joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ded04
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov dword [rsp + 0x30], esi
mov rbx, rcx
test rcx, rcx
je 0x1400ded77
cmp word [rcx], si
je 0x1400ded77
lea rdx, [0x140119098]
call fcn.1400bef88
test eax, eax
je 0x1400ded77
lea rdx, [0x1401190b0]
mov rcx, rbx
call fcn.1400bef88
test eax, eax
jne 0x1400ded6d
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400ded94
mov eax, dword [rsp + 0x30]
jmp 0x1400deda6
mov rcx, rbx
call fcn.1400cf474
jmp 0x1400deda6
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400ded98
xor eax, eax
jmp 0x1400deda6
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400deda6
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400dedb8
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ebp, edx
mov dword [rax + 8], ebx
mov edi, ecx
call fcn.1400cfcdc
mov ecx, edi
lea r9d, [rbx + 2]
and ecx, 0x3ff
lea r8, [rsp + 0x30]
bts ecx, 0xa
mov edx, 0x20000001
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400dee5b
cmp edi, dword [rsp + 0x30]
je 0x1400dee54
test ebp, ebp
je 0x1400dee54
mov r9, qword [rsi + 0x98]
mov r8d, ebx
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x1400dee30
sub dx, 0x61
cmp dx, 0x19
ja 0x1400dee3c
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x1400dee1d
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], bx
jne 0x1400dee40
cmp r8d, eax
setne bl
mov eax, ebx
jmp 0x1400dee5d
mov eax, 1
jmp 0x1400dee5d
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1e18
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400c27f8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400e1ea2
cmp byte [rbp - 0x21], r15b
je 0x1400e1e9d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400e1ed8
call fcn.1400d0bf8
test eax, eax
jne 0x1400e1ec4
cmp byte [rbp - 0x21], r15b
je 0x1400e1ebc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400e1ed8
cmp byte [rbp - 0x21], r15b
je 0x1400e1ed5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400cbc54
test eax, eax
jne 0x1400e1f78
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400c27f8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400e1f17
cmp byte [rbp - 0x21], r15b
je 0x1400e1f4c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400e1f4c
call fcn.1400d0bf8
test eax, eax
jne 0x1400e1f38
cmp byte [rbp - 0x21], r15b
je 0x1400e1f31
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400e1f4c
cmp byte [rbp - 0x21], r15b
je 0x1400e1f49
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400cbc54
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400e1f78
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400e1f7b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400e1f89
mov rcx, rdi
call fcn.1400cf560
cmp byte [rbp + 0x3f], r15b
je 0x1400e1f98
mov rcx, qword [rbp + 0x27]
call fcn.1400cf560
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400e442c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400e4466
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400e446b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400e44b4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14011e5a0]
cmp byte [rcx + rax], 0
je 0x1400e44b4
dec r8
sub rdx, 1
jne 0x1400e449a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400ff050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400eb752
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400eb735
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400eb720

Function at 0x140108490
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.1400dc15c
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401084e2
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1401084e2
sub ecx, 1
je 0x1401084db
cmp ecx, 1
je 0x1401084d4
xor eax, eax
jmp 0x1401084e7
mov eax, 3
jmp 0x1401084e7
mov eax, 1
jmp 0x1401084e7
mov eax, 2
add rsp, 0x28
ret

