joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100403230
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x810
mov rdi, qword [sym.imp.cygwin1.dll___stack_chk_guard]
mov qword [rsp + 0x850], r8
mov qword [rsp + 0x858], r9
lea rbp, [rsp + 0x30]
lea r9, [rsp + 0x850]
mov r8, rdx
mov r12, rcx
mov rax, qword [rdi]
mov qword [rsp + 0x808], rax
xor eax, eax
lea rax, [rsp + 0x20]
mov rcx, rbp
mov qword [rsp + 0x20], 0x7d0
mov qword [rsp + 0x28], r9
mov rdx, rax
call fcn.1004048b0
test rax, rax
mov rsi, rax
mov rbx, qword [rsp + 0x20]
je 0x10040331d
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, rax
call sub.cygwin1.dll_fwrite
cmp rax, rbx
jb 0x1004032f0
cmp rsi, rbp
je 0x1004032c4
mov rcx, rsi
call sub.cygwin1.dll_free
cmp rbx, 0x7fffffff
ja 0x100403312
mov rcx, qword [rsp + 0x808]
xor rcx, qword [rdi]
mov eax, ebx
jne 0x10040332c
add rsp, 0x810
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp rsi, rbp
mov ebx, 0xffffffff
je 0x1004032cd
call sub.cygwin1.dll___errno
mov ebp, dword [rax]
mov rcx, rsi
call sub.cygwin1.dll_free
call sub.cygwin1.dll___errno
mov dword [rax], ebp
jmp 0x1004032cd
call sub.cygwin1.dll___errno
mov dword [rax], 0x8b
mov rcx, r12
mov ebx, 0xffffffff
call 0x100403340
jmp 0x1004032cd
call sub.cygwin1.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or word [rcx + 0x10], 0x40
ret

Function at 0x403420
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403460
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x403457
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x403462
add rax, 0x28
cmp rax, r9
jne 0x403444
xor eax, eax
repz ret

Function at 0x403520
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x00400000], 0x5a4d
lea rbx, [0x00400000]
mov rsi, rcx
je 0x403544
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.004033e0
test eax, eax
je 0x40353b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00403420
Function at 0x14180b4f3
Capabilities:
Encode data using base64

