joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400022ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x55
mov byte [rsp + 0x24], 0x58
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x46
mov byte [rsp + 0x28], 0x44
mov byte [rsp + 0x29], 0x51
mov byte [rsp + 0x2a], 0x11
mov byte [rsp + 0x2b], 0x4d
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x57
mov byte [rsp + 0x2e], 0x57
mov byte [rsp + 0x2f], 0x4c
mov byte [rsp + 0x30], 0x11
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x55
mov byte [rsp + 0x33], 0x4a
mov byte [rsp + 0x34], 0xe3
cmp byte [0x140874288], 0
jne 0x14000237c
mov byte [0x1408742a5], 1
mov eax, 0
lea rcx, [0x140874290]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x140002357
mov byte [0x140874288], 1
lea rcx, [0x140001805]
call fcn.1400014f0
lea rax, [0x140874290]
add rsp, 0x48
ret

Function at 0x140002388
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x44
mov byte [rsp + 0x23], 0x51
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x44
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x48
mov byte [rsp + 0x28], 0x46
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x4c
mov byte [rsp + 0x2c], 0x57
mov byte [rsp + 0x2d], 0x5c
mov byte [rsp + 0x2e], 0x11
mov byte [rsp + 0x2f], 0x46
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x31], 0x50
mov byte [rsp + 0x32], 0xe3
cmp byte [0x1408741d8], 0
jne 0x14000242c
mov byte [0x1408741f3], 1
mov eax, 0
lea rcx, [0x1408741e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x140002407
mov byte [0x1408741d8], 1
lea rcx, [0x1400018ad]
call fcn.1400014f0
lea rax, [0x1408741e0]
add rsp, 0x48
ret

Function at 0x140002438
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x16
mov byte [rsp + 0x22], 0x19
mov byte [rsp + 0x23], 0x13
mov byte [rsp + 0x24], 0x57
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x4f
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x48
mov byte [rsp + 0x2b], 0x46
mov byte [rsp + 0x2c], 0x58
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x4c
mov byte [rsp + 0x2f], 0x57
mov byte [rsp + 0x30], 0x5c
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x140874180], 0
jne 0x1400024eb
mov byte [0x1408741a6], 1
mov eax, 0
lea rcx, [0x140874190]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x1400024c6
mov byte [0x140874180], 1
lea rcx, [0x1400018f5]
call fcn.1400014f0
lea rax, [0x140874190]
add rsp, 0x48
ret
Function at 0x1400024f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x44
mov byte [rsp + 0x22], 0x51
mov byte [rsp + 0x23], 0x57
mov byte [rsp + 0x24], 0x4c
mov byte [rsp + 0x25], 0x59
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x58
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x11
mov byte [rsp + 0x2b], 0x46
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x50
mov byte [rsp + 0x2e], 0x52
mov byte [rsp + 0x2f], 0x47
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x140874148], 0
jne 0x1400025ab
mov byte [0x140874166], 1
mov eax, 0
lea rcx, [0x140874150]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x140002586
mov byte [0x140874148], 1
lea rcx, [0x140001925]
call fcn.1400014f0
lea rax, [0x140874150]
add rsp, 0x48
ret

