joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14083b10b
Capabilities:
Authenticate hmac

Disassembly:
xor ebp, 0x20166a38
not sil
sar sil, 0x61
ror ebp, 1
call fcn.140841d39
mov ebp, 0xb0042932
movsx r11d, bp
mov esi, dword [r10 + r11*4 - 0xa4c8]
movsx r8d, r11w
lea rcx, [rbp*8 + 0x61a3b72c]
shr rbp, 0x52
lea r10, [r10 + rbp*4 - 0xb000]
xor esi, r9d
inc r8w
movzx eax, cx
bswap esi
setge r11b
lea esi, [rbp + rsi - 0x43b7089e]
movsx edx, ax
dec eax
not r8d
xor esi, 0xa51d3d1e
sar bpl, 4
not esi
inc rdx
cmovg r11d, edx
lea r8, [rdx + r8 - 0x1ad7b4c9]
lea esi, [rsi + rbp*2 + 0x3dbbe700]
call fcn.14084d6ff
ror r11b, 1
shr esi, cl
xor r9b, r11b
call fcn.140834440
sub ebp, 0xde96aaaf
bt rax, rax
jae 0x14082927d
mov r8, qword [rbx]
mov si, word [rbx + 8]
push 0x35197880
mov ecx, dword [rsp]
xchg qword [rsp + rcx - 0x35197880], rcx
mov word ss:[r8 + rcx*2 - 0x6a32f100], si
rol byte [rsp + rcx - 0x3519787f], 0xe4
lea rbp, [rcx + rcx*2 + 0x22053a00]
push rbp
lea rax, [rsp + rcx - 0x351977f0]
mov r11w, word [rax + rcx*2 - 0x6a32f100]
mov word [rcx + rbx - 0x35197878], r11w
mov eax, 0x900ad08a
lea rsi, [rcx + rbp*4 - 0x626c71ef]
lea rax, [rbx + rcx - 0x35197878]
lea rsi, [rsi + rsi*8 - 0xb4a94fc]
movzx r8d, byte [rsp + rcx*2 - 0x6a32f0f8]
mov qword [rbx + rcx*2 - 0x6a32f100], rax
mov edx, 0x590635b8
mov eax, dword [r10 + rcx - 0x35197880]
lea rdx, [rcx*8 + 0x5b11a96]
sar byte [rsp + r8*2 - 0x100], 0x46
imul r8d, esi
lea r10, [r10 + rcx - 0x3519787c]
dec bp
bts bp, cx
xor eax, r9d
call fcn.140826c9e
mov r8d, dword [r10 + rsi - 0x7300609d]
movzx ecx, si
lea rbp, [rsi + rcx*2 - 0x5edf4bd3]
xor r8d, r9d
sub r8d, 0x8204e933
xor r8d, 0xe50d7e93
rol rbp, 0xe4
push rsi
movsx edx, byte [rsp + rsi - 0x7300609a]
add r8d, ebp
neg ebp
sar bpl, 0x46
bswap r8d
ror r8d, 2
mov qword [rsp + rsi - 0x7300609d], r9
add si, 0x18ac
xor dword [rsp + rsi - 0x73007949], r8d
btr esi, edx
adc rcx, 0xffffffffe589c68c
pop r9
movzx eax, dx
movsxd r8, r8d
xor eax, 0x82343a87
sbb sil, cl
push rcx
adc rdi, r8
push rbp
bts rax, 0xa0
movzx cx, byte [rcx + rbx + 0x1a75d8d7]
mov r11b, byte [rbx + rsi - 0x7300791e]
sal word [rsp + rsi - 0x73007912], 0x2f
shr qword [rsp + rsi - 0x73007918], 0xf7
add qword [rsp + rsi - 0x73007918], rdx
and cl, r11b
xor cl, bpl
mov word [rbx + rdx - 0x71], cx
xchg ebp, esi
sal dword [rsp + rbp - 0x73007914], 0xbb
seta sil
movzx eax, byte [rdx + r10 - 0x6f]
shl rbp, 0x77
lea r10, [r10 + rdx*4 - 0x1c7]
xor al, r9b
dec al
xor al, 0x38
dec al
sal word [rsp + rdx - 0x6b], 0x2f
rol al, 1
lea r8, [rsi*8 + 0x5acb69d]
push rsi
xor r9b, al
lea rax, [rsp + rax + 0x18]
lea r11, [rdx + rsi*4 + 0x4701af0d]
mov rcx, qword [rax + rdx*2 - 0xe6]
xchg qword [rsp + rdx - 0x65], rbp
rol r11w, 0xcf
mov qword [rbx + rdx*8 - 0x39e], rcx
xadd byte [rsp + rdx - 0x66], dh
inc word [rsp + rdx - 0x5f]
lea rbx, [rbx + rdx*4 - 0x1d2]
pop rcx
pop rsi
pop rsi
jae fcn.140837a63
call fcn.140826b7b
Function at 0x14083d8a2
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
lea r10, [r10 + rax - 0x5ede9ade]
xor bp, bp
mov qword [rsp + rax - 0x5ede9ae2], rbp
xor r11d, r9d
sal al, 0x62
rol word [rsp + rbp + 1], 0x4c
