joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405d440a
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
jnp 0x140624cab
mov r11d, 0xe58ef78b
movzx r8d, r11b
mov ebp, r8d
mov ecx, dword [r8 + rdi - 0x8b]
lea rdi, [rdi + r8 - 0x87]
movsx eax, r11b
xor ecx, ebx
lea ecx, [r8 + rcx - 0x6012a015]
btc r11, rax
ror ecx, 1
lea r9, [rax + r11 + 0x7b3eab1]
xadd r8b, bpl
not ecx
neg ecx
push rbx
and bp, r9w
ja 0x14052027b
xor dword [rsp + rbp - 0x83], ecx
cbw
imul r11w, r9w
pop rbx
movzx edx, r9b
call fcn.14052b9d1
sub r10, 4
mov edi, 0x88aa098c
sal dil, 0x81
mov ecx, dword [r10]
lea rbp, [rdi + rdi*4 + 0x36080d38]
movzx eax, bpl
xor ecx, r11d
sub ecx, 0x86814101
xor ecx, 0x451c1228
neg ecx
bswap ecx
lea r8, [rdi*2 - 0x73d5cef6]
lea rdx, [rdi + rbp + 0x3cab3f34]
ror ecx, 1
call fcn.14056a540
lea rcx, [rax + rdx*2 - 0x14f8ec59]
bswap r8
xor r10, r8
movzx ebp, al
lea rsi, [rsi + rdx*4 - 8]
xchg qword [rsp + rdx*2], rbp
sub bpl, r9b
not byte [rsp + rdx + 1]
mov qword [rsi + rdx*8], r8
movsx r8d, bpl
jae 0x1404a5588
mov qword [rsp + rcx - 5], rsi
shr r10d, 0x15
xor dword [rsp + r10*4], edi
cqo
lea rbp, [rdx*2 + 0x27377d36]
dec r10b
pop rsi
dec bpl
movsxd rdi, edi
add r11, rdi
lea rbx, [r10 + rbx - 0x100]
push rax
not rcx
cdqe
movzx r9d, byte [rbx + r10*4 - 0x3fc]
and ebp, dword [rsp + r10*2 - 0x1fd]
jns 0x1405f9514
mov r9d, dword [r9 + r8 - 0x6136df8c]
movzx esi, al
xor r9d, ebp
movzx edx, al
shr edx, 0x3b
bswap r9d
movsx ecx, dx
adc ax, 0x4238
shr dx, 0x87
lea r9d, [r9 + rsi*2 - 0x305fb41]
not edx
jns 0x1405c34cb
jmp 0x14054aa8c
mov qword [rsp + rcx*8 - 0x28], r9
not edi
neg word [rsp + rcx - 3]
xor word [rsp + rcx - 1], r9w
movsx eax, cx
inc edi
rol edi, 1
jmp 0x1405beab4
mov r9d, dword [rbx + rdx*4]
lea rbx, [rbx + rdx*2 + 4]
jns 0x14054f65e
xchg dx, r8w
sal edx, cl
xor r9d, r10d
and rbp, rcx
div eax
ror dword [rsp + rax*4 - 0x8e1de], 0x82
inc r9d
movsx edi, r8w
sar edx, 1
bswap r9d
rol r9d, cl
or r8d, dword [rsp + rdx*2 - 0x2a5d6f89]
neg r9d
sub word [rsp + rax - 0x23875], dx
shr byte [rsp + rax - 0x23875], cl
xor r9d, 0x54081c80
pop rax
sub r9d, 0xaf22b39e
bswap r9d
sal rdi, 3
xor rdx, rcx
neg r9d
jmp 0x140560e78

