joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1417e9514
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffec02ce91
lea rsp, [rsp + 0x18]
jne 0x1417ec0a8

Function at 0x1417ea228
Capabilities:
Manually build aes constants

Disassembly:
sub sil, sil
jge 0x1417dbef1
mov qword [rsp + rdx - 0x3b87f], rcx
xchg sil, dl
lea edi, [rdi + rcx + 0x7dbb60a1]
neg rax
push rbp
mov qword [rsp + rdx*2 - 0x77014], r10
sete r11b
cwde
xor dword [rsp + rdx*8 - 0x1dc098], edi
and r11w, ax
idiv rsi
shl r11b, 0xc3
mov r10, qword [rsp + rdx - 0x316c80]
ror dl, 0x27
movsxd rdi, edi
inc edx
sar r11b, 0x46
btr ecx, ebp
adc rbx, rdi
movzx ecx, byte [r9 + rdx*4 - 0xc5b0ce]
rol byte [rsp + rdx*4 - 0xc5b0c1], 0x86
push rbp
adc word [rsp + rdx*2 - 0x62d852], 0x3497
lea r9, [rdx + r9 - 0x316c38]
xor cl, r10b
add edx, eax
lea rdx, [rbp*2 + 0x6935b41d]
not cl
shr eax, 8
rol cl, 1
dec dword [rsp + rsi*4 - 0x10269e8]
neg dword [rsp + rsi - 0x409a78]
dec al
neg cl
and word [rsp + rsi - 0x409a6f], dx
mov qword [rsp + rsi - 0x409a5f], 0x379b7d37
jbe 0x141819d55
rol cl, 1
xor r10b, cl
lea rcx, [rsp + rcx + 0x28]
xadd word [rsp + rsi*2 - 0x8134ed], dx
mov ebp, dword [rcx + rsi*8 - 0x204d3f8]
sal ax, 0x22
cwd
mov dword [rsi + r8 - 0x409a85], ebp
lea r8, [r8 + rsi*2 - 0x813504]
movsx edi, dl
movsx ecx, word [rsp + rsi - 0x409a5b]
dec word [rsp + rsi*2 - 0x8134f9]
pop rax
pop rdi
pop r11
pop rax
pop rdi
jno fcn.1417fa90c
inc ebp
lea rdx, [rsi + rcx*4 - 0x7eed1bff]
lea rcx, [rsi*2 + 0x34b85401]
call fcn.141830ab1
lea rax, [rdx + 0x2f8bc9b7]
mov ebp, edx
xor esi, r10d
xor esi, 0x18adc68f
div qword [rsp]
and al, byte [rsp + 1]
sbb byte [rsp + 4], bpl
rol esi, 3
mul rax
cwd
movzx ecx, dl
lea esi, [rsi + rcx*4 + 0x478ce0ac]
seto byte [rsp + rcx - 0xff]
cwde
rol esi, 2
call fcn.1417e782c
inc edi
mul dword [rsp + rsi - 0x409a0c]
not edi
jo 0x1417ccad0
mov qword [r8 + rcx - 3], rax
btc rdi, 0x1c
lea r9, [rcx + r9 - 7]
or cl, dil
mov ebp, dword [r9 + rcx*2 - 6]
and cl, sil
xor ebp, r10d
jmp 0x1417bfdd1

Function at 0x1417ecfa4
Capabilities:
Encode data using base64

Disassembly:
mov qword [r11 + rbp - 0x7d3feaa7], rax
add r11, rdx
mov r8, rbp
pop r10
pop rbx
sete dil
bt r11d, edi
pop r9
call fcn.1417eded7
mov ebp, 0x8e24191f
mov rsi, qword [r8 + riz]
push rbp
shr bpl, 0x25
mov rdi, qword [r8 + riz + 8]
call fcn.141808b07
mov rcx, qword [r9 + rdi - 0xc]
lea r9, [r9 + rdi - 0xc]
xor rcx, r10
shr rsi, 0x39
neg edi
rol rcx, 5
bswap rcx
neg edi
push rsi
setb byte [rsp + rdi*4]
lea rcx, [rcx + rdi*2 + 0x721cda3b]
not rcx
not dx
neg rcx
jmp 0x141832240
lea rsp, [rsp + 0x10]
call rax
mov r11d, 0x7d3feaa7
mov rsp, qword [r11 + rbp - 0x7d3feab7]
movzx edx, r11b
mov edi, r11d
mov rbp, qword [rbp + r11 - 0x7d3feaaf]
jmp 0x1417c2472
cdqe
xadd esi, eax
xor rcx, 0xfffffffff412d8ac
sub word [rsp + rdi + 2], dx
and bp, bp
bswap rcx
btr si, dx
adc word [rsp + rdi + 4], dx
xor r10, rcx
mov qword [rdi + r8 - 0xe], rcx
lea r8, [rdi + r8 - 0xe]
movzx ecx, bp
xor ecx, ecx
cqo
pop rcx
jno fcn.1417fa90c
Function at 0x1417f0d08
Capabilities:
Manually build aes constants