rol r11d, 3
not r11d
rol r11d, 1
mov ecx, 0x1431a487
neg dx
sbb r11d, ebp
add qword [rsp + rbp], r9
sal cl, 0x87
lea r9, [rbp + rax*8 - 0x136a9a57]
xor dword [rsp + rbp*8], r11d
movzx esi, cx
pop r9
push rcx
xchg word [rsp + rbp*8 + 1], ax
push rbp
movsxd r11, r11d
rol qword [rsp + rbp + 8], 0xfb
add ecx, edx
push rax
adc rdi, r11
add bpl, byte [rbx + rax - 0x5ede31a4]
mov r11d, esi
mov cl, byte [rbx + rsi*8 - 0x523fe]
lea rbx, [rbx + rsi*2 - 0x148fe]
jmp 0x1408889da
mul r11d
shr bpl, cl
mov r8d, dword [rsp + rdx*2 - 0x79e3]
mov word [rbx + rdx*2 - 0x79ea], bp
sar r11w, 0xcb
jne 0x140846953
mov rcx, qword [rbx]
mov r11d, 0x5da23637
movzx esi, r11b
movzx edx, r11w
mov r8b, byte [rbx + rsi*2 - 0x66]
lea rbx, [rbx + r11 - 0x5da2362d]
mov byte es:[rsi + rcx - 0x37], r8b
mov ecx, dword [r10 + rdx - 0x3637]
mov eax, 0x633af2b6
lea r10, [r10 + rsi*2 - 0x6a]
add esi, r11d
movzx r8d, ax
xor ecx, r9d
lea ecx, [rcx + r11 + 0x27036df]
ror rax, 0x9d
rol ecx, 2
lea r8, [rdx*8 + 0x4b8d226]
push rsi
sub ecx, 0x8ea39c1e
lea r8, [rax + rdx*4 - 0x55b4cce]
xadd r8b, sil
bswap ecx
mov qword [rsp + rsi - 0x5da23611], r9
call fcn.14084b662
mov esi, 0x4d12b536
sar sil, 0x61
call fcn.140823319
movzx cx, byte [rbx]
mov r8d, 0x11aeaf9d
movsx ebp, r8b
mov sil, byte [rbx + r8 - 0x11aeaf9b]
Function at 0x140844fc0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
movzx r8w, byte [rbx + rcx - 0x709ed128]
cdqe
mov cl, byte [rbx + rax + 0x402e0543]
xor qword [rsp + r11*2 - 0x276d68b9], 0xffffffffd33bcb0b
not ax
lea rbx, [rax + rbx + 0x402efac2]
setbe byte [rsp + r11 - 0x13b6b456]
rol byte [rsp + rax + 0x402efacb], 0x63
inc sil
shr r8b, cl
xadd sil, r11b
dec qword [rsp + r11 - 0x13b6b413]
mov word [rbx + r11*4 - 0x4edad058], r8w
push rax
cqo
mov qword [rsp + rax + 0x402efac0], rdi
ret 0x10
call fcn.140880ec9
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0x14087cc2e
call fcn.140892d01
mov ebp, dword [r10]
mov eax, 0x709ed1a0
mov ecx, eax
lea r11, [rcx - 0x5ce87771]
lea r10, [rax + r10 - 0x709ed19c]
movzx r8d, al
xor ebp, r9d
rol ebp, 3
sar r8, 0x5a
mov esi, eax
not ebp
bswap eax
btr r8w, cx
rol ebp, 1
sub esi, esi
add ax, r11w
dec ebp
push r9
push rsi
movzx r9d, r11w
xor dword [rsp + r11*4 - 0x4ed968b4], ebp
xadd r11w, r9w
shr cl, 2
or rax, 0xffffffffbf015a3a
mov r9, qword [rsp + rax + 0x402e0549]
sar esi, cl
mov qword [rsp + rax + 0x402e0549], rsi
adc si, 0xb215
movsxd rbp, ebp
rol qword [rsp + rax + 0x402e0547], cl
adc rdi, rbp
add r8w, si
jae 0x14083670f
mov esi, 0x61bb2239
inc si
movsx r11d, si
mov ecx, dword [r10 + r11*8 - 0x111d0]
ror r11b, 0xe7
or si, si
movsx r8d, sil
xor ecx, r9d
ror ecx, 1
bswap ecx
mov ebp, r8d
sub ecx, 0xf62aa112
sub r11d, esi
shl r8, 0xb8
xor ecx, 0x8383592b
lea rax, [r11 + rsi*2 - 0x78c3d2e5]
bts r11, rsi
cdqe
lea ecx, [rcx + rax*2 - 0x779ac949]
push r9
cqo
xor dword [rsp + rbp - 0x3a], ecx
and eax, 0xfc8f1d25
pop r9
cqo
movsxd rcx, ecx
adc rdi, rcx
xor rsi, r11
movzx ecx, byte [r10 + rbp*2 - 0x70]
sub r8, r8
sbb ax, bp
btr bp, ax
lea r10, [r10 + r8 + 5]
xor cl, r9b
jmp 0x1408616ae
push 0xffffffffb625fbbd
cmp ebx, 3
jmp 0x140842599