Function at 0x1400027a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov word [rsp + 0x20], 0xe4
mov word [rsp + 0x22], 0x12
mov word [rsp + 0x24], 0xdf
mov word [rsp + 0x26], 0xee
mov word [rsp + 0x28], 0x22
mov word [rsp + 0x2a], 0xdf
mov word [rsp + 0x2c], 0x22
mov word [rsp + 0x2e], 0x27
mov word [rsp + 0x30], 0x2e
mov word [rsp + 0x32], 0x28
mov word [rsp + 0x34], 0x22
mov word [rsp + 0x36], 0x24
mov word [rsp + 0x38], 0xdf
mov word [rsp + 0x3a], 0xee
mov word [rsp + 0x3c], 2
mov word [rsp + 0x3e], 0xdf
mov word [rsp + 0x40], 0x18
mov word [rsp + 0x42], 0xdf
mov word [rsp + 0x44], 0xee
mov word [rsp + 0x46], 0xd
mov word [rsp + 0x48], 0xdf
mov word [rsp + 0x4a], 0xee
mov word [rsp + 0x4c], 3
mov word [rsp + 0x4e], 0xdf
mov word [rsp + 0x50], 0x18
mov word [rsp + 0x52], 0xdf
mov word [rsp + 0x54], 0xee
mov word [rsp + 0x56], 0x13
mov word [rsp + 0x58], 0xdf
mov word [rsp + 0x5a], 0xf2
mov word [rsp + 0x5c], 0xdf
mov word [rsp + 0x5e], 0xe5
mov word [rsp + 0x60], 0xdf
mov word [rsp + 0x62], 3
mov word [rsp + 0x64], 0x24
mov word [rsp + 0x66], 0x2b
mov word [rsp + 0x68], 0xdf
mov word [rsp + 0x6a], 0xe1
mov word [rsp + 0x6c], 0xe4
mov word [rsp + 0x6e], 0x12
mov word [rsp + 0x70], 0xe1
mov word [rsp + 0x72], 0xbf
cmp byte [0x1408739a0], 0
jne 0x140002915
mov byte [0x140873a14], 1
mov eax, 0
lea rcx, [0x1408739c0]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x2a
jne 0x1400028ef
mov byte [0x1408739a0], 1
lea rcx, [0x140001a8a]
call fcn.1400014f0
lea rax, [0x1408739c0]
add rsp, 0x88
ret
Function at 0x140002988
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140002afc
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x140874bc1]
jmp 0x1400029ee
mov byte [0x140874bc1], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x140874ba0]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140002afc
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x7e
mov byte [rsp + 0x21], 0x7c
mov byte [rsp + 0x22], 0x77
mov byte [rsp + 0x23], 0x76
mov byte [rsp + 0x24], 0x8d
mov byte [rsp + 0x25], 0x82
mov byte [rsp + 0x26], 0x75
mov byte [rsp + 0x27], 0x7e
mov byte [rsp + 0x28], 0x78
mov byte [rsp + 0x29], 0x82
mov byte [rsp + 0x2a], 0x7a
mov byte [rsp + 0x2b], 0x8a
mov byte [rsp + 0x2c], 0x7b
mov byte [rsp + 0x2d], 0x74
mov byte [rsp + 0x2e], 0x79
mov byte [rsp + 0x2f], 0x7b
mov byte [rsp + 0x30], 0x86
mov byte [rsp + 0x31], 0x89
mov byte [rsp + 0x32], 0x8d
mov byte [rsp + 0x33], 0x79
mov byte [rsp + 0x34], 0x77
mov byte [rsp + 0x35], 0x86
mov byte [rsp + 0x36], 0x75
mov byte [rsp + 0x37], 0x86
mov byte [rsp + 0x38], 0x7a
mov byte [rsp + 0x39], 0x86
mov byte [rsp + 0x3a], 0x7a
mov byte [rsp + 0x3b], 0x81
mov byte [rsp + 0x3c], 0x77
mov byte [rsp + 0x3d], 0x84
mov byte [rsp + 0x3e], 0x7f
mov byte [rsp + 0x3f], 0x74
mov byte [rsp + 0x40], 0x13
cmp byte [0x140874b80], 0
jne 0x140002ad7
mov byte [0x140874bc1], 1
mov eax, 0
lea rcx, [0x140874ba0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140002ab6
mov byte [0x140874b80], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x140874bc1], 0
je 0x1400029c0
lea rax, [0x140874ba0]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140002aeb
jmp 0x1400029b9
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140012330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140874f74]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400124c0
mov rax, qword [0x140874f78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14001237c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140012405
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140012360
mov rcx, rdi
call fcn.140012e90
test rax, rax
mov r12, rax
je 0x140012512
mov rax, qword [0x140874f78]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.140012fd0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140874f78]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400124f5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400123fe
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140012470
add dword [0x140874f74], 1
cmp ebx, 8
jae 0x140012431
test bl, 4
jne 0x1400124d0
test ebx, ebx
je 0x140012426
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400124e4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140012426
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001244a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140874f78]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123fe
call qword [0x1408762c4]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400122c0
xor esi, esi
jmp 0x140012387
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140012426
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140012426
mov rax, qword [0x140874f78]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400122c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400122c0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140012e90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140867750]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140012eff
mov rcx, r9
call fcn.140012d60
test eax, eax
je 0x140012eff
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140012efd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140012ef4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140012eff
add rdx, 0x28
cmp rdx, r9
jne 0x140012ee0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x14001d3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14085d760]
jmp 0x140013cc0

