joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180575825
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
adc bp, 0x4a08
bt rdx, rdx
rol bp, 1
call fcn.1805a2b3c
push 0x7b31718e
mov ecx, dword [r9 + rcx*4]
shl byte [rsp + 2], 0xa4
jnp 0x1805bda03
mov r9, qword [rsi]
mov ebp, dword [r9]
call fcn.180548e5d
ror bx, cl
cmovb rdx, rbp
push r10
imul edx, ecx
btr dx, dx
xor ebx, ebx
xor dword [rsp + rbx*2], r9d
lea r10, [rbx + rdx*2 - 0x635e386f]
lea r10, [rbp + 0x1a8229b4]
mul r10w
pop r10
movsxd r9, r9d
lea rbp, [rdx + rax - 0x19c406f4]
add r11, r9
call fcn.1805c04aa
lea edi, [rdi + rbp*2 + 0x3fabd014]
inc bp
mov qword [rsp + rbp + 0x2c], r10
movzx eax, byte [rsp + r9 - 0x5c250032]
xor dword [rsp + rbp*4 + 0x20], edi
mov r10, qword [rsp + rbp + 0x2c]
sub qword [rsp + r9 - 0x5c250057], rdx
inc ecx
xor ebx, edx
mov dword [rsi + rbp*8 - 0x28], edi
movzx edi, byte [rsp + r9 - 0x5c250035]
lea rsi, [rsi + rbp*8 - 0x28]
xor rdi, 0x371b0cad
and bpl, cl
mov qword [rsp + r9 - 0x5c25002c], 0x38995c29
pop rbp
pop rdx
pop rdi
pop r9
pop rdi
pop rbp
pop rdx
jge fcn.1805a7402
lea rsp, [rsp + 8]
jne 0x1805bc75a
mov ecx, 0x9f0f328b
movsx edx, cx
shl rcx, cl
not edi
lea rax, [rcx + rcx*4 + 0x12954a15]
mov dword [rdx + rbx - 0x328b], edi
jne 0x18052ae31
mov ebp, r10d
mov edi, 0x3e96492c
xor r9d, r8d
movzx ecx, r10b
push rcx
dec r9d
call fcn.18055f48c
mul bp
mov edi, ebx
bswap r9d
call fcn.180544de1
not r9w
mul rbx
mov qword [rsp + rdx - 0xb30deb], 0x3536fa9a
mov bp, r9w
cwd
rol byte [rsp + rdx*8 - 0x597fffc], 0x45
movzx edi, byte [r8 + rdx*8 - 0x5980000]
setae al
dec byte [rsp + rdx*8 - 0x597ffff]
sbb dx, word [rsp + rdx - 0xb2ffff]
xor dil, r10b
sub dil, al
jmp 0x1805bd9ed
mov r10d, 0xc80e828d
movzx ebp, word [rsi + riz]
lea rdi, [r10 + r10*2 - 0x12dd8b76]
lea rdx, [r10 + r10*8 - 0x12faf86c]
rol r10d, 0xf
xor bp, r8w
lea rcx, [rdi + r10*4 - 0x166be556]
shr cl, 0xc3
jns 0x18055237f
jmp 0x1805ce38c
shr edi, 8
not word [rsp + 2]
dec dword [rsp + 3]
shr byte [rsp + 6], 0x83
xor edi, ecx
shr byte [rsp + 1], 0x24
inc rdx
xor edi, 0x792da6a4
shl dword [rsp + 1], 0x18
jp 0x1805b363f
mov rbx, qword [rsi]
mov edi, dword [rsi + 8]
mov eax, 0x7f9eb509
lea rsi, [rsi + rax - 0x7f9eb4fd]
movzx edx, ax
shr rax, 0xb8
mov dword [rbx + rax*2], edi
inc al
movsx ebp, ax
mov r9d, dword [r8 + rax - 1]
bts bp, bp
mov ebx, eax
lea r8, [rax + r8 + 3]
xor r9d, r10d
not rbp
sar bp, 0x26
lea r9d, [r9 + rax*2 - 0x4a2d9aaa]
xor r9d, 0xa5046d0c
jmp 0x1805670d9
dec rax
not dword [rsp + 1]
jmp 0x180561d53
mov ecx, 0x722406b2
xor cl, cl
movzx ecx, byte [rdx + rcx - 0x72240600]
xor ecx, edi
and ecx, 0xff
jmp 0x18055db86
xor dil, 0x81
movzx ecx, al
not dil
rol ebx, 0x53
adc dil, 0x23
call fcn.18058b7d4
jns 0x1805b0b05
jmp 0x18058a879
neg r9d
shl qword [rsp], 0x7d
inc r9d
call fcn.1805578d8
mov eax, 0x2198e0f
lea rbp, [rax*2 - 0x404c8746]
and bp, bp
mov r10d, dword [rsi + rax - 0x2198e0f]
Function at 0x18057d0ff
Capabilities:
Authenticate hmac

