joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180721d6b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
or eax, 0x7dbc7e36
inc ebx
ror ebx, 1
neg dword [rsp + rdx - 0x642a17e0]
je 0x1807ade67
mov qword [rsp + rdx - 0x642a17e9], rax
dec ebx
cwde
neg ebx
btc r9d, 0x9d
jb 0x18072dc4e
call fcn.180753d3b
mov edx, 0x5412152b
sar rdx, 0x4e
movzx r9d, byte [r10 + rdx - 0x15048]
shr rdx, 0xbb
and dx, dx
inc dx
adc r10, rdx
shr dl, 0xa2
add dx, dx
xor r9b, bl
rol r9b, 1
neg r9b
rol dx, 0x82
inc r9b
neg r9b
xor bl, r9b
push r10
add edx, edx
inc rdx
push r11
shr edx, 0x2b
shl edx, 0x7b
push rbx
add dl, dh
mov ebx, edx
xor ebx, r9d
btc rdx, 0x92
jae 0x180781898
not ebx
jae 0x1807c23f0
setb cl
lea ebx, [rbx + r9*2 + 0x20b93ae5]
adc al, byte [rsp + r9 - 0x12efc341]
mov qword [rsp + rdx - 0x642a17d9], rdi
lea rdi, [rbp - 0x3c40d97e]
xor dword [rsp + r9 - 0x12efc345], ebx
dec qword [rsp + r9*2 - 0x25df86a2]
mov rdi, qword [rsp + rdx - 0x642a17d9]
inc rdx
lea r8, [rbp + rdx + 0x643d7d1f]
pop r9
movsxd rbx, ebx
dec rbp
push rdx
pop rbp
add r10, rbx
mov r9, qword [r9 + r11 - 0x7ffdfe7e]
or rcx, r8
mov rbp, qword [r11 + rdx - 0x642a17ea]
cdq
ja 0x180711f5f
neg ecx
neg dword [rsp + r9*2 - 0x66]
movzx r8d, word [rsp + r9 - 0x2f]
ror ecx, 1
bswap ecx
ror ecx, 1
btc r8, r9
mov qword [rsp + r9 - 0x33], rbx
neg sil
btr esi, edx
jae 0x180763cb5
xor ecx, ebx
bswap rsi
rol di, 0x21
jae 0x18076637d
setb dl
mov edx, ebx
push 0xffffffff9c324bbf
xor ecx, ecx
shr word [rsp], 0xcb
or dword [rsp + 2], 0x3fadb3ad
shl word [rsp + 6], 0xe9
cmp ebx, 4
not byte [rsp + 5]
jmp 0x180782dbf
call fcn.180747ad2
mov ecx, dword [r10 + rsi*2 - 0x6354b354]
not r9d
lea r10, [r10 + r9 - 0x2f]
jmp 0x180777e3f

Function at 0x18072212f
Capabilities:
Parse pe header

Disassembly:
lea rsp, [rsp + 0x18]
jne 0x18075a642

Function at 0x180724392
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
xor r9d, edi
sub rdx, rdx
adc cl, dh
rol r9d, 3
lea r9d, [r9 + r8 + 0x6df72dd]
rol r9d, 1
ror r8, 6
btc bx, bp
dec r9d
call fcn.18073d62b
lea rax, [rcx - 0x735499da]
mov cl, byte [rbx + r11 - 0x7524]
cbw
cqo
shr r9, cl
pop rcx
lea rbp, [rdx*8 - 0x605121da]
lea rbp, [r8*4 - 0x5cf7e0e4]
mov qword [r11 + rbx*2 - 0xea56], r9
movsx r9d, ax
and rbp, rdx
mov r9d, dword [rsi + rbx*2 - 0xea5c]
movsx ecx, dx
jge 0x18070abdd
mov eax, 0x5b3fd636
cwde
rdtsc
sub rbp, 8
mov ecx, 0x8290128a
shr cl, 0x83
mov dword [rbp + riz + 4], eax
lea rcx, [rcx + rcx*8 + 0x7a9f323e]
mov dword [rbp + riz], edx
call fcn.1807adb57
mov si, word [rbp + rdi*2 - 2]
cbw
not eax
pop r8
mov r9b, byte [r10 + rdi*2 + 4]
sal al, 0xa4
lea r10, [r10 + rdi*2 + 5]
xor r9b, bl
jmp 0x18078970a
movzx edx, al
rol r9b, 1
lea r8, [rax*8 + 0x74bd5024]
add r9b, 0x9c
neg r9b
dec r9b
and ax, word [rsp + rdi*2 + 1]
sub al, r8b
jle 0x1807aaa7e
xor bl, r9b
cdqe
xchg qword [rsp + rdi*2], rdi
lea rcx, [rdx + rdi*2 - 0x45caecfc]
lea r9, [rsp + r9 + 8]
xadd word [rsp + rdi*4 - 0x92], cx
jne 0x18075d4c3
Function at 0x1807270de
Capabilities:
Parse pe header

