joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d74
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov dword [rax - 0x18], 0xf0000000
mov rbx, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rax + 0x20]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001e28
mov rcx, qword [rsp + 0x58]
mov r8, rdi
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
mov r8, rbx
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
vmovdqu xmm2, xmmword [0x1400046b0]
mov rax, rdi
mov ecx, 2
vpxor xmm1, xmm2, xmmword [rax]
vmovdqu xmmword [rax], xmm1
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140001df0
vpxor xmm1, xmm2, xmmword [rbx]
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
vmovdqu xmmword [rbx], xmm1
call fcn.140001b74
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
int3

Function at 0x140001ed8
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rdx
cmp ecx, 2
jge 0x140001f28
call fcn.14000128c
and dword [rsp + 0x28], 0
lea r9, str.__foodsum
and qword [rsp + 0x20], 0
lea rdx, str.open
mov r8, qword [rbx]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x140001ff4
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__time64]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_srand]
lea rcx, [rsp + 0x40]
call fcn.140001e34
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001d74
vmovdqu xmm2, xmmword [0x1400046b0]
xor eax, eax
vpxor xmm1, xmm2, xmmword [rsp + rax + 0x58]
vmovdqu xmmword [rsp + rax + 0x58], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x140001f60
vpxor xmm0, xmm2, xmmword [rsp + 0x30]
vmovdqu xmmword [rsp + 0x30], xmm0
call fcn.1400011b4
mov rcx, qword [rbx + 8]
lea rdx, str.__foodsum
call qword [sym.imp.ucrtbased.dll_strcmp]
test eax, eax
jne 0x140001fef
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400019a4
mov rcx, qword [0x1400066c8]
test rcx, rcx
je 0x140001fd4
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
mov rcx, qword [0x1400066c8]
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
mov rcx, qword [0x1400066d0]
test rcx, rcx
je 0x140001f21
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
jmp 0x140001f21
mov eax, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002020
add rsp, 0x80
pop rbx
ret
Function at 0x140002330
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400027b0
movzx eax, al
test eax, eax
jne 0x140002350
mov ecx, 7
call fcn.140002d50
nop
mov byte [rsp + 0x20], 0
call fcn.140002740
mov byte [rsp + 0x21], al
cmp dword [0x1400065f0], 1
jne 0x140002374
mov ecx, 7
call fcn.140002d50
nop
jmp 0x1400023cc
cmp dword [0x1400065f0], 0
jne 0x1400023c7
mov dword [0x1400065f0], 1
lea rdx, [0x1400043d0]
lea rcx, [0x1400043b8]
call sub.ucrtbased.dll__initterm_e
test eax, eax
je 0x1400023a8
mov eax, 0xff
jmp 0x1400024d1
lea rdx, [0x1400043b0]
lea rcx, [0x1400043a0]
call sub.ucrtbased.dll__initterm
mov dword [0x1400065f0], 2
jmp 0x1400023cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400029a0
call fcn.140002d20
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140002429
mov rcx, qword [rsp + 0x30]
call fcn.140002910
movzx eax, al
test eax, eax
je 0x140002429
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140004378]
nop
call fcn.140002d30
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14000245d
mov rcx, qword [rsp + 0x38]
call fcn.140002910
movzx eax, al
test eax, eax
je 0x14000245d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call sub.ucrtbased.dll__register_thread_local_exe_atexit_callback
nop
call fcn.140002510
mov dword [rsp + 0x28], eax
call fcn.140002f00
movzx eax, al
test eax, eax
jne 0x14000247c
mov ecx, dword [rsp + 0x28]
call sub.ucrtbased.dll_exit
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14000248b
call sub.ucrtbased.dll__cexit
nop
xor edx, edx
mov cl, 1
call fcn.1400029d0
mov eax, dword [rsp + 0x28]
jmp 0x1400024d1
add rsp, 0x68
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x18062c3d6
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
dec ebx
push 0xfffffffff709670e
lea rsp, [rsp + 0x10]
jne 0x18067d37f
mov rax, qword [rbp + riz]
push 0xffffffffce35490e
jmp 0x180657c7b
jg 0x180674ec8
mov ebx, dword [rcx + r11*4]
sbb r11b, dl
mov dword [rdi + rax - 0x5451c354], ebx
lea rdi, [rax + rdi - 0x5451c354]
adc r11w, ax
call fcn.180669157
mov esi, 0x4d3f7e3b
movzx r11d, byte [rsi + rbp - 0x4d3f7e3b]
xor r11b, r9b
movsx r10d, sil
add r11b, 0x22
movsx edx, sil
movzx ebx, sil
xor r11b, 0x91
dec si
add r11b, 0x1c
not r11b
lea r10, [r10*4 - 0x6fc3e2ff]
xor r9b, r11b
add r11, rsp
shr rdx, 0x63
jp 0x18065b00a
call fcn.18062f735
bt eax, 0xbd
adc rcx, rsp
neg ax
jbe 0x180642214
movzx ecx, byte [rbp + riz]
ror al, 3
movsx r11d, ax
xor cl, r9b
mov esi, eax
mul rsi
xor cl, 0xab
btr ax, 8
rol cl, 1
cdq
btr eax, 0x1c
bt si, r11w
sbb cl, 0x9c
xor r11, r11
neg cl
xor cl, dl
xor r9b, cl
or eax, r11d
movzx ebx, si
adc rcx, rsp
mov edx, dword [r11 + rcx]
mov dword [rdi + r11*2 - 4], edx
mov ecx, esi
movzx ecx, byte [rbp + r11 + 1]
inc bl
xor cl, r9b
ror cl, 1
mov r10d, 0x41b85b96
dec cl
movsx edx, r11w
cwd
xor cl, 0x2e
lea rsi, [rbx + rax*8 - 0x4cf1c3d8]
add cl, dl
idiv r10
mul r10
cmovno r11, rbx
xor r9b, cl
and r11, 0x7f160d98
je 0x18066aff2
mov esi, 0x19dfa08
movzx ebx, sil
mov rcx, rdi
mov qword [rdi + rsi - 0x19dfa10], rcx
call fcn.180670dd6
mov eax, 0xd09a473b
shr ax, 0xc6
push rax
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
call fcn.18064f972
mov eax, 0xd810bf9b
jmp 0x18066fe57