Disassembly:
mov r10, qword [rsp + rcx*2 - 0x67e7e6ee]
xchg bpl, r9b
shr rcx, cl
movsxd rax, eax
adc r11, rax
mov qword [rsp + rcx*4 + 0x10], r9
btc ecx, ebx
pop rbp
pop rax
pop rax
jae fcn.1805a7402
push 0xffffffffc703f533
mov edx, 0x6abe64a7
mov eax, dword [rbx + rdx - 0x6abe64a7]
shr dword [rsp + rdx - 0x6abe64a6], 0xd8
movsx r9d, dl
mov ecx, dword [rdx + rbx - 0x6abe64a3]
dec word [rsp + rdx - 0x6abe64a3]
mov rbp, rbx
mov qword [rsp + rdx - 0x6abe64a7], rbx
movzx edi, r9w
setg r9b
lea r10, [rdx + rdi*4 + 0x1592ab3e]
cpuid
je 0x180534dda
sbb r9b, 0x3a
sbb r10w, r10w
lea rbp, [rdi + rbp - 0xffaf]
mov dword [rbp + rdi - 0xff9b], eax
mov dword [rbp + rdi - 0xff9f], ebx
movsx eax, r10w
shl r10b, 0xa1
sar rdi, 0xa8
mov dword [rdi + rbp + 4], ecx
mov dword [rdi + rbp], edx
lea rdx, [r10 + 0x7f3fc009]
pop rbx
lea rcx, [r9*8 - 0x4ee0fbd2]
shl cl, 0x21
mov rbx, rbp
cbw
movzx ebp, dx
push rdx
mov r9d, dword [rsi + rdi*2]
shl ax, cl
lea rsi, [rdi + rsi + 4]
imul rbp
shl edx, 0xc9
setp dil
xor r9d, r8d
sar r10d, 0x89
adc al, dh
dec dil
neg r9d
not r9d
add r10b, 0x3e
bswap r9d
mul qword [rsp + rdi]
sal qword [rsp + rdi*2], cl
xor r9d, 0x342e8fa4
neg dword [rsp + rdi + 4]
ror r10b, 0x86
mul dword [rsp + rdx*2 - 0x17f6c]
lea r9d, [r9 + r10 - 0x6b38bcb]
mov qword [rsp + rdi], r8
movsx r8d, bp
xor dword [rsp + rdi], r9d
pop r8
movsxd r9, r9d
and ax, bp
sar ax, 0xe7
bt r10w, 0x2d
add r11, r9
cwde
rol r10d, 0x49
jb fcn.18051ffce
add r11, rcx
rol al, 0x65
imul rbx, rbp
call fcn.1805b7ff8
mov eax, dword [r8 + rbp*4 - 0x627edce4]
lea r9, [rbp*8 - 0x3f7b99f1]
movsx edi, bp
lea r8, [rbp + r8 - 0x189fb735]
mov ecx, edi
not rcx
xor eax, r10d
ror ebp, cl
rol r9w, 0x8b
sub r9d, edi
not eax
dec rcx
xor eax, 0x92903e20
call fcn.180585cc7
xor r10b, dl
xor ecx, ecx
lea rdx, [rsp + rdx + 8]
and bp, 0x9b8e
adc bp, bp
movzx bp, byte [rdx + rcx*2]
xor edi, dword [rsp + rcx + 1]
lea rsi, [rsi + rcx*2 - 2]
movzx edx, byte [rsp + rcx*8 + 4]
movsx eax, bx
mov word [rsi + rcx*4], bp
lea rbp, [rcx*2 + 0x313cd29b]
add ebp, 0x19ae3c82
pop rdi
jge fcn.1805a7402