Function at 0x14084b821
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
ror dword [rsp + 0xc], 0x5a
jae 0x1408211ca
xor r11d, eax
call fcn.140827ff6
shr r11d, 8
jmp 0x140820119
Function at 0x14084ba73
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
add rdi, r8
lea r8, [rcx + rsi*4 - 0x1b6ea054]
cqo
add edx, dword [rbx + rdx - 4]
mov qword [rsp + r11*8 - 0x5cea0], rcx
xor r8, qword [rsp + r11 - 0xb9d3]
jp 0x14086b1f3
neg cl
push rax
ror r8d, 0xb9
not cl
dec cl
ror cl, 1
mov ebp, eax
mul rbp
inc sil
xor r9b, cl
movzx r11d, ax
shl al, 0x41
mov qword [rsp + rax*2 - 0x17288], rsi
lea rcx, [rsp + rcx + 0x10]
shr rdx, 0xee
mov rbp, qword [rcx + rax*8 - 0x5ca40]
mov rax, rbp
mov ecx, dword [rax + rdx*2]
movsx ebp, word [rsp + rdx + 0xa]
mov dword [rbx + rdx*2 - 4], ecx
neg ebp
movsx eax, r8b
or rdx, 0x3700efbd
mov r8d, dword [r10 + r11*2 - 0x17347]
setne dl
xor r8d, r9d
inc r11b
lea rsi, [rdx + rax*2 - 0xb6c24d0]
sub bpl, 0xae
xor r8d, 0xc1896819
not r8d
xchg ebp, eax
idiv r11w
neg r8d
rol r8d, 3
mov qword [rsp + rdx - 0x3700d839], r9
movzx ecx, r11w
cqo
and ecx, 0x9b3b16be
xor dword [rsp + rdx + 8], r8d
dec cl
mov r9, qword [rsp + rdx*2 + 8]
movsxd r8, r8d
xchg al, r11b
jl 0x140847d70
and rsi, rax
push r9
movsx ecx, ax
ror eax, 0xd2
xor dword [rsp + rax*4 - 0x7251522c], r8d
pop r9
add ax, dx
xadd eax, esi
xor rsi, rsi
movsxd r8, r8d
sbb ax, r11w
adc rdi, r8
div rax
xor rsi, rdi
jmp rsi
movzx r8d, byte [r10 + rcx - 0x109e]
xadd dword [rsp + r11 - 0xb9ca], esi
lea r10, [r10 + rsi*2 + 6]
sub cx, word [rsp + rsi + 7]
xor r8b, r9b
dec r8b
add dword [rsp + rsi*8 + 4], eax
bts bp, ax
neg r8b
ror r8b, 1
or dword [rsp + rsi*4 + 2], 0x8c3be482
not r8b
sar r11d, 0xf6
xor r9b, r8b
and r11b, bpl
xor bp, 0x7082
lea r8, [rsp + r8 + 0x10]
dec word [rsp + rsi + 7]
mov dword [r8 + rsi*8], edx
dec rax
shr r11b, cl
movzx r8d, ax
mov qword [rsp + rsi*2], rdi
ret 8
Function at 0x14084d6ff
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
call fcn.1408251ab
lea rbx, [rbp + rbx - 0x2cba]
and r11, rbp
jno 0x140868d70
ror esi, 1
rol r8d, 0xa9
setb bpl
ror dx, 0x2c
mov qword [rsp + rbp - 0x2c00], r9
push rdx
xadd bpl, cl
xor dword [rsp + rbp*2 - 0x5970], esi
mov r9, qword [rsp + rbp*2 - 0x5970]
xchg qword [rsp + rbp - 0x2cbc], r8
xadd eax, r11d
movsxd rsi, esi
adc rdi, rsi
movzx r8w, byte [rbx + rbp - 0x2cbc]
inc qword [rsp + rbp - 0x2cbc]
jge 0x140867b45
mov esi, 0xe0313e30
movsx r11d, sil
lea r8, [rsi + rsi*4 + 0x63bdaba9]
movzx r8d, byte [r10 + r11*2 - 0x60]
movsx ebp, r11b
xor r8b, r9b
call fcn.14088a831
jo 0x140833119
mov dl, byte [rbx + rbp*2 - 0x5976]
jne 0x14084d317
mov ebp, dword [r10]
mov esi, 0xdbfd481
lea r10, [r10 + rsi - 0xdbfd47d]
xor si, si
xor ebp, r9d
jmp 0x1408356f2