Function at 0x1405de65d
Capabilities:
Encode data using base64

Disassembly:
lea rcx, [rdx*8 + 0x490d170b]
ror edi, 2
inc edi
push rbp
shr ecx, cl
ror edi, 1
not edi
dec edi
rol ebp, cl
ror edi, 3
shr r9, 0xd
lea r10, [rbp + rdx*4 - 0x59c9746f]
rol cl, cl
xor edi, 0xc2032033
sal byte [rsp + r9*8 - 0x38e3de], 0x46
mov qword [rsp + r9 - 0x71c67], rsi
adc r9w, 0x312e
xor dword [rsp + rcx - 0x28], edi
btr r9d, 0x29
call fcn.140660537
Function at 0x1405e9ddb
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + r9*2 - 0x242], 0x7a0dc30b
rol ebp, cl
pop rax
not r9
inc ebp
shl rcx, cl
jg 0x1405eb782
rol eax, 3
inc eax
not eax
sar dword [rsp + r11*2 - 0x76], 0xf1
mov qword [rsp + rbx - 0x3b], r9
sal bl, 0x44
or r11, rcx
xor dword [rsp + r11*4 - 0x4f0], eax
add si, si
setl sil
pop r9
jl 0x1405e4a27
movsxd rax, eax
jne 0x1405045d7
mov ecx, r8d
add rbx, 4
movsx r9d, cx
xor ebp, r10d
btr ecx, 0x25
jb 0x1404f5331
xor ebp, 0x7aae2bb4
lea ebp, [r9 + rbp - 0x3ebfa907]
xchg r9, rax
btc r8d, eax
push r10
and r8b, al
cdq
xor dword [rsp + r9 - 0x7a0dc30b], ebp
pop r10
movsxd rbp, ebp
xchg r9, r8
movzx edi, dl
add r11, rbp
cwd
lea rbp, [r9 + rdx*4 - 0x4a6a66d5]
not r9w
mov rax, qword [rsi + r8 - 0x7a0dc30b]
movzx bp, byte [r8 + rax - 0x7a0dc30b]
jmp 0x140626399
bts ecx, 0x3f
sub r9b, r8b
lea rsi, [r8 + rsi - 0x7a0dc305]
btr dx, dx
mov word [rsi + r8 - 0x7a0dc30b], bp
movzx eax, dl
rol dil, cl
jmp r11

Function at 0x1405eb9c6
Capabilities:
Encode data using base64

Disassembly:
shr edx, cl
lea rdi, [r8 + r8*8 + 0x6aa10f28]
mov eax, 0x6c180b30
mov dword [rsi + r8*2 - 0x1947e], edx
bts r8d, ebp
jmp r11
dec edi
mov qword [rsp], rcx
lea rdx, [rcx + rcx*2 - 0x2166e356]
xor edi, 0xa3a640b6
movzx r8d, dx
lea edi, [rdi + r8 + 0x5cba3648]
shr dl, 0x61
mov r9d, 0x1e129288
ror edi, 2
movsx ebp, cl
sal r8w, cl
rol bpl, 1
mov qword [rsp + r9 - 0x1e129288], r10
not r9d
xor dword [rsp + r8*8 - 0x65000], edi
pop r10
bswap rcx
movsxd rdi, edi
bt r9, rdx
ror r9d, 0x4d
adc r11, rdi
mov edx, dword [rsi + r8*8 - 0x65000]
add bpl, r9b
add cl, byte [rsi + r8*4 - 0x327fc]
shr r9b, 0x86
adc r8b, bpl
imul bp, r8w
lea rsi, [rsi + r8 - 0xca3d]
bts bp, r8w
jb 0x14056c97c
pop rbx
jne fcn.14064d800
Function at 0x1405ed77d
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r8*2 - 0x12c00], rsi
shl dl, 1
mov rdi, qword [rdi + r8*2 - 0x12c00]
pop r11
pop rax
pop r11
pop rax
pop rsi
jg fcn.1404c14d3

Function at 0x1405ed79c
Capabilities:
Encode data using base64

Disassembly:
dec r8d
bt rcx, rsi
mov qword [rsp + r11], r9
call fcn.14058908b
adc cx, dx
xor cx, dx
mul ax
xor r10w, cx
rol byte [rsp + r8], 2
sub word [rsp + r8*2], dx
cmovno ax, di
lea rsi, [rsi + r8 - 2]
mov word [rsi + r8*2], cx
lea r9, [r8*4 + 0x42012687]
pop rax
jge fcn.140621ffc
pop r9
push rbx
sar dword [rsp + r8 - 0x5c93962], 1
btr r8w, 0x2d
movsxd r11, r11d
bts si, r8w
adc r10, r11
shr dword [rsp + rsi + 0x3938], 0x3e
mov rbx, qword [rdi + r8 - 0x5c91966]
mov eax, dword [rbx + r8 - 0x5c91966]
call fcn.1404c5278