Disassembly:
lea r10, [rdx + r10 + 0x717828ec]
cmovs r9d, r8d
xor sil, bl
mov qword [rsp + rax - 0x78800000], rcx
neg r9
sbb sil, 0xb3
not sil
xor sil, 6
xadd byte [rsp + rdx + 0x717828f2], dh
call fcn.1807b1820
mov ecx, 0xfd1ed032
mov eax, dword [r11 + riz]
movzx edx, byte [rsi + riz - 1]
movsx r8d, cx
xor dl, dil
jmp 0x18072a693
xchg rcx, r8
movzx ebp, r8w
ror dl, 1
movzx ebx, cx
jmp 0x1806dfcc4

Function at 0x18072c515
Capabilities:
Parse pe header

Disassembly:
xor bl, dl
btc r8, rax
lea rdx, [rsp + rdx + 8]
mov qword [rsp + r9], 0x3ba4fc80
setb byte [rsp + rsi + 0x35caad61]
mov ecx, dword [rdx + rsi + 0x35caad60]
mov dword [rbp + r9 - 6], ecx
lea rbp, [rsi + rbp + 0x35caad5a]
sub di, r9w
pop rdx
jnp fcn.180739d94

Function at 0x18072ce4f
Capabilities:
Parse pe header

Disassembly:
ror r8b, 5
adc eax, ecx
and r8d, ebp
adc edx, edx
mov dword [r11 + r9], eax
mov qword [rsp + r9*2], 0x39b4c217
js 0x1807b82aa
sub rsi, 4
mov ecx, 0xed9c6f17
push rcx
mov r8d, dword [rsi + riz]
movsx r9d, word [rsp + 2]
xor r8d, edi
movzx eax, cx
lea rbp, [r9 + rax*2 - 0x64f1d6c2]
call fcn.1807c9715
movzx ebx, byte [rsi + r9*2 - 6]
pop rax
lea rsi, [rsi + r9*2 - 6]
mov ecx, eax
lea rbp, [rcx - 0x1a520ef2]
sbb r8d, ecx
xor bl, dil
sub bl, 0x1d
xor bl, 0xb6
lea rax, [r9 + 0x2e95c022]
sub ecx, eax
or dx, 0xe38a
adc bl, 0x2f
not bl
inc dl
cdqe
shr r8, cl
dec bl
btc cx, 8
xor dil, bl
add rbx, rsp
mov ebp, dword [rbx + r9*2]
bts rdx, 0x87
mov dword [r11 + r9 - 4], ebp
lea r11, [r11 + r9*8 - 4]
jb fcn.180764d25

Function at 0x18072e74f
Capabilities:
Parse pe header

Disassembly:
mov rbx, qword [rsp + 8]
jle 0x18077de08
sal r9b, 0x24
movsxd rdx, edx
add r11, rdx
mov r9, qword [rbp + riz]
pop rdx
jmp 0x1807ae43f
mov rdx, qword [rbp + 8]
jmp 0x1807a6f1b