Function at 0x18057ed31
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl rdi, 0x29
lea ebx, [rbx + rdx - 0x7b940b8]
jae 0x180567d5c
bswap ebx
sar ecx, cl
rol di, cl
ror ebx, 1
mov ebp, edx
not ecx
mov qword [rsp], rcx
mov qword [rsp], r10
inc edi
mov r9d, 0x4c859917
and cx, bp
xor dword [rsp + r9 - 0x4c859917], ebx
ror edi, cl
pop r10
bt bp, bp
setae r9b
movsxd rbx, ebx
mul dl
add r11, rbx
mov edx, dword [rsi + rdi - 0x4000]
xadd ax, di
dec di
mov ebx, dword [rsi + rdi - 0x1ff3]
sbb r9, rdi
shl eax, 0xa9
not edx
not bp
bt cx, cx
not ebx
or edx, ebx
mov r9d, edx
mov ebp, dword [rsi + rdi - 0x1fef]
cwde
btr eax, 0xe
add r9d, ebp
add di, cx
mov dword [rsi + rdi - 0x2121], r9d
jo 0x1805c506e
jns 0x1805b6cfb
jge 0x1805259fa
Function at 0x1805807bd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
jb fcn.18051ffce
mov edx, 0x2885c80
push rdx
mov r10, qword [rbx + rdx*4 - 0xa217200]
lea r9, [rdx + rdx*8 - 0x2762844a]
mov rax, qword [rdx + rbx - 0x2885c78]
lea rcx, [r9 + r9*4 - 0x554112ff]
add r9, 0xffffffffff2add2e
sar r9d, 0xb4
mov rax, qword [rbp + rdx*2]
mov qword [rbx + rdx - 8], rax
movzx ebp, r9b
mov eax, dword [rsi + rdx*8 + 1]
lea rsi, [rsi + rdx + 5]
xadd r9b, bpl
sub rdx, rcx
xor eax, r8d
mov qword [rsp + r9 - 0x156], r10
dec eax
shl qword [rsp + r9 - 0x156], 0xe6
rol byte [rsp + r9 - 0x153], 0x21
and dword [rsp + r9*4 - 0x557], 0x929a639d
not eax
inc eax
shr rdx, cl
ror r9d, 0xd
rol eax, 2
shl edi, 0x64
lea eax, [rdx + rax + 0x6611fb87]
rol cl, 0x61
shl r10b, 0xe3
imul dx, word [rsp + rdx*2 - 0x1a]
mov qword [rsp + rdx - 0x4980], r8
xor dword [rsp + rdx - 0x4980], eax
movzx r8d, bp
not r9d
pop r8
movsxd rax, eax
add r11, rax
inc bpl
sets r10b
mov rdx, qword [rbx + rdx - 0x4988]
setle cl
or cl, byte [rbx + rbp - 0x2c]
rol r9d, 0x17
movzx eax, r10w
neg bp
shr rdx, cl
sar r10b, 0x42
mov qword [rbx + rbp - 0xffda], rdx
add bpl, r9b
btc r9w, bp
cdq
lea rbx, [rbp + rbx - 0xffd9]
jb 0x180549963
Function at 0x1805810f4
Capabilities:
Authenticate hmac

Disassembly:
dec di
mul ebp
pop rcx
lea rdx, [r9 + rdx*4 + 0x6707abae]
xor r8w, di
shr dword [rsp + rbp*4 - 0x8e30e7], cl
cqo
mov word [rbx + rbp - 0x238c3f], di
cdq
lea rbx, [rbx + rbp - 0x238c3f]
mov qword [rsp + rbp - 0x238c23], rcx
jne 0x180580920
ror ecx, 1
add ecx, 0xb7b16423
push r10
xor dword [rsp + rbp], ecx
pop r10
add al, bpl
mov ebx, edx
movsxd rcx, ecx
cqo
setge al
shl ebp, 0xea
adc r11, rcx
mov r9d, edx
btr rdx, 0
adc rbp, r11
jmp rbp
cdq
ror r9d, 2
lea rax, [rax + rdi*4 - 0x4ad31e54]
lea rbx, [rax + rdx*4 + 0x2909ad91]
bswap r9d
call fcn.180528824
dec di
xor di, 0x3c88
neg di
mov qword [rsp + rax + 0x2d7d8af6], rcx
not di
mov qword [rsp + rbp*4 - 0x8e30ec], rcx
ror ax, 0xa1
jno 0x18052ab5e
mov ecx, 0x8b81e192
mov r9d, dword [r8 + riz]
movzx edi, cx
movzx eax, cl
lea r8, [rax + r8 - 0x8e]
xadd eax, edi
xor r9d, r10d
jmp 0x180546e0d

Function at 0x180581d73
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor r8b, r10b
cbw
mov word [rsp + rax - 0x1530005], 0x898a
call fcn.180564d4f
mov eax, 0x781ea73a
push rax
mov eax, dword [rbx + rax - 0x781ea73a]
mov edi, 0x130190be
movsx ebp, byte [rsp + rdi*2 - 0x26032179]
movzx edx, byte [rsp + rdi*2 - 0x26032179]
mov ecx, dword [rbx + rdi*4 - 0x4c0642f4]
mov r10, rbx
mov qword [rsp + rdi*4 - 0x4c0642f8], rbx
push rdi
push rdx
cpuid
call fcn.1805a2617

