joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180325310
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [rcx*4 + 0x3fb5d6b9]
lea rdi, [rdi + rbx - 0x18]
xor r10d, ebp
mov qword [rsp + r8 - 0x6c0fc81c], 0x3a235c1f
not ebx
shl eax, 0x95
bswap r10d
rol byte [rsp + r8 - 0x6c0fc818], cl
mov r11d, dword [rsp + r8 - 0x6c0fc81c]
rol r10d, 2
ror rax, cl
shl r11w, cl
dec r11b
sbb r10d, 0xe69b81aa
bswap r10d
inc al
sub r10d, 0x92850f3c
add rcx, rax
jp 0x180354e4f
not qword [rsp + r8 - 0x6c0fc81c]
mov qword [rsp + r8 - 0x6c0fc814], rbp
dec dword [rsp + r11 - 0x3a23e0f5]
add ebx, r11d
not word [rsp + r8 - 0x6c0fc819]
xor dword [rsp + rbx - 0x3a23e0d2], r10d
shr eax, 0x5c
shl rax, 0x3a
mov rbp, qword [rsp + r8 - 0x6c0fc814]
jae 0x180330a0b

Function at 0x18032b7b8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and eax, 0xb03b381c
mov qword [rsp], r8
xor rbp, r10
pop rcx
sub r11b, r11b
mov qword [r9 + 2], r10
movzx r10d, dl
inc r11w
bswap rdx
mov eax, dword [r10 + rdi - 0x20]
mov qword [rsp + r10 - 0x28], r10
xor eax, ebp
bswap eax
pop rdx
sub dword [rsp + rdx*4 - 0x9f], r11d
sub eax, 0xb69545a9
and byte [rsp + rdx - 0x22], dl
jns 0x18036880b
movsxd rcx, ecx
inc word [rsp + rax + 3]
pop rax
mov qword [rsp + rax + 0xee7e8ef], rbx
add rsi, rcx
call fcn.18033e18e
sub r8d, edx
xor eax, 0xb02bc3ba
ror eax, 1
sar dl, 0x83
sbb dword [rsp + rdx*2 - 7], 0x2e9f8c04
inc byte [rsp + rdx*2 - 3]
not eax
bswap ecx
not cx
xor eax, 0x801c00c
add qword [rsp + rdx*2 - 0xa], 0xffffffffa09409bd
dec eax
pop r10
lea r11, [r8 + rcx*2 - 0x87bac5b]
jmp 0x180377d19
xor eax, 0xc782d28f
push rbp
add r11b, 0x9b
call fcn.180336ffa

Function at 0x180331dd9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bswap r11d
lea rcx, [r8*2 - 0x79e30672]
xchg ecx, ebx
dec r11d
mov qword [rsp + r8 - 0x4e1bb088], rbp
call fcn.180379d71

Function at 0x180331e0d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor rax, rbp
ror dword [rsp + 0x16], 0x41
pop rcx
jae 0x180337028
rol bl, 1
pop r10
neg bl
dec bl
rol bl, 1
xadd r11w, cx
and byte [rsp + rdx - 0x1fd9ff1c], 0x91
adc bl, 0xb4
xor bl, cl
push rax
dec bl
neg bl
push r8
rol rax, 0x8e
bswap rdx
xor bpl, bl
inc r11w
and dword [rsp + 8], r11d
mov word [r9 - 2], bx
lea r11, [rax*4 - 0x13d11041]
inc r11b
mov rax, qword [rdi + 5]
mov qword [rsp + 0x18], r11
adc rdi, 0xd
jmp 0x18030ebf1
rol rax, 5
jmp 0x1803426c6

Function at 0x180332900
Capabilities:
Encode data using base64

Disassembly:
and r8w, ax
movsx r10d, bx
not r8w
mov qword [rsp + r11 - 0x29220bab], rbx
mov ecx, 0x4ab15205
sal ebx, cl
mov word [r9 + r11 - 0x29220ba9], r8w
sets bl
lea r8, [r11 + 0x6f2a871a]
xadd qword [rsp + r11 - 0x29220bab], rcx
mov r8d, dword [rdi + r10*4 - 0x8b88]
movzx eax, bl
lea rdi, [rdi + r11 - 0x29220ba7]
jno 0x180386027
ror cx, cl
xadd dword [rsp + r11 - 0x29220ba0], r10d
xor r8d, ebp
sal rbx, cl
and dword [rsp + r11*2 - 0x52441751], ebx
jne 0x18035cd7c
xor r8d, 0xc237c316
movzx edx, r10w
call fcn.180362868
Function at 0x180333bf1
Capabilities:
Encode data using base64

