qword [rsp + r8 - 0x438341e2]
adc r11, rax
movzx r8d, byte [rbp + r8 - 0x438341ea]
lea rbp, [r10 + rbp - 0x48ff]
mov qword [rsp + r10 - 0x48f0], rcx
sal cx, 0x2d
xor r8b, bl
xor r8b, 0x10
rol r8b, 1
mov qword [rsp + r10 - 0x48e8], r10

Function at 0x1408d7f6d
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea r9, [r11 + rdx*4 + 0x3b12ae85]
xor r8d, ebx
sub r8d, 0x8c164b84
pop rdx
movzx edx, r9w
not r8d
neg r8d
shr r11, 0x1c
mov ecx, 0xbc166489
ror ecx, 0xa3
lea r8d, [r8 + r11*4 - 0x289aadc4]
or r11b, 7
movzx ebp, cl
push rbx
xor dword [rsp + r11*2 - 0x1e], r8d
pop rbx
rol r9, 0xc9
movsxd r8, r8d
ror r11, 0x93
adc rdi, r8
mov r11, r10
lea r10, [r10 + rdx - 0x1a12]
mov qword [r10 + rdx*2 - 0x3414], r11
ror ecx, 0x77
jae fcn.1408f7a06

Function at 0x1408d7fd6
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
cmp ebx, 2
jmp 0x140890249

Function at 0x1408d872d
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edi
dec edi
add al, r8b
mov qword [rsp + rax*2 - 0x1a], rax
mov qword [rsp + rax + 3], rsi
rol edi, 1
div rsi
bswap edi
push rdx
and cx, 0xf3bb
sbb word [rsp + rax + 0x15], 0x9fa9
mov qword [rsp + rax + 0x18], rbx
sbb qword [rsp + rax*2 + 5], rsi
movzx r10d, word [rsp + rax + 9]
adc dl, 0x12
xor dword [rsp + rax + 0x18], edi
and qword [rsp + rcx - 0x68329319], r10
sal dx, 0x29
mov rbx, qword [rsp + rax + 0x18]
movsxd rdi, edi
ror r10w, 0xe6
cdq
adc r11, rdi
dec word [rsp + rax + 0x10]
mov r8, qword [rax + r9]
mul eax
jno 0x140900652
xor dx, bx
not word [rsp + rax - 0xd139fb3]
pop r8
neg dx
and al, r8b
btc r8d, 0xa8
add si, di
rol dx, 1
sal sil, 0x61
xor dx, 0x623e
dec ax
movzx ecx, si
rol di, 0x6b
sbb dx, 0x3c81
ror si, cl
movzx r10d, ax
xadd r10w, ax
not dx
shl r10w, 0xa8
xor bx, dx
or cx, r8w
imul r8, rax
sal dil, 0xc2
add rdx, rsp
mov r10d, dword [rdx + rax*4 - 0x344e7bfc]
cwde
lea r9, [r9 + rcx*4 - 0x3fc2c]
btc r8, r8
sbb eax, esi
mov edx, 0xe608e192
mov dword [r9 + rcx - 0xff0a], r10d
mov edi, dword [rbp + rcx*2 - 0x1fe14]
or si, 0x570f
ror edx, 0xdf
or rsi, rsi
lea rbp, [rbp + rcx*4 - 0x3fc24]
push rax
not rcx
xchg rcx, rsi
xor edi, ebx
inc edi
lea r10, [rsi*8 + 0x43168721]
imul ax, si
btr r10d, r8d
rol edi, 3
shr word [rsp + rsi*2 + 0x1fe1b], cl
not dword [rsp + r10 - 0x430e8ec7]
pop rcx
dec edi
push rax
sar byte [rsp + rsi*4 + 0x3fc30], 0xc1
bswap edi
jne 0x14088f3de
sal dword [rsp + rsi + 0xff0f], cl
ror edi, 2
sal si, 0x61
sbb si, cx
xchg byte [rsp + rsi*2 + 0xb51b], sil
inc edi
sal ax, 0xc3
mov qword [rsp + rsi + 0x5b00], rbx
shl sil, 0xe2
movzx ebx, r10b
sal rsi, 0xbd
xor dword [rsp + rsi*2], edi
not bx
mul ax
ror sil, 0x81
pop rbx

