joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140494b87
Capabilities:
Encode data using xor

Disassembly:
add cl, bpl
test ebp, 0x7701ec29
mov qword [rsp + 0x20], rbp
push r9
jb 0x14054cba9
movabs r9, 0x2d284faeef2fc9a5
lea rsi, [rsi + rbp + 0x400c1086]
neg r9w
bswap ecx
call fcn.140402477
jge 0x1405015a8
pop rsp
sbb dword [0x140494bb5], eax
xor byte [rbx], bl
add byte ss:[rbx + rbx + 0x36], ch
add byte [rbx + riz*8 - 0x2abffad], al
fist word [rdi + 0x6f]
xchg edx, eax
loop 0x140494b53
cdq
invalid
invalid
jo 0x140501507
or byte [rdi], dh
cwde
or byte [rax + 0x292467d8], ah
xchg esi, eax
shl dword [rdi + 0x5e], cl
lea esi, [rcx + 0x29]
cwde
movabs eax, dword [0x79c6cd9837c65355]
invalid
mov eax, 0xea0a0bbf
mov al, 0xcc
test eax, 0x14bd4802
and al, 0x16
out dx, al
adc dl, byte [rbx - 0x64]
mov edi, 0xc6edc040
add rbp, 0x5f2042b8
mov r8, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffff83ff0645
mov rbp, qword [rsp + 0x10]
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1407dd35b
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
call fcn.1407dd35b
cmpsd dword [rsi], dword [rdi]
jo 0x140501568
movsd dword [rdi], dword [rsi]
ja 0x140501549
out 0xe3, al
sti
push rcx
mov r13b, 0x99
or esi, dword [rbp - 0x7f]
mov bh, 0x19
or al, 0x15
ret
call fcn.1406175b4
movsb byte [rdi], byte [rsi]
xchg byte [rdi + 0x23], dh
mov edi, 0x2e64b33c
mov edi, 0x24c5af92
mov edi, 0x40d368e4
adc dword [rcx + rdi*8 - 0x3a], ecx
jns 0x14054cbf1
pop rbx
int3
invalid
sbb dl, bh
cwde
mov bh, 0x20
mov edi, 0x35265855
mov edi, 0x61c1feca
in eax, 0x81
in eax, dx
jno 0x14054cbd8
in al, 0xd2
stosd dword [rdi], eax
retf

Function at 0x1404bf5f8
Capabilities:
Encode data using xor

Disassembly:
jbe 0x1405f8353
push rdi
pushfq
movabs rdi, 0x93a42103b200f09a
mov rdi, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffff89e5735c
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14074373c
call fcn.14045b5f8

Function at 0x1404c3d77
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
jle 0x1403c2a43
mov r15, qword [rsp + r15 - 0x6e3de935]
or byte [rsp + rbp + 0x3df600d8], 0x9b
jb fcn.14043e6a3
jb fcn.140591a4d
setae byte [rsp + rbp + 0x3df600d8]
ja 0x1405ee4d9
fild qword [rcx - 0x2fc33328]
sar dword [rbp + 0x16], 0x74
test byte [rdx - 0x5fedb007], cl
loop 0x1404c3dc6
test byte [rcx], bh
xchg esp, eax
invalid
pop rsi
shl byte [rbx + 0x33], cl
outsb dx, byte [rsi]
ror byte [rcx], 0xa6
invalid
neg dword [rsp + rbp + 0x3df600b0]
mov rbp, qword [rsp + rbp*2 + 0x7bec0070]
setbe byte [rsp + 0xb0]
and dword [rsp + 0xb8], 0x74100031
setno byte [rsp + 0xd8]
call fcn.1404215a7

Function at 0x1404c72d9
Capabilities:
Authenticate hmac

Disassembly:
and r10b, 0x19
setns al
neg sil
Function at 0x1404c73b3
Capabilities:
Authenticate hmac