Function at 0x14084ea4b
Capabilities:
Manually build aes constants

Disassembly:
movzx ecx, word [rsp + rdx*2 - 0x489c9]
mov qword [rsp + rdx*4 - 0x913a4], rdi
ret 8
or r8, rbp
adc r11, rsp
not dx
call fcn.14082c02a
mov r8d, 0x80194488
mov r11d, 0xfb18ea2e
mov eax, r8d
mov rax, qword [rbx + riz]
inc r11d
mov r8, qword [rbx + riz + 8]
movsx edx, r11w
movsx esi, r11w
sal rsi, 0xa
not rax
not r8
lea rcx, [rdx + rdx - 0x1fefc16c]
movsx ebp, cx
or rax, r8
mov qword [rbx + rbp - 0x12ea], rax
bts rcx, 0x2d
movsx r8d, r11w
shr edx, 0x58
mov r11d, dword [r10 + rdx - 0xff]
neg ecx
dec cl
sal dl, 0x66
lea r10, [r10 + rdx - 0xbc]
xadd cx, si
xor r11d, r9d
movzx eax, dl
imul ebp
dec r11d
xor r11d, 0x203f9cab
mul bp
lea r11d, [r11 + rcx*4 + 0x4f55de83]
ror r11d, 1
ror dx, cl
adc cx, bp
not r11d
xor r11d, 0x1a2905b4
shr rcx, cl
imul r8, rsi
call fcn.14087271b
mov qword [rsp + r8 - 0x13], rsi
neg byte [rsp + r8*2 - 0x24]
mov qword [rbx + r8 - 0x1b], rbp
jns 0x14085acc6
lea rbp, [rsp + rdx - 0x24441]
mov dword [rbp + rdx*4 - 0x913a4], r8d
movsx ebp, byte [rsp + rdx*2 - 0x489c9]
jg 0x1408306ba
movzx eax, byte [rsp + r8 - 0xf]
lea rbx, [r8 + rbx - 0x1b]
add eax, dword [r8 + r10 - 0xb]
inc qword [rsp + r8 - 0x13]
je 0x14085d161
lea r10, [r10 + r8*8 - 0x8c]
shl qword [rsp + r8*2 - 0x26], cl
xadd r8d, esi
xor eax, r9d
not eax
imul r11w, word [rsp + r8 - 0xa011]
jno 0x140847e8e
add byte [rsp + rsi - 0x7a8c268f], 0x94
mov qword [rsi + rbx - 0x7a8c2691], rax
or qword [rsp + rsi - 0x7a8c2693], 0x1d11601a
lea rax, [r11 + r11*2 - 0x7bd63743]
movzx r11d, byte [r11 + r10 - 0x26d3]
cdqe
xor r11b, r9b
neg r11b
movsx r8d, al
mov edx, 0xf402bdad
sub r11b, 0x21
lea rsi, [rdx*4 - 0xf626bc2]
dec r8b
mov ecx, r8d
rol r11b, 1
imul edx
not qword [rsp + rax - 0x72283b7e]
inc r11b
inc r8b
pop rcx
and r8, 0xffffffffd594e114
not r11b
mov ebp, esi
cmova rsi, r8
sbb r11b, 0x9f
neg r11b
bts eax, edx
rol r11b, 1
xor r11b, 0x24
xadd ax, r8w
xor r9b, r11b
jmp 0x14084298b