Function at 0x1408db5ee
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x14092bfd7
call fcn.14090c94e
Function at 0x1408dc525
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rbx, qword [rsp + rcx - 0x71671068]
push r8
add r8b, byte [rsp + rcx - 0x71671069]
movsxd rax, eax
mov word [rsp + rbp - 0x11a1], r9w
sal cx, 0xee
xadd r9, rdx
adc rdi, rax
rol cl, 0x21
shr byte [rsp + rbp - 0x119f], 0xa4
jb 0x14093265d
pop rbp
pop r8
pop rbp
jbe fcn.1408f7a06
btr rax, rdi
call fcn.1408c29c2
push 0xffffffffbd1d2a03
sal dword [rsp + 1], 5
adc rsi, 3
call fcn.1408c3e37

Function at 0x1408de7c9
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
lea r10, [r10 + rax*8]
adc r9, rcx
mov qword [rax + r10 - 1], r9
jmp rdi
xor r10d, ebx
mov qword [rsp], 0xffffffffdda4ca01
neg r10d
shl dl, 5
sbb r10d, 0xa69ee8b0
ror si, 0x82
cbw
dec al
neg r10d
mov r8d, 0x33c2829
dec word [rsp + r8 - 0x33c2828]
movzx edi, al
dec r10d
bswap r10d
call fcn.1408f3f9d
mov r11d, 0x8e86b0af
lea rbp, [r11 + r11*4 - 0x465b16d5]
movzx edx, word [rsi + riz]
add rsi, 2
call fcn.140904716
neg ebp
ror qword [rsp + rdx], 0x58
or byte [rsp + rdx + 1], r11b
mov qword [rsp + rdx*2], rbx
cqo
xor dword [rsp + rdx*2], ebp
pop rbx
or ax, ax
xadd al, ah
bswap rax
movsxd rbp, ebp
imul al
dec eax
adc rdi, rbp
xor r8w, cx
mov r9, qword [r10 + rdx*2]
div r8
rol rcx, 0x20
mov rcx, qword [r10 + rax + 7]
jae 0x1408dbb70
Function at 0x1408e5253
Capabilities:
Encode data using base64

