joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180ed9a6f
Capabilities:
Authenticate hmac

Disassembly:
and dx, 0x3f98
sbb dil, 0xa
neg r10w
jns 0x180eb64fa
mov r9d, 0x8105eaa5
movzx r10d, r9w
mov r10, rbx
mov qword [rbx + riz - 8], r10
movsx edi, r9w
lea r9, [r9 + 0x3790352b]
movzx r10d, byte [rsi + riz - 1]
mov eax, r9d
mov ecx, 0x3b1d20a4
xor r10b, r11b
shr rcx, cl
add r9d, eax
sbb r10b, 0x19
shl ax, 0x29
not r10b
inc r9
div r9b
sub r10b, 0x2f
neg r10b
or r9, rax
xor r11b, r10b
mov ebp, edi
add r10, rsp
xadd dil, al
add di, 0x9d8d
mov edx, dword [rcx + r10]
movzx r10d, ax
mov dword [rbx + rcx - 0xc], edx
lea r10, [rax + r10*4 - 0x35f09bee]
inc bp
lea rbx, [rcx + rbx - 0xc]
mov edx, dword [rsi + rcx - 5]
and edi, ebp
shl bp, 0x21
lea rsi, [rsi + rcx*8 - 5]
call fcn.180ebab75
lea rcx, [rcx + r9*2 + 0x24157086]
bswap edi
rol bp, 0x63
lea edi, [rbp + rdi - 0x75aadcbe]
mov qword [rsp + r10*4 - 0x3ec], r11
mov qword [rsp + rbp - 0x63818d25], rax
xor qword [rsp + rbp - 0x63818d25], rdx
xor dword [rsp + rbp - 0x63818d1d], edi
mov r11, qword [rsp + r10*4 - 0x3ec]
cwd
mov qword [rsp + rbp - 0x63818d1d], 0xffffffffceb48285
neg cl
movsxd rdi, edi
ror r9b, 0xa4
adc r8, rdi
not eax
mov r9, qword [rbx + rax - 0x2685e20b]
lea rbx, [rbp + rbx - 0x63818d21]
rol cl, 0xe5
movzx edi, byte [rbp + rsi - 0x63818d2b]
shr r10, 0xa8
lea rsi, [rsi + rax*2 - 0x4d0bc414]
xor dil, r11b
not edx
lea rbp, [rbp + r10 + 0x3890be8b]
cwd
xor dil, 0x99
sub dil, 0xbb
not bpl
ror dil, 1
shr cl, 0x24
add dword [rsp + rax*2 - 0x4d0bc404], 0x20842618
sub dil, dl
xor dword [rsp + r10*8 + 2], r10d
sar ebp, 0xc
rol dil, 1
shr r10w, 0xca
sbb dil, dl
lea r10, [rbp + rbp*4 - 0x4a6b267b]
pop rax
sub dword [rsp + 2], 0x7e373184
xor dil, 0x8b
ror r10, 0xb
jb 0x180e78681
mov ecx, dword [rsi - 4]
jmp 0x180ea0232

Function at 0x180eda89f
Capabilities:
Authenticate hmac

Disassembly:
xor rcx, 0x839b137
mov qword [rsp + rbp - 0x6bb82f00], 0x15a6af26
lea rax, [rdx + rdi*2 + 0x15235cbc]
xor r11, rcx
xadd r9w, bp
cdqe
mov qword [rbp + rbx - 0x6bb8fff8], rcx
sub rax, rax
btr eax, eax
lea rbx, [rdx + rbx + 0x797c41c6]
cdq
adc edx, dword [rdi + rsi - 0x1c]
ror r9w, 0x8a
xor edx, r11d
sub rdi, rax
sets bpl
lea edx, [rdx + rdi*8 + 0x5e19e803]
movsx ecx, di
cmovno di, ax
shl r9d, 0x77
rol edx, 1
shr cx, 4
rol rcx, cl
inc edx
btr eax, 1
rol edx, 1
movzx r10d, dil
neg ax
setb al
lea edx, [rdx + rbp*2 - 0x27edbf65]
and rax, qword [rsp + rbp - 0x6bb8fef9]
mov qword [rsp + r9 - 0x57ffff8], r11
xor dword [rsp + rbp - 0x6bb8fef8], edx
mov r11d, dword [rsp + rbp - 0x6bb8fefc]
mov r11, qword [rsp + rdi*2 + 8]
cwde
movsxd rdx, edx
rol qword [rsp + rbp - 0x6bb8ff00], 0xef
add r8, rdx
cbw
movzx ebp, byte [rsi + rdi - 0xd]
or ax, 0xd43d
xor bpl, r11b
movsx edx, word [rsp + rdi*4 + 3]
push rdx
jmp 0x180ecf0b2
Function at 0x180edb6eb
Capabilities:
Authenticate hmac