Disassembly:
shl qword [rsp + rdx], 0xc4
lea rbp, [rbx + r8*2 + 0x64884b8d]
xor dword [rsp + rdx*4 + 8], r10d
mov rbp, qword [rsp + rdx + 8]
lea rax, [rcx*8 + 0x2b0c8930]
jmp 0x18032a26b
movsxd r10, r10d
xchg qword [rsp + rdx*2], rbx
ror ebx, 0x68
adc rsi, r10
sal cx, 0x61
jne 0x18036624d
or qword [rsp + rdx], rsi
ret 8
mov qword [rsp + rcx*4 - 0x1000000], rbx
xor qword [rsp + rdx*4 + 8], rbp
jmp 0x1803216e3
call rax
mov r8d, 0x1b1a6534
mov rsp, qword [rbp + r8 - 0x1b1a6544]
movsx esi, r8b
mov rbp, qword [rbp + r8 - 0x1b1a653c]
lea r11, [r8*8 - 0x1c5be5c2]
mov qword [r8 + rbp - 0x1b1a6534], rax
mov eax, r11d
mov edi, r8d
rol r8d, 0x6f
mov r9, rbp
pop rbp
jb 0x180316ea5

Function at 0x18033449e
Capabilities:
Authenticate hmac

Disassembly:
and byte [rsp + r8*4 - 0x1ffed], cl
lea rbx, [rsp + rbx + 0x18]
mov rax, qword [rbx + r8*4 - 0x20000]
push rdx
adc r11b, r8b
mov qword [r9 + r8*4 - 0x2000a], rax
adc dword [rsp + r8 - 0x7fed], 0xc79b808d
lea r9, [r8 + r9 - 0x800a]
inc edx
sbb cx, word [rsp + r8 - 0x7fe6]
mov ebx, dword [rdi + r8*2 - 0xfffe]
not r11w
lea rdi, [rdi + r8*4 - 0x1fffa]
lea rax, [rdx + r8*4 + 0x3d0ce4bd]
xor ebx, ebp
sar cx, 0x25
jns 0x180325352
bswap ebx
sub ebx, 0xb69545a9
xchg byte [rsp + r8 - 0x7fe2], al
xor ebx, 0xb02bc3ba
or r11w, dx
xchg qword [rsp + 8], r10
adc r10, 0xfffffffffffe8986
jmp r10

Function at 0x1803391bd
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + r8*2 - 0xfdbe], r8
mov bx, word [r8 + r9 - 0x7ed7]
and dx, bx
not dx
sub qword [rsp + r8 - 0x7edf], rax
dec rax
mov word [r9 + r8 - 0x7ed7], dx
mov edx, r11d
inc ecx
movzx ebx, r11b
mov r8, qword [r9 + r8*2 - 0xfdb6]
mov cl, byte [r9 + rbx*4 - 0x36c]
adc r11, r11
shl r8, cl
sar qword [rsp + rbx - 0xdf], 0x1b
add edx, dword [rsp + rbx*2 - 0x1be]
mov qword [rbx + r9 - 0xd5], r8
jbe 0x18034f10c
sub al, byte [rsp + rbx - 0xd8]
xor dx, bx
lea r9, [r9 + rbx*8 - 0x6ee]
movzx r8d, dx
mov ebx, dword [rdi + rbx*4 - 0x37c]
lea rdi, [rdi + r8*2 - 0xfcbc]
or dword [rsp + r8 - 0x7e5f], r11d
xor ebx, ebp
add r11, rdx
dec word [rsp + r8*2 - 0xfcbe]
jg 0x180356248
ror ebx, 3
neg byte [rsp + r8*2 - 0xfcc0]
neg ebx
lea ebx, [rbx + rax - 0x55f10f0b]
xor r11, r8
neg ebx
ror ebx, 1
movzx r10d, byte [rsp + r8 - 0x7e60]
rol r8, 0x3a
sub ebx, 0x889c48bf
ror ebx, 3
jmp 0x1803277a9

Function at 0x18033b3a8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor r8w, 0x61b1
add r8w, 0x2d81
not r8w
dec r8w
ror r11d, cl
call fcn.180332e9d
call fcn.1803571e9
lea rdi, [rdi + r8*2 - 0x63185b]
jne 0x180354802
sub r11d, r8d
or cl, 0x36
xor bpl, al
call fcn.180370e88
inc r11d
xor al, bpl
bswap ecx
ror al, 1
xor edx, 0xf78dde3a
adc edx, edx
not al
inc al
add cl, 0xac
xor al, 0xbe
jmp 0x18033f30f

Function at 0x18033b3d7
Capabilities:
Encode data using base64

Disassembly:
shl r11, cl
lea r9, [rsp + rbx*2 - 0x7969ed3c]
lea r10, [rcx*8 + 0x1b8cf01c]
lea rsi, [rbx + rsi*4 + 0x47baaf0b]
not r8w
mov qword [rsp + rbx - 0x3cb4f696], r14
movsx ebp, r10w
push r8
add word [rsp + rbx - 0x3cb4f690], si
lea r13, [r9 + rbx - 0x3cb4f8ce]
call fcn.18031ce35
Function at 0x180342e46
Capabilities:
Authenticate hmac