Disassembly:
xor r11d, 0x43acc01f
dec cl
jne 0x14182a928
not al
add ecx, r11d
dec al
neg si
xadd dl, dil
xor al, 0x3b
xadd di, r11w
and esi, 0x423ecd9e
dec al
btc rdx, rsi
rol al, 1
imul rdi, rsi
adc r11b, sil
lea rdi, [rdx*4 + 0x5b382f22]
xor r10b, al
rol ebp, 0x4a
inc ecx
adc rax, rsp
mov rcx, qword [rcx + rax - 0x171]
mov qword [r8 + rdx*2 + 0x20fd2590], rcx
bt r11d, edx
mov ecx, dword [r9 + rdi*4 - 0x64f78fde]
btc r11w, 0xad
bts rdx, rdx
inc r11d
xor ecx, r10d
xor ecx, 0xaf914da7
neg ecx
lea rax, [rsi*8 + 0x29a1953a]
sar dl, 0xa1
cdqe
not ecx
adc dil, dl
setle dil
ror ecx, 3
btc esi, eax
cmovb rbp, rax
push r10
lea r10, [rbp + 0x1930b499]
inc rdi
call fcn.141829729
bswap r11d
mul dx
lea rdi, [rbp + rcx - 0x1c485159]
push rcx
dec r11d
mov qword [rsp + rsi*4 - 0x2d40af4], rax
mov qword [rsp + rdx*2 + 0x72136b0a], r10
mov qword [rsp + rsi - 0xb5029f], rdi
xor dword [rsp + rsi*2 - 0x16a0556], r11d
call fcn.1417c0037
adc rax, rsp
bts esi, ecx
btc rdi, 0x8f
mov rdi, qword [rax + r11 - 0x2000008]
and bp, 0x6013
add ecx, 0xd3908994
mov qword [r11 + r8 - 0x2000008], rdi
and rdx, rbp
lea rax, [rcx + rbp*2 - 0x7674b4f7]
jmp rbx

Function at 0x1417f9630
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [r9 + rdx - 0x20bf8450]
movzx eax, dil
setns dil
or edi, 0xf687adb0
xor edx, r10d
ror edx, 1
lea edx, [rdx + rcx*4 + 0x2b0cd4df]
mov qword [rsp + rcx - 0x15ff84a8], rdi
btc di, 0x13
sub word [rsp + rcx - 0x15ff848c], 0x6130
rol edx, 1
sub edx, 0xb58e58b5
sar edi, cl
movzx r11d, al

Function at 0x1417fac79
Capabilities:
Parse pe header

Disassembly:
mov qword [r8 + rax*2 - 0x101c8], rbp
mov qword [rsp + rax - 0x80e2], rdi
sbb rdx, 0xd0bfa3d
lea r8, [r8 + rax - 0x80e6]
sub word [rsp + rax*4 - 0x20373], 0x5f06
mul rcx
dec dl
pop r11
pop rdi
pop r11
jl fcn.1417fa90c
Function at 0x1417facb2
Capabilities:
Parse pe header