Disassembly:
adc rsi, r10
cwde
mov r10d, 0x8f0fe995
add qword [rsp + r11*8 + 6], rcx
mov qword [rsp + r11*2], rsi
ret 0x10
xor r10, rdx
dec ebx
mov qword [rsp + r11 - 0x2de13e6e], r11
sar word [rsp + rcx - 0x5b04237c], 0x8a
bt eax, r11d
ror ebx, 2
neg ebx
sar r11b, 0xa5
imul dword [rsp + rcx - 0x5b04237c]
mul al
mov qword [rsp + rdx*8], rdi
and r11d, 0x418afb02
xor dword [rsp + rdx], ebx
bts r10w, ax
pop rdi
adc al, 0x12
add rdx, rdx
btc rcx, r10
movsxd rbx, ebx
cwd
rol eax, 0x3c
add rsi, rbx
jmp 0x14182d4a0
xadd cx, ax
movzx r10d, byte [r8 + rdx*2 - 5]
je 0x1417ff28c
and cx, 0x4720
mov ebx, 0xc0ae7414
lea r8, [r8 + rdx - 5]
xor r10b, dil
mul eax
cdq
ror r10b, 1
call fcn.14181a7b1
lea rbp, [rcx - 0x344222cf]
inc bl
ror bl, 1
sal rbp, cl
xor bl, 0xb5
lea rdx, [rdx*8 - 0x65f8d25d]
sar r10, 0x4f
sbb bl, 0x30
lea r10, [r10*2 - 0x5de3f076]
neg bl
add bl, 7
lea rax, [rbp - 0x534de84d]
add r11, rbp
btr r11, rcx
xor dil, bl
add rbx, rsp
add eax, 0xf121493
sbb al, r11b
mov rbp, qword [r10 + rbx + 0x5ddff078]
imul r11, r10
or r10, r10
mov qword [r9 + r10 + 0x5ddff070], rbp
sub ecx, 0x929ed293
movsx ebp, dx
mov ecx, dword [r8 + rcx - 0x6cae0167]
xor ecx, edi
sar r10, 0xa6
xchg r11w, ax
lea ecx, [rcx + r10 - 0x55104307]
neg ecx
jmp 0x141826cc5
Function at 0x141813054
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r11b
dec r11b
ror r11b, 1
not r11b
movzx ebp, dx
bts rcx, rdx
and ecx, eax
xor dil, r11b
add r11, rsp
bswap rax
mov word [r11 + rcx], r10w
jmp fcn.14180af9f
lea rbp, [rbx + rbx*8 + 0x4b22de8e]
mov eax, dword [r8 + riz - 4]
xor eax, edi
pop rcx
sal ebx, 0x17
movsx r10d, bx
lea eax, [rbx + rax + 0x6b340185]
mov ecx, 0x14b653a7
lea rbx, [r10 + rbx*8 + 0x2bb3fdbc]
mov r11d, r10d
rol eax, 1
xor eax, 0xa497e99b
sar rbp, 0x2e
inc eax
btr bx, bp
sal ebx, 0x2c
push rdi
xor dword [rsp + rbx - 0x3fdbc000], eax
shr ebx, cl
sar cl, cl
pop rdi
ror r10b, 0x82
or bx, r11w
movsxd rax, eax
not bx
adc rsi, rax
inc rcx
movzx edx, r11b
ror ecx, 0x46
lea r11, [rsp + rbx - 0x7f47af]
movzx eax, bpl
add ebp, dword [rbx + r11 - 0x7f487f]
cqo
mov dword [r9 + rbx - 0x7f4883], ebp
xor r10w, word [r9 + rbx*8 - 0x3fa43fc]
inc edx
add edx, ebx
mul ebx
lea r9, [r9 + rcx*2 - 0xa5b2a2]
movzx r11d, byte [r8 + rbx*4 - 0x1fd2201]
lea rbx, [rax - 0x28d9f7fd]
lea r8, [r8 + rbx*2 + 0x51b3eff5]
jae 0x14183559b
mov r11, qword [r9]
mov eax, 0x9d069101
lea rcx, [rax + rax - 0x5254d7d4]
movzx ebx, ax
mov edx, dword [r9 + rbx - 0x90f9]
movsx r10d, cl
mov dword ss:[r11 + rbx*4 - 0x24404], edx
sar rcx, 0x7a
and bl, 0x8c
movsx r11d, al
mov edx, dword [r8 + rcx*8 - 4]
add bx, 0x4d1b
btr bx, bx
ror r11, 0xc
xor edx, edi
movzx ebp, r10b
inc edx
neg edx
sal al, 0xc2
sbb rbx, rax
setno cl
xor edx, 0xe09f6c12
sub edx, ecx
jmp 0x14182ffc4
jmp 0x14184fb8a
xor r11b, dil
mul rbx
jae 0x14184ed5f
jae 0x14180c6b6
mov edx, 0x6bacc41d
mov r11d, edx
mov r10, qword [r9 + r11 - 0x6bacc41d]
and r11d, edx
lea r9, [r9 + r11 - 0x6bacc415]
movzx ebp, dx
lea r8, [r11 + r8 - 0x6bacc41f]
xor r11b, r11b
bts ebp, 0x20
movzx eax, word [r8 + rbp*4 - 0x31074]
xor ax, di
movzx ecx, bpl
imul r11, rcx
movsx ebx, dx
not ax
dec rbx
or bpl, r11b
dec ax
xor dl, bpl
shl bl, 0xc2
rol ax, 1
inc rdx
not ax
shl bpl, 0xe1
inc ax
sub bl, 0x2b
shr rbx, 0x31
xor di, ax
push rbp
bswap ecx
lea rax, [rsp + rax + 8]
push rbx
pop rbp
and dl, 0x38
mov qword [rax + rdx - 0x6bacc400], r10
xchg dword [rsp + rdx - 0x6bacc3fc], ebx
lea r8, [r8 + rcx - 0x1d000004]
jp 0x14180aaed
jmp 0x1418047fd

Function at 0x1418188fc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x519680bc
add dword [rsp + 4], 0x380e3632
dec ebx
call fcn.1418221bf
Function at 0x141818d68
Capabilities:
Encode data using base64