Disassembly:
pop r10
ror edx, 1
xadd eax, r11d
bswap edx
lea r11, [r8 - 0x10facf78]
dec edx
rol edx, 3
push r11
sub edx, 0x8484ce1c
lea r10, [r8*4 + 0x4e90f034]
mov qword [rsp + r8 - 0x11204b63], rbp
shl r11, cl
xor dword [rsp + r8 - 0x11204b63], edx
sal r10d, 0x24
setb byte [rsp + r8*2 - 0x224096e6]
shl ax, 0xac
mov rbp, qword [rsp + rax*2 - 0x22409ff0]
jp 0x180386559
movsxd rdx, edx
add rsi, rdx
movzx r8d, byte [rdi + r8*2 - 0x224096e1]
movzx edx, cl
xadd r11d, ecx
lea rdi, [rcx + rdi + 6]
sal eax, 0x32
xor r8b, bpl
not dx
dec dword [rsp + rcx + 0xa]
sar r11d, 0xc2
ror r8b, 1
call fcn.18037be12

Function at 0x180346dee
Capabilities:
Encode data using base64

Disassembly:
lea rdi, [rdi + rdx*4 - 0x3e8e07fc]
rol dl, 0xc3
call fcn.180386ce3
mov rsi, qword [rsp + rdx*2 - 0x1f4703e8]
adc bx, 0x4d31
mov rdi, qword [rsp + rdx*2 - 0x1f4703e0]
mov r8d, dword [rdi + rdx*4 - 0x3e8e0800]
lea r11, [rdx*4 + 0x6aa78024]
lea rax, [r11 + rdx - 0x1842fe64]
jne 0x180321cf8
xor dword [rsp + r10 - 0x8a], ebx
shr ecx, cl
pop rbp
rol rax, 0xf3
sub cl, al
shl cx, 0xad
movsxd rbx, ebx
call fcn.180359f41
lea rsp, [rsp + 8]
jne 0x180314641
call fcn.180329f84
mov r8d, 0xda9630a0
movsx r10d, r8b
call fcn.1803151de
rol bl, 1
xor dword [rsp + rdx*2 + 2], r8d
xadd r11, rdx
neg bl
rol r8w, 0x2f
or r10b, cl
dec bl
and r8d, 0xb42470a2
jne 0x18034b448
dec ebx
mov qword [rsp], 0x23bbdbb
lea rsp, [rsp + 8]
jne 0x18035865b
mov rax, qword [rbp + riz]
push 0x18af312f
sub rsp, 0x18
jmp 0x18036b73b
sal r10b, 2
rol bl, 1
shr dword [rsp + rdx - 0xdabaa3a], 0x55
add qword [rsp + rdx*8 - 0x6d5d51d0], 0x751e02bd
or word [rsp + rdx*2 - 0x1b575470], cx
adc bl, 0xb4
xor bl, 0x1c
xchg r11w, r8w
inc qword [rsp + rdx - 0xdabaa3a]
xor ecx, 0xfd2526b8
dec bl
jmp 0x18033a760
mov eax, 0x120a3738
neg al
mov rax, qword [rbp + rbx*8]
push 0xffffffff8d1b0d86
cmp ebx, 1
jmp 0x180345a3e
push 0xffffffffc1297e07
lea rsp, [rsp + 8]
call rax
mov edx, 0xfa38294
lea rcx, [rdx + rdx*4 + 0xab2a985]
movzx r10d, cx
mov rsp, qword [rbp + rdx*2 - 0x1f470538]
push rdx
sar ecx, 0x73
mov rbp, qword [rbp + rdx - 0xfa3829c]
lea rdi, [r10 + rcx*8 + 0x74947390]
ror qword [rsp + rdx - 0xfa38294], cl
mov qword [rbp + rdx*2 - 0x1f470528], rax
push rdx
xchg dword [rsp + rdx*4 - 0x3e8e0a50], edi
and word [rsp + rdx - 0xfa38290], dx
mov r9, rbp
mov ebx, dword [rsp + rdx*2 - 0x1f470523]
mov rbp, qword [rsp + rcx - 0xb0c]
and dl, bh
je 0x18033026b
mov r11d, 0xf3349939
movzx r10d, r11b
mov ebx, dword [r10 + rdi - 0x39]
or r11w, 0xe890
neg r11b
lea rcx, [r11 + r11 + 0x2105da03]
xor ebx, ebp
not r10w
jmp 0x180344c65
Function at 0x18034820a
Capabilities:
Encode data using base64