Disassembly:
dec qword [rsp + 8]
shl byte [rsp + 0xb], 0xa7
adc r8, 0xc
xor esi, esi
test rcx, rcx
call fcn.1417a5b88
mov ebp, 0x7590923b
movsx esi, bp
lea r9, [rbp + r9 - 0x7590923f]
lea r11, [rsi + rsi*4 - 0x30e506d0]
mov edi, dword [r9 + rbp - 0x7590923b]
btc si, si
or rbp, 0x2c9eb89d
xor edi, r10d
lea rdx, [rbp + rsi*2 - 0x58f376eb]
xor ebp, 0xc416f88f
dec rsi
rol edi, 2
lea rcx, [rbp*2 - 0x7842f4e9]
sal rdx, 0x56
dec edi
shr si, 0x44
neg edi
shl si, 0x44
dec edi
or edx, ecx
call fcn.1417ccab6
mov esi, 0x9ca487ad
movzx cx, byte [r8 + riz]
movzx ebp, sil
movsx edi, sil
mov bpl, byte [r8 + rbp*2 - 0x158]
or cl, bpl
not cl
movzx edx, di
lea r11, [rdx*4 - 0x3379f1c5]
mov word [rdx + r8 - 0xffab], cx
bt dx, di
mov rsi, qword [r8 + rdx*4 - 0x3feb2]
movsx ecx, dx
setb dil
mov cl, byte [r11 + r8 + 0x3375f31b]
movzx eax, dil
sub ax, ax
shl rax, 0xf5
shr rsi, cl
cwde
mov qword [r8 + rdx - 0xffa9], rsi
add eax, dword [rdx + r9 - 0xffb1]
movsx esi, dx
xor eax, r10d
lea eax, [rax + rdx*2 - 0x1d8346ec]
lea rcx, [rdi*4 - 0x30727062]
shl rdx, cl
adc edx, edi
not eax
inc eax
sar dx, 2
cmovne r11, rdx
lea rcx, [rsi + rcx*4 - 0x205803f5]
not eax
neg eax
shr dx, 0xf
sub rcx, 0x7d393fb8
sub edi, edx
push r10
xor dword [rsp + rdi - 0xff00], eax
movsx r10d, r11b
dec di
pop r10
bt di, 0x82
movsxd rax, eax
movsx ebp, si
btr r11, 0x2e
sar esi, cl
add rbx, rax
add dx, dx
mov rcx, qword [r8 + rdi*8 - 0x7f7f4]
lea r8, [r8 + rdi - 0xfef3]
not rdx
movzx edx, byte [r9 + rdi*8 - 0x7f7fd]
jne 0x14180f777
bts esi, 0x20
setae bpl
lea r9, [r9 + rdi - 0xff04]
xadd r11, rbp
xor dl, r10b
sub rsi, r11
ror dl, 1
lea rax, [rdi + r11*4 - 0x685182e7]
neg r11d
neg dl
sal rbp, 0x43
cwde
or si, si
sbb dl, dil
sal rax, 0x51
setb dil
rol dl, 1
and r11b, r11b
jg 0x1417d7f96
mov r11d, dword [r8]
add r8, 4
mov ebp, 0x1605eb0b
lea r9, [r9 + rbp*2 - 0x2c0bd618]
movsx ecx, bp
mov eax, ecx
movzx esi, word [rbp + r9 - 0x1605eb0b]
movzx edx, al
xor si, r10w
inc si
xor ebp, 0x60bcc41d
movzx edi, bpl
jg 0x1418306b4
adc rbx, rsi
and di, word [rsp + rdx*2 + 3]
inc dil
pop rsi
pop rsi
pop rbp
jae fcn.1417fa90c
Function at 0x1417fae29
Capabilities:
Parse pe header

Disassembly:
neg byte [rsp + rbp - 0xfffc]
sbb ebp, esi
mov qword [rsp + rbp - 0xfff7], r10
lea rax, [rbp + rdx*2 - 0x334391c4]
shl ebp, 0xfd
xor dword [rsp + rdx - 0x5810eaaf], ecx
shl dx, 0x8b
mov r10, qword [rsp + rdi*2 + 8]
movsxd rcx, ecx
sar edx, 0x8c
sbb di, 0x66b8
not rax
add rbx, rcx
xor bp, dx
not bpl
mov edi, dword [r8 + rdx*2 - 0xb0216]
movsx r11d, sil
movzx ecx, word [rsp + rdx*4 - 0x160428]
dec ebp
adc cl, byte [rdx + r8 - 0x58107]
dec rbp
mov qword [rsp + rdx - 0x58103], rax
xchg edx, r11d
lea r8, [rdx + r8 + 2]
jl 0x1417e3f3e
cwde
sal edi, cl
lea rcx, [rbp + r11*8 - 0x53fbcf7d]
mov dword [rdx + r8], edi
or qword [rsp + rdx], rbx
ret 8
mov qword [rsp + rax + 0xed80c1], rdi
xor r10w, bp
add r11b, sil
lea rbp, [rsp + rbp + 0x10]
mov rdi, qword [rbp + rax + 0xed80c1]
mov qword [r8 + rax*2 + 0x1db0176], rdi
imul word [rsp + rax + 0xed80c8]
movzx ebp, ax
lea r8, [r8 + rax*4 + 0x3b5fbf4]
mov edx, dword [r9 + rcx*2 - 0x1f370]
lea r9, [r9 + rax*2 + 0x1dafdf6]
jae 0x14181ea75
bt rbp, rcx
pop rax
xor edx, r10d
movzx edi, al
pop rax
neg edx
imul ecx, edi
dec edx
sal ax, 0xed
jbe 0x1417b92ea
mov edi, dword [r8]
movzx ecx, byte [r9 - 1]
mov esi, 0x8005693c
xor cl, r10b
rol cl, 1
lea r11, [rsi + rsi*4 - 0x36cb69c8]
movsx ebp, r11b
sub r11, 0x77b32a8c
not cl
bts r11, rbp
inc cl
movzx edx, sil
bswap r11d
xor cl, 0x36
jmp 0x14181b0c3
add cl, 0x1c
rol rbp, 0x20
sbb rdx, rbp
xor r10b, cl
xor r11, 0xffffffffbd222f98
adc rcx, rsp
lea rax, [rdx*2 - 0x284a1dc2]
neg ebp
idiv rax
mov dword [rcx + rbp], edi
and rax, rsi
call fcn.14180a3d0
sub r9, 4
mov ecx, 0x5810eab7
push rcx
mov ecx, dword [r9 + rcx - 0x5810eab7]
mov edx, dword [rsp + 3]
mov ebp, dword [rsp + rdx*4 - 0x15e]
xor ecx, r10d
xor ebp, ebp
xchg byte [rsp + rdx - 0x54], bpl
inc ecx
movzx edi, bp
push rdi
xchg qword [rsp + rdx - 0x50], rdx
ror ecx, 1
dec bp
movsx esi, byte [rsp + rdx - 0x5810eab6]
sal si, 0x67
xor ecx, 0xd11a4b26
mov byte [rsp + rbp*2 - 0x1fff3], dil
sub ecx, 0xab147c80
jmp 0x1417cfdce