Disassembly:
neg bl
mul rcx
ror bl, 1
btc edx, ebp
not bl
sar rdx, 0xde
idiv rax
xor dil, bl
cdqe
div eax
rol r11d, 0xb7
adc rbx, rsp
mov r10d, dword [rbx + riz]
movzx ebx, al
mov dword [r9 + rbx*8 - 0x3c], r10d
xchg rbp, rbx
xor rdx, rax
lea rbx, [r9 + rbp - 0xb]
btr rcx, rcx
mov qword [r9 + rbp*4 - 0x28], rbx
xchg al, bpl
imul rbp, rdx
lea r9, [r9 + rbp - 0xc923b35]
jae fcn.14180af9f
dec eax
add edx, ecx
mov qword [rsp + r10 - 0x7fffff], rdx
btc rbp, rcx
ror eax, 1
not eax
shl byte [rsp + r10 - 0x7ffffd], 0x81
jnp 0x14184e1de
mov qword [rsp + r10 - 0x7fffff], rdi
movzx edi, bp
call fcn.14181cf0c
ror dx, 1
mov word [r9 + rbp - 0xfd], ax
lea r9, [r9 + rbp*2 - 0x1fc]
jb 0x1417ff5c4
mov ecx, 0x6d31f923
mov ecx, dword [r8 + rcx - 0x6d31f927]
mov ebp, 0x2b8a9e80
xor ecx, edi
mov edx, ebp
lea ecx, [rcx + rbp*4 + 0x4d898785]
rol ecx, 1
movsx r11d, bp
mov eax, 0x16189aa2
xor ecx, 0xa497e99b
add al, 0x22
sub rax, 0x4d908812
inc ecx
bswap edx
movsx r10d, bpl
push rdi
xor dword [rsp + rax + 0x3777ed4e], ecx
lea rbx, [r10 + 0x7b90858a]
pop rdi
add dx, bx
adc dx, r10w
lea rbp, [rbp*8 - 0x7a69ac64]
movsxd rcx, ecx
add rsi, rcx
movzx ebx, byte [rax + r8 + 0x3777ed49]
lea r8, [r8 + rax*2 + 0x6eefda97]
neg r11d
xor bl, dil
or rbp, rdx
mov ecx, r10d
rol bl, 1
imul edx, r11d
jb 0x1418125f9

Function at 0x14181cd44
Capabilities:
Encode data using base64

Disassembly:
btc eax, ecx
xor dword [rsp + rbx*2 + 0x2ae99fb4], edx
pop rdi
ror r11w, cl
movsxd rdx, edx
mov r10d, eax
add rsi, rdx
mul rcx
and r11, rax
sal bp, cl
mov r10w, word [rbx + r9 + 0x1574cfda]
sal dx, 0x4e
neg ebp
jbe 0x141829780
mov edx, 0x8aaa8a2c
mov eax, edx
sub r8, 1
movzx ecx, al
inc cl
movsx ebx, cl
movzx ebp, byte [r8 + rcx - 0x2d]
inc rdx
xor bpl, dil
mov r11d, ecx
sub bpl, 0xb9
btr ebx, 9
setb cl
sar r11d, 0xbf
ror bpl, 1
or edx, eax
not bpl
inc r11b
neg bpl
rol bpl, 1
ror rbx, 0x2a
adc rbx, rdx
xadd r11d, edx
xor dil, bpl
mov r10d, ecx
add rbp, rsp
dec r10d
btr r11d, 0x95
cqo
mov ebx, dword [rbp + rdx*4]
setae al
lea rbp, [r11 + r11*2 + 0x6b21ef83]
or r11, 0x4811018f
lea r9, [r9 + rdx*2 - 4]
lea rbp, [r11*2 - 0x4df58fc]
xadd rcx, r11
neg rdx
mov dword [r11 + r9], ebx
imul cl
xchg al, r10b
lea r8, [r8 + rdx - 4]
mov ebx, eax
mov eax, dword [rdx + r8]
xor eax, edi
sar bp, 0x81
jo 0x14182f677
lea eax, [r10 + rax - 0x44bfd7b]
call fcn.14183d93d
mov qword [rsp + rbx*2 + 0x2ae99fb4], rdi
lea rcx, [rbx + rbx*2 - 0x66fc34c]
jnp 0x14181106b
adc bp, 0x55ac
add bp, r10w
mov dword [r9 + rbp - 0x42a0], eax
mov dword [rbp + r9 - 0x42a4], ebx
movsx eax, bp
mov dword [r9 + rbp*8 - 0x2155c], ecx
bts ax, 0xb4
xadd r11w, r10w
jne 0x141846e8e
mov r11w, word [rbp + r9 - 0x409ab43e]
mov cl, byte [r9 + rbx*4 + 0x55d33f6c]
lea r9, [r9 + rbx + 0x1574cfde]
neg rax
div bpl
neg dl
shrd r10w, r11w, cl
movzx r11d, bl
and rax, 0x43059829
jb 0x14180eb62
mov word [r9 + rbp - 0x409ab440], r10w
rol bx, 0x6f
jmp rsi
Function at 0x14182b33c
Capabilities:
Encode data using base64