Disassembly:
shl word [rsp + 0x50], 0xb6
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x58]
ret
mov qword [rsp + 0x50], rdi
xchg qword [rsp + 0x58], rdx
mov rdi, qword [rsp + 0x40]
and qword [rsp + 0x50], 0xffffffff86236509
shr word [rsp + 0x50], 0x1b
jne 0x14055ae64
shr dword [rsp + 0x50], 0x10
shr dword [rsp + 0x50], 0xab
jae 0x1403573bb
movabs rbx, 0x4ba8e13027345e94
mov qword [rsp + 0x18], 0x495d17ed
mov rbx, qword [rsp + 0x10]
add qword [rsp], 0xffffffffbfa309d5
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140830feb
je 0x1405857c0
jns 0x1405f4911

Function at 0x1404d03d9
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
lea rdx, [rdx + rdx*8 - 0x6d59b156]
mov qword [rsp + 0x18], rdx
push rcx
mov rcx, qword [rsp + 0x20]
mov dword [rsp + 0x20], 0xbbb32137
call fcn.14052a7dd

Function at 0x1404d5ccd
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], 0x43ffe29e
lea rsp, [rsp + 8]
call fcn.1407dd35b

Function at 0x1404d5d04
Capabilities:
Authenticate hmac

Disassembly:
mov rsi, qword [rsp + 0x40]
mov rsi, qword [rsi]
movabs rbx, 0xb68bbd06b4050713
mov r15, r8
not bx
seta r8b
jns 0x1405f65e2
cmp ebx, 0x4727c322
setns r15b
lea rsi, [rsi - 0x25c767c4]
not bx
mov qword [rsp + 0x40], r8
mov rbp, rbx
add cl, cl

Function at 0x1404d92bd
Capabilities:
Authenticate hmac

Disassembly:
pop rdx
push rdx
push rbp
pushfq
movabs rbp, 0x48a60b0ada090e08
movabs rdx, 0x938f70a3ecbefa9a
shr edx, 7
push r11
call fcn.1404ba302

Function at 0x1404e8849
Capabilities:
Packed with generic packer

Disassembly:
not bx
mov word [rsp + 0x30], 0xfe30
cmp r10d, ebx
mov r10, qword [rsp + 0x18]
lea rbx, [rbx + rbx*2 + 0x4226c80c]
sete byte [rsp + 0x30]
sub word [rsp + 0x30], bx
sub word [rsp + 0x30], 0xe06
lea rbx, [rbx*4 + 0x112e4017]
call fcn.140657388

Function at 0x1404f234d
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
not word [rsp + 0x38]
shr qword [rsp + 0x60], 0x4d
or word [rsp + 0x60], 0x1025
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x80]
ret
cmp byte [rsp + 0x60], r9b
not word [rsp + 0x38]
setle r9b
sets r9b
mov r9, qword [rsp + 0x70]
not qword [rsp + 0x38]
shl dword [rsp + 0x38], 0xda
jb 0x1404ec366

Function at 0x1404fa1f9
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rsp + 0x48]
add qword [rsp + 0x50], 0x572702a7
jno 0x14066bed3
out dx, al
xor byte [rcx + rax*2 - 0x40], ah
out 0xd0, eax
shl r15b, 0xd0
and dword [rsp + 0x50], 0x1b2b3531
call fcn.1405dbc69
mov ebx, dword [rdi]
movsb byte [rdi], byte [rsi]
jne 0x14066bed0
sub cl, dh
add byte [rsi - 0x19], dh
call 0x1537fa3c2
fidivr dword [rbx]
xchg byte [0x1abec39e2], al
out 0x86, eax
invalid
Function at 0x14050974b
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
seto byte [rsp]
mov qword [rsp + 8], r13
sub rsi, qword [rsp]
mov byte [rsp + rsi*2 - 0x130], sil
setle byte [rsp]
lea rdi, [rdi + rsi - 0x1d643e70]
ja 0x140553f24
add r13b, 0x88
movabs rsi, 0x493a3730b8837098
shl r13w, 0x1c
add qword [rsp], 0x989bd
not r13
nop
mov rdi, rsi
push rdi
shr edi, 0x73
add r13b, sil
mov dil, sil
jns 0x140517fff
test di, 0x4f86
mov rdi, qword [rsp + rdi*4 - 0x5e58]
mov rdi, qword [rdi]
jge 0x14035223c
iretd
mov qword [rsp + 0x20], rdi
jno 0x1404af871
popfq
lea rsp, [rsp + 0xb8]
ret
and qword [rsp + rsi*8 - 0x4b8], 0xffffffffbf89b992
push rbx
not rsi
seta byte [rsp + 8]
cmp byte [rsp + 8], 0xad
xchg qword [rsp + 0x30], rdi
mov rsi, qword [rsp + rsi + 0xb1]
je fcn.14055ae8c
mov rbx, r13
jg 0x1405cdb09
int 0x7c
and byte [0x17b90600d], ah
xchg r12d, eax
mov cl, 0x1f
rol ah, cl
out dx, al
fistp dword [rdx + rdx*8 - 0x363b0b3c]
int3