Function at 0x140850500
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0x152a9da9
mov eax, dword [rsp + 2]
lea ecx, [rax + rbx - 0x152e]
lea rsp, [rsp + 8]
Function at 0x140850546
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0x1abd421a
push 0xffffffff952cfcb9
add rax, rdx
sar word [rsp + 2], 0xa1
mov qword [rbp + riz - 8], rax
call fcn.14087760f
cwd
and rsi, 0xffffffffa91eea80
xor dword [rsp + rdx - 0x1273ffff], ebp
or rax, 0xffffffffa6b3ba10
not r11d
pop r9
adc r8b, sil
xor r8b, 0x20
cdq
movsxd rbp, ebp
sete r8b
inc eax
neg r11w
add rdi, rbp
btr rcx, rdx
bts edx, ecx
movzx ebp, ax
movzx eax, word [r10 + rcx]
neg cl
lea r10, [r11 + r10 - 0x37629707]
rol bpl, 0x26
xor ax, r9w
push r8
xor ax, dx
add ax, dx
or edx, ebp
sal cl, 1
xadd word [rsp + rcx*2 + 2], r11w
rol ax, 1
sub dl, 5
sbb rsi, rsi
btr r11, r8
dec ax
imul esi, edx
ror rsi, 0xca
xor r9w, ax
lea rax, [rsp + rax + 8]
lea r8, [rsi + rsi*8 + 0x1abe26b2]
lea rbp, [rsi + rcx*4 - 0xa5f8edc]
add cl, byte [rax + r11 - 0x3762e608]
lea rbx, [r11 + rbx - 0x3762e60a]
and dl, 0xba

Function at 0x140852f54
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
mov word [rbx + rax - 0x43802516], cx
xor r8, rsi
pop rcx
jne fcn.140837a63
not cl
mov qword [rsp + rax - 0x43802516], rsi
xor r9b, cl
shl si, 0xcc
lea rbx, [rbx + rdx*8 - 0x128b2]
add byte [rsp + rdx*8 - 0x128af], r11b
jne 0x140825061

Function at 0x140852fae
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
add r10, 4
mov qword [rsp], 0x593ba793
xor edx, r9d
jmp 0x140825df5

Function at 0x140853d6b
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
lea rsp, [rsp + 0x18]
jne 0x140864ba6

Function at 0x140853f1d
Capabilities:
Authenticate hmac

Disassembly:
add rdi, rcx
call fcn.1408360b5
bswap ecx
rol ecx, 2
dec edx
neg r8
mov qword [rsp + rbp + 1], rax
sub ecx, ebp
ror ecx, 2
or dx, si
cwde
xor dword [rsp + rbp*2 + 2], 0x84a1a436
neg ecx
sub ecx, ebp
mov qword [rsp + rbp*4 + 4], r9
inc dl
movzx r11d, sil
xor dword [rsp + rdx*4 - 0x62a9bc00], ecx
cwd
inc r11d
bts dx, 3
pop r9
bswap rsi
movsxd rcx, ecx
push rsi
mul dl
jb 0x1408465bf
Function at 0x140860718
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
xor r8d, r9d
lea r8d, [rsi + r8 - 0x331284c0]
or ebp, ebp
not sil
rol cl, 0xe2
rol r8d, 3
sar esi, 0x2d
not r11w
neg r8d
inc ebp
inc rcx
inc r8d
jmp 0x14087d995
lea rdx, [rsp + rdx + 0x10]
dec sil
mov qword [rsp + r8*4 - 0x22d5f9b8], rax
mov word [rdx + r8 - 0x8b57e6e], bp
movzx ebp, r8b
pop rcx
add byte [rsp + r8 - 0x8b57e6e], 9
mov r11d, dword [r10 + rax*8 - 0x3f7]
cdq
xor r11d, r9d
ror r11d, 1
dec r11d
neg r11d
mov dword [rsp + r8 - 0x8b57e6b], eax
xadd word [rsp + r8 - 0x8b57e6a], bp
sub qword [rsp + r8 - 0x8b57e6e], 0x13d170c
bswap r11d
setge al
mov qword [rsp + r8*2 - 0x116afcdc], r9
ja 0x14083008c
mov r8d, 0x458027ae
movzx esi, r8b
ror r8, 0x38
rdtsc
lea rbx, [rsi + rbx - 0xb6]
mov r11d, r8d
mov dword [rsi + rbx - 0xaa], eax
movsx ebp, r11b
sbb si, bp
mov dword [rbx + rsi - 0xae], edx
setbe r8b
mov edx, 0x2005d400
mov r8d, dword [r10 + rsi - 0xae]
or ebp, esi
bts si, r11w
lea r10, [r10 + rsi*8 - 0x574]
inc rsi
mov ecx, esi
jge 0x14085e230
call fcn.140847adc
push r9
mov eax, esi
movsx r9d, cl
xor dword [rsp + rsi*4], r8d
neg ebp
pop r9
shr rcx, cl
sets al
cwd
movsxd r8, r8d
mul dx
not r11
sal bp, 0x21
add rdi, r8
jmp fcn.140837a63