Disassembly:
lea rbp, [rax + rbp - 0x165fd943]
movsxd r9, r9d
push rdx
add r8, r9
lea rbp, [rdx + rdx*4 - 0x68f09edf]
neg dl
call fcn.180ec2fe3
mov r9d, 0xb31e1103
lea rax, [r9 + r9*2 + 0x17b6d828]
movzx edx, byte [rsi + riz - 1]
xor dl, r11b
lea rdi, [r9 + r9*2 - 0x61e7a6fd]
sub dl, 0x1a
mov ecx, 0x82913e
not dl
lea rcx, [rcx*4 + 0x3eaaee0c]
mov r10d, r9d
sub dl, 0x2f
movzx ebp, r10w
neg dl
shr cx, cl
xor r11b, dl
sal edi, cl
adc rdx, rsp
mov eax, dword [rdx + rbp*2 - 0x2206]
not r9
movzx edx, di
mov r9d, eax
mov edi, dword [rbx + rbp*2 - 0x2206]
inc cl
bts r10, rdx
shl bp, 0xc2
adc r9d, edi
mov dword [rbx + rbp*2 - 0x8818], r9d
push rdx
mov ecx, dword [rsi + rbp*8 - 0x22065]
lea rax, [rbp*2 + 0x6f80e494]
lea rdi, [rbp*2 - 0x46ff1b70]
rol r10d, 0x44
lea rsi, [rsi + r10*2 - 0x63c2207b]
xor ecx, r11d
inc ecx
xchg edi, eax
not ecx
xor ecx, 0x7710ccbd
inc ecx
not ecx
sal r10w, 0x8e
adc al, 0x9f
shr edx, 3
dec ecx
call fcn.180efea6b
xor r10d, 0x8c85da8e
neg ecx
mov qword [rsp + r9*2], 0xffffffffc015fca0
and word [rsp + rcx - 0x63], 0xee38
neg r10d
or byte [rsp + r9 + 3], cl
lea r10d, [r10 + rbp*2 + 0x337d6e21]
neg qword [rsp + r9]
shl byte [rsp + r9 + 5], 0xa1
not r10d
jb 0x180e6ee74
xchg word [rsp + r9 + 5], cx
inc r10d
shr edi, 0x5d
shl rdx, 0xdd
mov qword [rsp + r9], r11
sub ecx, 0x449a2d35
xor dword [rsp + rbp - 0x63952db1], r10d
shr rdx, 0x7e
pop r11
bts rdi, rdi
bt rcx, rcx
mul cl
movsxd r10, r10d
dec r9d
imul bp, bp
call fcn.180e7e6a3
sub rsi, 4
mov eax, 0x349ebb87
mov r9d, dword [rsi + rax*2 - 0x693d770e]
lea rdx, [rax + rax*8 - 0x3d49587b]
xor r9d, r11d
xor r9d, 0xd11a6e10
dec edx
lea r9d, [rax + r9 - 0x7548f32c]
mov ebp, edx
rol r9d, 3
bt rax, 0x37
xor r9d, 0x1a3a0a35
neg edx
push r11
lea rax, [rax + 0x5b2c7090]
xor dword [rsp + rdx - 0x63b4c0bd], r9d
movsx r11d, bp
inc r11w
setl bpl
pop r11
mul ebp
jb 0x180ea0a23

Function at 0x180edf600
Capabilities:
Authenticate hmac

Disassembly:
mov r11, qword [rsp + rcx - 0x2b130c74]
cbw
movsxd rbp, ebp
sub cx, ax
shr cl, 0x82
adc r8, rbp
xor r10b, byte [rdx + rsi - 5]
mov qword [rsp + rcx - 0x2b130c1f], 0x570e3f88
mov qword [rsp + rcx - 0x2b130c17], r9
xor r10b, r11b
pop rdx
shr word [rsp + rdx - 0x570e3f85], 0xa
shr rax, cl
adc r10b, 0xa3
not r10b
sub cl, r9b
imul rdi, qword [rsp + rcx - 0x2b130c62]
rol r10b, 1
btc ax, 0
xor r10b, 0x14
bswap rdx
lea rbp, [rcx + rcx*8 - 0x1568c5c8]
xor r11b, r10b
lea rdx, [rbp + rax*4 + 0x40b38802]
sal eax, cl
sub edx, 0xa2a1d284
lea r10, [rsp + r10 + 8]
mov rax, qword [r10 + rax*2 - 0x1a6eaf70]
add edx, r9d
btc ecx, edx
sar dword [rsp + rcx - 0xb130c61], cl
mov qword [rcx + rbx - 0xb130c6a], rax
sar ebp, 0xe1
sal rcx, cl
movzx r9d, byte [rsi + rdx*2 - 0x33178d40]
add word [rsp + rdx - 0x198bc697], 0xd6a1
lea rsi, [rdx + rsi - 0x198bc6a3]
push rdx
jne 0x180eed0db
xor r9b, r11b
add cx, di
call fcn.180e86909
Function at 0x180edfb88
Capabilities:
Encode data using base64