Function at 0x18072ffea
Capabilities:
Parse pe header

Disassembly:
lea r11, [r11 + rax*4 - 0xbe]
neg ax
add bl, bpl
movzx edx, al
mov word [r11 + rax*8 - 0x7fe80], bx
lea rsi, [rsi + rax*2 - 0x1ffa4]
movzx r9d, ax
movzx ecx, ax
mov r8d, 0x8fa1148d
mov ecx, dword [rsi + rax*2 - 0x1ffa0]
movzx ebx, dx
xor ecx, edi
rol ecx, 1
sub r9b, al
inc ecx
ror r9, 0xba
ror ecx, 1
movsx ebp, bl
not ebx
and dx, r9w
inc ecx
jmp 0x18077f444
inc r9d
mov qword [rsp + rdx*8], rdi
add r8b, al
mov qword [rsp + rdx*2], rbx
movzx ebx, r8b
xor dword [rsp + rdx], r9d
cwd
pop rbx
inc dl
dec esi
js 0x1807b6849
mov r8d, 0x4c8537b4
mov rbx, qword [r11 + r8 - 0x4c8537b4]
mov rdx, qword [r11 + r8 - 0x4c8537ac]
call fcn.180703de6
mov ebx, 0x24081930
movsx eax, bx
movzx bx, byte [r11 + rbx - 0x24081930]
cbw
movzx ebp, ax
mov bpl, byte [rax + r11 - 0x2e]
jmp 0x180700f08
Function at 0x180730f91
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov dword [r11 + rdx*4 - 4], r8d
xchg word [rsp + rdx + 0xa], dx
bt ebx, 4
lea r11, [rbx + r11 - 0x783a0ce7]
call fcn.1807a81a7
mov dx, word [rbp + riz]
mov r8d, 0x94b4aa8c
mov si, word [rbp + riz + 2]
mov cl, byte [rbp + riz + 4]
mov edi, r8d
movzx r9d, di
lea rbp, [r9 + rbp - 0xaa88]
push r9
mov qword [rsp + r9*2 - 0x15518], rdi
shr r8b, 6
shrd dx, si, cl
mov word [rbp + r9 - 0xaa8c], dx
lea rdx, [rdi + r9*2 + 0x569b8fa1]
lea rax, [rdi*8 - 0x69f888ec]
inc rdx
mov eax, dword [r10 + r9*2 - 0x15518]
push rdi
neg byte [rsp + r9*2 - 0x15510]
cmovo edx, dword [rsp + r9 - 0xaa82]
lea r10, [r10 + r9*2 - 0x15514]
xor eax, ebx
call fcn.18077b887

Function at 0x1807357c6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffff9a256a14
test ebx, ebx
lea rsp, [rsp + 8]
je 0x1807c5846
mov eax, 0xb0bd340d
bts eax, eax
mov rax, qword [rbp + rbx*8]
call fcn.1807cb71e
mov eax, 0x38ac93bc
bt rax, rax
push rax
mov rax, qword [rbp + rax*2 - 0x71592778]
call fcn.18077997f

Function at 0x180736f44
Capabilities:
Parse pe header

Disassembly:
call fcn.180732d35
mov ebx, 0x9f8ff22f
movsx ebp, bx
mov r9d, 0xf30cf884
mov bx, word [r11 + riz]
mov ecx, r9d
add r11, 2
sub rsi, 2
mov edx, 0x482f53a0
mov r8d, 0x44a44ab4
shr bp, 0xad
movzx edx, word [rdx + rsi - 0x482f53a0]
movzx eax, r9b
xor dx, di
lea rax, [rax*4 - 0x45d2fdd6]
neg dx
sal bpl, cl
bt rcx, rax
jae 0x18077ddad
mov ecx, ebp
mov r9d, ebp
xor edx, 0xb9246c1d
sub edx, 0x93af12aa
xor edx, 0xba8afc17
push rdi
shr bpl, 0x43
shl r9w, 0x2a
xor dword [rsp + rbp*2 - 0x7b496e26], edx
xor al, ch
pop rdi
mov ebx, 0x32270e93
sar cl, 0xe7
movsxd rdx, edx
ror eax, 0x48
shl r9b, 0x63
adc r10, rdx
mov rcx, qword [r11 + rbp*2 - 0x7b496e26]
mov rbx, qword [r9 + r11 - 0x3da46bf8]
and rcx, rbx
not rcx
mov edx, ebp
lea rbx, [r9*4 + 0x650369af]
mov rbx, rcx
mov r9, qword [rax + r11 - 0x2cffffa7]
btr rax, 0xb8
movzx ecx, bp
adc rbx, r9
btr cx, cx
sar cx, 0xa8
mov r9d, eax
mov qword [rbp + r11 - 0x3da4b703], rbx
inc rbp
btr edx, 0x28
ror eax, cl
lea r11, [r11 + rbp - 0x3da4b704]
shr rbp, 0x3b
xor rbp, r10
jmp rbp
bswap rbx
jmp 0x1806e84e9
not dx
xchg r8b, bpl
shr r9d, 0x67
ror r8, 0x11
rol dx, 1
inc dx
rol r9, cl
bswap r9d
not dx
ror r8b, 0x81
xor di, dx
add rdx, rsp
and r9d, ecx
mov word [rdx + r9*4 - 0x40318010], bx
not r9d
movzx edx, ax
lea rsi, [rsi + rax + 0x45d2fbc2]
movsx ebx, r8b
xadd rax, rdx
dec r9d
mov r9d, dword [rsi + rax + 0x45d2f78c]
sbb rbx, rbp
shl bp, 0x2d
xor r9d, edi
jmp 0x18073b2c4