Function at 0x1417fb92b
Capabilities:
Encode data using base64

Disassembly:
movzx edi, bpl
call fcn.141828da2
not rcx
lea rcx, [rcx + rdi*2 - 0x68e145d8]
sbb si, ax
ror rcx, 1
cwd
idiv bpl
lea rbp, [rsi*2 - 0x54cb142]
xor r10, rcx
inc rdx
mov qword [r8 + rdi*2 - 0x19f12], rcx
cdq
movsx ecx, dil
lea r8, [rdi + r8 - 0xcf8c]
setnp dl
jg 0x1417f7d4f
not r11d
xadd word [rsp + rdx*2 - 0x3f0], dx
lea rbp, [rdx + rdx*4 + 0x77a90d9d]
mov dword [r8 + rdx*2 - 0x143f6], r11d
mov ebp, dword [rdx + r9 - 0xa203]
sbb word [rsp + rdx - 0xa1f2], 0x3414
xadd dword [rsp + rdx*2 - 0x143f2], edx
sbb r9, 4
xor ebp, r10d
ror ebp, 1
inc byte [rsp + 8]
lea ebp, [rbp + rdx - 0x20c0045f]
xchg word [rsp + 5], dx
call fcn.141816c3b
cwde
jnp fcn.1417fa90c
lea r11, [r11 + 0x3ea39081]
add rdx, rsp
jmp 0x141826848
rol word [rsp + rbp*2 - 0x2e6cc458], 0x8f
adc sil, 0x2b
mov qword [rax + r11 - 0x4a070000], rcx
and eax, dword [rsp + rax - 0x4a06ffee]
push rax
sar rax, 0xd6
mov rsi, qword [r8 + rax + 8]
je 0x1417f7707
Function at 0x141807b55
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
neg r11d
mov dword [r8 + rdi*2 - 0x45315ef4], eax
xchg dword [rsp + rdi*2 - 0x45315ee6], r11d
mov dword [r8 + rbp*4 - 0x3d8], ebx
shr rbp, 0xb7
and bp, r11w
mov dword [r8 + rdi*2 - 0x45315efc], ecx
pop rbp
mov qword [rsp + r11 - 0x2244], rdi
mov dword [r11 + r8 - 0x224c], edx
movzx ecx, word [rsp + r11*2 - 0x4488]
mov rbx, qword [rsp + r11*2 - 0x4480]
sbb cx, word [rsp + r11 - 0x2240]
xchg word [rsp + r11 - 0x224c], cx
or ecx, 0x10b7fe01
pop rcx
pop rcx
pop rax
pop rax
jne fcn.1417fa90c

Function at 0x14180e7ec
Capabilities:
Authenticate hmac

Disassembly:
movzx eax, byte [rcx + r9 - 0x72950009]
bts ecx, edx
xor al, r10b
add al, cl
dec ebp
dec rcx
ror al, 1
neg al
mov qword [rsp + rdx*2 - 0x103f0], rdx
rol word [rsp + rdx - 0x81ee], 0xcf
xor al, 0xb6
mov qword [rsp + rcx - 0x7294fff8], rbp
sub qword [rsp + rdx - 0x81e8], 0xffffffffd405f63b
rol al, 1
pop r11
xor al, bpl
lea rcx, [rdx*2 - 0x466cafda]
rol al, 1
lea rsi, [rdx*2 - 0xe7589d8]
movzx edi, byte [rsp + rdx*4 - 0x207ee]
xor r10b, al
jmp 0x14182af48
Function at 0x141811824
Capabilities:
Encode data using base64