Function at 0x1405f41c0
Capabilities:
Encode data using base64

Disassembly:
movzx ebp, cl
mov rsi, qword [rsp + rdx*2 + 8]
sal r10w, 0x6a
mov qword [rsp + rdx*2 + 8], rdx
lea r8, [r8 + rcx*2 - 0x74099220]
mov dword [r8 + rcx - 0x3a04c90e], edi
adc rax, 0xffffffffe82aa4b3
lea rdx, [r10*8 + 0x3135531f]
lea rbx, [rbx + rax*2 + 0x2faab67a]
mov qword [rsp + rax + 0x17d55b3f], 0xffffffffa917120d
mov ebp, dword [rbx + rcx - 0x3a04c90e]
call fcn.1405acc19

Function at 0x1405fe963
Capabilities:
Encode data using base64

Disassembly:
shl r8w, 0x63
rol ebp, 2
dec ebp
movsx ecx, al
rol byte [rsp + rax + 0x7f61f7db], 0x22
bswap ebp
sar r9b, 0x25
xchg word [rsp + rax + 0x7f61f7df], r8w
mov qword [rsp + rdx*2 + 8], rbx
xor dword [rsp + r9*8 - 0x4000], ebp
jmp 0x1405835b0
div word [rsp + rdx + 1]
xchg qword [rsp + rdx*8 - 0x4158], r8
mov rbx, qword [rsp + rdx*2 - 0x104e]
movsxd rbp, ebp
or r11b, 0x3d
shl eax, cl
lea r8, [rdx*8 + 0x59948ca9]
adc r10, rbp
add qword [rsp + r8 - 0x5994ce01], rcx
add r9w, ax
neg qword [rsp + rdx*8 - 0x4158]
sbb ebp, 0xefbe562f
btr r8, rax
mov r11d, eax
ror ebp, 2
cwd
ror byte [rsp + rdx + 2], 0x81
cdqe
not ebp
jae 0x1404a1adf
mov r11, qword [r8]
mov ecx, 0x55977120
movsx r9d, cx
lea r8, [r8 + rcx - 0x55977118]
movzx r10d, r9b
mov rbp, r11
movsx edi, r9w
jmp fcn.1405a034c
mov qword [rsp], rax
mov qword [rsp + 8], rax
ror ebp, 2
cqo
shl qword [rsp + rdx + 4], 0xad
movsx r9d, word [rsp + rdx*8]
not ebp
jbe 0x1405d495d
Function at 0x1405fe984
Capabilities:
Encode data using base64

Disassembly:
lea rbx, [rbx + rbx*8 + 0x2eb5c326]
movsx ebp, bl
lea r10, [r10 + rbp*2 - 0xc4]
lea rax, [rbp + rdi*2 + 0x34b83e3b]
xor esi, r8d
xor esi, 0xb9013286
ror esi, 1
bswap esi
xchg ebx, edi
dec esi
cbw
push r8
xor dword [rsp + rdi*2 - 0x661230c8], esi
pop r8
movzx edx, al
movsxd rsi, esi
call fcn.1405e3499
pop r9
add r11, rax
call fcn.14052d49a
mov ecx, 0xfc1eaf05
movsx r9d, cl
lea rbp, [rbp + r9 - 9]
mov r9d, dword [rbp + r9 - 5]
xor r9d, r11d
not r9d
movzx eax, cx
neg r9d
btc rcx, rcx
cqo
jb 0x1405173ea
lea r9d, [rdx + r9 - 0x66084d27]
ror r9d, 1
dec r9d
push r11
xor dword [rsp + rax*2 - 0x15e0a], r9d
jmp 0x140583a77
lea rbp, [rcx*8 - 0x8ea0b5b]
ror eax, 2
mov qword [rsp + r9*2 - 0x40c], 0x1dbd0437
movsx r8d, byte [rsp + rcx - 0x4282e8aa]
mov qword [rsp + rcx - 0x4282e8ac], r10
xor dword [rsp + rcx - 0x4282e8ac], eax
mov r10, qword [rsp + r9*2 - 0x404]
jmp 0x14061ef90
mov qword [rsp + rcx - 0x4282e8ac], rdi
sal cl, 0x24
movsxd rax, eax
jnp 0x14052784f
mov edi, 0xa4b8df95
lea rbx, [rdi + rdi*2 + 0x67a5c00f]
mov esi, dword [r10]
jmp 0x1404eec16