Function at 0x1807392e3
Capabilities:
Parse pe header

Disassembly:
jmp 0x180706b6e
jmp 0x1807b6866
push 0xffffffffbb19ee2d
inc rcx
push 0xffffffffbebd1786
xor eax, 0xb13f51ad
jmp 0x180722763
Function at 0x18073c7c1
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
rol r8b, 0x25
xadd rbp, rax
mov r9b, byte [rsi + r9 - 0x66]
rol eax, cl
xor r9b, dil
mov qword [rsp + rcx - 0x139ce82f], rbp
push rbp
btc rax, rax
dec r9b
xadd cx, ax
adc byte [rsp + rbp*2 - 0x4e1], r8b
ror r9b, 1
push rbp
sub rbx, r8
inc r9b
sub eax, dword [rsp + rcx - 0x139ce954]
push rcx
rol r9b, 1
inc r9b
sub r8w, bp
xor dil, r9b
and dword [rsp + rcx*4 - 0x4e73a5de], ebx
btr ebp, 0xb
lea r11, [rcx + r11 - 0x139ce97c]
mov dword [rcx + r11 - 0x139ce978], r9d
rol r8, cl
inc cx
cwde
pop rbp
pop rbx

Function at 0x18073edf8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
btr r8d, ebx
movsx ecx, bl
xor rcx, rax
xor dword [rsp + r8 - 0x270480], ebp
pop rdi
inc cl
ror r9w, cl
movsxd rbp, ebp
not al
adc rbp, 0xc
push 0x2b3fa3b8
xor esi, esi
sub byte [rsp + 3], 0x90
jae 0x1806e1896
js 0x180785bcb
mov qword [rbp + r8*4 - 0x1b20c], rbx
call fcn.1807c878f
xor dword [rsp + rdi - 0xc4], r8d
pop rbx
rol rcx, 0x12
bt ecx, ecx
movsxd r8, r8d
neg cx
adc r11, r8
xor edi, ecx
adc cx, cx
inc rcx
mov rcx, qword [rbp + riz]
sar dil, 0xe5
mov rdi, qword [rbp + riz + 8]
ja 0x1806ee96a
sar r8, 0x97
lea r11, [r11 + rcx - 0x893c9a]
jnp 0x1807166d6
test rdi, rdi
call fcn.180794e07
mov esi, 0x6296380c
lea rax, [rsi + rsi - 0x64db76e8]
movsx r8d, al
mov rax, qword [rbp + rax - 0x6050f930]
add r8, r8
mov edi, 0x88937831
mov si, word ss:[r8 + rax - 0x60]
lea rbp, [rbp + r8*8 - 0x2fa]
movsx eax, dil
mov word [rbp + r8 - 0x60], si
lea r9, [rax + rax*2 - 0x16543be5]
mov edx, dword [r10 + r8 - 0x60]
rol al, 0x41
dec dil
movsx esi, di
lea r10, [r10 + r8 - 0x5c]
xor edx, ebx
call fcn.18070955e
xor al, dil
jmp 0x1807b5874
xor al, 0x26
mov r8d, r9d
lea rcx, [r9 + r8*2 + 0x39a79a33]
neg al
movzx ebp, r8w
xor cl, 0x14
btr r8d, r8d
dec al
mov ebx, 0x5180e203
sal rbx, 0x61
jns 0x1807c8dfb
neg al
or bp, bx
adc al, 0x81
ror al, 1
or r8w, bp
xchg ch, bl
xor dil, al
btc r8w, 0x9f
sub cl, r8b
sar rcx, 0xb6
adc rax, rsp
lea rcx, [r8*2 - 0x3c420ce9]
call fcn.18072caac
mov edx, 0xc9922af
movsx edi, dx
mov r8d, dword [r10 + rdx*2 - 0x1932455e]
xor r8d, ebx
xor r8d, 0x9b0cf911
movsx r9d, dl
xor edi, edx
rol r8d, 2
movsx esi, r9b
bt edi, 0x32
not r8d
sub dx, dx
bts rsi, 0x3e
jae 0x1807a53b1
mov eax, 0x300cb016
lea rsi, [rsi + rax - 0x300cb01a]
movzx ebx, al
mov edx, dword [rsi + rax*2 - 0x6019602c]
lea rcx, [rax + rax*8 + 0x65382f33]
shr bl, 0xc3
xor edx, edi
btc bx, bx
dec bx
lea rbx, [rcx - 0x1f51badc]
inc edx
mov ebp, eax
xor edx, 0x523a8af
btc bx, ax
btc ecx, 0x1f
xor bp, 0x6701
sbb edx, 0xcc8b0c2a
rol edx, 2
sub cl, bh
push rdi
mov r9d, ebp
xor dword [rsp + r9 - 0x300cd717], edx
movzx r8d, r9b
bts ebp, ecx
jae 0x18074feba
add rsp, rcx
jmp 0x18076da8d
Function at 0x180746547
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal ecx, 3
sar dword [rsp], 0xac
jp 0x180794305
btr rdx, rbp
and ebx, ecx
xor dil, r9b
xor dx, 0xde26
mov word [r11 + rax*2 - 0x5a], r9w
movsx r9d, al
lea rax, [rax + rax*2 - 0x59c5abfd]
bt rbp, 0x13
mov ebx, dword [rsi + rax + 0x59c5ab71]
xchg rbp, rdx
sub rbp, rax
xchg r9b, al
lea rsi, [rsi + rbp - 0x59c689a1]
xor ebx, edi
neg ebx
dec r9
inc r8b
dec ebx
call fcn.1807734c6
mov eax, 0x3d360e24
jmp 0x1807980a1
mov qword [rsp], 0xffffffff843c0792
jmp 0x180723e9f
shl edx, 3
mov eax, 0xdfb23596
and byte [rsp], ah
mov rax, rbp
adc rax, rdx
neg dword [rsp + 4]
mov qword [rbp + riz - 8], rax
shl word [rsp + 1], 0x63
dec dword [rsp + 2]
or byte [rsp + 6], 0xa3
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
sbb rsp, rcx
and rsp, 0xfffffffffffffff0
push 0x74ac7f89
xor word [rsp + 6], 0x1e2b
not byte [rsp + 2]
lea rsp, [rsp + 8]
adc rsp, rcx
test ebx, ebx
je 0x1807ca1e4
mov rbx, qword [r11 + rax - 0x3d360e24]
lea r8, [rax*4 - 0x4751816c]
lea r9, [rax + rax*2 + 0x6ae570a]
mov r9, qword [rbx + rax - 0x3d360e24]
xor r8b, 0x22
mov qword [r11 + rax*2 - 0x7a6c1c48], r9
lea rcx, [r8*2 + 0x43bc6a5]
ror r8w, 0xe5
rol rcx, cl