Function at 0x18062cfe6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push 0x7a39d885
jmp 0x180638fe4
cmp ebx, 2
jmp 0x18066a915

Function at 0x18062d178
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r9 - 0xf634], rax
or bl, r11b
shl rbx, 0x30
mov qword [rsp + r9*2 - 0x1ec10], r10
mov r8d, r9d
push r9
shr ebx, 0x72
mov ebp, dword [rsp + rbx + 0x88]
push r11
xor ebp, 0x1fb4fe8c
btc r8d, 0xa5
lea rdi, [r8 + rbx*8 + 0x24b12d1a]
jb 0x180633835
bswap ebp
imul r8w, r8w
ror ebp, 2
mov ecx, 0x37a21f3f
sub ebp, 0xb2b00802
push r9
not qword [rsp + rbx + 0x10]
not ebp
dec dword [rsp + r9*2 - 0x1ec58]
sar bx, 0x4b
setne byte [rsp + rbx + 0x10]
adc rbp, r10
neg r8w
movzx r10d, word [rsp + rbx + 0x14]
push r8
lea eax, [rbx + 0x8000000]
sal r9d, 0x13
shl rax, 5
push r8
add rbp, rax
mov qword [rsp + rbx*2 + 0xa0], rsi
or word [rsp + rbx*2 + 0x17], bx
setb r11b
mov qword [rsp + r8*4 - 0x23918], rdx
or r9d, ecx
rol r10b, 0xc4
neg byte [rsp + rbx + 6]
lea rdi, [rsp + rbx + 0x28]
lea rsi, [rbx + r10*2 + 0x7b88a42b]
rol dword [rsp + rbx*4 + 0x15], 0x90
lea rcx, [rdi + rbx - 0x208]
movzx edx, si
shl dx, 0x21
and cl, 0xf0
movsx eax, r9w
shr dword [rsp + rbx + 2], 0x63
add byte [rsp + rbx + 0x21], 0xab
mov rsp, rcx
Function at 0x18063ba1c
Capabilities:
Hash data using murmur3