Function at 0x14001d3b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14085d760]
jmp 0x140013cc0

Function at 0x140881c30
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rdx, dword [rsp + 0x30]
xchg qword [rsp + 0x78], rax
mov r15, qword [rsp + rdx - 0x6c37704e]
xor r10b, byte [rsp + 0x32]
mov ecx, 0xd4292d89
and word [rsp + 0x30], 0x46b4
shr byte [rsp + 0x30], cl
or dword [rsp + rdx - 0x6c37702e], 0x1a364830
add qword [rsp + 0x18], 0xffffffffbf64372c
mov word [rsp + 0x30], 0x6e94
mov r10, qword [rsp + 0x28]
movsx cx, byte [rsp + rdx - 0x6c37702a]
bswap edx
shr dword [rsp + rdx - 0x5e70373c], 7
js 0x14096482b
and word [rsp + rdx - 0x5e70373c], dx
mov rcx, qword [rsp + rdx - 0x5e7036fc]
or byte [rsp + rdx - 0x5e70373c], 0x13
jae 0x140943a84
mov r15, r10
xor cl, 0x86
bswap r10
add r15, r10
lea rax, [rax + 0x6cbdfc02]
shr r15, 0x1f
cmp r15, rcx
mov qword [rsp + 0x30], rcx
jno 0x140881c30

Function at 0x140883618
Capabilities:
Encode data using base64

Disassembly:
or r15, 0xffffffffe895c9b4
mov rax, qword [rsp + r15 + 0x156a3654]
mov rax, qword [rax + r15*4 + 0x55a8d930]
jno 0x140933789

Function at 0x140883635
Capabilities:
Encode data using base64

Disassembly:
mov rbx, qword [rsp + 0x10]
push rdi
or qword [rsp], 0xffffffffac08a919
mov rbx, qword [rsp + rbx + 0x704161b9]
mov rbx, qword [rbx]

Function at 0x14088375b
Capabilities:
Authenticate hmac

Disassembly:
push r9
movabs r9, 0xe8a517204e988c94
push r12
mov r11, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0x2ead5939
mov r9, qword [rsp + 8]
jbe 0x14088378c
movabs r12, 0xc825203da60372a5
sub r12, r12
not r12b
test r12w, 0x9801
jno 0x140906f31

Function at 0x1408839d0
Capabilities:
Authenticate hmac

Disassembly:
jo 0x140908cf4
call fcn.1409992c9

Function at 0x1408842cf
Capabilities:
Check http status code
Packed with generic packer

Disassembly:
mov ebp, dword [rsp + 0x20]
jae 0x14092645f
jrcxz 0x1408842a3
int3
jle 0x1409808a5
neg byte [rsp + 0x60]
call fcn.140906d01

Function at 0x140885c4d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop rbp
push r9
pushfq
movabs r9, 0x73b8a5b026b6ee2f
cmp r9b, 0x28
jg 0x140983c1e
Function at 0x14088938c
Capabilities:
Encode data using base64

Disassembly:
not dx
xor dx, word [rsp + r12 + 0x47ef7c05]
sub r12, qword [rsp + 8]
je 0x14092abbc
shl edx, 0x6c
and rdx, 0x3d20d606
lea rsi, [rsi - 0x276162c6]
add r12b, r12b
lea r13, [r12*4 - 0x3bf11c55]
sub r13, 0xffffffffd2037db2
call fcn.14095ddc1
test eax, 0x3749804b
mov al, 3
xlatb
mov rsi, qword [rsp + 0x18]
mov qword [rsp + 0x18], rbp
call fcn.1409507b8
add qword [rsp], 0xfffffffffffe5ef2
push rbx
mov rcx, rbx
lea rdx, [rcx + rdx*4 + 0x49e839e]
movzx rdx, word [rsp]
add rcx, qword [rsp]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
or dl, byte [rsp + 3]
mov qword [rsp + rdx - 0x2367], rbx
push rbp
call fcn.140960891
cmp edi, 0xd69ee035
movabs rdi, 0x5eb6a12614a4ca39
jae 0x14096eef7
and qword [rsp + 0x78], 0xa3f00bf
add dword [rsp + 0x78], 0x17af6830
mov rdi, qword [rsp + 0x60]
mov byte [rsp + 0x78], 0x97
jbe fcn.140881367
cmp qword [rsp + 0x78], 0xfffffffffb851fbd
call fcn.140906e15
popfq
lea rsp, [rsp + 0x30]
ret
Function at 0x14088c750
Capabilities:
Authenticate hmac