Function at 0x14051078f
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
sub word [rsp + r13*8 + 0x525d56b8], 0x45bd
shr r9b, 0xb2
mov r9, qword [rsp + r9*4 + 0x30]
add qword [rsp + r13*4 + 0x292eab68], 0xffffffffbfc0fe02
sub r13b, r13b
xor byte [rsp + r13 + 0xa4bab28], 4
or r13d, 0xec234694
lea r13, [r13*4 - 0x1e57b4e6]

Function at 0x14051b8e5
Capabilities:
Authenticate hmac

Disassembly:
and dx, dx
test word [rsp + 0x48], 0x226
jns 0x140525cf5
setg byte [rsp + 8]
mov rsi, qword [rsp + 0x10]
jo 0x1406b1c55
lea rbp, [rbp + riz - 0x43c1dedc]
not dword [rsp + rbp - 0x323e20dd]
bswap rbp
movsx bp, dl
mov rdx, qword [rsp + 0x38]
jne 0x14065c76b
add byte [rsp + 0x48], bpl
call fcn.1405fcd8a

Function at 0x14051bacd
Capabilities:
Authenticate hmac

Disassembly:
test r14w, r14w
not r14d
jae 0x1406b6afd
movabs byte [0x2b7ddc5741ccc52e], al
leave
add edx, dword [rdi + 0x279fa2f9]
pop rdx
loop 0x14051bb0e
add dword [rbx + rdx], edi
leave
sub eax, 0x9c1f231
invalid
sbb ebx, ecx
xchg ebx, eax
invalid

Function at 0x140525d26
Capabilities:
Authenticate hmac

Disassembly:
cmp r9b, 0x25
call 0x1405c4696
in al, dx
invalid
mov rcx, qword [rsp + r12 - 0x27fffd0]
lea rbx, [rbx + r9 + 0x67b39c35]
jg 0x1403c6010

Function at 0x140525d3c
Capabilities:
Authenticate hmac

Disassembly:
xchg qword [rsp + 0x80], rbx
mov rsi, qword [rsp + r12 + 0x68]
and ecx, r14d
xor dword [rsp + r12 + 0x48], 0x349e46aa

Function at 0x140526bbb
Capabilities:
Authenticate hmac

Disassembly:
jne 0x1406175ae
xor eax, 0x9afd0ac5
out 0xb5, eax
sbb dword [rcx], esp
out dx, al
invalid
Function at 0x14052a7dd
Capabilities:
Packed with generic packer