Disassembly:
mov esi, dword [r9 + r11*2 - 7]
shl bpl, 0xc1
shr r11b, 0x42
mov eax, r11d
xor esi, r10d
xor esi, 0xaf914da7
btr dx, cx
bt rcx, rcx
neg esi
btc r11w, bp
not esi
cqo
dec ebp
cwde
ror esi, 3
idiv ecx
ror edi, cl
xor cl, 0x9f
push r10
not dl
jnp 0x1417fea0b
not ax
rol ax, 1
dec ax
xor r10w, ax
mov word [r8 + rdi - 0x4313bea4], ax
lea r8, [rdx + r8 + 4]
mov esi, dword [r9 + rdx - 6]
neg dword [rsp + rdx + 4]
call fcn.14181a13e
sar byte [rsp + rdx*2], 4
rol sil, 1
shl edi, 0xcc
xor r10b, sil
rol qword [rsp + rdx + 0x10], 0x11
lea rsi, [rsp + rsi + 0x18]
ror r11, 0x20
jb 0x14182bcb2
xor sil, r10b
rol rbp, cl
ror sil, 1
mov qword [rsp + r11*4], 0xffffffffdc3a839d
dec byte [rsp + rdx - 0x7b811e3a]
pop rdi
not sil
add sil, 0x17
sub r11w, dx
btc edx, r11d
dec edi
xor sil, 0xbd
xor r10b, sil
sar r11d, 0xf8
add dx, cx
adc rsi, rsp
btr ecx, ecx
mov dword [rsi + r11*2], eax
inc ecx
sal rdx, cl
jb 0x14178ee4a
call fcn.1417bad90
bswap r11d
btr bp, cx
inc word [rsp + rcx*4 - 0x1c14000a]
xchg di, bp
xor r11d, 0x383f215
ror rdi, cl
jb 0x141824766
jae 0x141821f85
mov edi, dword [r8]
mov ecx, 0xd919afbe
mov esi, dword [r8 + riz + 4]
movzx ebp, cl
push rcx
movsx edx, byte [rsp + rbp*8 - 0x5ec]
not edi
lea rax, [rdx*2 - 0x4bf9d544]
not esi
or ax, 0xc0bc
and edx, ecx
shr bpl, 0xc4
and edi, esi
bt rbp, rdx
inc byte [rsp + rbp*2 - 0x12]
pop rax
mov dword [rbp + r8 - 7], edi
or cx, ax
mov rsi, qword [r8 + rbp*2 - 0x12]
ror rbp, 0x1a
mov cl, byte [rdx + r8 + 0xc]
shr rsi, cl
mov qword [r8 + rdx + 6], rsi
shl al, 0xe1
movzx eax, word [r9 + rdx*2 - 2]
xor ax, r10w
not ax
sal rbp, 0xd2
push rbp
lea rdi, [rdx + rdx + 0x4313bea8]
neg ax
or bpl, dil
not ax
shl dword [rsp + rdx*2 + 4], 0x2a
jnp 0x1418103e0
dec ax
jmp 0x1417c7583
ror r11d, 2
dec r11d
sal qword [rsp + rcx*2 - 0xe0a0006], cl
xadd word [rsp + rcx - 0x7050000], ax
jno 0x1417b9878
mov cx, word [r8]
mov r11d, 0x44009e95
movzx edx, r11w
xchg r11d, edx
mov si, word [r8 + r11*4 - 0x27a52]
not cx
not si
and cx, si
mov word [r8 + r11*4 - 0x27a52], cx
movzx edi, dl
mov rdi, qword [r8 + r11 - 0x9e93]
movzx eax, r11b
mov cl, byte [r8 + r11*4 - 0x27a4a]
xadd r11, rax
lea rsi, [rax*8 - 0x758184e]
shr rdi, cl
bts edx, 0x84
shl si, 0xa4
bts esi, eax
mov qword [r11 + r8 - 0x9f26], rdi
movzx edi, r11b
lea r8, [r11 + r8 - 0x9f26]
movzx ebp, sil
bt di, ax
mov ebp, dword [r9 + r11 - 0x9f2e]
movsx ecx, al
sal cl, 0xe4
bswap r11
lea r9, [rdx + r9 - 0x44009e99]
inc si
not dil
xor ebp, r10d
inc r11b
call fcn.141806b1b
mov ecx, 0xe024df9c
jmp 0x141833234
cmovs rdi, rbp
lea r9, [r9 + rsi - 0x70a30e6e]
push rbp
movsx ecx, word [rsp + rsi - 0x70a30e69]
mov esi, dword [r9 + rsi - 0x70a30e6a]
sar di, 0x61
jbe 0x141807454
Function at 0x14181634c
Capabilities:
Encode data using base64

Disassembly:
sub r11w, si
mov r10, qword [rsp + rdi + 0x36e4994c]
mov qword [rsp + r11*2 + 0x809602c], 0x7e8b000c
lea r8, [r8 + r11*2 + 0x8096020]
mov dword [r11 + r8 + 0x404b012], edx
mov qword [rsp + r11 + 0x404b012], rdi
pop rcx
pop rax
jne fcn.1417fa90c
mov edi, 0x71b0c915
lea r9, [r9 + rdi - 0x71b0c919]
movsx ebp, dil
movsx ecx, bp
movzx r11d, di
mov esi, dword [r9 + rbp - 0x15]
movzx edx, dil
xor r11w, cx
xor esi, r10d
xor r11w, dx
sbb esi, 0xbe8d5f2a
sub r11b, r11b
call fcn.1417d7eea

