joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c200
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00585352], 0
jne 0x41c2e7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c2da
lea rbx, [0x00557738]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c2c0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045d500
lea rax, [0x004a6e9a]
mov ebx, 0x2c
call fcn.00432960
nop
int3

Function at 0x41e5c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e6c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e603
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e6bb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f3a0
test rax, rax
je 0x41e6bb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e700]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045b120
xorps xmm15, xmm15
mov r14, qword [0x00585568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e6a9
xor eax, eax
jmp 0x41e6b3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e5f1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045b260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e5c0
Function at 0x42c680
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42c906
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42c8fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00585352], 0
jne 0x42c6da
xor edx, edx
xor ebx, ebx
jmp 0x42c720
xor edx, edx
jmp 0x42c705
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041ba60
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c6de
add rax, 0x1268
call fcn.0042c600
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42c894
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42c71b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.004113c0
test rax, rax
jne 0x42c76c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c71b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42c7ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c71b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42c8ed
lea r10, [0x00557738]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42c82f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42c865
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42c71b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42c8e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42c71b
cmp rbx, 0x200
ja 0x42c8d4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00422280
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042c600
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.0045d560
mov rax, r8
call fcn.0045d4e0
mov rax, r8
mov ecx, 0x40
call fcn.0045d500
mov edx, 0x200
nop
call fcn.0045d540
nop
mov qword [rsp + 8], rax
call fcn.00461d20
mov rax, qword [rsp + 8]
jmp fcn.0042c680
Function at 0x441420
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441587
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441432
cmp edx, ecx
jne 0x441575
nop word [rax + rax]
test rsi, rsi
jne 0x441575
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441494
nop
call fcn.0045ed40
xorps xmm15, xmm15
mov r14, qword [0x00585568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00441340
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441570
mov rdx, qword [0x00532568]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441565
mov rcx, qword [0x00532560]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00532fd0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00532fd0], rax
nop
mov edx, 1
lea rsi, [0x00532fd8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441553
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004a66df]
mov ebx, 0x28
nop
call fcn.00432960
mov rax, rsi
mov rcx, rdx
call fcn.0045d4e0
call fcn.00431000
lea rax, [0x004a5a8f]
mov ebx, 0x23
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00441420
Function at 0x44c460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44c5d7
movzx edx, byte [rax]
test edx, edx
jne 0x44c494
nop dword [rax]
test r8b, r8b
jne 0x44c494
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44c4a7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44c597
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44c585
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44c577
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44c4fd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44c540
mov eax, 1
cmp rax, rbx
ja 0x44c52b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.0045d5a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44c56f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44c533
mov rcx, r11
mov eax, r12d
jmp 0x44c502
mov rcx, rbx
call fcn.0045d4e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045d4e0
mov eax, r8d
mov rcx, rbx
call fcn.0045d5a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44c5cd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44c590
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44c4ad
mov eax, edx
mov rcx, rbx
call fcn.0045d4e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045d4e0
nop
int3
Function at 0x4539e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453a8f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00453ae0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045b120
xorps xmm15, xmm15
mov r14, qword [0x00585568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045b260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004539e0
Function at 0x45d040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403183
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408be0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403160
cmp byte [0x0058534b], 0
je 0x45d055
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45a2a0
jmp 0x403160

Function at 0x45d060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00585600]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0058534b], 0
je 0x45d095
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005858e0]
aesenc xmm0, xmmword [0x005858f0]
aesenc xmm0, xmmword [0x00585900]
movq rax, xmm0
ret
jmp 0x408e00

Function at 0x45d0a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00585600]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0058534b], 0
je 0x45d0d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005858e0]
aesenc xmm0, xmmword [0x005858f0]
aesenc xmm0, xmmword [0x00585900]
movq rax, xmm0
ret
jmp 0x408e60