Function at 0x140108bb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140108bd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140108bd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14010ad58
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400d429c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400d429c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14010aea5
cmp rax, 0xffffffffffffffff
je 0x14010aea5
xor edi, edi
test rbp, rbp
jle 0x14010ae53
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400d0810
mov rbx, rax
test rax, rax
jne 0x14010ade0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14010ae49
mov edx, 0x8000
mov ecx, r14d
call fcn.1400cd9bc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400d2984
cmp eax, 0xffffffff
je 0x14010ae29
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14010adf0
mov edx, r15d
mov ecx, r14d
call fcn.1400cd9bc
jmp 0x14010ae49
cmp byte [rsi + 0x38], dil
je 0x14010ae40
cmp dword [rsi + 0x34], 5
jne 0x14010ae40
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x14010ae49
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400cf560
jmp 0x14010aeb7
jns 0x14010aeb7
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400d429c
cmp rax, 0xffffffffffffffff
jne 0x14010ae71
cmp byte [rsi + 0x30], dil
je 0x14010aeb7
jmp 0x14010aead
mov ecx, r14d
call fcn.1400dc06c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14010aeb7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x14010aeb7
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14010aeb2
mov edi, dword [rsi + 0x2c]
jmp 0x14010aeb7
mov edi, socket
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400d429c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdx, [0x1400033ac]
lea rcx, str.G:1payload3.bin
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd r14, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x14000110f
lea rcx, str.Failed_to_allocate_memory__n
call fcn.140001020
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14000121f
mov r9, rbx
mov qword [rsp + 0x60], rbp
mov r8, r14
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test r14d, r14d
jle 0x140001147
mov r8, r14
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400033ec]
call fcn.140001020
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 5
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rsp + 0x44]
lea rcx, str.shellcode:_d
mov edx, r14d
mov byte [0x14000507c], al
call fcn.140001020
mov r9d, 4
mov r8d, 0x1000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, str.ceshi21
mov rbx, rax
call fcn.140001020
test rbx, rbx
je 0x14000121a
mov r8, r14
mov rdx, rbp
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x30]
mov r8d, 0x10
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ceshi2
call fcn.140001020
call rbx
mov rbp, qword [rsp + 0x60]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400021e0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x140002b1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b66
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b68
xor al, al
add rsp, 0x28
ret
Function at 0x14005aa40
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005aa4d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005aa5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14005aa45
lea eax, [rcx + 1]
jmp 0x14005aa6b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005aa7e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14005aa64
sub eax, 3
jb 0x14005aa9e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005aaed
sar eax, 1
movsxd rbp, eax
jb 0x14005aad4
jmp 0x14005aaac
add ebx, ebx
jne 0x14005aaaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005aad4
inc ecx
add ebx, ebx
jne 0x14005aaba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005aad4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14005aacd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005aabc
add ecx, 2
jmp 0x14005aad9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14005aa02
jmp 0x14005aa4d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a000
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14005ab39
cmp rsi, rcx
jae 0x14005ab41
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14005ab20
cmp al, 0x8f
ja 0x14005ab20
cmp byte [rsi - 2], 0xf
je 0x14005ab26
sub al, 0xe8
cmp al, 1
ja 0x14005ab0a
cmp rsi, rcx
jae 0x14005ab41
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14005ab10
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005ab41
lodsb al, byte [rsi]
jmp 0x14005ab20
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x58000]
mov eax, dword [rdi]
or eax, eax
je 0x14005abaa
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6ae40]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005ab4e
jns 0x14005ab83
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14005ab8d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14005aba4
mov qword [rbx], rax
add rbx, 8
jmp 0x14005ab6e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005abe4
cmp al, 0xef
ja 0x14005abd6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14005abb6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14005abc5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005ac38
sub rsp, 0xffffffffffffff80
jmp 0x14000cdb0
Function at 0x140c029fe
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rbp + riz - 8], rax
mov qword [rsp], 0xfffffffff92b5402
jmp 0x140c1763e
mov ecx, 0x6f250389
mov r8, qword [rcx + rsi - 0x6f250389]
movsx r11d, cl
lea r9, [r11 + r11*2 + 0x7e110209]
inc ecx
mov rcx, qword [rcx + rsi - 0x6f250382]
dec r9w
lea rbp, [r11 + r11*2 - 0x2ef9e3ed]
add rsi, 8
shl ebp, 3
adc r8, rcx
call fcn.140c276f4
mov rcx, qword [rsi]
mov r11d, 0x7f302398
mov r9d, r11d
movzx r8d, r11w
mov r11, qword [rsi + r11 - 0x7f302390]
sar r8b, 0x43
adc rcx, r11
mov r11, rcx
lea rcx, [r8*2 + 0x33abe02a]
lea rbp, [rcx + r9 + 0x71f1231]
btr r9w, 0x19
mov cl, byte [rsi + r8*2 - 0x47d6]
shr r11, cl
sub r8d, ebp
add bp, 0xa79c
movsx ecx, bpl
mov qword [r9 + rsi - 0x7f30218e], r11
lea rdx, [rsi + r9 - 0x7f30218e]
inc bpl
mov qword [rsi + rcx*2 - 0xe8], rdx
adc r8b, r8b
rol bp, 0x68
lea rsi, [r9 + rsi - 0x7f302196]
btc r9w, r8w
xor rcx, r8
cmovle cx, r8w
mov r9d, dword [r9 + rdi - 0x7f3021bc]
setbe r8b
bswap ecx
movzx eax, r8w
lea rdi, [rdi + rcx - 0x40c6044a]
xor r9d, ebx
sal ecx, cl
btr rax, r8
neg r9d
lea r9d, [r9 + rax*4 - 0x5bac088a]
lea rdx, [rcx + rax*4 - 0x2140546f]
not r9d
call fcn.140c22e3e
jmp 0x140c0fe77
sub rsp, rcx
push 0x740b5302
sal dword [rsp + 1], 0x5c
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
push 0xffffffffea8cd934
lea rsp, [rsp + 8]
add rsp, rcx
call fcn.140c1d38a
jmp 0x140c03f2f
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
jmp 0x140c0b4d2