Disassembly:
ror ebx, 8
movsxd rdx, edx
movzx eax, r10w
add rsi, rdx
call fcn.18038587b
shr cx, 0xc9
mov rbp, qword [rsp + rcx - 0x1e]
sub r11w, bx
rol r11, cl
xchg dword [rsp + rbx*2 - 0xfff], r11d
movsxd r8, r8d
movzx r10d, byte [rsp + r11 - 0xa1]
jb fcn.18036de09
adc rsi, r8
xor ax, 0x12ad
sal r10w, 0x41
jb 0x18030e14f
pop r11
pop rax
pop r10
jp fcn.180318520
mov dword [r9 + rdx*2 - 0x16f6], r10d
sal bx, 0xa9
mov edx, dword [rdi + rdx*8 - 0x5bd8]
setns r11b
lea rdi, [rdi + r11 - 0xab545fd]
xor edx, ebp
sub edx, 0xd1000022
mov ecx, ebx
movsx r8d, bx
xor edx, 0x35a1c707
bswap ebx
or r11w, cx
adc cx, 0x9c9c
inc edx
sub rcx, rbx
dec r11
rol edx, 1
movzx r10d, cx
push rbp
xor dword [rsp + rbx - 0x16b3b7], edx
rol cx, 0x4a
pop rbp
add r11w, bx
jno 0x180317e73
rol byte [rsp + r11 - 0x1d433fa], 0x45
lea ecx, [rax + rcx - 0x5c3e9e76]
movsx r10d, word [rsp + r11 - 0x1d433fb]
xor ecx, 0x31186638
mov qword [rsp + r11*4 - 0x750cff0], rbp
xor dword [rsp + r11 - 0x1d433f6], ecx
mov word [rsp + r11*8 - 0xea19fed], r11w
mov ebx, eax
mov rbp, qword [rsp + r11 - 0x1d433f6]
mov qword [rsp + r11 - 0x1d433f6], 0xffffffffb439c337
xor byte [rsp + r11*8 - 0xea19fe3], al
movzx r8d, r10w
movsxd rcx, ecx
neg r10
movsx edx, r11b
inc r11w
add rsi, rcx
mov r11d, dword [rdi + r11*4 - 0x750cff8]
call fcn.180325299

Function at 0x180348e52
Capabilities:
Encode data using base64

Disassembly:
movzx edx, byte [rdi + rcx*2 - 0x756e9b68]
movsx r10d, bl
sub ebx, ebx
xor dl, bpl
sal cl, 0x65
mov qword [rsp + rcx - 0x3ab74d80], rbx
adc dl, 0x82
call fcn.1803386fe

Function at 0x18034cb9c
Capabilities:
Encode data using base64

Disassembly:
lea r10, [rdx + rcx*2 - 0x785aa07b]
dec r8
lea rbx, [r11 + r10 + 0x400e99be]
xor r8, 0xfffffffffa3c9f94
mov qword [rsp + rdx + 0x83ae], rax
sal dl, 0x21
sets byte [rsp + rdx + 0x8360]
xor rbp, r8
or byte [rsp + rdx + 0x835c], ah
mov qword [rcx + r9 - 6], r8
neg bx
dec dword [rsp + rdx + 0x8360]
jl 0x18036f62f

Function at 0x1803521c4
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
not cl
neg ebx
inc cl
ror cl, 1
dec r8
neg cl
dec r8w
mov qword [rsp + rax*4 - 0x34c98], rax
ror r8w, 5
xor cl, r8b
push r10
sub dword [rsp + rax*2 - 0x1a64a], 0x8a294588
xor bpl, cl
xadd dl, r10b
push rdx
lea rcx, [rsp + rcx + 0x28]
mov rbx, qword [rcx + rax*2 - 0x1a64c]
call fcn.180372b11

Function at 0x18035644e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shr byte [rsp + r10 - 0xe1e36c3], 0x24
lea r11d, [r11 + rcx - 0x75231a7e]
inc r8w
shr dl, 0x61
sar byte [rsp + r10 - 0xe1e36cd], 0x21
rol r11d, 1
shl qword [rsp + r8 - 0xe1e0f12], cl
push rax
and qword [rsp + r10*8 - 0x70f1b6fa], r10
or qword [rsp + r10*8 - 0x70f1b6f0], rbp
ror r8d, cl
movsx ebp, byte [rsp + r10 - 0xe1e36e0]
xor dword [rsp + rcx*4 - 0x1cc], r11d
mov rbp, qword [rsp + r10 - 0xe1e36c2]
movsxd r11, r11d
call fcn.180351fb1
mov ecx, 0xc428f02f
mov r8d, dword [rdi]
add rdi, 4
Function at 0x18035b8c4
Capabilities:
Parse pe header