Disassembly:
rol edx, 1
xchg ecx, r11d
imul r10, qword [rsp + rbx*4 - 0x1a10c]
add ax, word [rsp + rbx - 0x6833]
bswap edx
mov qword [rsp + r10*2 - 0x54f38752], r9
movsx esi, r10b
mov qword [rsp + rbx - 0x6847], rsi
jnp 0x180647adc
xor dword [rsp + rbx*2 - 0xd07e], edx
mov r9, qword [rsp + rbx - 0x6837]
add word [rsp + rbx*2 - 0xd085], bx
neg dword [rsp + rbx*4 - 0x1a113]
mov qword [rsp + rbx*2 - 0xd07e], rcx
movsxd rdx, edx
lea rcx, [rsi + r11*2 + 0x6d93120e]
add r8, rdx
sal r10w, 0xcc
adc rbx, r11
mov r11, qword [rdi + r10 - 0x2a791000]
bts rax, 0x28
imul esi, dword [rsp + r10*2 - 0x54f21fef]
or ax, si
mov rax, qword gs:[r10 + r11 - 0x2a791000]
jns 0x18067a905
setle r10b
add word [rsp + r10 - 0x2a790fec], 0xa637
mov qword [rdi + r10 - 0x2a791000], rax
mov word [rsp + r10 - 0x2a790ffc], bx
movsx eax, word [rsp + r10*2 - 0x54f21ffa]
mov qword [rsp + r10*2 - 0x54f22000], r8
ret 0x10

Function at 0x18063f6bb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop rdi
ror qword [rsp + 0x28], 3
dec rcx
lea rsp, [rsp + 0x30]
jne 0x18065198b
jmp 0x180639ce9
Function at 0x180642cd9
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov ebx, 0x52389624
push rbx
mov esi, dword [rbp + rbx - 0x52389624]
mov edx, ebx
lea rbp, [rbp + rdx - 0x52389620]
xor esi, r9d
not word [rsp + rdx - 0x52389620]
mov ecx, edx
call fcn.1806714f2
mov qword [rsp], r11
call fcn.180673410
call fcn.18066d0c6
mov eax, 0x2ebe2c1c
neg eax
mov r11d, 0x17b3d782
mov si, word [r11 + rdi - 0x17b3d782]
movsx ecx, al
movzx edx, cl
mov cl, byte [r11 + rdi - 0x17b3d780]
dec r11d
call fcn.18064c874
mov r10, qword [rbp + riz]
jmp 0x180661c78
mov r11d, 0xb920f114
mov ecx, 0xaba6f122
xor r10, r9
push r11
inc r11d
dec r10
lea rax, [r11 + rcx*4 - 0x126f8ae1]
call fcn.180671a9a
mov r11d, 0x7b9da3bb
add r11w, r11w
lea rax, [r11 + r11 + 0x45b31a3d]
mov ecx, dword [rbp + r11 - 0x7b9d4776]
dec ax
xor ecx, r9d
and rax, 0xffffffff94a398bc
rol r11w, 0x83
not ecx
rol ecx, 1
movzx esi, ax
cbw
xchg si, ax
not ecx
inc ecx
mov ebx, 0xc70b180c
push r9
sal eax, 0xa1
xor dword [rsp + r11 - 0x7b9d3bb2], ecx
lea r9, [rsi + 0x422a9b3b]
pop r9
imul eax
sar r11w, 0xc4
cmovns rdx, rax
movsxd rcx, ecx
movsx r10d, r11b
btr eax, eax
shl rsi, 0xc1
adc r8, rcx
sub r10d, eax
mov r10, qword [rdi + rax - 0x2aea1900]
inc rdx
mov r11, qword [rdi + rax*2 - 0x55d431f8]
lea rcx, [rdx + rdx*2 + 0x722dc782]
btc ecx, ebx
add r10, r11
sal bl, cl
mov qword [rdi + rax - 0x2aea18f8], r10
movzx ecx, byte [rbp + rax*2 - 0x55d431fc]
je 0x18064ae8d
adc eax, 0xddb2a92d
lea rbp, [rbp + rax*2 - 0x11398457]
jle 0x1806316d8
mov r10d, ebx
shl ax, 6
xor cl, r9b
sar rax, 0xbb
bts r10, rbx
adc cl, 0x22
bts bx, bx
shl sil, 0x83
lea rbx, [rsi - 0x1ad836fd]
xor cl, 0x91
bts r10, r10
adc cl, 0x1c
btr bx, 5
setb r10b
push rax
not cl
sub byte [rsp + rax + 1], r10b
div r10d
xor r9b, cl
cdqe
lea rcx, [rsp + rcx + 8]
mov sil, byte [rcx + rax - 0x3731cadb]
mov word [rax + rdi - 0x3731cad5], si
neg r10
mov byte [rsp + rax*2 - 0x6e6395b0], r10b
lea rdi, [rdi + rax - 0x3731cad5]
xor qword [rsp + rbx + 0x1ad8367d], r8
ret