Disassembly:
neg byte [rsp + 2]
mov qword [rbp + riz - 8], rax
jl 0x14184bd69
cwde
mov qword [r11 + r9 - 0x4d13b202], rcx
lea r8, [r11 + r8 - 0x4d13b206]
sal r11d, 0xc9
adc r11w, dx
mov edx, dword [r11 + r8 - 0x2764e844]
movzx ecx, bx
xor edx, edi
jmp 0x1417fd6d4
ror r10d, 1
dec r10d
lea r11, [rdx + rax*2 + 0x58b8a7a6]
bswap r10d
cwd
rol r11d, cl
ror r10d, 3
pop rbx
sal al, 0xe5
lea rbx, [rbp*2 - 0x3ec019e9]
push rdi
ror cx, 0xd
jp 0x14181efc7
xor dword [rsp + rcx*4 - 0x3a8fa128], r10d
neg r11b
call fcn.1417f7fbb
shl ecx, 3
jmp 0x1418481c3
sal edx, 3
xor al, al
mov rax, rbp
push 0x4e388a0c
shr dword [rsp + 4], 0xe1
rol word [rsp + 3], 0xef
add rax, rdx
jmp 0x1418187f2
xor qword [rsp], 0x6a14c5b3
jae 0x1418026ee

Function at 0x14182b59b
Capabilities:
Encode data using base64

Disassembly:
movzx r11d, bpl
sub ebx, 0xc508dd32
mov qword [rsp + rcx - 0x2e97502d], 0xffffffffa70073ad
rol ebx, 1
movzx r10d, r11b
inc r11
not ebx
rol ebx, 1
xor ebx, 0xcc217603
mov qword [rsp + rcx*2 - 0x5d2ea052], rdi
add cx, 0xa09a
xor dword [rsp + rcx - 0x2e97f0bf], ebx
push r11
sar byte [rsp + rcx - 0x2e97f0bb], cl
mov rdi, qword [rsp + rcx*2 - 0x5d2fe17e]
not qword [rsp + r11 - 1]
movsxd rbx, ebx
add rsi, rbx
movzx eax, cx
pop rdx
movzx ebx, dx
mov r11, qword [r9 + r11*4 - 4]
xchg rbp, rcx
mov qword [rsp + rbp - 0x2e97f0bf], rbx
lea r9, [rbp + r9 - 0x2e97f0bf]
lea r8, [r8 + rbp - 0x2e97f0c8]
xadd r10w, bx
jle 0x14184bcbb
movzx r10d, byte [rbp + r8 - 0x2e97f0c7]
xor r10b, dil
shl ebx, 0x15
dec r10b
or bpl, byte [rsp + rax - 0xf0b9]
mul ebp
push rcx
rol r10b, 1
pop rdx
xor r10b, 0xb3
dec r10b
xor dil, r10b
call fcn.14180fb8f
xor dil, r10b
lea rbx, [rdx + rbx*4 + 0x1b83172d]
ror r11d, 0xa1
lea r10, [rsp + r10 + 0x18]
mul bpl
xor ebp, 0x6f25d737
mov byte [rax + r10 - 0x2abd7e78], cl
inc ebp
shl qword [rsp + rax - 0x2abd7e6f], 0xea
or ax, word [rsp + r11*4 - 0x12d]
lea r8, [r8 + rax - 0x2abd7e7c]
shr rax, 0xa3
mov ecx, 0x573d5813
rol byte [rsp + rax*4 + 0xa], 0x25