Disassembly:
push rbx
bts r8d, 0x8c
xadd rdx, rdi
xor dword [rsp + r8 - 0x4837c99], ecx
jmp 0x1408ca9e1
xor ecx, ebx
cdq
not di
sub di, ax
adc ecx, edx
bswap ecx
and r8w, dx
and dil, 0xa3
sal al, 2
ror ecx, 3
cwd
shr rax, 0x7f
xor ecx, 0x1a1cf6a9
xor ecx, edx
shl dl, 0x84
sub al, al
and rdx, 0xffffffffc7933ebb
xor ecx, 0xdfbcaa2a
movsx r10d, dx
movzx esi, r10w
jmp 0x1408c0003
mov word [r10 + rcx - 0x1f], bp
bt r11d, edx
mov r8d, dword [rsi + rcx*8 - 0xf8]
mov qword [rsp + rcx - 0x1f], rcx
shl rcx, cl
jae 0x140901ff4
mov r11, r10
mov edx, 0x2fa0200a
lea rcx, [rdx - 0x7362dadc]
push rcx
lea r10, [rdx + r10 - 0x2fa02012]
mov qword [rdx + r10 - 0x2fa0200a], r11
mov r11d, edx
mov r11d, dword [rdx + rsi - 0x2fa0200a]
lea rsi, [rsi + rdx*2 - 0x5f404010]
shr byte [rsp + rdx*2 - 0x5f404012], 0xe1
movsx ebp, byte [rsp + rdx - 0x2fa02007]
xor r11d, ebx
lea r11d, [r11 + rcx*2 - 0x490d5e0]
movsx eax, word [rsp + rdx - 0x2fa02008]
bt ax, cx
lea r8, [rdx - 0x76fa19f8]
not r11d
btr ecx, 0x2b
push r8
shr dx, cl
neg r11d
or r8, 0x2b8b9f8f
rol byte [rsp + r8 + 0x44506061], 0x61
lea r11d, [r11 + r8 + 0x1bb5b2d5]
mul dx
sal qword [rsp + rdx*2 - 0x5f3ffff8], 0x8a
movzx r9d, byte [rsp + rdx - 0x2f9ffff6]
mov qword [rsp + rdx*2 - 0x5f3ffff8], rbx
call fcn.1408d3122
movsxd r8, r8d
inc r11w
mov ebp, dword [rsp + rax*2 - 0x38]
push r9
add rdi, r8
jmp 0x1408f4c2e
pop rdx
pop rdx
pop r11
jmp fcn.1408f7a06
lea rsi, [rsi + rax - 0x1b]
push r9
bts rdx, rax
xor r8d, ebx
and r11b, dl
ror word [rsp + rax*4 - 0x78], 0xc
neg dword [rsp + rax - 0x1b]
xor r8d, 0x6992fa27
and eax, eax
rol r8d, 1
xor r8d, 0x20bf8a34
dec r8d
or r9w, word [rsp + rax - 0x1b]
jo 0x1408d0dfb
rol r8d, 2
inc eax
xor r9w, cx
adc rcx, rax
mov qword [rsp + rax - 0x18], rbx
xor dword [rsp + rax*2 - 0x38], r8d
mov rbx, qword [rsp + rax - 0x18]
mov qword [rsp + rax*4 - 0x78], rcx
jmp 0x1408edf00
Function at 0x1408e92f9
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
call fcn.1409316dd
mov ecx, 0x1bb4808
movzx r8d, cl
mov eax, dword [rbp + r8 - 8]
sar r8, 0x17
lea rbp, [rbp + rcx*2 - 0x376900c]
lea r10, [r8 + 0x38153194]
xor eax, ebx
mov edi, r8d
movzx edx, cl
not eax
btc r8, r10
sub rdi, rdx
add ecx, edx
inc eax
rol r10, 0xd6
adc rdi, r10
lea rsi, [rdi*8 - 0x7b51fb46]
xor eax, 0x72f4a89
or r10w, 0x539f
sbb eax, 0xa3105835
inc r10
sub di, dx
push rbx
jno 0x1408a2416
mov edi, 0x67aa1d12
movzx edx, dil
or di, di
mov esi, dword [rbp + rdi - 0x67aa1d12]
lea rbp, [rbp + rdi - 0x67aa1d0e]
xor esi, ebx
call fcn.1408ec05a
ja 0x14090da09
mov r10w, word [r9]
mov edx, 0x280d083f
lea rdi, [rdx + rdx*2 + 0x6f82ef8f]
sar edi, 0x6a
mov r8w, word [r9 + rdx*2 - 0x501a107c]
lea r9, [r9 + rdx*2 - 0x501a107c]
lea rsi, [rdi + rdx + 0x6a0aebb2]
not edx
not r10w
xchg esi, edx
push rdi
not r8w
jp 0x14092bf1b
mov r11d, 0xa800e12
mov eax, dword [rsi + r11*8 - 0x54007090]
lea rsi, [rsi + r11 - 0xa800e0e]
movsx ecx, r11w
call fcn.1408d8f3d
mov r8d, 0x7ca92aa6
neg r8d
mov edx, r8d
movzx r8d, byte [rbp + riz]
adc rbp, 0
inc edx
xor r8b, bl
inc dx
ror r8b, 1
xor rdx, 0x4885e929
call fcn.14092075a
mov qword [rsp + rbp*2 - 0x1c], rdi
ret 0x10
mov rdx, rax
push 0xffffffffdeab6a23
jmp 0x14091bfb0
cmp ebx, 2
push 0x7b814633
lea rsp, [rsp + 0x10]
jne 0x14089a52c
mov edx, 0xf23e0687
bswap edx
jmp 0x1408c105d
inc byte [rsp + r10 - 0xde9d]
mov qword [rsp + r10 - 0xde9c], rbx
sar r8d, cl
movzx ebx, si
dec rdi
xor dword [rsp + rax*2 - 0xa23bff0], edx
mov rbx, qword [rsp + rax - 0x511dff0]
movsxd rdx, edx
neg rsi
xor r8w, r10w
adc r11, rdx
not r8w
or si, word [rsp + r10 - 0xdea2]
pop r10
pop rsi
pop r8
jl fcn.1408dc1c2
neg edx
xor cl, al
xor al, 0x32
inc r10w
xor edx, edi
xor r8b, r8b
rol edx, 3
lea rsi, [r10 + r8*2 - 0x4d5cf4e6]
xadd al, r8b
push rbx
xor al, cl
btr rax, 0x10
jb 0x140926ef0
and r10w, r8w
or rsi, rdx
ror byte [rsp + 2], 1
mov word [r9 + riz], r10w
mov r8d, edi
or dl, 0x31
mov r10d, dword [rbp + riz]
mov eax, 0xa60451bb
mov ecx, 0x710d8b1b
lea rbp, [rbp + rcx - 0x710d8b17]
jp 0x1408f8fc0
add rdi, 0xffffffffe7b1e337
add r8d, r8d
xor r10d, ebx
bswap r10d
not edx
lea r10d, [r10 + rdx - 0x27c274f6]
neg r10d
div byte [rsp + rdx - 0x6dee218a]
dec r10d
xor r10d, 0xfe2fdd88
mov qword [rsp + rcx - 0x710d8b1b], rbx
xor dword [rsp + rcx - 0x710d8b1b], r10d
inc r8b
or cl, dil
idiv r8
pop rbx
sar si, 0x8d
adc sil, 0xa0
movsxd r10, r10d
add r11, r10
jmp r11
dec esi
xor dword [rsp + rcx*2 - 0x3769020], eax
bswap ecx
pop rbx
bt edx, r10d
xchg cl, dil
inc r8
movsxd rax, eax
bt di, di
inc esi
adc r11, rax
mov r8d, dword [r9 + rcx - 0x1048bbf0]
neg r10b
inc r10b
cmovg edi, edx
mov ecx, dword [r9 + rcx*4 - 0x4122efbc]
bt si, r10w
sub r10, 0x1d0b1336
lea r9, [r9 + rdi*2 - 0xc]
not di
je 0x1408b09e9
or si, 0x9e88
or r8d, ecx
bswap edx
not r8d
mov dword [r9 + rdi - 0xfff7], r8d
call fcn.14089c48a
jmp 0x14093080f
js 0x1409084ba
lea rsp, [rsp + 8]
jmp 0x14089edea
Function at 0x1408ed290
Capabilities:
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rbp + riz - 8], rax
sub byte [rsp + 0xb], 0x88
mov qword [rsp], 0xffffffff8d22ac05
lea rsp, [rsp + 0x10]
mov qword [rbp + riz - 0x10], rsp
push 0x62a75c17
call fcn.14093487a
mov ecx, 0x6212513a
xor eax, 0x6992fa27
movsx r11d, cl
movzx edx, r11w
movzx r8d, dx
rol eax, 1
xor eax, 0x20bf8a34
shr cx, 0x8d
sub r11, 0xffffffff9c9540b0
dec eax
movzx r9d, dl
bswap r8
lea rbp, [r11 + r8*4 + 0x75a85f86]
rol eax, cl
bts r11w, dx
push rbx
inc bp
sets dl
xor dword [rsp + rcx - 0x62120002], eax
pop rbx
movsxd rax, eax
lea rbp, [rbp + rcx + 0x5b0f6a5]
add rdi, rax
mov eax, r9d
mov al, byte [rsi + rcx - 0x62120002]
bts r8, 0x34
lea rsi, [rsi + r11 - 0x636abf89]
xor al, bl
and rbp, 0x2699db0d
inc r8
neg al
sal r9d, cl
ror r9d, 0x17
adc al, r8b
sal r8w, cl
not r8b
neg al
xchg cx, r8w
not al
push r8
xor bl, al
xadd dl, r8b
xchg byte [rsp + rcx - 0x621200f4], dh
lea rax, [rsp + rax + 8]
mov bp, word [rax + rcx - 0x621200fb]
dec r9d
lea r10, [rcx + r10 - 0x621200fd]
mov word [r10 + rdx*4 - 0xe808], bp
pop r9
jae fcn.1408f7a06