Function at 0x14181a13e
Capabilities:
Authenticate hmac

Disassembly:
sub word [rsp + rdx + 0xb], dx
lea r9, [rdx + r9 - 6]
movzx ecx, word [rsp + rdx + 8]
rol dil, 0x25
xor esi, r10d
dec dword [rsp + rdx + 9]
ror esi, 1
mov qword [rsp + rdx*2], rdi
xor dl, dh
sbb dword [rsp + rdx + 0xb], ecx
dec esi
ror word [rsp + rdx + 9], 0x4c
adc ecx, 0xb6bd59aa
pop rbp
rol esi, 1
movsx eax, cx
lea esi, [rsi + rdx*2 + 0x2323f408]
div eax
sal qword [rsp + rbp - 0x4313be15], 0x3b
pop rax
push r10
cwde
xor dword [rsp + rbp - 0x4313be15], esi
call fcn.1417f49c2

Function at 0x14181c89a
Capabilities:
Encode data using base64

Disassembly:
xor ax, 0x9d14
xor rax, 0xffffffffdeb6ac81
lea rdx, [r8 + rbx*2 - 0x8a0258]
and dl, 0xf0
dec al
mov rsp, rdx

Function at 0x14181d3de
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor dword [rsp + rsi*2 + 8], ecx
mov qword [rsp + rdi*4 - 0x7fef7b4], 0xffffffffc6ad8809
sal esi, 0x8f
mov r10, qword [rsp + rsi + 8]
inc edx
movsxd rcx, ecx
mov qword [rsp + rsi*2 + 8], 0xffffffffbab7ff2c
adc rbx, rcx
mov rax, qword [r8 + rdi*2 - 0x3ff7bda]
pop r11
add esi, dword ss:[rsi + rax]
jmp 0x141816694

Function at 0x141823fa5
Capabilities:
Encode data using base64

Disassembly:
ror esi, 3
add bp, r11w
mov qword [rsp + rax*2 - 0x5664191c], 0x21003329
ror word [rsp + rdx - 0x4592d1a], 0xcb
mov qword [rsp + rax - 0x2b320c8e], r10
bt edx, r11d
and bp, di
xor dword [rsp + rdx - 0x4592d1b], esi
sub r11d, edx
call fcn.1417b44d9

Function at 0x141826447
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
xor eax, 0x563b8d89
ror eax, 3
call fcn.1417d589b
mov qword [rsp + rdx*2 - 0x227e8e8a], rdx
mov r11d, esi
mov ebp, dword [r8 + rdx*2 - 0x227e8e82]
add r11d, ebp
or rcx, rax
mov ebp, eax
mov dword [r8 + rdx*4 - 0x44fd1d0c], r11d
not word [rsp + rdx - 0x113f4742]
movzx r11d, ax
adc ecx, dword [rsp + rdx*2 - 0x227e8e87]
lea rdx, [r8 + rdx*2 - 0x227e8e82]
mov qword [r8 + rcx*2 - 0x28e66], rdx
sub dword [rsp + rax - 0x4744], eax
xadd r11w, cx
mov edi, dword [rsp + rax - 0x4745]
mov eax, dword [rcx + r9 - 0x14749]
lea r9, [r9 + rcx - 0x14749]
jl 0x1418112e0
xor eax, r10d
xadd byte [rsp + rcx*2 - 0x28e83], r11b
xor eax, 0x6a818693
bswap eax
rol eax, 1
jmp 0x1417d153e
Function at 0x141826e2f
Capabilities:
Authenticate hmac

Disassembly:
bts rdx, rdx
cpuid
lea r8, [r8 + rsi - 0xffb8]
movsx ebp, r11w
mov dword [r8 + rsi*8 - 0x7fd74], eax
add r11d, r11d
movzx eax, r11w
mov dword [r8 + rax*2 - 0x1ffec], ebx
js 0x1417961d0
and di, r11w
xadd bpl, al
mov dword [r8 + rsi*8 - 0x7fd7c], ecx
mov dword [r8 + rsi*2 - 0x1ff60], edx
and ebp, eax
sar sil, 0x62
pop rbx
movzx ecx, sil
btr rsi, rdi
cqo
jae fcn.1417fa90c
lea r8, [r11 + r8 - 0xced3]
movsx edi, si
or word [rsp + r11 - 0xced3], r11w
mov word [rsp + r11*2 - 0x19dac], di
mov qword [rsp + r11 - 0xced7], rbx
ret
mov qword [rsp + r11 - 0xced8], rcx
adc rbx, rdi
btc rsi, 0x99
movzx di, byte [r8 + r11*2 - 0x19dae]
mov bpl, byte [r11 + r8 - 0xced4]
sub al, 0x31
invalid
dec dword [rax - 0x3f]
clc
adc eax, dword [rsi + 0x1a]
pushfq
pop rsp
push rsp
invalid
invalid
inc ecx
cli
sub byte [rax + 0x22], al
std
xor dil, dl
ror byte [rsp + r11*2 - 0x19dac], 0x82
mov word [r8 + r11*2 - 0x19daa], di
jb 0x141813720
movsxd rbp, ebp
add rbx, rbp
mov eax, dword [rax + r8 - 0x4812e8d0]
and edx, ecx
btc ecx, 0xb4
sal di, 0xe2
mov ecx, dword [r8 + rcx*4 - 0x4002b0]
sar r11b, 0x45
push rbx
shr dil, 0xe2
jae 0x14179591c
Function at 0x14182aebf
Capabilities:
Authenticate hmac