Function at 0x140c052dd
Capabilities:
Authenticate hmac

Disassembly:
not r9d
rol r11b, 0x81
movzx edx, cl
lea r9d, [r9 + r11*2 - 0x4cba096f]
mov qword [rsp + r11 - 0x1c], rdx
btc ebp, edx
sub bpl, 0xab
xor r9d, 0xadb0e0be
mov qword [rsp + r11 - 0x14], rbx
movzx eax, dx
jmp 0x140c0d5e2
xor dword [rsp + r11*2 - 0x30], r9d
push rbp
shr dword [rsp + r11 - 0x16], cl
sub dl, byte [rsp + r11*2 - 0x2f]
mov rbx, qword [rsp + r11*4 - 0x60]
shl r8, cl
movsxd r9, r9d
adc r10, r9
mul cl
shl edx, 0x2a
mov esi, dword [r11 + rsi - 0x1c]
pop r8
pop rcx
pop rcx
jns fcn.140bfdea8

Function at 0x140c0571a
Capabilities:
Authenticate hmac

Disassembly:
inc r8d
neg r8d
call fcn.140c2ae2d
add r10, rbp
bt r8d, eax
jb 0x140c003d8
mov si, word [rsi + r9 - 0x90fbb17]
xadd cl, r11b
jb fcn.140bfdea8

Function at 0x140c06358
Capabilities:
Encode data using base64

Disassembly:
movzx r8w, r8b
mov cl, byte [rsi + r11 - 0x3d8fa58b]
lea r9, [r9*4 + 0x102b6a8a]
shr r8b, cl
cdqe
movsx ebp, r11w
movsx edx, al
mov word [r11 + rsi - 0x3d8fa58b], r8w
mov edx, dword [rdi + r11*2 - 0x7b1f4b1b]
lea rcx, [r9*8 + 0x2b18b59f]
rol r11d, 0xf
xor edx, ebx
neg edx
mov qword [rsp + rax*2 - 0x7b1f5b16], 0xffffffff81ba6a9d
lea edx, [rdx + rax*2 - 0x6763516f]
sal r11b, 0x46
jbe 0x140c07a74
Function at 0x140c0704d
Capabilities:
Encode data using base64

Disassembly:
inc r8w
xor edx, ebx
lea edx, [rdx + r8*4 + 0x491da3fb]
jmp 0x140c292a6
jb 0x140c112c0
sub rdi, 4
mov ecx, 0x58380498
mov r9d, dword [rdi + rcx - 0x58380498]
lea rax, [rcx*4 - 0x3ac40c5e]
shl rax, cl
lea rdx, [rax*4 + 0x1c91fa16]
xor r9d, ebx
lea r9d, [r9 + rcx*2 + 0x2dbce5e0]
not r9d
mov r8d, 0x5a385306
rol r9d, 3
or cx, dx
ror dl, 0x43
or eax, edx
lea r9d, [r9 + rax - 0x61944256]
movsx ebp, al
neg r9d
sal rdx, 0x8b
push rbx
push rax
xor dword [rsp + rcx - 0x5838fe96], r9d
mov rbx, qword [rsp + r8 - 0x5a3852fe]
movzx r11d, al
or dword [rsp + r11 - 0xc0], r8d
movsxd r9, r9d
jne 0x140c1bef9
bswap ecx
call fcn.140bfd9a8
mov qword [rsp + rcx - 0x7a033ca0], r11
lea rsi, [rsi + rbp - 0x7166f369]
shl r11d, 0x62
mov word [rsi + r11*2 - 0x210], r8w
setnp r11b
pop r9
ja fcn.140bfdea8
mov eax, 0x7eb7ab04
lea rbp, [rax - 0x53d22cfa]
mov r11d, dword [rsi + rbp*2 - 0x55cafc14]
mov edx, eax
rol rbp, 0x9e
mov r9d, dword [rsi + rdx - 0x7eb7ab00]
or r11d, r9d
not r11d
sal rax, 0xc1
shl edx, 0x3d
mov r8d, eax
mov dword [rdx + rsi - 0x7ffffffc], r11d
adc edx, r8d
mov edx, dword [rdi + rdx - 0x7d6f560c]
cdqe
inc ebp
movzx r9d, bp
lea rdi, [rax + rdi + 0x290a9f4]
sbb r8d, 0xd52bad04
ja 0x140bfa3fd
shl r8, cl
adc r9, rsp
inc cx
setp r8b
adc r10, r9
push rcx
mov r9, qword [rcx + rsi - 0x5838fe9f]
sar rdx, cl
mov r8, qword [r9 + rax - 0x2691fac2]
xchg byte [rsp + rax*2 - 0x4d23f57c], r11b
sar dx, 0xa2
mov qword [rax + rsi - 0x2691fac2], r8
sets byte [rsp + rax - 0x2691fab7]
movsx r8d, cx
mov qword [rsp + rax - 0x2691fac2], r10
ret 0x10
mov r11d, ebp
bswap edx
sal eax, 0xfd
and eax, r8d
sbb edx, r9d
btr rax, r9
neg edx
btc r11w, r11w
bt ebp, r9d
shr ebp, 0x57
not edx
movzx ecx, bp
je 0x140bff01e
xchg r11w, bp
adc edx, r9d
xadd r9b, al
and ax, r9w
sar ecx, 0xfd
push rbx
adc ax, ax
xor dword [rsp + rax*2 - 4], edx
bswap r8
rol bpl, 6
lea rcx, [rax*2 - 0x2cf59850]
pop rbx
push r8
neg r9d
or r9w, word [rsp + rax - 1]
movsxd rdx, edx
inc word [rsp + rax*2 + 2]
xchg r9w, ax
adc r10, rdx
inc word [rsp + rax - 0xfffd]
js 0x140c03f28
not al
mov r9, qword [rsi + rax - 0xfefc]
shr dword [rsp + rax*8 - 0x7f7ff], 0x3f
mov cl, byte [rsi + rax*4 - 0x3fbf4]
dec dword [rsp + rax*2 - 0x1fdfd]
lea rdx, [r11*8 - 0x7e704fe8]
bts r11w, 1
shr r9, cl
mov qword [rsi + rax - 0xfefa], r9
lea rsi, [rsi + rbp - 0xba]
mov qword [rsp + rax*8 - 0x7f800], r10
ret