Function at 0x1408ed801
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
xadd dword [rsp + rbp - 0x33868c76], eax
lea r9d, [r9 + rbp + 0x7f2e7688]
mov qword [rsp + rbp - 0x33868c82], 0x5d1eba2b
push rax
sets byte [rsp + rbp*2 - 0x670d18f3]
xor r9d, 0x20abb1bb
rol r9d, 1
mov byte [rsp + rbp*2 - 0x670d18fd], al
movzx edx, cl
imul r8
neg r9d
push rdx
ror byte [rsp + rbp - 0x33868c7b], 0xc6
imul r11
mov qword [rsp + rbp - 0x33868c6a], rbx
add dx, 0x761c
rol r11b, 1
sar eax, cl
xor dword [rsp + rbp - 0x33868c6a], r9d
mov ebx, 0x6d2e3e1e
mov rbx, qword [rsp + rbp*2 - 0x670d18ec]
xadd cx, ax
shr word [rsp + rbp - 0x33868c70], 0x64
movsxd r9, r9d
add rdi, r9
mov rax, qword [rbp + r10 - 0x33868c7e]
sal r11w, cl
pop rbp
mov r8, qword [r10 + rbp*4 + 0xc]
adc rax, r8
push rbp
mov qword [r10 + rbp*4 + 0xc], rax
call fcn.140905ae5