mov r10d, dword [rax + r8]
or r11, 0x6083128b
not byte [rsp + rax + 0x11]
sbb rdx, 0x2ac202a
xor r10d, edi
not r10d
imul bp, word [rsp + rax + 0x11]
lea r10d, [r10 + rax + 0x6e0ed7be]
call fcn.14183fbfb
Function at 0x14182c148
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffff8a010abb
push 0xffffffffc82c9391
or qword [rsp + 6], 0x7124760e
cmp ebx, 2
jmp 0x1418024dd
push 0xffffffff9f0bf43f
sbb rsp, 0x18
call rax
mov r9d, 0x7fbd0a23
movzx ebx, r9b
lea r10, [r9 + r9*2 + 0x3332ae93]
mov rsp, qword [rbp + rbx*8 - 0x128]
movsx r11d, r10b
mov rbp, qword [rbp + rbx - 0x2b]
mov qword [rbp + rbx*2 - 0x46], rax
neg ebx
and r9d, ebx
mov r9, rbp
pop rdi
call fcn.141829e17
neg edx
push rcx
mov qword [rsp + r11*2 - 0x4ec9d088], rbx
movsx ebp, r11b
ror edx, 1
xor cx, word [rsp + rbx*2 - 0xc805]
or r10d, ebp
lea edx, [rdx + rbx*2 - 0x273b7443]
ror edx, 3
neg rbp
dec r11w
sete al
neg edx
dec bpl
dec rbx
lea edx, [rdx + r11*4 + 0xf977e32]
mov qword [rsp + rax - 0x4700], rdi
btr r10w, ax
not r11
xor dword [rsp + r11*2 + 0x4ec9d088], edx
sal rbp, 0x76
bts ebx, r11d
sub ax, ax
pop rdi
sub ax, r11w
movsxd rdx, edx
bswap eax
add rsi, rdx
cqo
jmp 0x14180f503
not dword [rsp + 8]
lea rsp, [rsp + 0x10]
jne 0x141829aef
mov edx, 0xce254808
jmp 0x14183df15
lea rsp, [rsp + 8]
jmp 0x1418075f0
dec ebx
jne 0x14182c158
mov eax, 0xc3a36b3c
sal rax, 0x85
mov rax, qword [rbp + riz]
jae 0x1417fd690
jmp 0x14181f8ff
mov qword [rsp + 8], 0xffffffff820b75b9
lea rsp, [rsp + 0x10]
jne 0x1417f76aa
mov rcx, rax
push 0xffffffffe22d4e81
mov qword [rsp], 0xffffffffc384b7b2
jmp 0x14180447e
jmp fcn.14180af9f
call fcn.141848541
jmp 0x141829483
push 0x69dc314
lea rsp, [rsp + 0x18]
je 0x1418075f8
mov eax, 0xdf29c926
btc rax, rax
inc ax
mov rax, qword [rbp + rbx*8]
push 0x41ad9c33
push 0xffffffffe80c4b36
not dword [rsp + 9]
cmp ebx, 1
jmp 0x141817773
jmp 0x14184199e
mov rdx, rax
push 0xffffffffda34a790
call fcn.1418132f3
Function at 0x1418300d9
Capabilities:
Encode data using base64