Function at 0x180582ccc
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
sal rdi, 0x28
ror ebp, 1
sub word [rsp + rdx*2 - 0x1d41755a], cx
jp 0x1805cf5e3
movsxd rbp, ebp
add r11, rbp
sub rdx, r10
dec r9w
ror cx, 0x8d
movzx di, byte [rbx + rdx*4 - 0x3a7ee936]
and r9b, al
inc r10d
mov al, byte [rbx + rdx*2 - 0x1d3f749a]
xor r10, r9
not dil
not al
and dil, al
call fcn.18053ed6d
not ebp
mov qword [rsp + rdx*2 - 0x1d417566], r9
pop r9
xor ebp, 0x2aa013bb
xor byte [rsp + rdx*2 - 0x1d417561], ch
js 0x1805d18bb
mov edx, 0x36936722
movsx ebx, dl
jmp fcn.1805a85fa
lea ebp, [rdx + rbp + 0x39173a02]
not dl
or dword [rsp + rdx - 0xea0ba49], 0xc91c7e39
adc rdi, qword [rsp + rdx*2 - 0x1d417498]
xor ebp, edi
sal byte [rsp + rdx - 0xea0ba4b], 1
movzx r10d, word [rsp + rdx - 0xea0ba49]
neg dil
mov qword [rsp + rdx*2 - 0x1d417498], r8
xor dword [rsp + rdx*8 - 0x7505d260], ebp
pop r8
jmp 0x1805c2e46
Function at 0x180588f10
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
sub r10, qword [rsp + rax*4 + 0x3cb8]
mov qword [rsp + rax*8 + 0x7970], r8
cdqe
xor dword [rsp + rax*2 + 0x1e5c], r9d
mov edx, ecx
pop r8
imul dx
imul rdx, rcx
movsxd r9, r9d
xchg edx, ecx
add r11, r9
push rax
shl cl, 0x81
call fcn.180546bfa
and dl, 0xa
adc bx, dx
movsxd r9, r9d
shl rdx, 0x5f
rol edx, 0xbd
adc r11, r9
shl bpl, 0xe4
js 0x18056887b
mov rax, rsi
shr ebp, 0x64
sar rbp, 0x8f
imul rcx, rbp
lea rsi, [rsi + rdi - 0xc935]
shl edx, cl
and edi, ecx
bts rbp, 0x2a
mov word [rsi + rdi - 3], ax
lea r9, [rbx - 0xfd35ce1]
xadd ebx, edx
jb 0x1805ce351
jno fcn.1805a7402
bt bp, r9w
sub cx, r9w
mov rcx, qword [rdx + rax*2 + 0xcdf4]
neg rdi
mov qword [rax + rsi + 0x66f2], rcx
sar word [rsp + rax + 0x66fa], 0xa3
mov edi, dword [r8 + rax*2 + 0xcdf6]
xor edi, r10d
bts ebp, 0xb1
sbb ax, bp
rol byte [rsp + rax + 0x6706], 0xa2
lea edi, [rax + rdi - 0x71980c1d]
add qword [rsp + rax + 0x6700], 0xffffffff98a203b9
rol edi, 1
ror word [rsp + rax + 0x6703], 0x49
mov ebx, 0x30a37d96
rol r9, 0x10
neg edi
jmp 0x1805c193e
lea rdi, [rsp + rdi + 8]
or r10, rbp
mov ebp, dword [rax + rdi - 0x59c5]
push rcx
jle 0x1805728e9
mov dword [rbx + rax - 0x59c9], ebp
shr r9w, 0x2d
lea rdi, [rcx*4 - 0xc59def1]
mov r9d, dword [rsi + rax*4 - 0x16713]
inc eax
lea rsi, [rax + rsi - 0x59c1]
sbb r10d, ecx
mov qword [rsp + rax*4 - 0x16710], rax
imul r10b
xor r9d, r8d
pop rcx
not r9d
rol cx, cl
neg rax
xor r9d, 0x30a46500
add word [rsp + rax*2 + 0x1e61], cx
xchg qword [rsp + rax*4 + 0x3cb8], rcx
bswap r9d
ror r9d, 2
bts rax, 6
jb 0x1805270a4
shr edi, 0xf
sbb word [rsp + rdi*2 - 0x19261], ax
mov qword [rsp + rdi - 0xc933], r10
xor dword [rsp + rdi*4 - 0x324cc], r9d
movzx r10d, cx
jmp 0x1805bdefc
xadd ebp, ebx
pop r10
jp 0x180561350
mov qword [rsp + rdi - 0x3897fdb5], r11
ret 0x18
add r9, 0x78bc7322
bswap eax
rol edi, 1
movsx ecx, bp
mov qword [rsp + rax*2 - 0x133fffe], r10
xor dword [rsp + rax - 0x99ffff], edi
idiv cl
mov edx, ecx
lea r10, [rax*8 - 0x6a6abdf3]
pop r10
movsxd rdi, edi
cwde
xchg ecx, eax
add r11, rdi
add rcx, rdx
jg 0x18057fdc5
Function at 0x18058a34a
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
add eax, ecx
xor ebx, r10d
ror edx, cl
lea r9, [rdi + rdx - 0x25871f2]
xchg ch, cl
rol ebx, 1
imul rdi, rdx
bswap ebx
jno 0x1805d0184
mov ebx, 0xa139d20f
lea rax, [rbx*4 + 0x62968c01]
mov eax, dword [r8 + riz]
movsx r9d, bl
movzx edi, r9b
lea r8, [r8 + r9*8 - 0x74]
movsx ecx, r9b
movzx ebp, bl
xor eax, r10d
inc bp
jns 0x1805b8e84
not qword [rsp + rcx - 0x15]
lea rsi, [rsi + rcx - 0x23]
shl rcx, cl
and qword [rsp + r9*8 - 0x7e0], 0xffffffff8a337b33
pop rbp
mov dword [r9 + rsi - 0xfe], eax
sar edx, 0x2c
shr dword [rsp + rdi*2 - 0x68e49f6e], 0xc9
ror edx, 0xd8
pop rbx
pop rbx
jp fcn.1805a7402
mov ebx, 0x2d33393a
mov r9, qword [rsi + rbx*2 - 0x5a667274]
movzx ecx, bx
sar bl, 0x43
movsx edi, bx
lea rsi, [rsi + rbx - 0x2d3338ff]
xor rdi, rdi
movzx eax, word [r8 + rbx*2 - 0x5a66720e]
btr rcx, 0xba
xchg ecx, ebx
or ebx, 0x4783a125
lea r8, [r8 + rcx - 0x2d333905]
xor ax, r10w
movsx edx, bl
xor ax, 0xb53e
not ax
movzx ebp, cl
rol ax, 1
shl bp, cl
btr bx, cx
sal bp, cl
adc ax, di
add edx, edx
rol bp, 0xef
sar dil, 0x22
xor r10w, ax
btr edx, edi
adc rax, rsp
shr bx, 0x44
mov qword [rax + rcx*2 - 0x5a66720e], r9
bt rbp, rdi
lea rcx, [rbx*4 + 0x52b48929]
bts bx, 0xa8
mov ebx, dword [r8 + rdi*4]
xchg rdi, rbp
cmovae cx, di
lea r8, [r8 + rdi*2 - 0xbffc]
movsx eax, dil
jb 0x18051d0fb
mov cl, byte [rbx + r10*4 + 0x761f917c]
lea rbx, [rbx + rax - 0x5d1eb64e]
add eax, r10d
dec al
shrd ebp, r9d, cl
mov ecx, 0xa09002b9
mov dword [rbx + r10 + 0x1d87e45d], ebp
xadd rax, r10
push rdx
not qword [rsp + rdx - 0xc1f9]
mov qword [rsp + r10 - 0x3f96d1f6], r11
ret 8
and bx, 0xe03c
lea eax, [r9 + rax + 0x6586baae]
setge bl
ror eax, 1
movsx edx, r9w
dec rdi
not rdx
lea eax, [rax + r9 - 0x5988f8a9]
jge 0x18054b4b0
lea eax, [rax + r9*4 - 0x4a2d9ae4]
setnp r9b
xor eax, 0xa5046d0c
btr rbx, rdi
bts rbp, rbp
sbb r9b, 8
bswap eax
jbe 0x18058a810