Disassembly:
movabs r8, 0x8f1f3d82a9386fa6
jl 0x140654737
push r10
lea rdi, [rdi + rbx - 0x4a5ff3f5]
lea r10, [r8*4 - 0x42ec9e00]
shl rbx, 0x41
shl ebx, 0xec
xor r8, qword [rsp]
push r11
lea rbx, [r8 + r10*4 - 0x36e1d5cb]
mov r11, qword [rsp + 8]
cmp ebx, dword [rsp + 0xb]
mov qword [rsp + 0x40], rdi
jbe 0x140430b2b
add qword [rsp + 0x10], 0x4f3888
movabs rax, 0xe89fa33adfab651f
push r11
sub r15d, r15d
call fcn.14000aa42
lea rsi, [rsi - 0x9f08e4e]
movzx edx, word [rsp + 0x2c]
jle 0x1403ada55
xchg qword [rsp + 0x40], rsi
mov rdx, qword [rsp + rdx + 0x33]
shl byte [rsp + 0x28], 0xf8
test byte [rsp + 0x29], cl
jbe fcn.1405dc50f
jge 0x1407008a6
invalid
call 0x140641214
adc bl, byte [rdi + 0x68b7cdee]
lea ebp, [0x11e22b86e]
ficomp dword [rcx - 0x41]
loope 0x140700858
cmp dword [rbx + 0x13], ebp
invalid

Function at 0x14054f504
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
jle 0x14061ce25
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407ca41c

Function at 0x14055ac6f
Capabilities:
Authenticate hmac

Disassembly:
push r10
pushfq
movabs r10, 0xa63c5315d3bf7312
neg r10b
neg r10w
mov qword [rsp + 0x18], 0xffffffff88ec80fc
mov r10, qword [rsp + 8]
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.14074373c
call fcn.14054ecf0
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.14074373c

Function at 0x14055cdfb
Capabilities:
Packed with generic packer

Disassembly:
jo fcn.14055dcc3
call fcn.140432a5f

Function at 0x140560b49
Capabilities:
Packed with generic packer

Disassembly:
mov rsi, qword [rsp + rsi*2 + 0x23c]
jns 0x1406e5470
xchg edx, eax
cmc
invalid
setne byte [rsp + 8]
or byte [rsp + 8], r13b
add rbx, 0xffffffffae09aa22
movzx rbx, byte [rsp + 8]
lea r13, [rbx + r13*2 - 0x4eedffea]
xor r13b, bl
call fcn.1404a5ef1

Function at 0x14056efe2
Capabilities:
Packed with generic packer

Disassembly:
test r10b, r10b
mov r10, qword [rsp + r10 - 0x10706b5c]
push rsi
not r10d
jae 0x1405072da

Function at 0x14059fbb6
Capabilities:
Authenticate hmac

Disassembly:
pushfq
mov qword [rsp + 0x10], 0xffffffff88f2d754
lea rsp, [rsp + 0x10]
call fcn.14074373c

Function at 0x14059fbe7
Capabilities:
Authenticate hmac

Disassembly:
mov rax, qword [rsp + 0x30]
setle bpl
movzx bp, bpl
add ebp, ebp
call fcn.14045764f

Function at 0x14059fc4c
Capabilities:
Authenticate hmac

Disassembly:
setl sil
push r9
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movsx r10, r10w
mov r9w, word [rsp + rsi + 5]
jne 0x1406321ab
movzx r10w, sil
sub r9b, byte [rsp + r10*8 + 0x80004]
movsx r10w, r10b
seto sil
lea rax, [rax - 0x53eabb70]
call fcn.140427759
xchg qword [rsp + 0x68], rdi
mov r13, qword [rsp + 0x60]
js 0x1405e09b3
xor r12b, byte [rsp + r15*2 + 0x31]
setbe r9b
ja 0x1404c72e3
shr word [rsp + r15*4 + 0x30], 0xd9
add qword [rsp + r12 + 0x20], 0x159f5112
neg r12
mov r12, qword [rsp + r12*4 + 0x48]
sete byte [rsp + r15 + 0x28]
shr byte [rsp + 0x30], 0xe1
cmp qword [rsp + 0x20], 0xffffffff82921d83
jo 0x140680750
mov r10, qword [rsp + 0x30]
call fcn.1405a6e49
movabs rsi, 0xec329b0e12a78aa6
call fcn.1404f005a
Function at 0x1405ac2a0
Capabilities:
Authenticate hmac