Function at 0x180748ca9
Capabilities:
Authenticate hmac
Encrypt data using chaskey

Disassembly:
sub r9, rdi
bswap rsi
ror eax, 1
movzx r8d, r9b
sar cl, 7
bswap eax
xor r9w, cx
btr ecx, r8d
mov qword [rsp + r8*2], rsi
ror eax, 1
sar qword [rsp + r8], 0x37
and sil, 0xbf
je 0x18078ba09
mov edi, 0xf0a7803a
movzx ecx, di
call fcn.1807abc60
mov qword [rsp + r8*8], rbx
xor dword [rsp + r8*2], eax
xadd si, di
btr di, 0xb5
or r9w, di
pop rbx
movsxd rax, eax
sal rdi, 0xf4
adc r11, rax
lea rax, [rsi + r9*8 - 0x9e338e5]
neg esi
xchg cx, ax
mov r9, qword [rbp + rdi]
add rdi, qword [rbp + rdi + 8]
add r9, rdi
mov qword [rbp + r8*8 + 8], r9
neg r8b
movzx eax, byte [r8 + r10 + 4]
movzx r9d, cl
shl esi, cl
and si, r9w
lea r10, [r10 + r8 + 5]
jo 0x1806fa0e7
xor al, bl
shl r8w, 0x41
xchg r8w, si
sar r8w, cl
dec al
rol r8, 0xee
xor al, 0x1f
mov edx, 0x8f8ec62f
not r8
bt dx, cx
adc al, 6
btc dx, si
xchg r9b, sil
call fcn.1807bac9a
lea rcx, [rsi*2 + 0x56293ca8]
movzx r8d, byte [r10 + riz]
mov eax, 0x241288a0
xor r8b, bl
cwde
inc r8b
mov edi, 0x902e8326
neg r8b
xchg si, ax
movsx edx, sil
mov r9d, edi
inc r8b
call fcn.1807b089b
xor si, 0x6612
mov dword [rcx + riz], eax
movzx edx, word [r10 + riz + 5]
sbb r10, 0xfffffffffffffff9
shr sil, 0x61
xor dx, bx
sub r8, rdi
dec r9
rol dx, 1
or dil, 0xbd
dec dx
not dword [rsp + r8 - 0x6404f6fe]
movsx eax, di
movsx ecx, di
not dx
sar r9b, 0xe1
neg r8
call fcn.18071d853