Disassembly:
lea rdi, [rdi + r8 - 0x1a]
jge 0x180374a26
mov qword [r9 + r10*4], rax
call fcn.18036b93b
jmp 0x18037961c
lea r9, [rax + r9 - 0x35]
mov word [r9 + rax*4 - 0xcc], r8w
xor r10b, 0xb
jae 0x18034fee3
mov ecx, 0x3ab74db4
lea rbx, [rcx*2 - 0x6ed73f5d]
call fcn.180348e52
mov r8d, 0x1bbd6a07
mov rdx, qword [r9 + r8*2 - 0x377ad40e]
movsx r10d, r8w
mov r11w, word [r9 + r8*2 - 0x377ad406]
lea rax, [r10 + r8*2 + 0x5f33fe32]
lea r9, [r9 + r8*2 - 0x377ad404]
shr eax, 0xc7
mov word ss:[r8 + rdx - 0x1bbd6a07], r11w
mov r8d, dword [rdi + r8*2 - 0x377ad40e]
ror ax, 0x48
lea rdi, [rdi + r10*4 - 0x1a818]
sub r10d, 0x1d05450a
xor r8d, ebp
lea r11, [r10 + r10 + 0x2b249d2e]
lea rcx, [r11 + r11*8 - 0x4e53784f]
neg r8d
rol r8d, 1
call fcn.180311d83
sal cl, 0xa5
xor r10d, 0x92929f36
xchg word [rsp + r11*2 - 0x1c63ea72], cx
rol r10d, 2
jmp 0x180384479
or r11b, 0x9b
add dword [rsp + r11 - 0xe31f5b0], eax
bswap r10d
je 0x18036d437
sal cl, 0x44
mov qword [rsp + r11 - 0xe31f5a3], rbp
movzx edx, byte [rsp + r11 - 0xe31f5ba]
xor dword [rsp + r11 - 0xe31f5a3], r10d
rol word [rsp + r11*4 - 0x38c7d6e9], 0x6d
mov rbp, qword [rsp + r11*8 - 0x718fadc0]
rol dx, 0x6c
movsxd r10, r10d
movzx ebx, al
mov dword [rsp + r11*4 - 0x38c7d6db], 0xd18add35
jb 0x18037eea5
movzx r8d, word [r11 + rdi + 5]
shr r11w, 0xee
movzx ebx, byte [rsp + r11 + 7]
lea rdi, [rdi + r11 + 7]
sbb r11b, bl
xor r8w, bp
call fcn.18037c521
sar r10, 0xc7
inc bx
ror bx, 1
mov qword [rsp + r10*4 - 0x21e90000], 0x1988de97
shr qword [rsp + r10 - 0x87a4000], 0x97
mov eax, 0xa4394902
sbb bx, 0xa80e
not bx
mov r11d, eax
pop rax
not r10d
xor bp, bx
shl r8w, 0x6e
sal r8b, 4
adc rbx, rsp
shl r11d, 0x38
inc r10b
mov r8w, word [rbx + r8*2 - 0x40bf0000]
rol r10b, 0x63
movzx ecx, r10b
je 0x18033692f
lea r9, [r9 + r10*4 - 0x306cc]
jp 0x180326b08
mov r10d, 0x12e9212
mov dx, word [r9 + r10*8 - 0x9749090]
movzx ebx, byte [rdi + r10 - 0x12e9212]
mov r8d, r10d
xor bl, bpl
add bl, 0xb5
ror bl, 1
jmp 0x1803132d2
xor bl, bpl
ror word [rsp + r11*2 - 0x718fadc7], 0x6a
xadd r11, rcx
neg bl
sal cl, 0x82
mov qword [rsp + r11 + 0x18cc28ec], r11
mov r10d, edx
inc bl
pop r11
lea r11, [r11 + r8 + 0x3b95a9ad]
xor bl, 0x31
call fcn.18033950b
dec rax
lea r8, [rdx + rbx - 0x6175385f]
push rcx
xor rax, 0xfffffffffa3c9f94
shr bx, 0xa8
xor rbp, rax
shr r10d, 0xbf
sete r8b
jae 0x1803299af
movsxd rcx, ecx
or ebx, 0x3a3240a2
sbb qword [rsp + 3], rdx
adc rsi, rcx
dec dx
pop r10
pop r8
jmp rsi
add rsi, r10
dec r8w
mov rax, qword [r11 + r9 - 0xe31f5ab]
rol r11d, 0x82
neg cx
lea r9, [r11 + r9 - 0x38c7d6d4]
mov bl, byte [rdi + r11 - 0x38c7d6e7]
sbb dword [rsp + r8 - 0x1f], 0xbb3e183a
and r8w, 0x6dba
jae 0x1803199ff
add bx, r11w
lea rdi, [rdi + r11 - 0x1ffff57]
movzx edx, r10b
movsx ecx, dl
add qword [rsp + r11 - 0x1ffff4d], rbx
xor r8w, bp
xor r8w, 0x61b1
call fcn.18037714d
adc rsi, rbx
jmp 0x180340e01
rol qword [rsp + r8 - 0xa], 0x5b
lea r10d, [r10 + r11*8 + 0x64a3b167]
jae 0x1803390d7
Function at 0x18035e9f4
Capabilities:
Parse pe header