Function at 0x180590674
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
call fcn.18056ce86
call fcn.1805cb436
mov eax, 0x6b84a138
push rax
neg eax
movzx r9d, byte [rsi + riz]
adc rsi, 0
xor r9b, r8b
movsx edi, ax
dec dword [rsp + rdi - 0x5ec7]
and byte [rsp + rdi*4 - 0x17b1d], dil
xor r9b, 0xaa
cdqe
add r9b, 0x88
cdq
movzx ebp, word [rsp + rax + 0x6b84a13c]
xadd word [rsp + rax + 0x6b84a13b], bp
neg r9b
neg dil
lea rcx, [rdi + rdx*2 - 0x20ff2a73]
rol r9b, 1
shr dword [rsp + rdi - 0x5e38], cl
div dl
xor r8b, r9b
btr bp, 0xd
movsx r10d, cl
adc rax, rax
lea rbx, [rbx + rdi*2 - 0xbc72]
add qword [rsp + rbp*2 - 0x90], 0xffffffff8f35f1a1
sbb word [rsp + rdi - 0x5e34], dx
sub rdx, qword [rsp + rdi*4 - 0x178e0]
mov word [rbx + rdi*2 - 0xbc70], r9w
mov ebp, dword [rsi + rdi*2 - 0xbc70]
and rax, qword [rsp + rdi - 0x5e38]
lea rsi, [rsi + rdi*8 - 0x2f1bc]
movzx r9d, cl
dec dil
and word [rsp + rdi*2 - 0xbc6d], dx
xor ebp, r8d
and word [rsp + rdi - 0x5e35], r9w
cdqe
neg ecx
dec ebp
ror ebp, 2
pop rcx
ror di, cl
cbw
sbb ebp, 0x86861e34
xor di, ax
xor rdx, rcx
bswap ebp
Function at 0x1805a3ea3
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
shr edi, 8
push 0x273eb69a
xor edi, ebx
call fcn.1805bb769
mov ebp, dword [r8]
mov eax, 0x7592a28b
movsx ecx, al
lea r8, [rax + r8 - 0x7592a287]
jmp 0x18055a2dc
mov ebx, dword [rcx + rbx*4]
jb 0x18059e13a
jmp 0x18056a00c