Function at 0x18064fdbe
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add rdi, 4
movzx ebx, word [rbp + riz]
mov esi, 0x16a8cfb5
sal sil, 0x25
lea rbp, [rbp + rsi - 0x16a8cf9e]
jne 0x1806623d4
inc r10w
lea rdi, [rdi + rcx - 0x5e081c02]
jp 0x18063f5d4
mov qword [rsp + rcx - 0x5e081c00], rsi
cqo
mov word [rdi + rdx*2], bx
movzx ebx, byte [rsp + rdx*2 + 0x12]
pop rcx
movzx r11d, cl
pop rdx
pop rdx
jg fcn.18066bd91
shr r11, 0x49
mov word [rdi + r10*2 - 2], cx
movsx ecx, dl
mov r11d, dword [rbx + rbp + 2]
call fcn.1806727dd
Function at 0x180650d8a
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [r10 + rdi - 0x520b], ebx
mov dword [rdi + r10 - 0x520f], ecx
neg r10d
sub sil, 0x99
dec ax
mov dword [rdi + rsi*8 - 0x154], edx
lea rdi, [rdi + rsi - 0x35]
pop rsi
pop rdx
jno fcn.18066bd91
mov qword [rsp + 8], rsi
mov qword [rsp], 0x18072b1a
mov qword [rsp], r12
jmp 0x18066534a
adc r8, rdx
btc rsi, 0x21
imul r11
shl rdx, cl
mov ecx, dword [rdi + r11 - 0x19710000]
bt edx, 0x27
push rdx
jae 0x180638dbf
not edx
movsx eax, si
and r11b, r11b
sbb edx, 0x97869b94
lea rcx, [rsi*2 + 0xb954c19]
ror edx, 1
imul r11w, ax
cbw
sub al, al
bswap edx
xadd r11w, ax
push r9
or sil, al
xor dword [rsp + rsi*2 - 0x14418], edx
pop r9
ror si, 6
xor r11d, eax
movsxd rdx, edx
sets sil
jno 0x18065b6ab
sar word [rsp + r10*4 - 0x1480f], 6
mov qword [rsp + r10*8 - 0x29038], 0x1bae0399
cpuid
mov dword [r10 + rdi - 0x5207], eax
mov esi, r11d
movsx eax, r10w
jns 0x180649b46
mov r11d, 0x78af634
push rbx
push r11
movsx ebx, r11b
mov qword [rsp + r11*2 - 0xf15ec68], rbp
mov ebp, ebx
push r9
movzx r9d, r11w
call fcn.180663e82
mov r11d, 0xfebad2b9
lea rbx, [r11*8 - 0x73649241]
neg bl
mov rdx, qword [rdi + riz]
mov sil, byte [rdi + riz + 8]
xadd r11d, ebx
movsx r10d, r11w
jg 0x18067618e
adc rdi, 9
ror r10d, 0xdd
imul r11d, r10d
mov byte ss:[rdx + riz], sil
mov r10d, dword [rbp + riz]
adc rbp, 3
movsx esi, r11b
xor r10d, r9d
movsx eax, sil
movzx ecx, r11b
ror sil, 0x41
not r10d
rol cx, 0x89
bswap r10d
btr bx, 0xb0
inc r10d
lea r11, [rbx + rcx*4 + 0x7a920bb2]
not r10d
movsx edx, r11b
cwde
ror r10d, 3
push r9
bts rcx, 0x95
lea r11, [rsi*2 - 0x414895cf]
btr edx, esi
xor dword [rsp + r11 + 0x41489551], r10d
inc esi
pop r9
movsxd r10, r10d
inc dl
jne 0x18066b542
add r8, r10
xchg cx, ax
jmp r8
add r8, r10
mov rdi, qword [rdi + rax*8 - 0x238]
push rdx
imul rbx
pop rdx
jae fcn.18066bd91
mov esi, 0xd9ea328
movzx edx, sil
movsx r11d, dl
mov bx, word [rdi + rsi - 0xd9ea328]
push rdx
sub esi, edx
mov r10w, word [rsi + rdi - 0xd9ea2fe]
and bx, r10w
and edx, esi
ror dword [rsp + rsi - 0xd9ea2fd], 0x32
lea rax, [rsi + rsi*8 + 0x75186712]
not bx
movsx ecx, word [rsp + rsi - 0xd9ea2fe]
not byte [rsp + rsi - 0xd9ea2fe]
or dx, bx
pop rax
mov ax, word [rdi + rsi - 0xd9ea2fc]
movzx r10d, cl
btc rsi, r10
call fcn.18065d696
movzx esi, r10w
xor edx, r9d
bt rsi, rsi
dec edx
mov r11d, 0xe68e2200
inc r10w
jle 0x18065cd47