Disassembly:
movzx eax, dx
mov edx, dword [r8 + rdi - 0x551a55aa]
or rax, 0x43b8ed83
lea rdi, [rdi + r8 - 0x551a55a6]
mov qword [rsp + rax - 0x43b8fdab], rax
movsx r11d, byte [rsp + rax - 0x43b8fda9]
sar dword [rsp + r8 - 0x551a55a7], 0x63
xor edx, ebp
shr rax, 0xf8
sbb qword [rsp + r8 - 0x551a55aa], r11
xor edx, 0xc237c316
shr dword [rsp + r8 - 0x551a55a7], 0xa3
call fcn.180355224
mov r10d, dword [rsp + 2]
bswap eax
rol r10w, 0xeb
adc qword [rsp + r10*4 - 0x14090], r10
and byte [rsp + r10*2 - 0xa048], r10b
xor eax, 0x5b21353c
sub byte [rsp + r10 - 0x5024], 0x14
sub byte [rsp + r10 - 0x5020], 0x3c
inc eax
movzx r11d, word [rsp + r10 - 0x5022]
xor r11d, 0x301b8a0e
not eax
lea r8, [r11*4 + 0x828c1bc]
not r11
mov qword [rsp + r10*4 - 0x14090], rbp
call fcn.18034fb65

Function at 0x18036767d
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mov bl, byte [rdi + r8*4 - 0x1407fb]
lea rdi, [rdi + r8*8 - 0x280ffa]
lea rdx, [r8*8 + 0x7ab3448c]
xor r8w, r11w
xadd dl, r11b
xor bl, bpl
mov qword [rsp + r8*4 - 0x17e0e8], r8
lea rcx, [rax*2 + 0x64847d1c]
add bl, 0x82
rol bl, 1
not dl
neg bl
add byte [rsp + r8*8 - 0x2fc1c8], r8b
mov r10d, r11d
bswap r8
dec bl
or qword [rsp + r10 - 0x61a8fa84], r10
ror dl, 0x62
push r10
rol bl, 1
sub byte [rsp + rcx*2 + 0x4dbd7005], ah
xadd r11b, r10b
lea rax, [r11*2 + 0x243b4028]
add bl, 0xb4
ror r11w, 0xa1
shr dword [rsp + rcx*2 + 0x4dbd7012], cl
inc al
xor bl, 0x1c
add eax, eax
rol r8b, 0x61
dec bl
dec qword [rsp + rdx - 0x7adb5446]
jns 0x180372dc2
Function at 0x180367715
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
ror dl, 1
neg dl
sub r8b, 0x12
not dl
xor bpl, dl
add rdx, rsp
sub r10b, bl
mov rcx, qword [rdx + rbx - 0x4fa25100]
ror rax, 0xec
and r10d, 0xb9a10b3d
not r10
mov qword [r11 + r9 - 0x610077d8], rcx
push r8
lea r9, [r8 + r9 + 0xd]
pop r8
jp fcn.180318520
mov ebx, 0x838b3500
mov edx, dword [rdi]
sal bx, 0xa8
add rdi, 4
or ebx, 0xd6ae45ab
adc bx, 0x921c
or bx, bx
xor edx, ebp
inc bx
call fcn.18037ca24
mov edx, 0x7204c0ac
mov edx, dword [rdi + r10*4 - 0x1f8]
lea rdi, [r10 + rdi - 0x74]
mov qword [rsp + r10 - 0x70], rax
and byte [rsp + r10 - 0x77], 0x1c
add byte [rsp + r10*8 - 0x3ea], cl
xor edx, ebp
push rax
shr r10, cl
bswap edx
call fcn.18030d374
or bx, dx
sar r11d, 0xc5
mov word [r9 + r10*8 + 4], bx
movsx eax, cx
lea r9, [r10 + r9 + 4]
call fcn.180368110
mov dword [rdx + r11 - 0x24c301a], ecx
xadd byte [rsp + r11 - 0x24c300b], r11b
movzx edx, ax
mov qword [rsp + r11 - 0x24c3000], rsi
ret 0x10
inc r8b
bswap rax
bswap eax
neg cl
xor r8b, 0xbe
xor bpl, r8b
neg r10b
call fcn.180334698
sbb r10d, 0x8484ce1c
inc r8
mov qword [rsp + rbx - 0x6b812f7a], rbp
mov qword [rsp + rbx - 0x6b812f82], rax
sal qword [rsp + rbx - 0x6b812f82], 0xb0
xor dword [rsp + rbx - 0x6b812f7a], r10d
sar dword [rsp + rbx - 0x6b812f7f], 0x44
ja 0x18037a37d
mov qword [rsp + r10 - 0x17f8], rax
rol r8, 5
or r10w, r10w
not r8
jns 0x18033af87
rol dl, 1
add al, byte [rsp + rbx - 0x3efa]
neg dl
lea r10, [rax + 0x6b18d337]
shl rax, 0x56
inc dl
sal qword [rsp + rbx*8 - 0x1f810], 0x10
jns 0x1803397c7
add dl, r8b
movsx eax, bx
not ax
xor bpl, dl
lea rdx, [rsp + rdx + 0x10]
push rbx
jmp 0x18034a5e7
lea rdi, [rdi + rbx - 0x61008942]
and bx, bx
xor dl, bpl
sar r11, cl
inc rcx
or rcx, rbx
neg dl
add dl, 1
xor bx, 0xfe95
shl r11d, 7
not dl
xchg r11d, ebx
not r8
inc dl
ror cx, 0x29
shl bl, 0x85
jp 0x180331475
mov word [rsp + rbx - 0x6b812f82], dx
mov rbp, qword [rsp + rbx - 0x6b812f7a]
mov qword [rsp + rbx - 0x6b812f7a], r11
push rcx
movsxd r10, r10d
adc rsi, r10
shl dx, cl
and r8b, byte [rsp + rbx - 0x6b812f74]
xadd r11, rax
movzx r8d, byte [rdi + rbx - 0x6b812f82]
seto byte [rsp + rbx - 0x6b812f72]
lea rdi, [rdi + rbx - 0x6b812f81]
movsx r10d, byte [rsp + rbx - 0x6b812f7d]
xor r8b, bpl
inc r11w
ror r8b, 1
add r11d, 0xef23560b
not r8b
jbe 0x18034e570
sar r11, 0xec
inc r10d
inc ebx
neg r10d
movzx r8d, r11b
lea rax, [rcx*4 - 0x22c45ece]
push rax
inc r10d
rol r10d, 1
shl ebx, cl
sbb word [rsp + r11*8 + 3], cx
mov qword [rsp + rbx - 0x61000000], rbp
sar dx, 4
xor dword [rsp + rbx - 0x61000000], r10d
xadd cx, dx
ror ecx, 0xaf
ror r8, cl
pop rbp
add ax, 0x6db5
add dl, r8b
movsxd r10, r10d
adc rsi, r10
movzx r10d, al
dec edx
xadd rax, r11
movzx edx, byte [rdi + rbx - 0x60fffffc]
xadd r11w, bx
jno 0x1803718c0