Function at 0x1805a6ccb
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
shl edx, cl
neg edi
ror qword [rsp + 8], 0xdf
push rbx
dec dword [rsp + 0x13]
xor edi, 0xc3b22236
add edx, 0xddaa31ae
shl byte [rsp + 0x13], 0x62
mov qword [rsp + 0x10], r10
mov qword [rsp + 8], rdx
xor dword [rsp + 0x10], edi
inc dword [rsp + 0xb]
mov r10, qword [rsp + 0x10]
mov qword [rsp + 0x10], rbp
or rbx, rbx
movsxd rdi, edi
dec dword [rsp + 2]
adc r11, rdi
push rdx
sub rcx, qword [rsp + 0x18]
mov rbp, qword [rsi + rcx - 0x6f1ea98f]
shl dl, 0xe5
jbe 0x18053f8c8

Function at 0x1805a6d2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rdx*2 - 0x5045aa68], r11
ret
sal qword [rsp + 0x10], 0x6a
je 0x1805b1c2c
mov eax, dword [rcx + rax*4]
call fcn.1805a3eb1
xor edi, r8d
movzx eax, dl
lea edi, [rdi + rcx*2 + 0x10276016]
neg edi
dec edi
neg edi
push r8
cdq
shl rdx, 0x24
mov r8d, edx
xor dword [rsp + rdx], edi
pop r8
xor rcx, rcx
movsxd rdi, edi
ja 0x180526c81
mov r9d, 0xf699679e
adc r11, rdi
xadd cl, ah
ror al, 0xa6
mov rbp, qword [rbx + rdx*2]
sal dl, 0x66
call fcn.180569fea

Function at 0x1805a86fb
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdx*2], 0x5e8dc52a
pop r10
jp fcn.18051ffce
mov edi, eax
xor dl, r8b
lea r10, [rcx + rcx*8 - 0x67fee3ec]
inc dl
ror ax, 0x4c
adc rdi, rbp
not dl
cwde
bt rdi, rcx
dec dl
ror dl, cl
shl rdi, cl
adc bp, bp
not dl
shr dil, cl
xchg rdi, rbp
lea r9, [rdi + rcx - 0x246c026b]
xor r8b, dl
and di, 0xf5a0
rol ecx, 0xa1
adc rdx, rsp
cbw
xor r9b, al
ror r10, 0xc5
mov al, byte [rdx + rax*4 - 0x1d4]
jne 0x1805c891c
adc ecx, 0x4004569f
lea rbx, [rbx + rcx - 0x28879764]
mov word [rbx + rcx*2 - 0x510f2ec4], ax
lea rax, [rbp + rbp*8 + 0x6625cfb0]
xor ebp, dword [rcx + rsi - 0x28879762]
bt r10d, 0x1a
lea rsi, [rsi + rcx - 0x2887975e]
xor ebp, r8d
shr dil, 1
seta cl
inc ebp
btr r9d, 0xb5
neg ebp
lea r10, [rdi + r9*8 + 0x1b96e93c]
movsx edx, r9w
xor ebp, 0x2838d194
bt dx, cx
sbb edx, 0x661c4ab1
inc ebp
dec r9d
imul rcx, r9
push r8
xor dword [rsp + r9 - 0x18d7f370], ebp
shr rax, 0xf3
pop r8
movsxd rbp, ebp
not rdi
bts di, r10w
add r11, rbp
lea rdx, [rdi*2 - 0x7a796be2]
or r10, rdx
add rdi, rdx
jle fcn.18051ffce
push 0x23939b0
lea rsp, [rsp + 0x10]
jmp 0x1805a41d5