Function at 0x45eda0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45edd4
mov rcx, 0x28
jmp 0x45eddf
shl rcx, 3
add rcx, 0x1480
mov qword [0x00585568], rcx
pop rbp
ret
Function at 0x468dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468ebe
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x468e42
cmp r8, rdi
ja 0x468eb2
cmp rsi, rbx
je 0x468e25
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x468e22
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x468e9f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x468e25
mov rbx, rdx
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x468e97
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
nop
jmp 0x468e80
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x468e48
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.0045d4e0
lea rax, [0x0048c680]
lea rbx, [0x004c05b8]
call fcn.004321e0
mov rcx, r8
mov rdx, rdi
call fcn.0045d560
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045b260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00468dc0
Function at 0x474800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4748ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x00585568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4748af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048cb00]
xor ebx, ebx
mov rcx, rdx
call fcn.00445500
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00474de0
inc rbx
cmp rcx, rbx
jae 0x47489e
mov edi, 1
lea rsi, [0x0048cb00]
call fcn.004455e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c0b48]
lea rsi, [0x004c04b0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00474800
Function at 0x1405169ad
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
pop rax
xor r11w, 0x7024
rol r11w, 1
pop r8
xchg rdx, rbx
inc r11w
lea rax, [rdi + 0x74039fa9]
ror r11w, 1
sal rbx, 0x7a
ja 0x140561236
dec r11w
xor r9w, r11w
lea r11, [rsp + r11 + 0x10]
jmp 0x14054bb48
xor edi, ebx
mov di, word [r11 + rbx*4]
sar ax, 0xc8
cqo
lea rsi, [rsi + rbx - 2]
rol bl, 0x21
mov qword [rsp + rbx*4 + 8], r8
mov word [rsi + rbx], di
and qword [rsp + rbx + 8], rax
imul dl
pop rdi
pop rdx
jno fcn.140551fd0

Function at 0x140517ee8
Capabilities:
Authenticate hmac

Disassembly:
xor al, 0x2a
add al, 0x89
xor r9b, al
sal di, 0x89
call fcn.14051970a

Function at 0x14051801a
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor rdx, qword [rsi + rcx - 0x188dc700]
call fcn.14053a154

Function at 0x14052531e
Capabilities:
Authenticate hmac

Disassembly:
sub r9, rbx
mov ebp, 0x229bdd01
movsx r8d, bp
movsx ecx, bp
lea rbp, [0x14051f0e7]
sar r8, cl
ror cx, 0x68
lea r10, [r8 + r10 - 0x7fffee84]
call fcn.140534ebe
jp 0x140567546
inc si
mov qword [rsp + r9 - 0x3430ecb8], rbx
movzx ebp, si
push rbp
lea rsi, [rsp + r9*2 - 0x6861da70]
push r11
lea rcx, [rsi + rdi*2 - 0x4e47c200]
setns byte [rsp + rdi*2 - 0x4e47bffe]
lea rbx, [rdx + r8*2 + 0x5e89af22]
pop r9
and cl, 0xf0
lea rdi, [r9*8 + 0x10a60191]
mov rsp, rcx
mov eax, 0x2b2f281c
mov r9, r10
movsx ebp, ax
movabs rbx, 0
lea rcx, [rbp + 0x4ba9f630]
jmp 0x14051f0e4
pop r9
mul edx
call fcn.14056269e
jmp rbp
inc edx
adc rbp, r11
neg edx
mov rax, qword [rdi + rsi - 0x4d720]
or cl, byte [rsi + rcx + 8]
sal rax, cl
imul rdx, rdi
movzx ecx, dx
jo 0x140560dda
mov qword [rsi + rdi - 0x4d71e], rax
inc dil
mov r8, qword [rsi + rdi*2 - 0x9ae40]
lea rsi, [rdi + rsi - 0x4d717]
add dl, ch
lea rax, [rcx + rdx - 0x4672b9c5]
movzx ecx, byte [r10 + rdi*2 - 0x9ae47]
lea rbx, [rbx + rbx*8 + 0x6e90f890]
sal dx, 0xc9
inc rbx
lea r10, [r10 + rdi*2 - 0x9ae47]
xor cl, r9b
inc edx
ror cl, 1
not rdx
dec rax
not ebx
not cl
xor cl, 0x97
sub cl, 0x20
ror rdi, 0x2a
push rdi
adc qword [rsp + rbx - 0x13f7067b], rax
xor r9b, cl
sub rbx, rdx
xchg word [rsp + 5], ax
sub eax, 0xbeab6c35
lea rcx, [rsp + rcx + 8]
mov r11d, eax
sub dword [rsp], r11d
mov qword [rcx + riz], r8
lea rdi, [rax + rax*4 + 0x6dafc199]
xchg qword [rsp], rax
pop rax
jmp rbp
Function at 0x140537831
Capabilities:
Authenticate hmac