Disassembly:
bt ecx, r11d
movsx edx, r10b
inc ebx
xchg al, dl
neg ebx
lea rcx, [rdx - 0x7e79d342]
bswap ebx
mul bp
inc ebx
inc rbp
mul dl
push rdi
jo 0x141835ce9
sal r11w, 0x6e
xor dil, cl
add rcx, rsp
btr r10, 8
mov word [rbx + rcx - 0xbe48], bp
movzx eax, r11b
lea r8, [rbx + r8 - 0xbe4c]
mov r11d, dword [r8 + rbx*8 - 0x5f240]
call fcn.141833518
movzx r10d, byte [r8 - 1]
mov ebx, 0xd7b8549d
lea rcx, [rbx - 0x2af53d5f]
rol ecx, cl
xor r10b, dil
movzx edx, cl
movzx eax, bx
btc rdx, 0x95
neg r10b
imul dx
mov ebp, 0x7f32b2b0
xchg ebp, ecx
rol r10b, 1
sub cl, 0x14
movzx r11d, dl
adc r10b, 0xa1
not edx
ror r10b, 1
xor dil, r10b
bswap r11
not eax
sub rdx, 0xffffffffe593c724
add r10, rsp
mov cx, word [r10 + rcx - 0x7f32b29c]
mov r10d, eax
lea rbp, [rbp*8 - 0x395978c5]
mov word [r9 + riz - 2], cx
mov ecx, dword [r8 + riz - 5]
imul rbx, rax
sbb r10b, 0xa8
adc r8, 0xfffffffffffffffa
rol bp, 0xcb
push rax
xor ecx, edi
rol ecx, 2
call fcn.14182ac71
lea rbp, [r11 + 0x693c7b2]
mov ebx, r11d
movsx r10d, r11b
bswap ecx
call fcn.141836596
neg r11d
cwd
call fcn.141829488
or rax, 0x5e88199e
shr r10b, 0x22
adc rsi, r11
sub rbp, rdx
mov r9, qword [r9 + rcx*4 + 4]
xor ebx, eax
xchg rbx, rbp
bts rcx, 0x2c
jae fcn.14180af9f
lea rbx, [rdx + rdx*2 - 0x5056adec]
dec ebp
btr r10w, 0x1f
ror ebp, 2
lea rax, [rdx*8 + 0x1e36dc87]
neg ebp
mov ecx, eax
shr r10d, 0x7d
xchg r10b, r11b
rol ebp, 2
sub al, al
adc rax, 0xffffffffb2b6ab9d
or edx, edx
not ebp
cwd
lea rbx, [rax + r11*8 - 0xff86ec]
shr eax, cl
push rdi
sub eax, r10d
sbb dx, 0xab0
xor dword [rsp + r10 - 0x14], ebp
rol r10w, cl
pop rdi
xchg edx, r10d
movsxd rbp, ebp
cmovb edx, ebx
adc rsi, rbp
mul r10b
mov rbp, qword [rdx + r9 - 0xa00]
sal edx, cl
xadd r11b, r10b
call fcn.14182afed
mov byte [rdx + rbx - 0x58bb054d], al
mov edx, dword [r9 + rcx*2 - 0x6411ffda]
call fcn.141831817
mov r10d, 0x4bbf8ab6
mov rbx, qword [r10 + r9 - 0x4bbf8ab6]
lea r11, [r10 + 0x7519d985]
mov ecx, r11d
mov r10, qword ss:[r10 + rbx - 0x4bbf8ab6]
mov rcx, r10
lea r10, [r11*8 - 0x577b8a7c]
mov ax, word [rcx + riz]
mov word [r9 + riz + 6], ax
movzx ecx, r10w
lea r9, [r9 + rcx*8 - 0x4bada]
inc r11
mov r11d, dword [r8 + rcx - 0x9760]
sub cl, r10b
neg rcx
movzx eax, cl
lea r8, [rcx + r8 + 0x96fc]
movsx ebx, r10w
mov ebp, 0x4b8ec28e
lea rcx, [r10*8 - 0xdcaa8c7]
xor r11d, edi
movzx edx, ax
dec r11d
ror r11d, 2
rol rbx, cl
shr bpl, 0x24
jb 0x14181333e
not bl
rol ecx, 0x7f
adc bl, bpl
btc r10d, ebp
jb 0x14180cefb
pop r11
not bl
ror r10d, cl
movzx r11d, dl
xor dil, bl
sar cx, cl
not rbp
or cx, 0xfa82
adc rbx, rsp
xchg r11, r10
or rbp, rcx
jne 0x141828bad
or r11b, 0xa9
adc rsi, rdx
add r10b, 0x84
mov ebx, dword [r8 + r11*2 - 0x206]
jno 0x141844b7a
cwde
xor dword [rsp + r11 - 0xff], ebx
inc al
pop rdi
mov dword [r9 + r11*2 - 0x20a], ebx
shr rax, cl
cdqe
lea r9, [r11 + r9 - 0x10b]
mul r10b
jno fcn.14180af9f
btc rdx, 0xb7
not bx
not cl
jae 0x14180c15d
mov r11d, 0x8f0f2a14
sub r8, 4
movsx r10d, r11w
mov ebp, dword [r8 + r10*4 - 0xa850]
xor ebp, edi
movzx edx, r10w
jmp 0x14181e9e5
inc r10b
movsx ecx, r10b
lea r8, [r8 + r11*2 - 0x206]
bt r11, r10
xor ebx, edi
jmp 0x1417fb16c
Function at 0x1418346e0
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [r9 + r11*2 - 0x624c2d66]
lea r9, [r9 + r11*2 - 0x624c2d6c]
movsx eax, r11w
sal rbp, cl
inc bx
mov qword [r9 + r11 - 0x312616b7], rbp
push r11
movsx ebp, word [rsp + r11 - 0x312616b3]
lea r8, [r8 + r11 - 0x312616bb]
lea rdx, [rbp + rax + 0x19a39137]
xadd bl, dh
mov ebx, dword [r8 + r11*2 - 0x624c2d6e]
xor ebx, edi
shl bpl, 0xc6
not ebx
mov qword [rsp + r11*2 - 0x624c2d66], 0x6014629e
dec dl
neg ebx
movzx r10d, byte [rsp + rax*2 - 0x2d63]
inc rbp
sub ebx, 0xc708642e
bt rax, 0x3d
call fcn.141830473
shr cx, 1
mov qword [r9 + rdx - 0x727c0001], rbp
mov eax, 0xfcb64f09
dec r11w
pop r10
pop r10
pop rax
jg fcn.14180af9f