Disassembly:
movsx edx, r9w
lea rsi, [rdx + rsi - 0xe3e]
xor eax, r11d
mov ebp, ecx
lea eax, [rcx + rax - 0x4c6ecd03]
mov qword [rsp + rdx*2 - 0x1c74], rbp
bswap eax
bt bp, bp
mov r10d, 0x23898b9d
ror eax, 3
ror word [rsp + rdx - 0xe3a], 0xb
shr ecx, 0xf6
pop rcx
not eax
dec eax
lea rbp, [r10 + rbp - 0x3bed99fc]
ror eax, cl
neg eax
bswap eax
dec dx
dec r9
ror eax, cl
movzx edi, r10b
call fcn.180eca5bd
mov edi, 0xdd3ae32a
mov edx, 0x5e1a51b9

Function at 0x180ee0221
Capabilities:
Authenticate hmac

Disassembly:
shr r10, cl
xor rdi, 0xffffffffde837999
dec cl
rol rdi, 4
lea rbp, [rdx + rcx - 0x12f25afa]
mov qword [rsp + r10], 0x77860d07
movsx eax, r10b
xor r11, rdi
movsx r9d, r10w
call fcn.180e7aaa3
add dx, 0x539e
xor rdi, r11
movzx ecx, r10b
imul r10w, r10w
not rdi
jb 0x180ef5775
rol dword [rsp + r10 - 0x3f0], 0x62
lea rdi, [rdi + r10 - 0x55b66635]
jae 0x180ed179e
not r9d
bt rax, 0xa4
sar al, 0x81
lea r9d, [r9 + rdi - 0x74859d92]
cmovae cx, dx
inc bp
xchg bpl, al
xor r9d, 0x80842a2c
bt ax, di
push r11
mul rdx
xor dword [rsp + rdx], r9d
btc rdx, rax
movsx r11d, dil
pop r11
ror dl, 5
movsxd r9, r9d
shl ebp, 0xc6
idiv ebp
add r8, r9
cwde
mov ecx, dword [rbx + rdx*2 - 0x15e8134c]
mov r10d, dword [rbx + rdx - 0xaf409a0]
rol di, 0x2b
movsx r9d, bpl
not ecx
add rbp, 0x150dcda1
jge 0x180e6ed13

Function at 0x180ee11ad
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r10 - 0x6a006cf5], r11
mov dword [rsp + rcx + 0x5ed28359], 0x58a037b2
xor dword [rsp + rax - 0x6cf5], edi
xor rax, rax
mov r11d, 0x6aa61c31

Function at 0x180ee265e
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + rax - 0x24], rdx
xor r9b, r11b
mul dx
rol r9b, 1
imul byte [rsp + rax - 0xdef2]
imul edi
sbb r9b, 0xa
shr bp, 0xc8
neg r9b
bswap eax
sub r9b, 0xc
sar edi, 0x66
dec dword [rsp + rdx - 0x3432]
xor r11b, r9b
lea r9, [rsp + r9 + 8]
cdqe
mov qword [rdx + r9 - 0x3435], r10
cbw
push rdi
mov edx, dword [rdx + rbx - 0x342d]
mov ecx, dword [rbx + rdi*2 - 0x1a47232]
add word [rsp + rdi*2 - 0x1a47232], di
push rax
movsx r9d, al
adc edx, ecx
mov dword [rbx + rdi - 0xd23913], edx
lea rbx, [rdi + rbx - 0xd23913]
sub di, r9w
jns 0x180e6fdc7

Function at 0x180ee38f6
Capabilities:
Authenticate hmac

Disassembly:
movzx eax, r9b
movzx r9d, byte [rsi + rax*8 - 0x735]
lea rsi, [rax + rsi - 0xeb]
add rdi, 0xffffffffdc356c11
lea rbp, [rdi + rdi*8 + 0x300ec6be]
xor r9b, r11b
inc di
call fcn.180e99d9b
Function at 0x180eeb8b2
Capabilities:
Authenticate hmac

Disassembly:
push 0xfffffffff22c6133
add ecx, 0x63bd9e01
bswap ecx
sar qword [rsp + 0x20], 2
jbe 0x180ec31c5
mov r10d, 0x6a9f9b0
mov cx, word [rbx + r10*8 - 0x354fcd80]
lea rax, [r10 + r10*8 - 0x3d69b4d]
movzx edx, byte [rsi + r10 - 0x6a9f9b1]
bswap r10d
xor dl, r11b
imul rax, r10
movzx edi, r10b
inc dl
not edi
not dl
rol di, 0x89
movsx r9d, al
mov ebp, eax
adc dl, 0x2b
lea r10, [rdi + r10 - 0x71d24bcf]
xor dl, dil
xor r11b, dl
rol al, 0x21
adc rdx, rsp
sal rbp, 0x62
sal r9w, 0x46
sal bp, 0x4c
mov byte [rdx + r9*2 - 0x2900], cl
sar r9, 0x54
mov edx, r10d
shr rbp, 0x12
mov rax, qword [rbx + r9*4 + 2]
shl di, 7
movzx edx, byte [rsi + r9*4 - 2]
sar bpl, 0x67
bts edi, ebp
add ebp, edi
xor dl, r11b
rol dl, 1
lea rcx, [r10*2 - 0x58490363]
call fcn.180ee0483
bswap ecx
jmp 0x180eb48f1