Function at 0x18074f579
Capabilities:
Authenticate hmac

Disassembly:
lea rdx, [rcx*8 - 0x724f91d1]
xor r9d, 0xc09f2d89
call fcn.18076a25e
pop rdx
pop rdx
pop r8
pop rax
pop r8
jbe fcn.180764d25
mov edi, 0xce9effb4
mov eax, edi
mov r9d, dword [r10 + riz]
movzx ecx, ax
lea rdx, [rcx + rcx*4 + 0x4833f4ab]
lea r10, [r10 + rcx*2 - 0x1ff64]
movzx esi, di
xor r9d, ebx
cwde
not al
dec r9d
lea rsi, [rcx + rdi + 0x7883e8b7]
jmp 0x180716543
Function at 0x180755868
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
sub rsi, 4
lea rcx, [rdx*8 - 0x79ec5be9]
jmp 0x1807748f1
add rdi, rsp
mov qword [rdi + rcx*4 - 0x2be6c], rdx
movzx edi, cx
rol sil, 0x43
cdqe
mov edx, dword [r10 + rcx*2 - 0x15f33]
bts eax, r9d
lea r10, [rsi + r10 - 0xe634]
not si
cmovae ax, r8w
xor edx, ebx
sal dil, 0x47
xor edx, 0xa81f3017
btc cx, r8w
rol edx, 1
shl sil, 0xc1
add r9d, 0x260748a4
not cx
bswap edx
neg r8b
rol edx, 1
inc al
ror ecx, cl
xor ecx, esi
push rbx
cwde
jns 0x1806f3912
or cl, r9b
adc dil, 0x1f
xor al, sil
bt ax, 9
and r8d, 0xd582a403
xor dil, cl
dec dil
sal r9, 0x12
dec r9b
xor bl, dil
sar r9w, 0x41
jg 0x1806fea22
mov qword [rsp + rcx*2], r9
btr rdx, 0x19
mov dword [rcx + rbp - 4], eax
jb 0x1806e6988
movzx r8d, byte [r10 + rcx + 1]
movsx esi, cx
xor r8b, bl
xchg cl, r9b
pop rcx
xor r8b, 0x31
sub dword [rsp + rcx*8 - 0x57ccf], edx
shr byte [rsp + rcx*8 - 0x57ccd], 0x46
adc r8b, 0x94
pop rax
bts eax, 0x1d
movsx edi, cx
neg r8b
btc rax, rdx
sbb r8b, 0x92
bts edx, edx
ror r8b, 1
add r8b, 0x1b
neg r8b
ror si, 0x45
xor bl, r8b
dec r9
bts cx, si
not r9
mov qword [rcx + rbp - 0xafa7], r8
adc r9b, al
mov rdx, qword [rbp + rcx*4 - 0x2be78]
lea rbp, [rcx + rbp - 0xaf9f]
movzx edi, byte [r10 + rcx*4 - 0x2be6a]
movzx r8d, si
xor dil, bl
xadd ax, si
neg si
rol dil, 1
inc rsi
jne 0x180705a8c

Function at 0x18075dc83
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov qword [rsp], 0x6e932420
call fcn.1807c623d
mov edx, 0x9b8ae35
movsx eax, dx
mov r9d, dword [rdx + r10 - 0x9b8ae35]
lea r10, [r10 + rdx - 0x9b8ae31]
movsx esi, al
btc rsi, rsi
mov edi, eax
xor r9d, ebx
lea r9d, [rdx + r9 - 0x436fe6da]
neg r9d
movzx r8d, di
rol r9d, 1
xor rdi, rsi
adc rax, rsi
add dil, r8b
bswap r9d
push rbx
xor dword [rsp + rdx - 0x9b8ae35], r9d
btc r8d, 0x18
ror edx, 0xfe
cmovae r8, rsi
pop rbx
btr r8, r8
bt rdx, rdi
movsxd r9, r9d
adc dil, al
adc r11, r9
lea rcx, [rsi*2 - 0x3e054c3]
neg r8w
mov rdx, qword [rbp + rdx*2 - 0x4dc571a8]
bts eax, 0xa7
movsx r9d, r8w
call fcn.1807a1c30
mov ebp, 0x37a38ba9
btc ebp, 0x11
movzx r9d, bpl
mov r8, qword [rbp + r11 - 0x37a18ba9]
mov ecx, r9d
call fcn.18070a5b9