Function at 0x141835eb8
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jne 0x141843fc4
push 0xffffffffe214659c
call fcn.141849095
push 0x5d0c0db2
jmp 0x14183ff56

Function at 0x14183ff7e
Capabilities:
Encode data using base64

Disassembly:
movzx ebx, word [r8 + rbp*2 - 0xf8a0]
xchg rbp, r11
xor bx, di
dec bx
mov qword [rsp + rbp*2 - 0xa0], rax
div r11b
xor bx, 0x9508
shl r11d, 0x73
sub r11, rcx
xor qword [rsp + rbp*2 - 0xa0], rbp
dec bx
rol bx, 1
sub bx, 0xed0c
rol cx, 0x65
sub word [rsp + rbp*2 - 0xa0], 0x1e24
xor di, bx
neg rbp
lea rbx, [rsp + rbx + 8]
mov word [rbx + rbp + 0x50], dx
push rcx
sal word [rsp + rbp + 0x50], 0x29
jns 0x141827c13
Function at 0x141846b44
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov rdx, qword [rdx + r9 - 0x275554a0]
movzx eax, r11w
mov rbp, qword [r9 + rbp*2 - 0x786a]
call fcn.141802e64
mov ebp, dword [r8 + riz - 4]
lea rbx, [r11 + r11 - 0x29d9975d]
lea rdx, [rbx + r10 + 0x4dbb8b36]
add r10b, byte [rsp + 3]
xor ebp, edi
bt r11w, 0xb8
bswap ebp
or rbx, rdx
inc ebp
or qword [rsp], rdx
xor byte [rsp + 2], r10b
adc qword [rsp], 0xffffffffbc3ba728
ror ebp, 1
lea rax, [r11*2 + 0x603ec302]
dec ebp
mov dword [rsp + 1], 0xdf1fbd38
bt r10, r10
not ebp
ror ebp, 1
sub r11d, ebx
call fcn.14181264f
sbb al, bpl
sar rcx, 0x42
mov r10d, dword [rcx + r8 - 0x2225d7af]
xor r10d, edi
sub cl, 0x3b
bt eax, r11d
cdq
xor r10d, edx
lea r10d, [r10 + rcx*2 + 0x4a5f672c]
imul ax, cx
xor r10d, edx
inc ax
neg r10d
btr dx, 0xe
sbb bp, bp
push rdi
xor dword [rsp + rcx - 0x2225d774], r10d
pop rdi
bts rdx, 0x97
movsxd r10, r10d
xchg dx, cx
dec r11w
add rsi, r10
bswap rcx
xchg dh, cl
jmp rsi
not eax
xor dword [rsp + rdx - 1], r11d
sub cl, bh
rol dx, 0xcb
imul dl
pop rdi
movsxd r11, r11d
adc rsi, r11
btc bp, 0x38
jb fcn.14180af9f
sub r8, 4
mov edx, 0x92802e1f
mov r11d, edx
mov r11d, dword [r8 + riz]
lea rcx, [rdx + rdx*8 - 0x3af94277]
push rdx
xor r11d, edi
mov eax, 0xc52cfc3a
pop rax
dec r11d
ror r11d, 2
movsx ebp, dl
not r11d
mul rax
sub eax, ecx
jle 0x14183bb29
rol eax, 3
sub r11d, 0x6b0b15b5
push rdi
imul ebx, edx
or r10d, 0x872fc6a9
xor dword [rsp + rdx*2 - 0x4eaaa914], eax
shr bx, 0xcd
pop rdi
movsxd rax, eax
not dl
movsx ebp, cx
sal dl, 0xa5
adc rsi, rax
ror r11b, 0x66
inc bl
jg 0x141802f92
sub r11d, 0xec8d7d09
push rdi
xor dword [rsp + rdx], r11d
mov r10d, 0x11a1b4a9
xadd dx, ax
lea rbp, [r10 + rcx + 0x421a75ac]
pop rdi
movsxd r11, r11d
btc r10d, eax
cdq
add rsi, r11
mov edx, dword [r10 + r9 - 0x11a1b4a8]
mov cl, byte [r9 + r10 - 0x11a1b4a4]
lea r9, [r9 + r10 - 0x11a1b4a6]
btc r10d, r10d
shl edx, cl
xadd ebp, r10d
mov r11d, r10d
movsx ecx, r11b
mov dword [rbp + r9 - 0x50e63c9d], edx
jmp rsi
rol r11d, 2
jmp 0x141831da7
xor r11d, 0x64aae3b0
mov qword [rsp + rdx*4 - 0xa8], rax
mul rbx
adc cx, 0x512e
lea r11d, [r11 + rdx*2 - 0x1c2ac424]
mov qword [rsp + rdx - 1], rdi
jno 0x141805d71

Function at 0x141846b6e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0x64a50192
push qword [rsp + 0x10]
popfq
call fcn.14183760d
mov qword [rsp], rdi
mov edi, 0xf7bcb32d
lea rdi, [rdi + rdi + 0x4a96b23d]
push r9
mov r9d, edi
neg r9b
neg edi
lea rdi, [0x1417e40f0]
Function at 0x14184bd78
Capabilities:
Encode data using base64