Function at 0x180eeb983
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
sub al, cl
neg al
sub al, 0xc
xor r11b, al
imul ecx, edx
mov r9d, 0x1106692f
mov qword [rsp + rbp - 0x6c22f4ba], 0x652d05ac
lea rax, [rsp + rax + 8]
sar bpl, 0xa7
ror r9w, 0xd
inc qword [rsp + rcx - 0x58459a79]
mov qword [rbp + rax - 0x6c22f4ff], rdi
xor dword [rsp + rbp - 0x6c22f4fb], r10d
mov edi, dword [rbp + rsi - 0x6c22f504]
sbb rcx, qword [rsp + rdx - 0xb]
jl 0x180ea042a
call fcn.180e6d3d4
mov ebp, 0xa2b75032
lea rax, [rbp*4 - 0x136cb04f]
movzx r10d, byte [rsi + riz - 1]
rol rbp, 0x4c
mov ecx, ebp
lea rcx, [rax - 0x459bfdf]
xor r10b, r11b
add r10b, 0x8f
btr cx, ax
mov r9d, eax
neg r10b
ror r10b, 1
and ax, ax
lea rax, [r9*4 + 0x71baa30d]
not r10b
setne bpl
setnp cl
xor r11b, r10b
lea rdi, [rcx + rcx*4 + 0x18a79280]
not al
not cx
mov word [r9 + rbx - 0x7770907b], r10w
mov r9d, dword [r9 + rsi - 0x7770907e]
mul bpl
mov r10d, 0xc7801eaf
xor r9d, r11d
or eax, ecx
xor eax, 0x54320b16
div cl
rol r9d, 1
cqo
xadd ebp, edi
inc r9d
ror r9d, 3
not rcx
not eax
inc r9d
not r9d
dec edx
push r11
xor dword [rsp + rdi - 0x75032001], r9d
dec ebp
mov r11d, edi
pop r11
movsxd r9, r9d
cqo
setl cl
shr bpl, cl
add r8, r9
call fcn.180e90a37

Function at 0x180eec764
Capabilities:
Encode data using base64

Disassembly:
bswap ebp
mov qword [rsp + r9 - 0xec], r9
add r9, rcx
ror ebp, 3
movzx edx, word [rsp + r9 - 0x198]
movzx r10d, cx
bswap ebp
lea ebp, [rbp + r9 - 0x12295131]
xor dword [rsp + r9 - 0x194], ecx
sub r10, qword [rsp + r9 - 0x198]
jg 0x180edfce0
mov qword [rsp + r9*2 - 0x330], r11
neg rax
xor dword [rsp + r9*8 - 0xcc0], ebp
sar r9, 0xce
bswap r9
pop r11
call fcn.180e83a24
Function at 0x180eef749
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rbp*2 - 0x6890], 0x5c9ccf82
mov edx, dword [rsi + rbp - 0x344d]
lea rsi, [rsi + rbp*8 - 0x1a245]
sal qword [rsp + rbp - 0x3448], 0x75
setae cl
xor edx, r11d
neg edx
jmp 0x180ecb38e

Function at 0x180ef16ab
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
cwde
xor bpl, r11b
mov qword [rsp + r9*2 - 0xb6e860], 0x2f9d9806
shl cx, 0x42
rol r10, 0x2a
neg bpl
xchg word [rsp + r9 - 0x5b742f], ax
ror byte [rsp + r9 - 0x5b742e], 0x83
lea rcx, [r10*8 + 0x7cad571b]
xor bpl, 0x2e
xor qword [rsp + r9*8 - 0x2dba180], rax
dec al
push r9
dec bpl
cdq
rol bpl, 1
cwde
ror edx, cl
neg bpl
xor r11b, bpl
mul rax
lea rbp, [rsp + rbp + 0x10]
push rax
neg ecx
mov word [rbp + rdx], di
lea rax, [rbx + rdx*2 - 2]
mov edi, 0x5e0267ac
add cx, 0x3c26
shr dl, cl
mov qword [rbx + rdx - 0xa], rax
lea rbp, [r10 + r10*8 - 0x21f319de]
lea rbx, [rbx + r9*4 - 0x16dd0ca]
pop rbp
pop rax
pop rbp
jns fcn.180eb17b9

Function at 0x180ef37fa
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 3
push 0x5e022abe
push 0xffffffffa0a0bb20
lea rsp, [rsp + 0x18]
jne 0x180efdf03
push 0xffffffffc98dcca7
mov r8, rax
lea rsp, [rsp + 8]
jmp 0x180eeef4a