Function at 0x140860fe7
Capabilities:
Authenticate hmac

Disassembly:
movzx ecx, word [rdx + r10 - 0x34188584]
lea r10, [r10 + rdx*2 - 0x68310b06]
movsx ebp, dl
movzx r8d, bp
xor cx, r9w
shl dword [rsp + rdx - 0x34188581], 0x22
ja 0x140845234
mov eax, 0x549c560e
mov eax, dword [r10 + rax - 0x549c560e]
mov esi, 0xe6b96f29
dec rsi
movzx ecx, sil
lea r10, [r10 + rcx*4 - 0x9c]
movsx r8d, cl
xor eax, r9d
mov edx, 0xdf30862a
sub r8b, dl
movzx ebp, dx
neg eax
lea eax, [rcx + rax - 0x5a33454a]
neg eax
dec edx
btc rcx, rsi
shr ebp, cl
lea eax, [r8 + rax - 0x728ed48e]
btc ebp, 0x26
neg eax
push r9
movzx r11d, dl
xor dword [rsp + r8*2 - 0x1fc], eax
bts cx, 0x32
setae r11b
pop r9
call fcn.140845527
btc rbp, 0x89
lea rdx, [rsp + rdx + 0x30]
jb 0x140846661
mov eax, 0xf0998ab0
cwde
mov ax, word [rbx + riz]
mov edx, 0x34188584
push rdx
lea rbx, [rbx + rdx*2 - 0x68310b06]
neg dword [rsp + rdx - 0x34188580]
jns 0x140860db3

Function at 0x14086f6a6
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
adc rdi, rcx
mov esi, ebp
mov qword [rsp + r11 - 0xdb], rdi
ret 0x10
dec r11b
pop rdx
inc ecx
ror byte [rsp + r11*2 - 0x1b4], 0x22
push r11
mov byte [rsp + r11 - 0xd7], r11b
not ecx
not qword [rsp + r11*4 - 0x361]
inc ecx
mov edx, 0x578fbda2
lea rdx, [r11 + rax*8 - 0x3e713669]
not ecx
xor ecx, 0x94284199
mov qword [rsp + r11 - 0xcb], r9
xor dword [rsp + r11 - 0xcb], ecx
imul qword [rsp + r11 - 0xd9]
sar qword [rsp + r11 - 0xd5], 0xd5
mov r9, qword [rsp + r11*4 - 0x35c]
movsxd rcx, ecx
shl bpl, 0x81
rol rbp, 7
jne 0x140835f0d

Function at 0x140871486
Capabilities:
Authenticate hmac

Disassembly:
xor r9b, dl
lea rbx, [rcx + rbx - 0x1760]
pop r11
mov word [rbx + rcx*4 - 0x5d78], dx
inc sil
call fcn.140885d57
movsx ecx, r11b
mov eax, r8d
adc cl, byte [rbx + r8*4 - 0xbc]
lea rbx, [rbx + r8*8 - 0x17c]
call fcn.140871e63
Function at 0x1408714bf
Capabilities:
Authenticate hmac

Disassembly:
neg dx
mov ebp, dword [rcx + rbx - 0x18b7fc7d]
call fcn.140893cb6
xor ebp, 0x94284199
not r8d
mov qword [rsp + rdx - 0x7e], r9
call fcn.140850d5c
mov r8d, 0x31228905
mov rax, qword [r8 + rbx - 0x31228905]
movsx edx, r8w
jmp 0x140866c01

Function at 0x140871637
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x10]
jbe 0x140850519
mov edx, 4
call fcn.140850500
push 0xffffffffd9a2a88d
lea rsp, [rsp + 8]
sub rsp, rcx
push 0x433866a5
neg qword [rsp]
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
jmp 0x140887b50
mov eax, 0xa08e01b4
shl al, 0xa3
shl ecx, 3
add al, 0x2d
shl edx, 3
add ax, ax
push rax
mov rax, rbp
not word [rsp + 2]
neg byte [rsp + 1]
add rax, rdx
mov qword [rbp + riz - 8], rax
call fcn.140828bd4
jmp 0x14083054e
push 0x56aeaf25
lea rsp, [rsp + 8]
add rsp, rcx
call fcn.140886073