Disassembly:
bswap edx
add rbp, rdi
lea r10, [rax + r10 - 1]
lea rdi, [r8*4 + 0x6534b1a0]
ror dx, 0x8c
ror edx, cl
mov dl, byte [r10 + rax]
shr di, cl
dec r8d
call fcn.140554a25
ror cl, 0xe1
ror bl, 1
lea r8, [rdx + rcx + 0x13b8d8b]
xor bl, 0x2b
dec r11w
jne 0x14053a03d
movsx edx, cl
div r11
mov di, word [rsi + rdi*4 - 0x3733c]
bts ecx, edx
lea rsi, [rax + rsi - 0x62b24c]
push r11
lea r10, [rcx + r10 - 0x728a1943]
add rax, r8
mov qword [rsp + rcx - 0x728a1931], r11
movzx ebx, word [r10 + rcx - 0x728a1941]
xor bx, r9w
mov qword [rsp + rcx - 0x728a1939], rdx
cwde
jmp 0x1405599e5
dec bl
rol edx, 0x82
jae 0x1405248f8
neg bx
call fcn.14056a6d4
movzx ebx, byte [r10 - 1]
mov ecx, 0xc71f4bb9
xor bl, r9b
movzx edi, cx
movzx r11d, cl
movzx edx, cx
rol bl, 1
ror r11d, cl
dec bl
dec dl
jge 0x14051e649
rol bl, 1
sal dl, 0x84
adc cl, 0x86
jo 0x1405559b6
mov r8d, 0x3597efb3
movzx ecx, r8b
mov ebx, 0x26a9f4ab
mov r11, qword [rsi + r8 - 0x3597efb3]
sal cx, 0x6e
cmovae r8d, ecx
movsx edi, r8b
mov ax, word es:[r11 + r8 - 0xc000]
bswap ecx
jne 0x14053d957

Function at 0x14053d369
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rbx - 0x4269393e], r9
call fcn.1405631d7
mov r11d, 0x63010424
movq rdi, xmm0
lea rsi, [r11 + rsi - 0x6301042c]
movsx ebx, r11w
mov qword [r11 + rsi - 0x63010424], rdi
movzx ecx, bx
mov edi, 0x5c056629
lea r10, [r11 + r10 - 0x63010428]
mov ecx, dword [r10 + rbx - 0x424]
btr r11d, 0x22
xor ecx, r9d
not ecx
movzx r8d, dil
ror bx, 0xa8

Function at 0x14054723b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jp 0x14056129c
adc rbp, rcx
movzx bx, byte [r8 + rsi]
or dl, byte [r8 + rsi + 2]
movzx ecx, r8b
lea rsi, [rsi + r8*2 + 2]
call fcn.1405470fa
or r11b, al
push rbx
not r11b
not byte [rsp + rbx - 0x139c]
bts bx, bx
setae byte [rsp + rbx - 0x139e]
mov word [rsi + rbx*8 - 0x9d06], r11w
mov ecx, dword [r10 + rbx - 0x13a5]
sub byte [rsp + rbx*4 - 0x4e80], r8b
push r8
neg r8
lea r10, [r10 + rbx*2 - 0x2746]
lea rdx, [rbx*4 - 0x5c8ec2]
lea rdi, [rdx + rbx*4 - 0x54426a5b]
xchg qword [rsp + rbx*2 - 0x2740], r8
xor ecx, r9d
and rbx, qword [rsp + rbx - 0x1399]
rol ecx, 1
movzx eax, di
shl rax, 0x2e
not ecx
jne 0x14053a344