Function at 0x180ef7413
Capabilities:
Authenticate hmac

Disassembly:
not dword [rsp + 0xb]
lea rsp, [rsp + 0x10]
jne 0x180eb4489

Function at 0x180ef897b
Capabilities:
Authenticate hmac

Disassembly:
xor r9d, 0xfbb11d01
mov qword [rsp + r10 - 0x19113e65], rbp
xor dword [rsp + r10*4 - 0x6444f992], 0x152fec9e
bt rbp, 0x93
mov qword [rsp + r10*2 - 0x32227cca], r11
not rdx
setb bpl
xadd di, dx
xor dword [rsp + r10 - 0x19113e65], r9d
inc di
shl edx, 0xdf
pop r11
mov eax, ebp
movsxd r9, r9d
add r8, r9
or rax, 0xffffffff87276f95
cdq
btc rbp, rdx
mov rcx, qword [rbx + r10*2 - 0x32227cca]
mul di
cwde
mov rbp, qword [rbx + rax*4 - 0xef64]
cqo
movsx r9d, dl
sub ax, 0x5405
mov qword [rcx + rdx*2], rbp
xchg r9d, r10d
call fcn.180eb1d84
Function at 0x180ef95d9
Capabilities:
Authenticate hmac

Disassembly:
mov r11, qword [rsp + rdx*2 + 8]
movsxd r9, r9d
add r8, r9
mov qword [rsp + rdx*2 + 8], rdx
xor rdx, qword [rbx + rdx*2]
mov rcx, qword [rbx + rbp - 0x5393b756]
call fcn.180eb34f2
mov edi, 0xb09013b5
lea rax, [rdi + rdi*8 - 0x5be6c87d]
movzx r9d, al
lea rsi, [rsi + r9*2 - 0x1c8]
push r9
jmp 0x180eea548
neg rdx
xor rdi, 0xffffffffbdac65a9
or dx, 0x699
xor rcx, rcx
not ecx
dec rdi
sub bpl, r10b
shr ecx, 0xca
xor r11, rdi
inc r10b
lea rbx, [r9 + rbx - 0xe8]
jne 0x180ecacb3
call fcn.180e78d0c
push r10
btc cx, cx
mov qword [r9 + rbx - 0xe0], rdi
lea rdi, [rdx*8 - 0x7c57e4de]
lea rsi, [r9 + rsi - 0xe4]
mov eax, dword [rsi + r9 - 0xe0]
xor eax, r11d
lea eax, [rax + r9*2 + 0x5e19e6c3]
shr qword [rsp + r9 - 0xe0], cl
xadd rdx, r9
rol eax, 1
inc eax
shr r9b, 0x45
mov qword [rsp + rcx - 0x3f7fff], 0x4b11a88a
rol eax, 1
sar dword [rsp + rcx - 0x3f7ffc], cl
lea eax, [rax + rbp + 0x64cb47c9]
neg word [rsp + rcx*4 - 0xfdfff9]
btc cx, di
mov qword [rsp + rcx*2 - 0x7ef7fe], r11
shl edi, 5
not r10d
xor dword [rsp + rcx - 0x3f7bff], eax
xor rcx, r9
pop r11
sbb dl, r9b
btr di, 0x82
movsxd rax, eax
adc r8, rax
jmp fcn.180eb17b9
sar byte [rsp + r9*8 - 0x6fe], 0xe1
mov rdi, qword [r9 + rsi - 0xe0]
pop r9
movsx ecx, al
xor rdi, r11
cdq
mov ebp, 0x4ab8f608
lea r10, [rax*8 + 0x1b007336]
lea rdi, [r9 + rdi + 0x2535cda8]
not rdi
neg rdi
rol rdi, 6
jmp 0x180ef3697
jmp 0x180ec6973
lea rsi, [rsi + rdx*8 - 5]
xor r10b, r11b
xor r10b, 0xaa
sub r10b, 0x38
mov qword [rsp + rcx - 0x7a012a14], rdx
neg ecx
xor r10b, 0x1a
mov edi, dword [rsp + rdx*2 + 4]
dec di
imul qword [rsp + rdx*2]
sbb r10b, 0xa7
btc r9w, r9w
sub rdx, 0xffffffffd8abf105
xor r11b, r10b
lea r10, [rsp + r10 + 8]
xchg dword [rsp + rdx - 0x27540efb], ecx
xchg byte [rsp + rcx*4 + 7], cl
mov qword [r10 + rcx*4], rbp
lea rbp, [r9 + rdx - 0x7b55d644]
and ecx, ecx
sar edx, 0xed
movzx dx, byte [rbx + rcx*2 + 8]
push r9
movzx r10d, byte [rsp + rcx*8 + 8]
setp dil
adc cl, byte [rcx + rbx + 0xa]
call fcn.180e80f63
mov r9d, dword [rsi - 4]
mov edi, 0xe41d6cbf
mov edx, edi
sar rdx, 0x3a
xor r9d, r11d
dec r9d
lea rbp, [rdi - 0x52c7e85a]
lea r10, [rdi + rdx*2 - 0x21df5343]
rol r9d, 2
lea r9d, [r9 + rdx - 0x542c7018]
bswap r9d
sar di, 0xa6
adc ebp, r10d
lea rcx, [r10 + rdi*2 + 0x3b061507]
push r11
xadd bp, r10w
rol r10w, 0x43
xor dword [rsp + rdx*4], r9d
push rdx
jmp 0x180e8a743