Function at 0x18036ca36
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rcx - 0x91f8], rdx
xor dword [rsp + r11 - 0x5336e2a3], r10d
call fcn.18037f4df
movsx eax, r8w
neg cl
add cl, 0x1d
not cl
xor bpl, cl
mov r11d, 0x27a9bb84
mov r10d, dword [rsp + rax - 0x4b9c]
lea rcx, [rsp + rcx + 8]
call fcn.18033a0d0
Function at 0x18036ec77
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rbp, [rbx*4 - 0x476ec6dd]
mov rbp, qword [rsp + rbx*4 + 8]
sal rbx, 0xfd
call fcn.180375016

Function at 0x18036ec8d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shr bx, 0x61
movsxd rax, eax
lea r11, [rdx + r10*2 + 0x7808e02]
adc rsi, rax
call fcn.180316875
neg r8w
jg 0x18038417b
xor cl, r11b
shl r8b, 0x64
call fcn.180371e74
mov qword [rsp + rbx - 0x54198601], rbp
xadd edx, ebx
xor rdx, rbx
xor dword [rsp + rbx - 0x582c48e], eax
pop rbp
inc edx
jns 0x18034f523
mov qword [rsp + rax - 0x5180], rsi
ret

Function at 0x180377653
Capabilities:
Authenticate hmac

Disassembly:
mov r11d, r8d
xor bp, r10w
sar r11d, 0xdb
jbe 0x180339757
not r11b
shr bl, 4
movsx r8d, word [rsp + rcx*2 + 2]
sbb bl, 0xbb
rol r11b, 1
neg r11b
inc r11b
xchg byte [rsp + rcx*4 + 1], r8b
call fcn.18034f986
lea rax, [r8 + rdx*4 - 0x25e223fe]
dec r10w
jmp 0x1803252df
not cx
inc dx
add cx, 0x9c32
lea rdx, [rbx*2 - 0x16f7e059]
neg eax
lea r8, [rax*4 - 0x5d45cffa]
xor cx, 0x48b7
neg r8d
mov qword [rsp + rdx + 0x16f7dfdf], rax
neg cx
and dl, 5
ror cx, 1
sub bx, dx
xor bp, cx
call fcn.1803875a1
mov r10d, 0x5e0c5da9
movzx ecx, r10b
mov r10d, dword [r10 + r9 - 0x5e0c5da9]
lea rbx, [rcx + rcx*2 + 0x363f7498]
movzx r11d, byte [rdi + rcx - 0xa9]
push rcx
xor r11b, bpl
dec bx
dec r11b
shr rcx, 0xd1
jae 0x180355d4a
Function at 0x18037a34c
Capabilities:
Parse pe header