Function at 0x140c0b0d4
Capabilities:
Encode data using base64

Disassembly:
xor r11d, ebx
ror r11d, 1
movzx edx, ax
xor bpl, r8b
jae 0x140c36dc4
xadd eax, r11d
inc r9b
xor r9b, 0x94
call fcn.140c3f61d
mov r8d, 0x869f6523
lea rbp, [r8 + r8*4 + 0x793e9e8d]
lea rax, [rbp + rbp*8 - 0x6d780b5a]
sub rdi, 4
mov r11d, dword [rdi + riz]
jmp 0x140c067bc
neg r11d
not dl
mov ecx, 0x363ad52e
rol r11d, 2
jmp 0x140c3a37b

Function at 0x140c0b9d2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0x7a03cd3f
xor ebp, edi
jmp 0x140c23a80
lea rsp, [rsp + 0x30]
jne 0x140bfc220
mov eax, 0x350b3193
mov edx, eax
pop rdi
push 0xffffffffa386591e
inc r8
xor ebp, 0x9dad53a3
push 0xffffffff9600e8b3
dec r9
jmp 0x140c12d8a
Function at 0x140c0ccbd
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rax - 0x400000], rax
rol bpl, 1
shl r9b, 0x81
xor bl, bpl
lea rsi, [rsi + rax*4 - 0x1000002]
mov qword [rsp + rcx*4], rcx
mov word [rsi + rax - 0x400000], bp
or r8d, r9d
sbb word [rsp + rax*2 - 0x7fffff], r9w
pop rax
jb fcn.140bfdea8
call fcn.140c4171c
mov edx, 0xb23a33b6
sub rdi, 4
movsx r11d, dl
mov r8d, dword [rdi + riz]
movsx eax, r11w
movsx ecx, r11b
xor r8d, ebx
bswap r8d
bt rcx, rdx
sbb r8d, 0x74257992
not r8d
xadd r11b, dl
btr rax, r11
inc r8d
sub ecx, r11d
push rbx
shl ax, cl
ror rax, cl
xor dword [rsp + rax - 0x3ffff6], r8d
pop rbx
lea rbp, [rax + rax*4 + 0x778ce794]
movsxd r8, r8d
add r10, r8
movsx r8d, r11b
btr rcx, r8
inc r11d
lea rdi, [rdi + rax*2 - 0x7fffee]
Function at 0x140c0ce12
Capabilities:
Encode data using base64