Disassembly:
pop rcx
mov qword [rsp + rsi*2], rbx
ret
rol bpl, 0x46
adc rbx, rdi
jmp rbx
lea r8, [r8 + r11 - 0x74afcf39]
lea rdx, [r11 + 0x511c5c3d]
btc r11d, 0x35
mov word [r8 + r11 - 0x748fcf3f], ax
mov eax, ecx
neg dil
lea r9, [r9 + r11 - 0x748fcf43]
mov esi, r11d
lea rsi, [rdi + rsi*4 - 0x63f37fcd]
mov edi, dword [r9 + r11 - 0x748fcf3f]
cqo
xor edi, r10d
movsx ebp, cx
sal dl, 0x27
not edi
shl r11b, 0xa6
xor edi, 0x9a94189c
sub edi, 0xd10888aa
xadd dl, r11b
sar r11b, 0xc1
xor edi, 0x35934e01
mul rbp
inc rbp
push rdx
inc edi
xadd rbp, rax
adc eax, dword [rsp + r11 - 0x748fceff]
pop rsi
push r10
btc rax, 0x8c
xor dword [rsp + r11 - 0x748fcf00], edi
idiv ax
movzx r10d, dl
sal ax, 0x83
pop r10
xadd si, ax
neg r11
add esi, ecx
movsxd rdi, edi
jg 0x1417f9e2d
sub r9, 4
mov r11d, 0x482af8aa
mov edx, dword [r9 + r11 - 0x482af8aa]
movzx ecx, r11w
movzx edi, r11b
lea rsi, [r11 + rdi + 0x3a90150f]
xor edx, r10d
rol r11b, 0x42
push rsi
mov byte [rsp + rcx - 0xf8a9], 0x97
dec edx
call fcn.14182af9f
mov r11, qword [r8 + rdi*2 + 0x10]
dec di
mov qword [rsp + rdi - 0xffff], rbp
adc rdx, r11
rol rbp, 0xf7
lea rax, [rsi + rbp + 0xc2fa60e]
call fcn.1418337bc
xor eax, 0x6cb2299e
movsx esi, dx
sub eax, 0x8c23261a
push r10
btr esi, esi
movsx ebp, dil
push rsi
xor dword [rsp + rdx + 8], eax
mov r10, qword [rsp + rdx*2 + 8]
movsxd rax, eax
shr rsi, 0xe8
mov qword [rsp + rdx*4 + 8], 0x171bbda9
sbb edx, 0xc023d01
add rbx, rax
xor edi, dword [r8 + rdi]
mov eax, dword [r8 + rsi + 4]
lea r8, [r8 + rsi*2 + 4]
or edi, eax
not edi
mov word [rsp + rsi*2 + 2], 0x459b
btc rbp, rbp
mov dword [r8 + rsi], edi
mov ecx, 0xf0b4b108
jae 0x1417d9dbb
rol rsi, 0x4c
adc cx, 0x68bd
lea rax, [rsp + rax + 0x18]
mov r11d, 0xd3254d14
sub qword [rsp + rdx - 0x81fb], r11
mov r11, qword [rcx + rax + 0x466b431c]
jge 0x141834482
mov rbp, qword [r8]
mov eax, 0x74afcf3f
mov r11d, eax
mov ax, word [rbp + r11 - 0x74afcf3f]
movsx ecx, r11w
mov edi, ecx
jmp 0x14181b220
sub dl, sil
xor rcx, rcx
mov qword [r8 + rcx*4 - 0x10], r11
movsx r11d, sil
lea r8, [r8 + rcx*8 - 0x10]
and rsi, rbp
imul edx, ecx
mov edi, dword [rcx + r9 - 0xd]
shr cl, 0x24
sar r11d, 0xe1
inc byte [rsp + rcx + 0xd]
lea r9, [r9 + rcx - 0xd]
jb 0x1417fa58f
inc si
rol ebp, 1
bt edx, 0x9a
xor ebp, 0x43acc01f
shl dword [rsp + rdi - 0xb80b], 0x23
xor qword [rsp + rsi - 0x41a8f13a], 0x49ae760f
sbb rax, 0xffffffff84a10d0c
bswap ebp
cdqe
sbb ebp, edx
shl rsi, 0x91
mov qword [rsp + rax*2 - 0x6faa25de], r10
lea rcx, [rdi + rax*8 + 0x1d85163b]
add ax, di
xor dword [rsp + rax - 0x37d5cafb], ebp
pop rsi
pop r10
movsxd rbp, ebp
shr r11d, 0x2f
adc rbx, rbp
call fcn.1417e33fc
Function at 0x14182cdec
Capabilities:
Encode data using base64