Disassembly:
jae 0x1405e20bf
jge 0x1405c99e0
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x40], cx
jb fcn.140438c89
mov rcx, qword [rsp + 0x50]
sete byte [rsp + 0x40]
setle byte [rsp + 0x40]
and byte [rsp + 0x30], 0xa3
add word [rsp + 0x30], 0xba2f
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x78]
ret

Function at 0x1405ae5f0
Capabilities:
Packed with generic packer

Disassembly:
sub edi, 0x80ac6b33
mov rdi, qword [rsp + 0x10]
jge 0x1406185f2
loopne 0x1405ae664
stosd dword [rdi], eax
invalid
cmpsb byte [rsi], byte [rdi]
movsd dword [rdi], dword [rsi]
mov edx, 0xfffffebf
push qword [rdx + 0x76377b83]
invalid
call fcn.140364696
sahf
xor ch, ah
invalid
jo 0x1405e22d0

Function at 0x1405b0473
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x10], 0xffffffffc9fb2e23
lea rsp, [rsp + 0x10]
call fcn.140770f17

Function at 0x1405b0486
Capabilities:
Packed with generic packer

Disassembly:
mov rbx, qword [rsp + r9 - 0x55f2e458]
cmovns rbx, r9
mov rbp, rbx
mov rbp, qword [rsp + r9 - 0x55f2e448]
mov rbp, qword [rbp + r9 - 0x55f2e470]
mov qword [rsp + r9 - 0x55f2e448], rbx
js 0x1406c556b
and r9, 0xffffffffbdad0aa4
add word [rsp + rbx - 0x55f2e448], 0xdf05
mov r15, r9
shl qword [rsp + r9*2 - 0x2b400018], 0xaa
push rdi
xor r15w, 0x4f03
lea rbp, [rbp - 0x32ec7f44]
push r11
mov rdi, rbx
test dword [rsp + rbx - 0x55f2e438], 0x98a940ac
seta r9b
not r9w
xchg qword [rsp + rbx - 0x55f2e420], rbp
mov rbx, qword [rsp + r9*2 - 0x2b41ffde]
shl r9w, 0x5d
not r9d
je 0x140642018
or r15w, 0x4287
test rdi, r9
movabs r11, 0x419c45985a8b4903
jne 0x1404d5d78
add byte [rdi - 0x147adae3], ch
pop rsp
or bh, byte [rbx]
call 0x1ba29011d
pop rax
pop rbx
out 0xc4, al
invalid

Function at 0x1405c0bb0
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
jge 0x1406f841e
lea rbp, [r8 + r11*4 - 0x1df5634b]
call fcn.140702c8c
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + rbx + 0x1d74648c]
mov rdi, qword [rsp + rbx*4 + 0x75d191a8]
and edi, 0xc3aba8b2
push rdx
and dword [rsp + 0x20], 0x3ab5b529
lea rcx, [rcx + 1]
push r15
movabs r15, 0x73889785d78958a3
call fcn.1406c5564

Function at 0x1405cf62b
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
push rbx
pushfq
add qword [rsp + 0x10], 0xffffffffbfcaadab
call 0x1404c73e7
push rbx
pushfq
movabs rbx, 0xf0ad45a96d818f32
add bl, 0x37
bswap ebx
mov rdx, qword [rsp + rbx - 0x698f814d]
and ebx, 0x968d0a3e
test rbx, rbx
push rbp
movabs rbp, 0xeebd1c0ae4abe7ae
bswap rbx
jo fcn.1405c694b
jl 0x140581d39
push rbp
lea rdx, [rdx + 1]
jo 0x14040164e
push r14
sub qword [rsp + 8], 0xffffffffd0acba15
call fcn.140607d48
Function at 0x1405d05d5
Capabilities:
Packed with generic packer