Function at 0x1805aae84
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r9], 0x639ada84
neg qword [rsp + r9 + 4]
bswap eax
sbb eax, r9d
btc ecx, 0x9b
not eax
jb 0x18054df0b
Function at 0x1805abe1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsxd rdx, edx
shl rax, 0xac
movzx edi, cl
add r11, rdx
xadd r9w, bp
add rbx, rdi
or eax, dword [rsi + rbp*2 - 0x1d640]
sal ebp, 0x11
ror cx, 0xd
mov ecx, dword [rsi + rdi*8 - 0x434]
cpuid
lea rsi, [rsi + rdi*2 - 0x116]
je 0x18054cbbf
mov dword [rsi + rdi*4 - 0x210], eax
mov eax, 0x319126a5
dec ax
mov dword [rsi + rdi - 0x7f], ebx
btc rdi, rbp
mov dword [rsi + rdi*2 - 0x108], ecx
xor r9, 0x568922a8
lea rcx, [rbp + 0x268aca3b]
mov dword [rdi + rsi - 0x86], edx
jne fcn.1805a7402
movsx ebx, r9b
neg edx
mov qword [rsp + rbx*8 - 0x110], r9
lea edx, [rdx + r9 - 0x32765b1f]
rol edx, 1
xor edx, 0xfaa5f20d
movzx ebp, byte [rsp + rbx*8 - 0x110]
btr r9d, 1
setae bpl
ror edx, 1
movsx ecx, byte [rsp + rbx*2 - 0x42]
btr r9, 0x33
neg byte [rsp + rbx*2 - 0x3e]
xor edx, 0x67064110
mov qword [rsp + rbx - 0x22], r10
or rbx, r9
btr ebx, ebx
mov eax, ebx
xor dword [rsp + rbp], edx
mov r10d, 0xfaea53c
pop r10
lea rax, [rcx*4 + 0x703370bd]
bts r9, 0xbf
jae 0x18055db13

Function at 0x1805b90a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ebx
lea rsp, [rsp + 0x10]
jne 0x1805b2d02

Function at 0x1805b9bab
Capabilities:
Encode data using xor

Disassembly:
push rdx
pushfq
movabs rdx, 0x1938b78551acfc99
test rdx, 0x7fbd9783
mov rdx, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffae7b7f0f
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.18051bea5
enter 0xffffffffffff8f55, 0xffffffffffffffd3
mov word [rax], fs
xor byte cs:[rax + 0x2e10fd3e], al
xor byte [rax + 0x2e00f49d], al
xor byte [rax + 0x2ec8ed5d], al
xor byte [rax + 0x2e2865b5], al
xor byte [rax + 0x2ef8fc86], al
xor byte [rax - 0x2e28a38a], al
fsub st(2), st(0)
sub dword [rax], eax
xor rax, 0x913c002
jp 0x18032f78e
jae 0x18032f802
mov bh, bh
invalid
jmp [rcx]
add r11, rdi
lea rsp, [rsp + 0x10]
jmp 0x18032f763

Function at 0x1805bc73e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x30]
je 0x180561d5e
mov r9d, 0xd780b524
sar r9d, 0x62
lea r9, [0x1805830d0]
Function at 0x1805c7250
Capabilities:
Authenticate hmac