Function at 0x1405ffb28
Capabilities:
Encode data using base64

Disassembly:
lea rbx, [rax + rax + 0x28003623]
lea edi, [rbx + rdi - 0x7180e8ea]
cdq
pop rbx
mul al
ror edi, 1
sub edi, 0xbd0f1e06
neg qword [rsp + rax - 0x6541]
inc byte [rsp + rax*4 - 0x19501]
cqo
rol edi, 1
lea r8, [rax*4 - 0x647b3feb]
neg edi
dec edi
jmp 0x1404d65ee

Function at 0x14060521e
Capabilities:
Authenticate hmac

Disassembly:
bt cx, 0xb4
push rbx
xor esi, 0x8a274435
neg esi
or qword [rsp + rax + 0x5a54], r11
xor esi, 0xc49ba82b
shr bp, 0xb
inc qword [rsp + rax*8 + 0x2d29b]
inc esi
sar r11d, 0xd0
ja 0x140577cdd
neg ax
xor dword [rsp + r9*4 - 0xcb838], edx
and r9b, r9b
xchg rsi, rax
pop rbp
or rcx, 0xffffffffaeb6f21d
movsxd rdx, edx
lea r9, [rax*8 - 0x23eece68]
jl 0x1405bac41
mov qword [rsp + rax*2 + 0xb4b4], r9
setnp cl
jp 0x1406514ee
mov ebx, 0xfda47e2f
movzx ecx, bl
lea r10, [r10 + rcx*2 - 0x62]
bts ebx, ecx
mov edi, dword [r10 + rcx - 0x2f]
push rbx
add cx, 0x9c3e
inc word [rsp + rcx*2 - 0x138d7]
xor edi, r11d
dec edi
xchg qword [rsp + rcx - 0x9c6d], rbx
not edi
dec edi
rol edi, 1
add qword [rsp + rcx*2 - 0x138da], rbx
call fcn.1405a38a0
adc r11, rdx
call fcn.14066b669
call fcn.1405955c3
movzx ebp, cx
mov esi, dword [rbp + r10 - 0x1502]
cdqe
lea r10, [r10 + rax + 0x5a56]
lea r11, [rcx + rbp - 0x32edc957]
xor esi, r9d
rol esi, 1
cwd
lea rcx, [rdx + 0x380c6481]
neg esi
mov qword [rsp + rax*4 + 0x16948], 0xffffffff9a10b63d
movzx ebx, bpl
bswap esi
jmp 0x140542b84
xor dword [rsp + rax + 0x5a62], esi
sar ebx, 0x62
mov r9, qword [rsp + rax + 0x5a62]
div dl
ror r11d, 0xf7
movsxd rsi, esi
bts ebx, 0x18
adc rdi, rsi
push rbp
xchg r11, rbx
mov qword [rsp + rax + 0xab5a], rdi
ret 0x18
Function at 0x140609688
Capabilities:
Encode data using base64