Disassembly:
shr dword [rsp], 0x59
sub r9b, byte [rsp + r14 + 0x67]
mov r12, r9
jo fcn.1406fd7e9
xchg qword [rsp + r14 + 0x78], rdx
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + r9]
shl r15, 0x5f
test r12w, 0xb8b0
call fcn.1406fe727
sub byte [rsp + 0x10], 0x1a
call fcn.1405f57d0
movzx r9d, word [rsp + r9 - 0xb8a4]
test byte [rsp + 0x5b], dil
mov qword [rsp + r9 + 0x50], rdi
push rdi
lea rdx, [rdx + rdi*2 - 0xa03850]
je 0x1404008d2

Function at 0x1405d6603
Capabilities:
Packed with generic packer

Disassembly:
jl 0x14036049b
mov r14, qword [rsp + r14 - 0x7cd18fc9]
mov r9, qword [rsp + 0x48]
sub byte [rsp + r9*4 - 0x3463fbc], 0x3a
jae 0x14061250d
neg byte [rsp + r9 - 0xd18fb9]
mov r9, qword [rsp + r9*4 - 0x3463fec]
jle 0x1405919de
add qword [rsp + 0x20], 0xffffffffbf911acb
and word [rsp + 0x48], 0xed84
call fcn.140373a00
invalid

Function at 0x1405e4bc6
Capabilities:
Packed with generic packer

Disassembly:
push rdi
push r12
pushfq
movabs r12, 0xcba69c9e9e80653d
not r12d
lea r12, [r12*8 + 0x7f988d89]
push r8
movabs r8, 0x90308ea7078aa7a8
jge 0x1403ec635
jne 0x1406f5d46
lea rsp, [rsp + 0x50]
ret
ja 0x1404235be
mov rbp, r15
jae 0x14054cc9f
ret
mov qword [rsp + r15 - 0x26], r13
je 0x14051bd1b
lea rdx, [rdx + rbp*2 - 0x234fc2fe]
xor r13, r10
push r14
mov r12, rbp
jo 0x140607683
jge 0x1405c71b6

Function at 0x1405f4909
Capabilities:
Authenticate hmac

Disassembly:
call fcn.14057a537
nop
push r10
jbe 0x140031735
mov r13, rsi
sete sil
add qword [rsp + 0x10], 0x28918e
or esi, 0x54b2bf2f
movabs rax, 0xb7a89a0c232c4525
bswap eax
call int.14059fe6a

Function at 0x1405f8b42
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
add qword [rsp], 0x1a1389
mov rcx, rdx
lea rdx, [rdx + rcx - 0x44c2c8e6]
sub ecx, 0xe01c96b0
jl 0x140464ff3
jae fcn.14069544d
push rbp
movabs rbp, 0x53fc232c03dd286
mov rcx, qword [rsp + rcx - 0x59f56948]
mov rcx, qword [rcx]
movabs r13, 0xf0bb733e8f3f738f
mov qword [rsp + rdx*2 - 0x5ec26e2c], rdx
xor rdx, qword [rsp + rdx - 0x2f613712]
call fcn.140694d13

Function at 0x140607eff
Capabilities:
Encode data using add xor sub operations

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407ca41c
or r15, r15
neg r15
mov qword [rsp + 0x18], 0xffffffffcfe4e86a
mov r15, qword [rsp + 0x10]
jae 0x140607eff
call 0x140607eff

Function at 0x140607f0e
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0
mov rdx, qword [rsp + 0x10]
push 0xfffffffff2302e07
pushfq
sub byte [rsp + 8], 0x85
jg 0x140620b8c
and byte [rdx - 0x5de52ae8], dh
xor al, 0x25
add al, 0x99
and byte [rbp + 0x60], dl
sbb eax, 0xfd8ec08c
cmp byte [0x18e296ef3], r14b
jle 0x140607f0c
nop
insd dword [rdi], dx
sbb ebx, dword [rcx - 0x43]
pop rsi
or edi, edx
movabs al, byte [0x4b63b36561eae864]
out dx, al
pop rdi
mov ebx, 0xb7fbd02b
lodsb al, byte [rsi]
sar al, 0xb6
sal dword [rbp + 0x40b1e618], cl
xchg r14, rax
sub esi, dword [rdx + rbx*2 - 0x30e750a0]
mov cs, edi
invalid
call fcn.1406cd96e
pushfq
xchg ebp, eax
xchg ecx, eax
invalid
Function at 0x14060abe9
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
push rax
push 0x135e531
pushfq
neg dword [rsp + 8]
seto byte [rsp + 8]
call fcn.1403ee3a3