Disassembly:
shr rbp, 0xcd
movsx edx, r10b
mov rdi, qword [rsp + rbp*8 + 0x10]
movsx ecx, r11w
xadd dx, r11w
mov qword [rsp + rbp*4], r11
movsxd rax, eax
cmovb bp, cx
adc rsi, rax
lea rax, [r10 + rbp*4 + 0x731ca030]
mov rbx, qword [rbp + r9]
neg r10w
not rdx
add ebp, dword [r9 + rbp + 8]
btr rdx, r11
sar r10w, 0x66
or r11w, 0x46b4
lea r9, [r9 + r11*4 - 0x11ac8]
mov dword [rbx + r11*2 - 0x8d6a], ebp
shl r11, 0x19
mov qword [rsp + r10 - 0xfff7], rcx
call fcn.141836de0
add rsi, rcx
movzx r11d, bp
movzx edx, word [r8 + rbp + 0x9e]
movzx eax, byte [rsp + rbp + 0xac]
lea r8, [r8 + rbp + 0x9e]
or r11w, bp
call fcn.1418474c7

Function at 0x14184be0e
Capabilities:
Encode data using base64

Disassembly:
mov r10d, 0x5e947f0b
lea rax, [rdx + r10*2 + 0x12395980]
idiv rax
xor ebx, edi
mov r11d, dword [rsp + r10 - 0x5e947f0a]
call fcn.141804e88
shl byte [rsp + r11*2 - 0x905a104], 0xa1
lea r10, [rsp + r10 + 8]
bts rcx, 0xa7
movzx ebx, byte [rsp + r11*8 - 0x2416840c]
mov qword [r10 + r11 - 0x482d082], rax
pop r11
mov eax, ecx
call fcn.141804bb7
mov edx, 0x4728ba27
mov eax, dword [r9 + rdx - 0x4728ba27]
lea r11, [rdx - 0x66d04bda]
mov ecx, dword [r9 + r11*4 + 0x7e9e46d0]
movzx ebp, dx
sar bpl, 0x47
lea r11, [r11 + 0x460fcba2]
cpuid
sbb r11w, bp
ror bpl, 0x66
lea r9, [r9 + r11 - 0x26687ff7]
mov dword [r9 + r11*2 - 0x4cd0ffd2], eax
movsx eax, r11b
ror al, 0xc7
mov r10d, r11d
mov dword [r11 + r9 - 0x26687fe7], ebx
mov dword [r9 + rbp*2 - 0x173fc], ecx
mov dword [r9 + r11 - 0x26687fef], edx
jb 0x1417fe9c9
or r11d, eax
jle 0x141826f5c
lea r8, [r8 + rbp*2 - 0x17404]
mov r11d, dword [r8 + rbp*4 - 0x2e800]
mov ecx, 0xb2855f05
xor r11d, edi
dec eax
call fcn.141829ce9
mov edx, 0x841cb091
jmp 0x1418500cc
adc rsi, r11
xor ebx, ebp
mov qword [rsp + rdx - 8], rdx
sal r10w, 0xf
mov r10, qword [r9 + rdx - 8]
mov ecx, 0x69322398
mul rcx
lea r9, [r9 + rdx + 8]
or byte [rsp + rdx*2 + 3], ch
xor rcx, 0xffffffffa1a56017
mov qword [rsp + rdx + 8], rdx
movzx eax, byte [rdx + r8 - 5]
je 0x1417fd304
lea r8, [r8 + rdx - 5]
xor al, dil
xadd dl, bl
sar ebp, 0xdb
sar bpl, 0xc3
inc al
call fcn.141801286

Function at 0x1407ab8e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1407ab8ea
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1407ab913
pop rbp
sub rbp, 0x33
sub rbp, 0x7ab8e0
sub rsp, 0x20
jmp 0x1407ab932
add al, 0
add byte [rax], al
ja 0x1407ab975
and byte [eax - 0x39], cl
shl al, 0xb8
jp 0x1407ab939
mov rax, 0x7ab8e0
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x1d510cbd
xor byte [rax], dl
inc rax
dec rcx
jne 0x1407ab951
jmp 0x1407ab968
cmc
xor al, 0x54
xor al, 0x81
mov ebp, 0x3cf5bdbd
jl 0x1407ab92a
mov esp, 0xbcf5bdbd
push rsp
cmc
jp 0x1407ab9fb
mov ch, 0xbd
mov ebp, 0x7f7af5bd
xchg ebp, eax
mov ebp, 0x4af5bdbd
pop rdi
cmc
mov esp, 0xb13c367c
mov ebp, 0xbcf5bdbd
push rbp
in eax, dx
in eax, dx
cmc
add eax, 0xbdabf0c5
mov ebp, 0xf5bdbdbd
add al, 0xda
invalid
push rsp
xor byte [rdi + 0x55efbdbd], bh
sar byte [rbp - 0x15184243], 0xf5
xor al, 0x6a
cmc
invalid