Function at 0x180ef9fa0
Capabilities:
Authenticate hmac

Disassembly:
or cl, 0xbc
mov qword [rsp + rdi*2 - 0xffffffc], 0x7f0563b7
lea r9, [r9 + rdx + 0x6903f601]
cdqe
sal rax, 0x81
xor r11, r9
mov qword [rdi + rbx - 0x8000004], r9
and edx, edi
btr r10, rdx
ror eax, 0xb1
lea rbx, [rbx + rdi*2 - 0x10000002]
pop r9
pop rcx
jae fcn.180eb17b9
mov qword [rsp + rdx + 9], r11
add bp, r9w
xor qword [rsp + rdx*4 + 4], r9
call fcn.180ee76e9
Function at 0x180ef9ff5
Capabilities:
Authenticate hmac

Disassembly:
xor edx, r11d
dec edx
rol edx, 2
cdqe
push rax
sub edx, 0x542c7018
jmp 0x180e9bd28
bswap edx
cdqe
mov qword [rsp + rax - 0x5411bc98], r11
imul eax, r9d
xor dword [rsp + r9 - 0x5411bc98], edx
inc r9w
mov edi, r9d
mov r11, qword [rsp + rdi - 0x5411bc99]
jge 0x180eece02
movsx ebp, dil
movsxd rdx, edx
add r8, rdx
imul r9
mov rbp, qword [rbx + r9 - 0x5411bca1]
shr rdi, 0xe3
jns 0x180ef972f
btc edi, edi
movsxd rcx, ecx
add r8, rcx
ror eax, 0xd6
movzx r10d, word [rsi + rdx - 0x133f0006]
lea rsi, [rdx + rsi - 0x133f0006]
mov qword [rsp + rdx - 0x133efff7], 0xffffffffddaf3312
dec dword [rsp + rdx - 0x133efffc]
call fcn.180ea307b
call fcn.180eae358
mov r10, qword [rbx + r9 - 0x5411bc99]
inc di
pop rcx
neg dx
adc rbp, r10
neg dx
xadd rdi, rdx
idiv r9d
mov r10, rbp
push rax
jmp 0x180ed1351
mov qword [rsp], 0xffffffffbca01596
add dword [rsp + 4], 0x2c0f5412
mov edx, dword [rsi - 4]
mov r9d, dword [rsp + 2]
shr byte [rsp + r9 - 0x5411bc9f], 0x85
mov eax, r9d
lea rsi, [r9 + rsi - 0x5411bca4]
jbe 0x180e77af0
sar cl, 0x45
dec dil
ror dil, 1
idiv cl
add rcx, r10
rol cx, 0x21
sbb dil, 1
xor r11b, dil
lea rdi, [rsp + rdi + 8]
xor r10w, word [rsp + rax - 0xce]
sar cl, 0xc1
mov word [rax + rdi - 0xd4], dx
mov edx, dword [rsi + rax - 0xd9]
mov r9d, 0x99ad41a2
mov ebp, eax
lea rsi, [rax + rsi - 0xd9]
xor edx, r11d
not rax
inc edx
xadd r9d, r10d
call fcn.180e6c284

Function at 0x180efab51
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdi*2 + 0x10], rdi
add word [rsp + rdi*2 + 0x11], 0xdf29
movsxd rax, eax
add r8, rax
sal qword [rsp + rbp + 0x5d5e41f9], cl
pop rax
jbe fcn.180eb17b9
Function at 0x180efab72
Capabilities:
Authenticate hmac