Function at 0x14060abfe
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jo fcn.140505a0f
cmp word [rsp + 0x18], 0x6098
mov rbp, qword [rsp + 0x10]
movzx r11, r11w
jo 0x1405ab264
sub r11, qword [rsp + r11*8 - 0x67670]
mov r11, qword [rsp + 0x20]
call fcn.14064c582
and esp, ecx
invalid

Function at 0x140610e0d
Capabilities:
Authenticate hmac

Disassembly:
not qword [rsp + 0x40]
call fcn.14067c49d

Function at 0x1406175a3
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1404ee059
jae 0x1403610d9

Function at 0x1406185f8
Capabilities:
Packed with generic packer

Disassembly:
sub r11d, 0xd5022895
test rdx, rdx
jle 0x140502689
mov dx, 0x3088
movzx r11, r11b
xchg qword [rsp + r11*2 - 0x3c], rbp
mov r11, qword [rsp + rdx*2 + 0x19ef0]
ja 0x140646234
int3
push 0x783cbd39
push r13
lea rax, [rax + 1]
jb 0x140593d62
or byte [rsp + 8], 0xb7
movabs r13, 0xb69fc017b939ff0f
test dword [rsp + 8], 0x3eabb492
push r11
mov r11, qword [rsp + 0x10]
jge 0x140597aee
js 0x140661016
or r11b, 0xbf
or rdx, 0xffffffff9b815f2d
lea rbp, [rbp + r11*2 - 0x2603e86a]
jae 0x1403583aa
not ebp
cmovs bp, dx
lea rcx, [rbp + rdx + 0x2183f091]
call fcn.1405cdab5

Function at 0x140674f9b
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
call fcn.1405fdd92
sub byte [rax + rbp*2], bh
invalid
call fcn.1405fb335
mov rdi, qword [rsp + 0x48]
jg fcn.140661953
jns 0x140641e22
setns r9b
neg r9w
cmp r9, 0xffffffffb8ab3fb9
jge 0x1404fd163
lea r14, [r14 + r14*2 + 0x5b31109c]
call fcn.1406126cd
not sil
and sil, 0xbd
mov rsi, qword [rsp + rdx + 0x793dd226]
mov rsi, qword [rsi + rdx + 0x793dd206]
jg 0x140548a91
bswap rdx
test edx, 0x39372cae
call fcn.1405f3dc8
neg ecx
pop r12
and rcx, r15
or dword [rsp + rcx + 0x40], 0xa829f815
mov rdi, qword [rsp + rcx + 0x28]
movabs r9, 0x5a3712857b0b778c
jle 0x1403d18fa
mov qword [rsp + 0x20], 0x161d123
mov rdx, qword [rsp + 0x18]
movabs r9, 0x711d229e029d9e80
jle 0x1405ab850

Function at 0x14068b51c
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xfffffffffff28598
mov r13, qword [rsp + r13 + 0x19]
mov qword [rsp + 0x28], rsi
or r12w, 0x9111
push r14
shl r12b, 0x5f
jne 0x14042aede
mov r14, r12
lea r14, [r12*8 + 0x2aa159ae]
sets r12b
add qword [rsp + 0x10], 0x279577
movabs rsi, 0xa2b9293ad406fc9d
neg esi
call fcn.14047c526

Function at 0x14069544d
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
lea rdx, [r8 + r8 + 0x3725bb0e]
lea r8, [r8 + rdx*8 + 0x3a0bd5b4]
jle 0x1404fc430