Disassembly:
mov rbx, qword [rsp + rdx*4 + 8]
call fcn.1404d3682
movzx di, byte [rdx + rbx]
lea r10, [rax + rax + 0xba0bb03]
mov cl, byte [rbx + r9 - 0x5320360c]
rol esi, 0x3a
lea rbx, [rdx + rbx + 2]
bt rax, 0x24
not dil
btc r9w, r10w
bswap eax
not cl
inc dl
xadd r9, rsi
and dil, cl
xchg dl, r10b
mov word [rbx + rdx - 0x8b], di
jmp r11
btc edi, 0x17
pop r8
jae 0x14058c005
movsxd rdx, edx
xor ebx, ecx
sal bl, 0x61
inc sil
add r11, rdx
jmp fcn.14054f807
shl bx, 0xa6
xor dword [rsp + rbp*8 - 0x18e0], edx
jmp 0x14056b145
mov qword [rsp + rbp*2 - 0x638], 0xffffffff8516f189
mov edx, dword [r10 + rbp*8 - 0x18e0]
lea r10, [r10 + rbp*2 - 0x634]
xor edx, r8d
rol dword [rsp + rbp - 0x318], 0xa7
inc edx
neg qword [rsp + rbp - 0x31c]
rol edx, 1
pop rbx
bt ebx, ebx
inc edx
rol edx, 1
bswap rcx
xadd di, cx
not edx
push rbx
dec ecx
mov word [rsp + rbp - 0x317], di
mov qword [rsp + rbp*4 - 0xc70], r8
jg 0x1405c7381
mov ebp, 0xa036b520
movzx eax, bpl
mov r9d, dword [rax + rsi - 0x20]
bswap eax
mov r11d, ebp
mov eax, dword [rsi + rax*2 - 0x3ffffffc]
jmp 0x140658f2c
mov r8d, 0xe89624a8
lea rcx, [rbp*8 - 0x7164a357]
mul r9d
sub bp, r11w
mov dword [rsi], edx
lea r9, [rbp + rbp*2 - 0x9793e4a]
mov dword [rsi + 4], eax
mov ecx, dword [rdi]
lea rax, [rbp + r11*8 - 0x7cc80a64]
adc rdi, 4
xor ecx, ebx
and r11d, r8d
not ecx
btc r9d, 0xbe
lea rdx, [r11 + r9*2 + 0x2c3638a6]
rol ecx, 2
shl r9w, 1
not dx
btc rdx, r8
inc ecx
rol ecx, 3
cqo
push rbx
ror al, 0x61
xor dword [rsp + rdx*2], ecx
push r9
mov dword [rsp + rdx], r8d
jmp 0x140518f73

Function at 0x14060b65e
Capabilities:
Authenticate hmac

Disassembly:
xor r11b, 0x30
lea rbx, [rcx + rax - 0x7f0c17c]
not ebx
neg r11b
ror r11b, 1
not bx
cdq
xor rax, 0x3133d1bc
xor r9b, r11b
or rdx, rsi
cbw
bt ax, dx
add r11, rsp
ror si, 0xac
mov ebx, dword [r11 + rsi - 0x2064872b]
jb 0x14051d7be
sub rax, 0x36b8838c
not r8d
rol rax, 0x61
sbb r8d, ebx
mul dl
mov qword [rsp + rdx*2 - 0x620013c], r11
mov qword [rsp + rdx - 0x31000a2], rdx
mul dx
xor dword [rsp + rdx*2 - 0x62000c4], r8d
pop rbp
lea r11, [rdx + rdi*8 + 0x631a6820]
lea rcx, [rbp + rbp - 0x16e00fe9]
pop r11
btr edx, ecx
jb 0x14053b2f6
cdq
movsxd r8, r8d
adc r9, r8
mul al
bt ebp, ecx
xor rbx, r9
jmp rbx

Function at 0x14060d14a
Capabilities:
Manually build aes constants

Disassembly:
dec word [rsp + rdi - 0xff52]
xor dword [rsp + rdi*4 - 0x3fd50], edx
mov rsi, qword [rsp + rdi*2 - 0x1fea4]
mov qword [rsp + rdi - 0xff4e], rbp
movsxd rdx, edx
add r11, rdx
xchg cx, bp
btc eax, 0x30
jae 0x140592966
pop rax
pop r9
jae fcn.1405c7bae
lea rbx, [rdi + rbx - 0xae]
neg di
mov edx, dword [rbx + rdi*8 - 0x7fab0]
sbb dil, cl
xor edx, esi
neg byte [rsp + rcx - 0xfff4]
dec edx
movzx r9d, cx
lea rbp, [r9 + rcx*2 - 0x5e4a4846]
neg edx
mov qword [rsp + rdi - 0xff56], 0xaa19a23
xor qword [rsp + rdi - 0xff4f], r10
lea edx, [rdx + r10 + 0xe11dee1]
xor edx, 0xb6a719b6
xadd word [rsp + rdi - 0xff4e], bp
mov qword [rsp + rdi - 0xff4e], rsi
jbe 0x14051a36f
mov qword [rsp + rcx*2 - 0x490c0000], r9
ret 0x20
Function at 0x14061375a
Capabilities:
Encode data using base64