Disassembly:
add qword [rsp], 0xfffffffffff4fee9
movabs rbx, 0xea9eed807a18519c
and r14d, 0xfd395d87
test r14d, 0x3c262d0e
bswap ebx
mov rbx, qword [rsp]
mov rbx, qword [rbx]
call fcn.140949114

Function at 0x14088fd40
Capabilities:
Authenticate hmac

Disassembly:
push r14
movabs r14, 0xc6a2b82ec927e433
cmp r14d, 0x48291738
mov edx, r14d
mov edx, 0x5f28759b
mov rdx, qword [rsp + rdx - 0x5f287583]
mov qword [rsp + 0x18], rbp
push r11
push r12
call fcn.140940b81
shr byte [rsp + 0x10], 0xcb
push r14
jne 0x14088a2b8
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
shr word [rsp + 0x18], 0xe8
mov r14, qword [rsp + 0x18]
jne 0x14089b08c
xor r14w, r14w
shl r14d, 0xff
test r14b, r14b
lea rbp, [rbp + r14 + 0x663f9895]
setne r14b
neg r14
jo fcn.1409681c4
xchg qword [rsp + r14*8 + 0x20], rbp
mov r14, qword [rsp + r14*2]
jo fcn.14094e6a0
jb 0x1409a332d
jns 0x14094950c
movsx esi, word [rsp + 0x1b]
neg qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
movabs rdi, 0xb2935dbc6006c904
call fcn.1409532c5
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
ret 8
add qword [rsp], 0x6d90d
movabs rbp, 0xfda43e0519b2dd95
lea rbp, [rbp*2 - 0x4b74d46c]
cmp word [rsp + 0x10], 0xba0c
jge 0x14088fd40
call fcn.140889fde
call fcn.140967092

Function at 0x1408960c0
Capabilities:
Authenticate hmac

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.1409c38a4
call fcn.1408816dc
mov ah, 0x5c
xor eax, 0x19a4861f
push rax
mov qword [rsp + 0x18], 0x2e8fbad1
lea rsp, [rsp + 0x18]
call fcn.1409c38a4
or rdx, 0x75200989
not word [rsp]
setge byte [rsp + 0x18]
or r9b, byte [rsp + 3]
xchg qword [rsp + 0x38], rsi
mov rdx, qword [rsp + 0x28]
ja 0x140906edf
mov r12, qword [rsp + r12*2 - 0x1fe]
jne 0x1408960c0

Function at 0x1408980f0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp ebp, 0xe11f651a
mov rdi, rbp
call fcn.1408f37b3
lea rdx, [rdx + riz + 0x2e062287]
push rbx
mov rbx, rdx
test bx, bx
call fcn.1408fc841
wait
push rbx
int3
or r9b, bpl
setne bpl
mov rbp, qword [rsp + r9*4 - 0x100546d4]
mov rbp, qword [rbp + r9*8 - 0x200a8df8]
not r9
shl r9, 0x20
not r9d
sub r9d, r9d
jne 0x14088fd06
sub r9b, 0x2d
jno 0x1408980f0
pop rsi
push r8
pushfq
movabs r8, 0xcd843c205594deaf
lea r8, [r8 + r8*2 - 0x12e8a080]
shl r8b, 0x87
xchg qword [rsp + 0x10], rsi
push rdx
mov rdx, r8
lea r8, [rdx + rdx + 0x22eb230]
movsx dx, dl
ja 0x14089b6b4
mov r8, qword [rsp + 0x10]
mov qword [rsp + 0x10], rsi
push r9
or edx, edx
mov r9, rdx
lea r9, [rdx + r9*8 - 0x95e6346]
setbe dl
add edx, 0xf1f34ad
call fcn.140996212
shl r9b, 0xa9
lea rbp, [rbp + r9*2 - 0x75c4c1e4]
lea r9, [r9 + r9 - 0x445f1758]
not r9
add qword [rsp + r9 - 0x445f1737], 0xffffffffbf705b3b
call fcn.140989ada
add rdx, 0x5b146216
jge 0x140897030
mov rcx, qword [rsp + 0x60]
Function at 0x14089b0b3
Capabilities:
Packed with generic packer