Function at 0x180651013
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
call fcn.180662c52
jnp 0x18064d5db
push r9
xor dword [rsp + rcx - 0xbc0], esi
pop r9
movsxd rsi, esi
sub r10b, 0xf
sal r11d, 0xca
add r8, rsi
push rax
sal dword [rsp + rcx - 0xbbd], 0x5c
setp bl
mov rdx, qword [rdi + rcx*8 - 0x5e00]
mov esi, 0x802c608a
mov r10, qword gs:[rdx + rcx*4 - 0x2f00]
imul eax
not ax
bt ax, dx
mov qword [rdi + rcx*4 - 0x2f00], r10
div qword [rsp + rcx*2 - 0x1780]
imul rsi, rcx
mov qword [rsp + rcx*2 - 0x1780], r8
ret
Function at 0x180655a59
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rdi, [0x1805ad7e0]
lea rsp, [rsp + 0x20]
je 0x180650e89
jmp 0x18065738c
push 0xffffffff94bf0d38
mov qword [rsp], rdi
mov edi, 0xee0d72a2
inc edi
setno dil
push r8
mov r8d, 0x82955c8c
neg rdi
jp 0x18064a940
neg ecx
movsx eax, r10w
lea ecx, [rcx + r10 + 0x32887393]
bswap ecx
lea ecx, [rcx + r10*2 - 0x1c2e84bd]
neg ecx
ror sil, 0xc2
setae bl
or dx, dx
push r9
sal ebx, 0xad
xor dword [rsp + r10 - 0x8d], ecx
sub r11w, si
add r10w, r11w
ror bx, 0x8d
pop r9
movsxd rcx, ecx
adc r8, rcx
mov rcx, qword [rdi + r10*2 - 0x9e1a]
cdqe
mul r10
ror rsi, 0x10
mov r10, qword [r10 + rcx - 0x4f0d]
and esi, ebx
call fcn.18067d71e
shl rcx, 0x78
sbb al, cl
xadd dword [rsp + rbx*2 + 0x465142bd], r10d
ror al, 1
add al, 0x3f
dec r10d
sal ecx, 0xd0
xor r9b, al
movzx r11d, word [rsp + rbx*2 + 0x465142c1]
lea rax, [rsp + rax + 0x18]
not r11b
mov dword [rbx + rax + 0x2328a158], edx
sar dword [rsp + rcx + 0x11], 0x95
rol esi, 0xaa
adc dword [rsp + rbx + 0x2328a15f], r10d
mov qword [rsp + rbx + 0x2328a158], r8
ret 0x10