Disassembly:
bswap ebx
mov rdi, qword [rsp + rbx + 0x78]
lea rdx, [rdx*2 + 0x463964b4]
call fcn.18053d808
xor al, 0xa8
xor r8b, al
sal r10, 0xbb
sbb r9w, 0xfe80
lea rax, [rsp + rax + 8]
not cl
mov word [rcx + rax - 0x79], bp
pop rdi
mov edx, dword [rsi + rcx*2 - 0xf1]
lea rbp, [r9*4 + 0x40319212]
rol di, 0xc1
ja 0x1805cbb83
mov edx, 0xc902aa87
mov ebp, edx
movzx eax, bpl
movzx edx, byte [rsi + rax*2 - 0x10e]
lea rcx, [rbp*8 + 0x2c2c4c29]
add ax, ax
lea rsi, [rsi + rax*8 - 0x86f]
sub eax, ebp
jge 0x1805a870b
movzx edx, byte [rsi + riz]
movsx r9d, dil
movzx ebp, r10w
imul rbp, rbp
adc rsi, 1
rol dil, 1
xor dl, r8b
lea r9, [rbp + rbp*2 - 0x49e721cb]
add dl, 0xa
ror dl, 1
movzx eax, r9w
push r10
neg dl
ror di, 0x69
push r10
adc bpl, al
rol dl, 1
xadd bp, ax
and word [rsp + rax*8 - 0x77e2b], di
push r9
sbb dl, 0x89
not dl
and rax, qword [rsp + rax*2 - 0x1df7c]
adc r9b, byte [rsp + rax*4 - 0x2ac04]
and di, di
sbb dl, 5
or r10, 0xffffffffba247b2e
pop rdi
or dil, r9b
xor r8b, dl
ror r9, 0x42
inc dword [rsp + r10*2 + 0xbb40989]
lea rdx, [rsp + rdx + 0x10]
xchg qword [rsp + r10 + 0x5da04ca], r10
pop r10
mov dword [rax + rdx - 0xab06], ecx
lea rcx, [r9*2 + 0x738247a9]
mov edi, dword [rsi + rax - 0xab06]
bt ebp, r10d
sbb byte [rsp + rax*8 - 0x5582f], r10b
shr byte [rsp + rax*8 - 0x5582c], 0xc7
lea rsi, [rsi + rax*2 - 0x15608]
lea rdx, [rcx + r10*4 + 0x253f239c]
xor edi, r8d
and r9, qword [rsp + rax*2 - 0x1560c]
setbe r9b
setns r10b
rol edi, 1
cqo
bts rax, rcx
xor word [rsp + rax - 0x200ab00], 0x9882
xor edi, 0x8b9ab409
sub edi, 0xb33eb7b7
xchg byte [rsp + rax*2 - 0x401560a], r10b
push r10
ror edi, 2
rol rbp, 0xe8
add word [rsp + rax - 0x200ab00], dx
inc edi
cwde
xor edi, 0x57178da6
mov qword [rsp + rdx*2 + 8], r8
btr rax, rax
add dx, ax
xor dword [rsp + rdx*8 - 0x55828], edi
sar qword [rsp + rdx - 0xab06], 0x45
neg bpl
dec word [rsp + rdx - 0xab03]
mov r8, qword [rsp + rdx - 0xaafe]
sar rbp, 0x99
div r10d
movsxd rdi, edi
add r11, rdi
mov qword [rsp + rax - 0xe1ad], r11
ret 8

Function at 0x1805c74d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r10b
mov rbx, qword [rsp + r10 - 0x53472482]
pop rcx
movsx eax, dil
mov rbx, r9
bswap r10
jns 0x18051dc98
mov ebp, 0x78045530
mov edi, dword [r8 + rbp - 0x78045530]
xor edi, r10d
lea rdx, [rbp + 0x429d28bc]
bswap edi
call fcn.1805c9ef4
Function at 0x1805cece6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
mov word [rbx + rbp*2 - 0x751a9b2a], r10w
mov r10d, dword [rbp + rsi - 0x3a8d4d93]
cqo
lea rsi, [rsi + rbp*2 - 0x751a9b23]
mov qword [rsp + rbp - 0x3a8d4d94], rax
setae r9b
xor r10d, r8d
add ebp, dword [rsp + rbp*2 - 0x751a9b24]
neg r9d
adc r10d, edx
neg r10d
xor r10d, 0x2838d194
inc r10d
mov qword [rsp + rbp - 0x3a8d4d94], r8
xor dword [rsp + rbp - 0x3a8d4d94], r10d
movzx r8d, dl
shl ecx, cl
jae 0x180590758
pop r8
adc rdi, rax
cmovbe dx, ax
or rax, 0xffffffffda1632bd
movsxd r10, r10d
adc r11, r10
add dl, byte [rbx + rdi - 0x751ac75b]
xor rdi, rbp
sub bpl, r9b
shl r9w, 0xac
mov r10b, byte [rbx + rbp*2 - 0x751a9b2a]
setb dil
dec rdi
xor ebp, 0xd497183a
not dl
xadd rdi, rax
not r10b
xor rbp, rbp
or dl, r10b
dec bpl
mov word [rbx + rbp*4 - 0x3fc], dx
inc rcx
jmp r11
jnp 0x18058a6d7
mov r8, qword [rsp + rdi - 0x2097a2f8]
mov qword [rsp + r9 - 0xff49], r9
movsxd rdx, edx
shl qword [rsp + rdi - 0x2097a2f8], cl
inc r9b
not byte [rsp + rdi - 0x2097a2f1]
add r11, rdx
jmp 0x18059acbd