Disassembly:
or dil, byte [rsp + 0x19]
lea r14, [r13*8 - 0x7372c551]
jae 0x14093cb87
shr r15w, 0x19
shr qword [rsp], 0xe0
cmp r15, qword [rsp]
mov qword [rsp], r15
mov r15, qword [rsp + 8]
setb byte [rsp]
xor dword [rsp], 0xc89fd09a
jns 0x140915656
or byte [rsp], 0xa9
not word [rsp]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
ret 8
mov rbx, qword [rbx + r15 - 0x12c067a]
sub qword [rsp + r15 - 0x12c0672], 0xffffffffed838b07
jo 0x140967906
call fcn.140895492
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1409c38a4
jg 0x140966a81
movabs eax, dword [0x4a66ebc0000005b8]
lea ebp, [rbp + rdi + 0x309ec571]
cmp word [rsp + r15 - 0x3c86a398], 0xe28d
jae 0x140913a40
push rsi
test byte [rsp + r15 - 0x3c86a390], r15b
setle byte [rsp + r15 - 0x3c86a388]
movabs rsi, 0x439aa415428d9c2b
neg r15w
xchg qword [rsp + 0x38], rbp
mov rsi, qword [rsp]
and word [rsp + r15*2 - 0x790cb898], 0x6db6
and r15, 0xffffffff9321039b
xor byte [rsp + r15*4 - 0x40000048], 0x1b
jge 0x140919882
neg cx
call fcn.14096c897
jg 0x140999173
pushfq
call fcn.140012a76
mov r14, rdi
mov qword [rsp + 0x18], r13
jl 0x1409638a5
add qword [rsp + r15*2 - 0x20000020], 0xffffffffbf77e0a3
call fcn.14093cc13
not r13d
xchg qword [rsp + 0x40], rbp
mov rdi, qword [rsp + 0x38]
or qword [rsp + rcx - 0x142e8c68], 0xfffffffff00b83bf
sub r14d, ecx
call fcn.140927467
mov ecx, edi
lea rbp, [rbp + 0xda3cb2a]
shl byte [rsp + 0x18], 0x44
sub qword [rsp + 0x18], 0xffffffffa937efb3
jno 0x14088b6a0
movabs rcx, 0x5207770725894fb0
not r10b
shr r10, cl
neg ecx
call fcn.14095345a
jle 0x14094aae8
push rdx
movabs rdx, 0x379926b602a35b96
movabs rbx, 0x3324cd1e6218dd02
call fcn.14095b044
mov word gs:[rdx + 0x62], cs
ret 0x63e6
push r10
jb 0x140896d7b
mov qword [rsp + 0x20], rax
not r9
push rcx
jl 0x14090fe3c
mov r10, rdi
jge 0x140957326
add qword [rsp + 0x10], 0xffffffffbf669d08
call fcn.140963fbc
lea rax, [rax + r11 + 0x1da091f8]
xor r15, qword [rsp]
neg qword [rsp]
and r11, r15
add r15w, r11w
lea r15, [r15 + r11 - 0x2064066b]
ja 0x1409992d4
lea r11, [r11 + r11 + 0xb3e9d1f]
xchg qword [rsp + r11*2 - 0x16bd3cbe], rax
mov r11, qword [rsp + r11 - 0xb5e9e5f]
jno 0x140896ab1
lea rdx, [rdx + rdx - 0xb414ec1]
call fcn.14099bbc9
push rsi
cmp word [rsp + 0x10], 0x548d
call fcn.14094bff4
xor r14w, 0x1d8d
push rcx
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
mov qword [rsp + 0x20], r9
shl word [rsp + 0x20], 0xe9
push r13
movabs r15, 0x57053a21d63e8e2e
call fcn.140933b94
movabs eax, dword [0x10fa9657019273c2]
add dh, bl
jmp [rax]