Function at 0x180659888
Capabilities:
Manually build aes constants

Disassembly:
ror ebx, 1
ror si, 0xcc
shr cl, 1
add ax, ax
mov qword [rsp + r10 - 0x4095], r9
xor dword [rsp + r10*2 - 0x812a], ebx
pop r9
movsxd rbx, ebx
cdq
shr rcx, 0x75
adc r8, rbx
ror r10, cl
shl r10, 0x44
dec al
movzx r11d, word [rcx + rbp - 0x20]
and cx, 0x302f
Function at 0x18065afa9
Capabilities:
Hash data using murmur3
Manually build aes constants

Disassembly:
mov cx, word [rdx + rdi]
lea rdi, [rdx + rdi + 2]
mov qword [rsp + rdx], rdx
or dl, byte [rbp + rdx*4]
push rsi
mov qword [rsp + rsi + 8], rsi
shr al, 0x64
lea rbp, [rbp + rax*4 - 0xf]
sal sil, 0xa3
and r11w, ax
cdqe
xor dl, r9b
bts rax, rbx
ror dl, 1
sal byte [rsp + rax + 2], 0x24
xchg byte [rsp + rsi + 0xb], r11b
lea r10, [rax + r11*8 - 0x3870c15c]
inc dl
add r11, qword [rsp + rax*2 - 4]
and dword [rsp + rax*2], eax
bt r11d, 0x9e
neg dl
rol r10w, 0x86
not dl
call fcn.180643461
dec sil
movzx si, byte [r11 + rdx*4]
adc ebx, ebx
adc r10d, ebx
mov word [rdi + rdx - 2], si
movzx ecx, dl
add cl, byte [rbp + rdx*8 + 1]
inc ebx
xor cl, r9b
movsx esi, dx
dec cl
sar edx, 0xb
movsx r11d, dl
not cl
cmovnp r11w, bx
sbb rdx, rdx
sbb cl, 0xbb
bswap esi
xadd r11d, esi
call fcn.180633c0e
xor r11d, r9d
rol byte [rsp], 0x64
rol dword [rsp + 2], 0x23
jae 0x18066dea0
neg r11d
shr byte [rsp + 7], 0x23
add dword [rsp + 4], 0x24a65b14
mov qword [rsp], r9
mov r9d, 0x9fa70182
btc r9w, r9w
bt r9w, r9w
xor dword [rsp], r11d
or r9d, r9d
pop r9
call fcn.1806696d2
mov r10d, 0x6ab40096
mov r10d, dword [rbp + r10 - 0x6ab40096]
mov ebx, 0x9810538b
add rbp, 4
xor r10d, r9d
sal bx, 0x85
neg ebx
xor r10d, 0xa18fa429
not ebx
sar bl, 0x24
dec r10d
not r10d
bts bx, bx
adc r10d, 0x6a8ca98
sub ebx, ebx
seto bl
btr bx, bx
neg r10d
sar bl, 0x61
shr rbx, 3
ror ebx, 0x18
push r9
lea r9, [rbx + rbx + 0x4baa62a4]
inc ebx
xor dword [rsp + rbx - 1], r10d
pop r9
sal ebx, 0x79
shr rbx, 0x8b
movsxd r10, r10d
xor ebx, 0x80080f1d
sal bl, 4
js 0x18067ccd4
xor r11d, 0xa18fa429
shl byte [rsp + 6], 3
sal word [rsp + 3], 9
dec r11d
ror byte [rsp + 2], 0xc6
rol byte [rsp + 4], 0x83
not r11d
sbb dword [rsp + 3], 0xed207408
shl dword [rsp + 4], 0x51
jbe 0x180671cb8
adc r11d, 0x6a8ca97
add word [rsp + 5], 0x6594
jne 0x180665977
Function at 0x180663740
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
pop rbp
mov r11d, dword [rbp + r11*2 - 0x20]
ja 0x180644f97
btr bx, dx
lea rbp, [rbp + rbx + 4]
xor r11d, r9d
rol dl, 0xe5
add r10d, ebx
mov ecx, ebx
xor r11d, 0xc62d3332
shl rbx, 0x62
rol r10w, 0xa3
adc bx, cx
neg r11d
ror r11d, 3
lea r11d, [r11 + r10 + 0x5ce59380]
shr rcx, 0x7d
dec dx
mov esi, ebx
push r9
and dl, ch
bts esi, r10d
xor dword [rsp + rbx*8 - 8], r11d
lea rax, [rbx*8 - 0x645607fb]
xor si, bx
pop r9
push rcx
mul byte [rsp + rbx - 1]
movsxd r11, r11d
adc r8, r11
btr r10w, r10w
or word [rsp + rbx + 1], cx
btr r10w, 0x3d
adc qword [rsp + rcx], r8
ret
lea rsp, [rsp + 8]
call rax
mov rsp, qword [rbp + riz - 0x10]
mov r10d, 0x8822b110
movzx edx, r10b
movsx r11d, dl
mov rbp, qword [rbp + rdx*2 - 0x28]
movsx r8d, dx
mov qword [rdx + rbp - 0x10], rax
not edx
and r10b, dl
mov rdi, rbp
movsx ebx, r10b
pop r9
pop r8
movsx ebp, dl
shr ebx, 0x2d
jp 0x18063c43b