Function at 0x14054bb2a
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xfffffffff2385f04
mov eax, 0x292e3d06
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
call fcn.14051e9df
Function at 0x14054db2f
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0x8b194b85
ror eax, 1
dec eax
not qword [rsp + r11*4 - 0x3c4]
rol bl, 0xa4
ror word [rsp + r11*2 - 0x1e0], 0xe5
rol eax, 2
xchg qword [rsp + r11*2 - 0x1e2], rdi
mov qword [rsp + r11 - 0xf1], r9
lea r8, [rdx + r11*4 + 0x1822a79b]
xor dword [rsp + r11 - 0xf1], eax
lea rdx, [r8*8 - 0x6de8485b]
pop r9
sal edx, 0x98
movsxd rax, eax
not bl
adc rbp, rax
lea rax, [rdx + r11*2 + 0x66abb280]
shr r8, 0xea
adc rcx, rbp
jmp rcx
mov qword [rsp + r11 - 0xf1], rdi
mov ebx, dword [r11 + rsi - 0xe1]
sub rax, rax
movsx ecx, ax
cmovo r11w, word [rsp + rax + 2]
lea rsi, [rsi + r11*4 - 0x3b0]
shl rcx, 0xc1
mov dword ss:[rdx + r11 - 0xf1], ebx
btr eax, r11d
not qword [rsp + r11 - 0xf1]
add eax, dword [r11 + r10 - 0xf5]
lea r10, [r11 + r10 - 0xf5]
xor eax, r9d
xor word [rsp + r11*2 - 0x1e0], di
and cx, word [rsp + r11 - 0xef]
rol eax, 1
mov ebx, 0xaeb7fd04
movzx r8d, byte [rsp + r11*2 - 0x1df]
xor r8d, r8d
not eax
jp 0x1405371fb

Function at 0x1405504e8
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rbp + riz - 8], rax
push 0x7424b688
push 0xffffffffbca2cd04
lea rsp, [rsp + 0x28]
mov qword [rbp + riz - 0x10], rsp
push 0x7639480c
call fcn.14055ebc3
Function at 0x14055be6c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub r11b, byte [rsp + r11 - 0x53fc6bf6]
lea rax, [rsp + rax + 0x10]
mov qword [rsp + rcx - 0xffc8], 0x68192417
btr r8, r8
and dword [rsp + r11 - 0x53fc6bf5], 0xfe198e88
mov ebx, dword [r11 + rax - 0x53fc6c01]
jg 0x140538a83

Function at 0x14055bea3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r11*2 - 0x330d12fe], r11
neg eax
rol eax, 2
mov word [rsp + rdx - 0x53175fac], bx
neg eax
shl dl, 0xe7
rol r8w, 0x2b
mov qword [rsp + rdx - 0x53175f00], r9
btc r11, r8
xor dword [rsp + rdx - 0x53175f00], eax
pop r9
movsxd rax, eax
bts r8d, edx
neg rdx
add rbp, rax
inc edx
movzx ecx, bl
dec r11b
mov r11, qword [rsi + rbx*2 - 0x330c897e]
rol dil, 0xc1
not ecx
call fcn.140533996
Function at 0x14056794d
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
xor r8d, 0x7f20538d
neg r8d
movsx eax, byte [rsp + r11 - 0x2d8ff82e]
mov qword [rsp + r11 - 0x2d8ff838], rax
rol r8d, 2
pop rdi
call fcn.140526808
Function at 0x1e59cbc6a14
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
cmp dword [0x1e59cbd1308], 0
jne 0x1e59cbc6aaf
mov dword [rsp], 0
jmp 0x1e59cbc6a3f
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jae 0x1e59cbc6aa5
mov eax, dword [rsp]
mov dword [rsp + 4], eax
mov dword [rsp + 0xc], 8
jmp 0x1e59cbc6a63
mov eax, dword [rsp + 0xc]
dec eax
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 0
jbe 0x1e59cbc6a92
mov eax, dword [rsp + 4]
and eax, 1
test eax, eax
je 0x1e59cbc6a86
mov eax, dword [rsp + 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 4], eax
jmp 0x1e59cbc6a90
mov eax, dword [rsp + 4]
shr eax, 1
mov dword [rsp + 4], eax
jmp 0x1e59cbc6a59
mov eax, dword [rsp]
lea rcx, [0x1e59cbd0f08]
mov edx, dword [rsp + 4]
mov dword [rcx + rax*4], edx
jmp 0x1e59cbc6a37
mov dword [0x1e59cbd1308], 1
mov dword [rsp + 8], 0xffffffff
mov dword [rsp], 0
jmp 0x1e59cbc6ac8
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x1e59cbc6b00
mov eax, dword [rsp + 8]
shr eax, 8
mov ecx, dword [rsp]
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
xor ecx, dword [rsp + 8]
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1e59cbd0f08]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 8], eax
jmp 0x1e59cbc6ac0
mov eax, dword [rsp + 8]
not eax
add rsp, 0x18
ret