Function at 0x14089c13b
Capabilities:
Encode data using base64

Disassembly:
jb 0x1409601b7
xchg qword [rsp + rsi*8 - 0x168], rcx
mov r11, qword [rsp + r10 + 0x2c905b74]
and dword [rsp + r10*2 + 0x5920b6b8], esi
ja 0x140953479
or dword [rsp + r10*4 + 0x18f80], 0x5991b3bb
shr r11, 1
shl r15b, 0xac
movsx rsi, r11b
xor r10, 0x2c90389c
jno 0x140895dd6
xor r14d, dword [rsp + r14 - 0xd201291]
neg r14d
jns fcn.14088f335
xor word [rsp + 0x48], 0x1315
mov r14, qword [rsp + 0x28]
cmp qword [rsp + 0x48], 0x4bd5017
call fcn.1409b11d2
Function at 0x1408a9220
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov r8d, 0xea0cb7a3
mov r14, qword [rsp + r11 - 0x647ffc0]
js 0x14089814b
setno dil
xchg qword [rsp + r10*4 - 0x794], rax
mov r10, qword [rsp + rdi - 0x4547b0b1]
jne 0x1408a9220
push rsp
test eax, 0xcccccccc
push rbp
sub rsp, 0x20
mov rbp, rdx
mov eax, dword [rbp + 0xb8]
and eax, 2
test eax, eax
je 0x1408a9ca6
and dword [rbp + 0xb8], 0xfffffffd
lea rcx, [rbp + 0x48]
call fcn.1408950d0
add rsp, 0x20
pop rbp
ret

Function at 0x1408a9c60
Capabilities:
Packed with generic packer

Disassembly:
mov r8d, 0xea0cb7a3
mov r14, qword [rsp + r11 - 0x647ffc0]
js 0x14089814b
setno dil
xchg qword [rsp + r10*4 - 0x794], rax
mov r10, qword [rsp + rdi - 0x4547b0b1]
jne 0x1408a9220
push rsp
test eax, 0xcccccccc
push rbp
sub rsp, 0x20
mov rbp, rdx
mov eax, dword [rbp + 0xb8]
and eax, 2
test eax, eax
je 0x1408a9ca6
and dword [rbp + 0xb8], 0xfffffffd
lea rcx, [rbp + 0x48]
call fcn.1408950d0
add rsp, 0x20
pop rbp
ret

Function at 0x1408fa041
Capabilities:
Authenticate hmac

Disassembly:
push rcx
push rbp
pushfq
movabs rbp, 0x6225089b1bb0faaf
shr rbp, 0xc6
xor bp, 0xe407
jg 0x1408f1b2c

Function at 0x1408fa0a7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rdx, dword [rsp + 0x30]
xchg qword [rsp + 0x78], rax
mov r15, qword [rsp + rdx - 0x6c37704e]
xor r10b, byte [rsp + 0x32]
mov ecx, 0xd4292d89
and word [rsp + 0x30], 0x46b4
shr byte [rsp + 0x30], cl
or dword [rsp + rdx - 0x6c37702e], 0x1a364830
add qword [rsp + 0x18], 0xffffffffbf64372c
mov word [rsp + 0x30], 0x6e94
mov r10, qword [rsp + 0x28]
movsx cx, byte [rsp + rdx - 0x6c37702a]
bswap edx
shr dword [rsp + rdx - 0x5e70373c], 7
js 0x14096482b
and word [rsp + rdx - 0x5e70373c], dx
mov rcx, qword [rsp + rdx - 0x5e7036fc]
or byte [rsp + rdx - 0x5e70373c], 0x13
jae 0x140943a84
mov r15, r10
xor cl, 0x86
bswap r10
add r15, r10
lea rax, [rax + 0x6cbdfc02]
shr r15, 0x1f
cmp r15, rcx
mov qword [rsp + 0x30], rcx
jno 0x140881c30

Function at 0x140906c14
Capabilities:
Check http status code
Packed with generic packer

Disassembly:
mov byte [rsp + 0x50], 0x91
setge byte [rsp + 0x50]
call fcn.140906d9e

Function at 0x1409137f9
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1409c38a4

Function at 0x14092646e
Capabilities:
Authenticate hmac

Disassembly:
jb 0x1409b6805
test r10, 0x7b8b2b22
jo 0x140906f85
and r10d, 0x643b883b