Disassembly:
movsxd rdx, edx
adc r10, rdx
mov rax, qword [rsi + rbp*2 - 0x2af2]
sar r8, cl
shr r8b, 0x82
bswap r9
mov rcx, qword [rsi + r8*8 + 0x608]
bswap r9
not rax
bts r11w, r8w
not rcx
or rax, rcx
mov byte [rsp + rbp - 0x1570], 0x3f
jmp 0x140c0d2e6
mov cl, byte [rsi + riz + 0x10]
mov qword [rsp], r11
adc rsi, 0xa
xchg rbp, r8
sub r11b, 0x18
shld rax, rdx, cl
xor r8, 0xffffffffd0a6cc25
mov qword [rsi + riz], rax
sbb rdi, 4
movsx ecx, byte [rsp + 3]
sub r11b, bpl
mov ecx, dword [rdi + riz]
movsx r9d, r11w
neg ebp
mov edx, 0x7a845ba1
xor ecx, ebx
xor r9, r11
movsx eax, byte [rsp + rbp*8 - 0x3ef14f44]
lea ecx, [rcx + rbp*2 + 0x9e1ac55]
not ecx
lea ecx, [rcx + r8 + 0x9c661b1]
not ecx
lea rdx, [r9 + r9*4 - 0x6b6ef759]
or dword [rsp + rbp - 0x7de29e6], 0x96b4f2a7
call fcn.140c2b4f9
push rcx
sub r9w, word [rsp + r8 + 0x2cd00000]
mov rbx, qword [rsp + rbp*4 - 0x55cc]
js 0x140bfa8a1
mov r9d, 0xaf02af3e
sub rdi, 4
movzx r11d, r9b
mov ebp, dword [r11 + rdi - 0x3e]
xor ebp, ebx
movzx eax, r11w
and r9, rax
rol ebp, 3
not ebp
movzx edx, r9b
lea ebp, [rbp + r9*2 - 0x1590d97f]
push rax
mov ecx, 0x9131120a
lea r8, [r9 + rax*2 + 0x629768f]
bswap ebp
call fcn.140bffa35
mov eax, 0xf20d4402
add al, 4
sbb rdi, 4
mov edx, 0x5219fc1a
mov ecx, eax
mov ebp, dword [rdx + rdi - 0x5219fc1a]
movzx r9d, ax
xor ebp, ebx
movsx r11d, dx
lea r8, [r11 + r9*2 + 0x7159c97]
rol rcx, 0xd4
bswap ebp
xadd r9w, ax
not r11
imul edx
not ebp
lea r11, [rax*8 - 0x375f2ecd]
xchg r8b, dl
sbb ebp, 0xc62e401f
jmp 0x140c4047b
mov qword [rbp + rsi - 0x1575], rax
mov ecx, r9d
mov qword [rsp + rbp - 0x156d], 0x1039df08
mov rdx, rsi
mov qword [rsi + rbp*2 - 0x2af2], rdx
lea rbp, [rbp*4 + 0x2b32cbb7]
lea rax, [r8 + r9 + 0x2107c5ba]
cqo
lea rsi, [r8 + rsi + 0xb9]
shl dword [rsp + rbp*2 - 0x5666430e], 0x57
pop rcx
pop r11
jb fcn.140bfdea8
add r11d, 0x20865601
sal rax, cl
mov qword [r8 + rsi - 0x716205], rax
btr dx, 0x86
sub rdx, 0x6279e20
jmp r10
xadd r11w, r9w
lea rsi, [rsi + r8*2 - 0xe2c408]
jl 0x140c0d4bf
mov ebp, 0x782be1c
movsx r8d, bpl
not r8b
mov rax, qword [rsi + rbp*4 - 0x1e0af870]
lea rcx, [r8*4 + 0x6c9c03a0]
push rcx
mov r11w, word es:[rbp + rax - 0x782be1c]
not r8
lea rax, [r8 + rcx - 0x3ffd2f5d]
lea rsi, [rbp + rsi - 0x782be16]
mov word [rsi + rbp - 0x782be1c], r11w
lea rdi, [rdi + rbp - 0x782be20]
call fcn.140c414ca
ror ax, 0xe5
sub r9b, 0x83
bswap ebp
sar r8d, 0xa4
or ax, 0x6e84
cbw
push rbx
xchg dx, r11w
xor dword [rsp + r9 - 0x8889], ebp
shl rax, 0xe8
pop rbx
btc edx, 0x38
movsxd rbp, ebp
shl rcx, 0xca
setnp al
adc r10, rbp
btr r8d, r11d
jb 0x140c00f3d
sbb r9b, r8b
mov rax, qword [rsi + r9*8 - 0x44420]
xadd r9, rcx
setne r11b
mov cl, byte [rsi + rcx - 0x887c]
jne 0x140c3bc13