Disassembly:
cqo
lea esi, [rsi + rdi*2 - 0x60a4a7a2]
mov qword [rsp + rdi - 0xd780], 0xffffffffa7b86d95
sub dl, 0xae
rol esi, 2
neg rdi
rol qword [rsp + rdi*4 + 0x35e00], cl
mov qword [rsp + rdi*2 + 0x1af00], r10
setb bpl
push rbp
xor dword [rsp + rdi + 0xd788], esi
mov r10, qword [rsp + rdi + 0xd788]
call fcn.141789062
add rbx, rdi
add si, ax
movzx edi, si
movzx edi, byte [r11 + r9 - 0x38]
mul r11b
shr al, 0x23
xor dil, r10b
shr dl, 0xc1
ror r11, 0x7e
adc dil, 0xa1
cdq
xor dil, 0x36
btc ebp, esi
lea rcx, [rbp + 0x67ad94af]
cwde
sbb dil, 0x3f
lea rdx, [r11*8 - 0x36f0a0e7]
shl si, cl
setb cl
not dil
imul cl
btc rax, 0x9c
xor dil, 0xaf
sal cx, 0x81
js 0x14182ba12
Function at 0x14182f844
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dword [rsp + rax - 0x9213], ebp
sub word [rsp + rdx - 0x79640a34], cx
bt edx, esi
mov r10d, 0x2480ae1e
mov r10, qword [rsp + rax - 0x9213]
jae 0x1417a5006
xor r10b, r11b
lea r11, [rsp + r11 + 0x18]
mov eax, dword [r11 + rbp*4 - 0x2890]
mov dword [rbp + r8 - 0xa28], eax
mov qword [rsp + rbp*2 - 0x1438], 0xffffffff9120a42f
mov qword [rsp + rbp*2 - 0x1448], rcx
mov ebp, dword [rbp + r9 - 0xa29]
xor ebp, r10d
not ebp
movzx eax, word [rsp + 7]
sal cl, cl
xor ebp, 0x3093cb86
div byte [rsp + rax - 0x240c]
mov edx, ecx
and dl, ah
neg ebp
mov esi, edx
lea rdi, [rax + rdx*8 - 0xc444bdb]
ror ax, 0x69
lea ebp, [rdx + rbp + 0x49d6d5fe]
sar dword [rsp + rax - 0x921b], 0x38
adc ecx, eax
shl rsi, cl
mov qword [rsp + rax - 0x9213], r10
sbb word [rsp + rcx - 0x79649c5a], 0x6cbb
jne 0x1417ce8e8
mov eax, 0xafbbd4ad
mov r11d, eax
mov r11d, dword [r9 + riz - 4]
cqo
mov esi, edx
xor r11d, r10d
movzx ebp, dx
mul rdx
not r11d
ror r11d, 3
lea rax, [rsi*4 + 0x220a278f]
xor al, dl
inc al
xor r11d, 0xd1b86e11
jmp 0x1417ff1e7

Function at 0x1418302ff
Capabilities:
Authenticate hmac

Disassembly:
shl rdi, cl
xor dword [rsp + rsi*2 - 0x28319e20], ebp
mov qword [rsp + r11 - 0x4be1fe27], rsi
ror ax, 0x8f
mov r10, qword [rsp + rsi*2 - 0x28319e20]
sar cl, 0x86
movsxd rbp, ebp
jbe 0x1417f4343

Function at 0x141831b07
Capabilities:
Encode data using base64

Disassembly:
inc r11
movsxd rdi, edi
mov qword [rsp + rcx*2 - 0x9756], 0x35bc7f8e
or word [rsp + rcx*4 - 0x12eaa], 0xeb80
btr r11, 0xb6
add rbx, rdi
Function at 0x141834217
Capabilities:
Authenticate hmac

Disassembly:
div dil
xor r11d, r10d
inc rbp
dec r11d
mov qword [rsp + rdx*2 - 0x2345583c], rcx
cwde
mov qword [rsp + rbp*2 - 0x15866], rsi
rol r11d, 1
lea r11d, [r11 + rdx*2 + 0x665539bd]
and si, cx
and edx, 0x3683180e
neg r11d
lea r11d, [r11 + rsi - 0x403ac3fa]
shl rdi, cl
xchg qword [rsp + rdx*2 - 0x21040fdc], rbp
xadd qword [rsp + rdx*2 - 0x21040fdc], rsi
xor r11d, 0x8884002c
not rax
inc r11d
mov qword [rsp + rsi - 0xac0b], r10
call fcn.1417914a1
mov r11d, 0xb791bf01
movzx edx, byte [r9 + riz - 1]
movzx ecx, r11b
xor dl, r10b
bts r11, r11
inc cx
neg dl
inc dl
movzx esi, cl
neg dl
xor dl, 1
lea rbp, [r11 + r11*4 + 0x6eb7a504]
inc bpl
bt bp, 0xa5
xor r10b, dl
rol r11b, cl
adc rdx, rsp
bswap rcx
mov edi, ebp
push r11
mov rax, qword [rdx + rsi*4 - 8]
call fcn.14181aa9b