Disassembly:
pop rcx
pop r8
pop rax
jnp fcn.180318520
movsxd r8, r8d
bswap r11d
adc rsi, r8
movzx ebx, byte [rdi + rbx - 0x2bd70202]
lea rdi, [rdx + rdi - 0x95e4]
jmp 0x18031cc17
mov qword [rsp + rdx*4 - 0x2579c], 0x7297b20c
or dword [rsp + rdx - 0x95e3], 0x4da5dbaa
xor bl, bpl
dec bl
dec word [rsp + rdx - 0x95e8]
not bl
xor eax, eax
dec bl
neg bl
xadd dword [rsp + rdx*4 - 0x25798], ecx
xor bpl, bl
mov word [rsp + rcx + 7], 0x4023
lea rbx, [rsp + rbx + 0x10]
sub eax, 0x7f1e8baa
mov r8d, dword [rbx + rdx - 0x95e9]
call fcn.1803341fe
lea rdx, [rax - 0x5bcba3cc]
mov qword [r9 + rax*2 - 0x14c], r11
lea r9, [r9 + rax*4 - 0x2a6]
xor dx, word [rsp + rax*2 - 0x153]
lea r11, [r8 + rax*8 - 0x15644471]
neg rax
mov qword [rsp + rax + 0xad], rsi
ret 8
call fcn.18035addd
pop r8
not rbx
add r11b, 6
dec dword [rsp + rax*2 - 0x34503421]
push rdx
dec rbx
lea rcx, [r11 - 0x7f591be2]
xor rbx, 0xfffffffffa3c9f94
or byte [rsp + rax*2 - 0x34503405], ah
and r11w, r8w
inc ax
xor rbp, rbx
xor r11, qword [r9 + rax - 0x1a281a1a]
push rdx
pop rdx
add rbx, r11
xchg qword [rsp + 8], r8
add r8, 0x20787
jmp r8
lea rax, [rcx + r10 + 0x42995428]
xor r8d, 0x16a1b7a1
movsx edx, ax
mov qword [rsp + rdx - 0x6786], rbp
shl al, 0x61
lea rbp, [r10 + r11*8 + 0x3014fead]
xor dword [rsp + rdx*4 - 0x19e18], r8d
pop rbp
shr r10b, 0x61
inc r10w
xor rcx, r10
movsxd r8, r8d
jnp 0x18034856a
xor dword [rsp + r11 + 0xf], ecx
mov rbp, qword [rsp + r11 + 0xf]
movsxd rcx, ecx
mov qword [rsp + r11 + 7], rdx
add rsi, rcx
mov r8w, word [r9 + r11 + 0xd]
inc dx
mov r10w, word [r9 + r11 + 0xf]
movsx ecx, dl
jle 0x18031f24e
or r11, r10
xor r8d, ebp
xchg r11d, r10d
dec r8d
mov ecx, 0x9124cb2a
bswap r8d
push r11
dec r8d
dec rcx
jne 0x180326994
dec byte [rsp + r11*8 - 0x41ffa]
mov qword [rsp + r11 - 0x83f8], rbp
xor dword [rsp + rax - 0x538be43f], edx
mov r10d, dword [rsp + r11 - 0x83fd]
shr byte [rsp + r11 - 0x83fb], 0x41
neg r8d
mov rbp, qword [rsp + r11 - 0x83f8]
and r10b, 0xb8
jp 0x18036569f
add rdi, 4
jmp 0x18033cd8a
movsxd rdx, edx
or rcx, rcx
adc rsi, rdx
mov r11d, dword [r9 + r11*2 - 0x107fc]
inc rbx
mov ebx, dword [rax + r9 - 0x538be43f]
mov qword [rsp + rax - 0x538be43f], 0xffffffff8299debb
jne 0x180377030
mov ebx, r11d
movsx ecx, r11b
movzx ebx, byte [rdi + r11*2 - 0x1f14a644]
lea rdi, [rdi + r11*2 - 0x1f14a643]
sbb dx, 0xab14
xor bl, bpl
xchg word [rsp + r11 - 0xf8a530a], cx
call fcn.18034d2fe
mov r8d, dword [rdi]
jmp 0x18035ecbd
inc r10b
add r11d, ebx
mov dword [rsp + rax - 0x538be43e], r10d
pop rax
add word [rsp + rcx*2 - 0x6085bca6], cx
mov dword [r9 + rcx*2 - 0x6085bca2], r11d
movsx edx, cx
jg 0x18030c786
jno 0x18037f7c1
sal ebx, cl
movsx r10d, dl
mov dword [r9 + r11*2 + 2], ebx
sar dword [rsp + r11 + 0xe], 0x52
pop rbx
mov r10d, dword [r11 + r9 + 2]
mov qword [rsp + r11*2 + 0x20], r8
xor r11, 0xf8a5324
lea r9, [r9 + r11*2 - 0x1f14a642]
jne 0x180368a57
lea r9, [r9 + rcx - 0x3042de4d]
mov qword [rsp + rcx*2 - 0x6085bcaa], rsi
ret
Function at 0x1803875f6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r8d, [r8 + rax - 0x7855ee11]
sub rax, rbx
jbe 0x180368c17
movsx ebx, cx
xor r8d, ebp
jmp 0x18037fecb
mov eax, ebx
neg r8d
jmp 0x18035014d
mov word [r9 + rdx*2 - 0x442], r10w
neg dword [rsp + rdx - 0x213]
lea r9, [rdx + r9 - 0x224]
jg 0x1803564be
pop r10
pop rax
pop r8
pop r10
jno fcn.180318520
call fcn.18032e3ec