Function at 0x140871d1f
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [rbx + rdx]
neg r8b
shl r11, cl
push rax
pop rbp
jns fcn.140837a63
mov r9, qword [rsp + r8*4 - 0x62dffeb4]
movsxd rax, eax
push rdx
sar rsi, cl
adc rdi, rax
dec sil
mov eax, dword [rbx + r8*4 - 0x62dffebc]
shr dword [rsp + rcx - 0x18b7fc85], 0xbd
mov r8d, dword [rcx + rbx - 0x18b7fc81]
btc ebp, 0x29
xor dl, dl
not eax
sub rsi, 0xffffffff9f1d599f
not r8d
mov qword [rsp + rcx - 0x18b7fc7d], 0x1803d393
setns r11b
mov qword [rsp + rcx - 0x18b7fc75], rdx
and eax, r8d
neg dx
call fcn.1408714bf
movsx ebp, dx
movsxd rsi, esi
sar edx, cl
ror r8d, cl
adc rdi, rsi
ror r11b, 0x63
bt rdx, rbp
jae 0x140827eab
mov rsi, qword [rbx]
mov r11d, 0xe234e213
mov r8w, word ss:[rsi + riz]
movsx eax, r11w
add rbx, 6
movsx ecx, ax
mov esi, r11d
btr r11w, 0x2e
mov word [rbx + riz], r8w
mov r8d, esi
add esi, r11d
mov r8d, dword [r10 + riz]
adc r10, 3
lea rdx, [r11*4 - 0x71ec8e69]
btr rdx, 0x8c
or rdx, rsi
xor r8d, r9d
Function at 0x14087547e
Capabilities:
Execute anti-debugging instructions

Disassembly:
or r8d, eax
btr rsi, 0x8c
sbb sil, sil
mov dword [rbx + rcx*2], r8d
or sil, 0xb4
lea r11, [rbp + rsi*8 + 0x2b8fb48b]
add ecx, dword [rcx + r10]
lea r10, [r10 + rbp + 0x2cf4b334]
lea rbp, [rbp + rbp + 0x1d877332]
xor ecx, r9d
ror r11w, 0xc9
movsx edx, bpl
ror ecx, 2
bts r11, 0xb4
neg si
movsx eax, r11b
inc ecx
xadd rax, rdx
jnp 0x140850b18
mov r11d, 0xf0295b0
movzx r8d, r11b
rdtsc
lea rbp, [r11 - 0x9da22e4]
rol bp, 0x24
imul r11w, r11w
lea rbx, [rbx + r11*4 - 0x3c096408]
movsx esi, r8b
mov dword [rbx + r11 - 0xf0258fc], eax
mov dword [r8 + rbx - 0xb0], edx
neg rbp
btr esi, esi
lea rdx, [rsi + r8 - 0x33d612eb]
mov ebp, dword [r10 + r11*2 - 0x1e04b200]
lea r10, [r10 + r11*2 - 0x1e04b1fc]
neg dx
xor ebp, r9d
movsx ecx, r8w
lea ebp, [rbp + r11*2 - 0x51173610]
inc r8b
rol ebp, 3
shr rcx, cl
neg ebp
add dl, dl
adc ebp, ecx
push r9
movzx eax, dx
xor dword [rsp + r11 - 0xf025900], ebp
pop r9
neg esi
movsxd rbp, ebp
add rdi, rbp
bts ecx, 0x98
rol ax, 0x26
lea rbp, [rsi - 0x7b64b277]
jae fcn.140837a63
mov r8d, dword [r10 + rax*4]
movsx edx, sil
not sil
lea r10, [r10 + rsi - 0x3eae00dc]
xor r8d, r9d
bt dx, 0xa1
setb r11b
jae 0x140895af1
bswap r8d
rol r8d, 2
inc r8d
cbw
mov qword [rsp + rsi*2 - 0x7d5c01c0], 0x270f0a06
ror r8d, 2
call fcn.14084ef99
je 0x140833bd2
xor r11b, r8b
xor si, 0xc798
xor r9b, r11b
ror edx, cl
not word [rsp + rsi*2 - 0x15f07c77]
lea r11, [rsp + r11 + 0x38]
mov qword [r11 + rsi*8 - 0x57c1f2a0], rax
mov qword [rsp + rcx - 0x343965], rdi
ret 0x30
Function at 0x14087c9e2
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + r11 - 0x563eba40], eax
mov qword [rsp + r11 - 0x563eba50], r11
mov r9, qword [rsp + r11 - 0x563eba40]
rol rcx, 0x29
not ecx
call fcn.14083bee5
mov esi, 0xb4936984
call fcn.140837032
mov ebp, dword [r10]
xor ebp, r9d
mov esi, 0x1ca25b19
and esi, esi
ror ebp, 2
movsx edx, sil
mov ecx, edx
inc ebp
lea rax, [rcx + 0x5f2fcc84]
jmp 0x14087832c