Disassembly:
xchg word [rsp + rdx*2 - 0x151d285], r9w
btr r9w, di
movsxd rax, eax
xchg ebp, ecx
adc r8, rax
add qword [rsp + rbp], 0xffffffffef84673d
ror ecx, 0x71
movzx edi, byte [rsi + rbp*2 - 5]
neg qword [rsp + rbp*2]
not edx
xadd dx, r9w
lea rsi, [rbp + rsi - 5]
adc edx, ebp
rol edx, cl
sub rbp, qword [rsp + rbp]
xor dil, r11b
neg rbp
setnp r10b
jp 0x180ec3108
shr qword [rsp + rbp*2 - 0x206faf82], 0x26
xor r11b, dil
dec rbp
lea rdi, [rsp + rdi + 0x10]
add byte [rsp + rdx - 0x7fab8b51], r10b
call fcn.180e9df13
jmp fcn.180eb17b9
adc dil, 0xa3
or r10b, dl
mov qword [rsp + rbp - 0x1037d7bb], r10
xor dil, cl
sal r10, cl
rol dil, 1
xor dil, 0x14
jmp 0x180eb339b
mov r10d, ebp
xor dword [rsp + rdx - 0xa8e943], eax
push rcx
rol rdi, 0xb0
mov r11, qword [rsp + rdx - 0xa8e93b]
jb 0x180e6c46f
jmp fcn.180ed36de
or dword [rsp + 3], edi
xor eax, 0x5109fea6
movzx ecx, bpl
dec eax
neg eax
xadd dword [rsp + rcx*2 - 0x17e], edx
sar rcx, 0xf8
dec eax
mov qword [rsp + rdx*2 - 0x151d286], r11
jmp 0x180ec9671
mov qword [rsp + r9*4 - 0x44c3d6f8], rdi
mov eax, dword [rsi + r9*2 - 0x2261eb80]
neg word [rsp + r9 - 0x1130f5b9]
lea rdx, [rbp*4 + 0x702ea782]
xor eax, r11d
or bp, di
sbb eax, 0x990f1cbe
xadd qword [rsp + r9*4 - 0x44c3d6f8], r9
jg 0x180ef96a9
not dl
dec bp
xor r11b, dl
lea rdx, [rsp + rdx + 0x10]
mov r10w, word [rbp + rdx - 0x4554a62f]
rol rax, 0x93
not cl
call fcn.180ede646
lea rbp, [rax + rax*4 - 0x53eae2ed]
mov word [rbx + rax*4 - 0x18f2cd80], di
lea rbx, [rbx + rax*2 - 0xc7966be]
imul rbp
push rax
mov edx, dword [rcx + rsi - 0x5003]
jo 0x180e963f5
call fcn.180f05bb1
cmp ebx, 3
push 0x2e35eaba
lea rsp, [rsp + 8]
jne 0x180ed9f2e
mov r8, rax
call fcn.180ebfa5b

Function at 0x180efba3d
Capabilities:
Authenticate hmac

Disassembly:
call fcn.180ed9a6f
mov ebp, 0xc91f8338
lea rcx, [rbp*2 - 0x2e54387b]
mov r9d, dword [rbx + riz]
lea rdx, [rbp - 0x7d553267]
movzx edi, byte [rdx + rsi - 0x4bca50d2]
btr dx, 0x99
xor dil, r11b
mov eax, 0xa88bb830
movzx r10d, cl
cbw
xor dil, 0x36
mul rax
adc dil, bpl
cdqe
sub rdx, 0x550e0912
xor dil, 0x91
inc dil
add dx, dx
xor r11b, dil
push rcx
imul rax, r10
lea rdi, [rsp + rdi + 8]
neg cx
adc word [rsp + r10*2 - 0x1e8], bp
mov dword [r10 + rdi - 0xf5], r9d
cdqe
jno 0x180ea5100
mov word [rbx + rbp*4 - 0x28aa1a74], cx
lea rsi, [rsi + rbp*2 - 0x14550d3e]
mov eax, dword [rbp + rsi - 0xa2a869d]
shr rdi, 0x53
push r9
or word [rsp + rdi + 5], 0xa727
xor eax, r11d
lea eax, [rbp + rax - 0x6739c2db]
push rdi
pop r10
not eax
btc r10w, r10w
sbb eax, r10d
ror byte [rsp + rbp*2 - 0x14550d38], 0xa6
call fcn.180e9d9fc
mov qword [rsp + rbp - 0x6381b1a4], r10
ror edi, 3
jmp 0x180eecea6
Function at 0x180efcc60
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
sal rdx, cl
not dil
mov ebp, 0x37a29796
bts ax, ax
sbb dil, 0xaa
neg r10d
call fcn.180e9c3b4
call fcn.180eab9ef
mov r9d, 0x5495ba92
mov edx, r9d
bts edx, 0x86
mov r9d, dword [rbx + rdx - 0x5495bad2]
movzx edi, dx
lea r10, [rdx + rdi*8 + 0x1b0ae1a0]
movzx edi, byte [rdx + rsi - 0x5495bad3]
lea rax, [r10*2 + 0x5f29abb6]
imul dx, ax
movsx ecx, dx
xor dil, r11b
bts r10d, eax
sal r10b, 1
neg dil
add dil, 0x11
rol dil, 1
cqo
sar r10b, 1
adc dil, 0x10
or rdx, 0x5aebb3b
ja 0x180e74d8b
mov rdi, qword [rbx]
mov r10d, 0x682a26ad
movsx ecx, r10b
mov al, byte [rbx + r10 - 0x682a26a5]
mov byte ss:[r10 + rdi - 0x682a26ad], al
movzx edx, r10b
ror cx, cl
jb 0x180ed857c
rol r9d, 0xbe
btc rbp, rcx
movsxd r10, r10d
adc r8, r10
sub bpl, 7
pop r9
jmp r8
rol edx, 1
mov qword [rsp + r10 - 0x190a34be], r10
neg edx
pop rbp
mov qword [rsp + r10*4 - 0x6428d2f8], rcx
mov edi, 0x671d3ab7
rol edx, 2
lea r9, [rdi*8 + 0x718f5ebf]
rol r9, 0x1d
xor edx, 0x7dad758e
or r9, 0xffffffffc41d2cb3
jne 0x180f00dd5
mov qword [rsp + r10*4 - 0x6428d2f8], r11
xor dword [rsp + r10*2 - 0x3214697c], edx
pop r11
ror edi, 0x1b
movsxd rdx, edx
jb 0x180eb3119
movzx edi, byte [rsi - 1]
xor dil, r11b
mov edx, 0x77be7823
mov ebp, edx
push rdx
neg dil
movzx r10d, dl
movzx eax, word [rsp + r10*2 - 0x44]
sub r10b, al
sbb dil, 0x16
dec qword [rsp + rdx - 0x77be7823]
not dil
neg dil
movsx ecx, r10b
sar rbp, cl
imul rax
ror dil, 1
xor r10, rax
sbb byte [rsp + rdx + 6], bpl
adc dil, 0xa9
dec eax
ror byte [rsp + rdx + 4], 0x41
lea r9, [rdx + rcx - 0x7a720d62]
xor r11b, dil
rol r9, cl
btc ecx, 0x2a
xadd dword [rsp + rdx + 1], r10d
mov word [rdx + rbx - 2], di
or byte [rsp + rdx + 1], 0xb5
jae 0x180ea0b2e
sub dl, r10b
xor r11b, dl
ror r10w, 0xc1
jo 0x180ec6e4a
mov r10d, 0x93a17b8a
mov ecx, dword [rsi + riz - 4]
lea rdi, [r10 + r10*4 - 0x7d7dc4fe]
xor ecx, r11d
inc ecx
ror ecx, 1
movsx ebp, r10b
add bpl, r10b
jp 0x180ef79bd
Function at 0x180efcfe6
Capabilities:
Authenticate hmac