Function at 0x18075dd38
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov rdi, qword [rsp + 0x18]
mov qword [rsp + 8], r9
or r8, r9
bswap r9
movsxd rdx, edx
movsx eax, word [rsp + 0xf]
movsx ecx, ax
ror rcx, 0x78
adc r10, rdx
push rcx
xor r9b, byte [r11 + rax - 0x2500]
mov bpl, byte [r11 + rcx*4 - 0x93fffe]
mov ebx, dword [rsp + rcx - 0x24fff0]
or bx, ax
lea rcx, [rax + rax + 0x18b6e22b]
lea r11, [r11 + rax*2 - 0x49fe]
mov qword [rsp + rax*2 - 0x49f8], rax
sar r8, 0x20
not r9b
sets byte [rsp + r8*2 - 0xa]
neg word [rsp + r8 + 0xb]
neg byte [rsp + r8 + 0xc]
not bpl
not dword [rsp + r8*2 - 4]
or r9b, bpl
mov qword [rsp + r8*4 + 0xc], rax
call fcn.1806e32a4
Function at 0x180761e66
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec dx
mov qword [rsp + rbp*2], rdi
ror r9d, 0x73
ja 0x18076dacb
mov dword [r11 + rbp - 4], ebx
mov qword [rsp + rbp*8], 0xffffffffaf037d2c
mov qword [rsp + rbp + 8], 0xffffffffaf81eaac
shr byte [rsp + rbp + 0xc], 0xc3
lea rdx, [rsp + rbp + 0x60]
mov ebx, 0x198528a1
or qword [rsp + rbp*2 + 6], rcx
mov rax, qword [rdx + rbp*4]
bt ebp, 8
pop rcx
pop r9
mov qword [r11 + rbp*2 - 0xc], rax
push r8
inc dword [rsp + rbp]
shl byte [rsp + rbp*2 + 1], 0x26
mov ecx, dword [rbp + rsi - 5]
xor ecx, edi
xor ecx, 0x589994bd
rol bl, 0xc5
ror ecx, 2
lea rbx, [rbx + r9*2 + 0x31960813]
movzx edx, bx
sub ecx, 0x9037392b
xadd dword [rsp + rbp + 3], ebx
ror ecx, 1
sal dx, 0x45
jae 0x1806f8739

Function at 0x18076745b
Capabilities:
Authenticate hmac

Disassembly:
xadd word [rsp + rcx*2 - 0x1a5d0], ax
adc r9w, r8w
mov rax, qword [r11 + rcx*2 - 0x1a5c2]
sal r8b, 0x81
mov qword [rsp + rcx*2 - 0x1a5cc], r9
je 0x1807bb0ff
lea r11, [rcx + r11 - 0xd2d0]
movzx ebx, byte [rsi + rcx*2 - 0x1a5d9]
pop rbp
lea rsi, [rsi + rcx - 0xd2ef]
setnp byte [rsp + rcx*2 - 0x1a5d0]
btr r8, rcx
xor bl, dil
xor bl, 0x26
neg bl
sal dword [rsp + rcx*4 - 0x34ba4], 0x71
dec bl
neg bl
add bl, 0x81
jmp 0x180737b74
sar qword [rsp + r9*8 - 0x7e770], 0x9a
pop rcx
ror bl, 1
bswap r9d
jmp 0x1807b73e7
movsxd rsi, esi
add r11, rsi
call fcn.1806f27a2
xor dword [rsp + r9*2 - 0x1a5c4], ebp
shr dl, 0x84
shl word [rsp + r9*8 - 0x69744], 0xcb
mov rdi, qword [rsp + r9*8 - 0x69740]
pop rcx
movsx r8d, dx
movsxd rbp, ebp
add r10, rbp
jmp 0x18071bf52
ror dx, 0xe1
adc rbx, rsp
inc r9b
jnp 0x1807ba98b
ror rdx, 0xe0
xor dil, bl
ror r8d, 0xce
jb 0x1807a45e9
mov qword [rbx + rcx*2], rax
add rcx, r10
jmp rcx
btc r8, rax
or ebx, r8d
mov eax, dword ss:[rcx + r8 + 0x90a513a]
or bp, dx
ror r9b, 0x44
lea r11, [r11 + r8*2 + 0x1214a278]
and rbx, rbx
rol r9b, 0xc2
shr dx, 0x63
mov dword [r8 + r11 + 0x90a513a], eax
sub ebx, r9d
not r8d
btc edx, 0xa0
jmp r10