Function at 0x14087cb75
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
mov eax, 0xe7047815
shr ax, 0x49
mov rax, qword [rbp + rbx*8 + 0x20]
push 0xfffffffffb3c5936
ror byte [rsp + 3], 0x43
push 0x35a296b9
mov qword [rsp + 8], rax
lea rsp, [rsp + 8]
call fcn.1408514e1
lea rsp, [rsp + 0x18]
jne 0x1408435e2
jmp 0x14086c15d

Function at 0x14087cc0f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
not bpl
inc r11d
pop rsi
btr edx, ebp
rol r11d, 3
mov qword [rsp + r8 - 0x79af5809], r9
sar rbp, cl
jne 0x14085591a
Function at 0x140881ecd
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
sar cl, 0x61
mov word [rbx + r11*2 - 2], si
mov qword [rsp + r11*2], 0x66b537bc
lea rbx, [rbx + r11 - 2]
call fcn.140881d17
add rdi, r8
mov si, r11w
inc ax
js 0x14087a8dc
mov r11d, dword [r10]
xor r11d, r9d
mov r8d, 0xc0af6338
movzx esi, r8w
lea rbp, [r8 - 0x9437fc1]
neg r11d
push rsi
not r11d
xor r11d, 0x9d3db004
and rsi, qword [rsp + rsi*4 - 0x18ce0]
mov ecx, ebp
call fcn.14084df21

Function at 0x14088348a
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
movzx r11d, r8w
xor eax, r9d
not r11
not eax
call fcn.1408358a3
xor dword [rsp + rcx*2 - 0x18640010], esi
rol r11w, 0x6a
movzx r9d, bp
cdq
pop r9
btc rdx, r11
jb 0x140856a43
movsxd rsi, esi
inc r8
and al, bpl
adc rdi, rsi
movsx esi, r8b
jmp 0x140889bcb
xor dword [rsp + r8 - 0x73573ff8], esi
dec r8d
lea r8, [rbp + rbp*8 + 0x7e3af53d]
mov r9, qword [rsp + rdx*2 + 2]
push rbp
movsxd rsi, esi
movsx r11d, bp
add rdi, rsi
call fcn.14081fd8d
mov esi, dword [r10]
mov ecx, 0xc328a1a
lea r10, [r10 + rcx*4 - 0x30ca2864]
movsx r8d, cx
dec ecx
lea r11, [rcx + rcx - 0x11e2a978]
xor esi, r9d
add r8, r8
not esi
shr cx, 0xac
mov eax, r8d
lea esi, [rsi + rcx - 0x6cdadf45]
setnp r11b
btr r11, 7
movzx edx, r8w
not esi
imul r11w, dx
bswap esi
lea r8, [r8*8 + 0x52059e06]
push r9
jae 0x140888dc6
lea rbp, [rdx + 0x57234799]
jo 0x140857cc4
mov esi, 0x6c3eb90e
mov eax, dword [r10 + rdx - 0x98f5]
jmp 0x140839e48

Function at 0x140885446
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
adc qword [rsp + 8], 0x722cc29e
movsx r8d, cl
pop rsi
pop rax
jno fcn.140837a63

Function at 0x14088545b
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
call fcn.140844db7
neg edx
movzx ecx, al
call fcn.140842cec
mov ecx, 0x3b096405
movzx esi, byte [rcx + r10 - 0x3b096405]
movsx r11d, cl
movzx eax, cx
xor sil, r9b
neg sil
shl rcx, cl
or r11d, 0xa0079421
ror sil, 1
dec ecx
btc cx, r11w
movzx ebp, r11b
xor sil, 0xb6
lea r8, [rcx + r11*2 + 0x71ab0a5]
jmp 0x140856af8
sal ecx, 3
sub ax, 0x2da3
sete al
mov qword [rsp], rax
shl edx, 3
neg word [rsp + 3]
inc rax
sete al
mov rax, rbp
sub dword [rsp + 4], 0x37a3ef87
xor dword [rsp], 0xcb2a1d2f
adc rax, rdx
jmp 0x1408607e6