Disassembly:
movzx di, byte [rbx]
mov qword [rsp], 0x2e89ba9a
mov ecx, 0x42969637
lea rdx, [rcx*4 - 0x54e6f76]
mov dl, byte [rbx + rcx - 0x42969635]
not word [rsp + rcx - 0x42969634]
mov r10d, ecx
or dil, dl
pop rdx
not dil
lea rax, [rcx + r10*4 - 0xac07c63]
mov word [rbx + r10 - 0x42969635], di
mov edi, r10d
neg dil
mov r9d, dword [rsi + rdi - 0x429696cd]
xor r9d, r11d
not r9d
or rax, 0x663de784
sub eax, ecx
movsx ebp, di
xor r9d, 0xc935cb2
or rdx, r10
sub ebp, ebp
lea r9d, [r9 + rcx*4 - 0x49ceb43a]
shr r10, cl
setne dil
lea rcx, [rdx + rax - 0x1ee981f1]
rol r9d, 2
bswap r10d
cdqe
xchg ecx, edi
push r11
push r10
xor dword [rsp + rcx - 0x429695f8], r9d
mov r11d, edi
cbw
mov r11, qword [rsp + rcx - 0x429695f8]
movsxd r9, r9d
add r8, r9
lea rbp, [rsp + r10 + 0xe8]
neg r10d
adc r10, qword [rcx + rbp - 0x42969600]
mov qword [rsp + rcx - 0x429695f8], rax
neg qword [rsp + rax*2 - 0x474e00f4]
mov qword [rbx + rcx - 0x42969606], r10
xadd word [rsp + rcx - 0x429695fb], ax
rol byte [rsp + rcx - 0x429695f1], 0xc6
mov rbp, qword [rsi + rax - 0x23a7000c]
je 0x180ed960a
lea rsi, [rsi + rax*2 - 0x474e000c]
movsx r10d, byte [rsp + rcx - 0x42969600]
xor rbp, r11
idiv qword [rsp + rcx - 0x429695ff]
shl qword [rsp + r10*2 + 7], 0x4f
lea rbp, [rbp + rcx - 0x1d60c778]
not rbp
neg rbp
bts r10, rdi
ror ax, 0xcb
movsx r9d, byte [rsp + r10*2 - 0xffb]
rol rbp, 6
cdq
not eax
neg rdx
xor rbp, 0xffffffffbdac65a9
push rdx
add dil, dil
or qword [rsp + rdx + 0x10], r9
dec rbp
mov dword [rsp + rcx - 0x429695fe], 0xd800eb8a
pop rcx
idiv word [rsp + rdx + 0xc]
xor r11, rbp
rol dl, 0x66
inc dil
mov qword [rbx + rdx*2 - 0x17d6], rbp
dec rax
lea rbx, [rbx + rdx - 0xbf2]
mov dword [rsp + rdx*2 - 0x17c2], 0xf5a44302
pop r9
pop rcx
jno fcn.180eb17b9

Function at 0x180efe31c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
not r10d
movzx r11d, si
mov r8, qword [rsp + r8*2 - 0x4fc0]
mov r12, qword [rsp + r11 - 0xbd85]
call fcn.180ee35c9