Function at 0x180769592
Capabilities:
Authenticate hmac

Disassembly:
bswap r8d
adc r9d, esi
mov qword [rsp + rdx*2 - 0x144], rbx
movzx ebx, cl
xor dword [rsp + rdx - 0x9e], r8d
shl edx, cl
mov rbx, qword [rsp + rsi - 0x20a0acb5]
mov qword [rsp + rsi - 0x20a0acbd], rsi
mov qword [rsp + rdx - 0x2978], 0x6e054921
movsxd r8, r8d
js 0x18079a096
pop rdi
movzx eax, word [rsp + rsi - 0x20a0acbd]
adc r11, r8
cwd
mov r9, qword [rbp + rsi - 0x20a0acbd]
movzx r8d, si
xadd dx, si
adc di, 0x7b2b
mov r8w, word [r9 + rsi*2 - 0x41400000]
movzx r9d, cl
lea rbp, [rbp + rsi - 0x209ffffa]
inc dword [rsp + rsi - 0x209ffffe]
mov word [rsi + rbp - 0x20a00000], r8w
mov qword [rsp + rsi*2 - 0x41400000], r11
ret
Function at 0x18076b874
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol bl, 0xc1
xor r8w, 0x8d05
not eax
rol r8w, cl
inc r8w
neg bx
xor di, r8w
mov qword [rsp + rdx - 0x3dd3c500], rsi
movzx ebx, word [rsp + r8 - 0xf8]
mov rbx, qword [rsp + rdx*2 - 0x7ba789f0]
movsxd rdi, edi
add r11, rdi
call fcn.18078c71a
xor r8w, di
mov ecx, 0xfd901038
sub r8w, 0xa839
jmp 0x1807b6042
not dl
ror r8w, 1
or r9w, dx
bts r9d, ebx
setb cl
adc r8w, 0x3cb7
lea rbx, [rcx + rbx + 0x1b357110]
lea rbp, [rbx*8 - 0x4dc8a9fa]
mov eax, ecx
xor r8w, 0xb693
add r8w, 0x6331
jmp 0x18074f7d8

Function at 0x18076d50d
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], r8
sub rbp, 8
mov dword [rbp + riz + 0xc], eax
pop rax
mov dword [rbp + riz + 8], ebx
shr ax, 0xcd
mov dword [rbp + riz + 4], ecx
mov esi, r8d
sbb ax, 0x8e1d
neg si
mov dword [rbp + riz], edx
pop rbx
and r9d, 0xc1b617b8
bts rax, r8
mov edx, esi
mov edi, dword [r10 + riz]
jae 0x1807cb72e

Function at 0x18077065d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
sub bx, word [rsp + rax*2 - 0x14b]
adc ecx, r9d
sal al, 0x61
mov dword [r11 + rax*8 - 0x260], ecx
mov qword [rsp + rax*8 - 0x260], r10
ret
btc rcx, rdx
mov qword [rsp + rax*2 - 0x53442c2c], r8
dec ebp
not ebp
sar rax, cl
or word [rsp + rax - 0xa1], dx
jle 0x1807370ac
inc ebp
mov qword [rsp + rax*2 - 0x14c], rdi
xor dword [rsp + rax - 0xa6], ebp
lea rdi, [rcx + 0x53175d1a]
movzx ebx, di
shl bl, 3
pop rdi
xor dl, dh
movsxd rbp, ebp
xadd dx, r8w
sal edx, cl
add r10, rbp
mov ecx, dword [r11 + rax*2 - 0x14c]
movzx ebp, r9w
push r8
mov r9d, dword [rax + r11 - 0xa2]
lea r11, [r11 + rax*2 - 0x148]
and qword [rsp + rax - 0xa6], r8
jge 0x180759f4d

Function at 0x1807714ab
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.180733108
mov rdx, qword [rbp + rdi + 8]
not r8
bt di, r9w
not si
lea rcx, [rsi*8 - 0x2d5f83cc]
not rdx
neg di
or r8, rdx
neg cx
bts di, cx
sal r9w, 0x22
mov qword [rsi + rbp - 0x408ca0f7], r8
btr rcx, rcx
inc r9
mov esi, dword [rdi + r10 - 0x10]
jae 0x1806f1cc0
mov edi, 0xef0aab85
movsx r8d, di
rol r8b, 0xe6
movzx esi, byte [r10 + riz]
lea rcx, [rdi + rdi*2 + 0x101be3a1]
lea rax, [r8*4 + 0x1a324d08]
xor sil, bl
lea r9, [rcx + rdi - 0x5b6c1ffe]
bts rax, 0xa6
not r9w
inc sil
and eax, eax
xor sil, 6
inc r9b
jg 0x180754c59