Function at 0x18066549f
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + r11 - 0x4755], 0xfffffffff204d602
sub word [rsp + r11*2 - 0x8ea8], ax
movsxd rbx, ebx
rol esi, cl
add r8, rbx
not qword [rsp + r11 - 0x4755]
movsx ebx, byte [rsp + r11 - 0x4753]
call fcn.180643d0e

Function at 0x180668c68
Capabilities:
Manually build aes constants

Disassembly:
add r8, rax
not rcx
mov qword [rsp + rbx - 0x3fccf13f], r8
ret
mov qword [rsp + rbx - 0x3fccf13f], r11
and dword [rsp + r11 - 0x895e], r11d
movsxd rax, eax
imul r10d, ebx
jo 0x18064e4b3

Function at 0x18066af57
Capabilities:
Hash data using murmur3

Disassembly:
bswap esi
lea esi, [rsi + rdx*2 + 0x548febb6]
xadd dword [rsp + rdx + 0x14], r11d
mov qword [rsp + rdx*2 + 0x10], r9
xor dword [rsp + rdx + 0x10], esi
and word [rsp + rdx*4 + 9], r10w
movsx ecx, r10w
mov r9, qword [rsp + rax + 0x10]
xadd ecx, r11d
sbb rbx, 0xffffffffc5ae7980
div ebx
movsxd rsi, esi
rol dl, cl
adc r8, rsi
bt r10w, r11w
mov qword [rsp + rdx], r8
ret 0x10
add al, ah
cqo
adc cl, dl
and r10w, word [rsp + rdx + 0xf]
not cl
inc cl
or dx, r10w
add ebx, dword [rsp + rdx + 0xb]
rol cl, 1
inc cl
ror esi, 0x68
mov qword [rsp + rdx*4], rsi
sal sil, 0xe5
xor r9b, cl
or r10d, 0xe31f78af
lea rcx, [rsp + rcx + 0x18]
cwde
mul qword [rsp + rdx*2 + 7]
mov r10w, word [rdx + rcx]
idiv bx
push rdx
mov word [rdi + rdx*2 - 0x5cb8], r10w
lea r10, [rax + rax*8 - 0x1de52c7e]
sub rax, 0x9a75ea6
lea rdi, [rdi + rdx*2 - 0x5cb8]
pop rax
sar dword [rsp + rdx - 0x2e4e], 0xee
mov esi, dword [rdx + rbp - 0x2e5d]
cwd
lea rbp, [rbp + rdx + 6]
xor esi, r9d
mul rdx
and r11d, 0xa1b15336
xor esi, 0x94a267a7
inc esi
dec byte [rsp + rax*2 + 0xc]
js 0x180633c4f