Function at 0x140695473
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov dl, dil
call fcn.14067937b
add qword [rsp], 0xffffffffffeeb5b5
call fcn.1406775b6
push rcx
push r10
pushfq
movabs r10, 0xa924bc941e3e2696
movabs r10, 0xd5035508ab8b0227
shr r10d, 0x56
bswap r10d
and r10w, 0x3f0e
call fcn.14049fa39
Function at 0x1406a0c59
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbx, [rbx - 0x3f5a0f7]
shl r15, 0x51
lea r15, [r15 + r15 - 0x3de8f877]
lea r15, [r15*4 - 0x4c576c7e]
call fcn.1403b1535

Function at 0x1406a4358
Capabilities:
Encode data using xor

Disassembly:
not byte [rsp + 0x28]
call fcn.140601e36
xchg esp, eax
out 0xbc, eax
mov word [rcx + rbp*4 - 0x659982f8], fs
xor dword [rdx - 0x1a], edi
push rcx
xor dword [rdx + 0x4c], 0x3d081986
push 0xffffffffffffff80
cdq
fld qword [rdi]
stosd dword [rdi], eax
jns 0x1406a4364
xchg ebx, eax
sal dword [rcx + 0x66], cl
pop rsp
imul ebp, dword [rcx], 0x69
xchg dword [rcx - 0x7a5e022d], ebx
sbb dword [rbx], esp
lodsd eax, dword [rsi]
jrcxz 0x1406a440e
mov ch, 0x2e
test byte [rcx - 0x2e96ccb5], bl
test dword [rcx], ebx
jl 0x1406a4407
retf 0x667d
invalid
push rax
jbe 0x1406a43b0
fcom dword [rbx + 0x4d]
fcmovnb st(0), st(1)
invalid
ror dword [rax - 0x71], 0x20
invalid

Function at 0x1406ad4ae
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
not cx
cmp word [rsp + 0x30], cx
lea rbp, [rbp - 0x5fd418fc]

Function at 0x1406b0eb3
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
or byte [rsp + 0x38], 0xb5
add qword [rsp + 0x10], 0xffffffffbf939079
mov r14, qword [rsp + 0x40]
cmp byte [rsp + 0x38], 0x37
je 0x140362db4
add dword [rsp + 0x38], 0xd1009235
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x60]
ret
ja 0x14057a94b

Function at 0x1406b6324
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x60], rcx
cmp di, word [rsp + 0x35]
call fcn.1405529b5

Function at 0x1406b6338
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0xffffffffbffd52a2
not r10b
call fcn.14048430b
push rbp
push r9
pushfq
movabs r9, 0x2e0d4d17b8a8620e
call fcn.14058a40d

Function at 0x1406c4153
Capabilities:
Packed with generic packer

Disassembly:
mov rsi, qword [rsp + 0x18]
lea rsp, [rsp + 0x50]
ret
jle 0x14000adfc
mov rbp, qword [rsp + 0x48]
setbe byte [rsp + 0x50]
add dword [rsp + 0x50], 0xd78a1f24
jne 0x140704ffc
or r8, 0xffffffffde8758a3
push 0x732cca14
sub r14b, 0x8c
or dword [rsp + r10 - 0x41f6000e], r10d
and dil, byte [rsp + 7]
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
movabs r9, 0xa6a05fafff0e80bf
jb 0x1405a5380
add r10b, r14b
mov qword [rsp], 0x7a3c0fae
je 0x1405e159f
call fcn.14064ea3d
add qword [rsp + 0x30], 0xffffffffbfb9c3c5
not qword [rsp + 0x50]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1406c5569
Capabilities:
Packed with generic packer

Disassembly:
push rbx
push rdi
pushfq
movabs rdi, 0x10021f31602e6cab
push r11
sub rdi, 0x1d0a9a2b
cmp di, 0x4224
jne 0x140443413
mov qword [rsp], 0x5c2893c0
call fcn.140790fb0