Disassembly:
xor r9w, r10w
or ebp, edx
inc r9w
ror edx, 0xb3
bt r8d, 0xab
not r9w
mov eax, 0x1a25763e
cwd
adc r9w, 0x9120
xor r9w, 0x2a3c
movzx ecx, byte [rsp + rdx*4 - 0x4f17fff5]
imul ecx
dec r9w
xor r10w, r9w
shr eax, cl
or al, 0x3d
lea r9, [rsp + r9 + 0x10]
not r8w
call fcn.1405fcd0c

Function at 0x14061593c
Capabilities:
Encode data using base64

Disassembly:
xor edx, esi
mov ebp, 0xc2af8330
xor edx, 0x30bc5e0c
movzx r9d, bp
call fcn.140518736
inc byte [rsp + r11 - 0x8c3]
mov r9, qword [rsp + r11 - 0x8c1]
mov dword [rsp + r11*4 - 0x233e], r11d
movsxd rbp, ebp
lea rsi, [r11 + rbx*2 - 0x2df783e2]
ror r11b, cl
add esi, ebx
add rdi, rbp
sar word [rsp + r11 - 0x8e5], 0x85
movzx ebp, byte [rsp + r11*2 - 0x11c9]
mov rdx, qword [r8 + r11*2 - 0x11d0]
and bpl, 3
push rsi
mov r11d, dword ss:[rdx + r11*4 - 0x23a0]
mov qword [rsp + rcx - 0x468aaf09], 0x2d9a4491
mov edx, 0x8a9ea4a9
lea r8, [rcx + r8 - 0x468aaf1d]
shr ecx, cl
mov dword [r8 + rbp*4], r11d
lea rdx, [rsi*2 - 0x44cb4b50]
adc rbp, qword [rsp + rcx - 0x2345577c]
movzx r11d, bpl
mov qword [rsp + rcx - 0x23455790], rdi
ret 0x18
imul dword [rsp + r9*2 - 0x37639d17]
or word [rsp + r9 - 0x1bb1ce87], dx
pop rcx
pop r8
jge fcn.140621ffc
jmp 0x1405d6ceb

Function at 0x14061b6a6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor sil, r8b
movsx edi, bpl
dec sil
push rcx
shl edx, 0xac
mov eax, dword [rsp + rcx*2 - 0x37d94f68]
neg sil
not sil
inc bx
add sil, 0x1f
xor sil, dl
xor r8b, sil
lea rsi, [rsp + rsi + 0x20]
xchg dword [rsp + rbx - 0x4b359a22], ecx
cbw
neg ebx
mov edi, dword [rsi + rcx - 0x1beca7]
lea r9, [r9 + rcx - 0x1becab]
bt ebx, 0x9a
mov dword [r9 + rcx - 0x1beca7], edi
cwde
pop rbx
pop rax
pop rax
pop rcx
jb fcn.14054f807

Function at 0x14061f845
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rep movsb byte [rdi], byte [rsi]
push 0xffffffffd21a1183
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
mov qword [rsp + rsi - 0x2b98b570], 0xffffffffdc8ca8a0
mov rsp, rdx
pushfq
rol edi, 0x5d
mov rsi, rax
mov rdi, rdx
cld
jmp 0x1405e44dd

Function at 0x140624c83
Capabilities:
Encode data using base64

Disassembly:
lea edx, [rdx + rcx*4 + 0xbb6b55]
mov qword [rsp + rcx*2 - 0x6a4076d6], rbx
xor edx, 0xfbac55b9
mov qword [rsp + rbp - 0x3b6b], r11
rol r8w, 0x4d
jb 0x1405d1eab

Function at 0x140625a4a
Capabilities:
Encode data using base64

Disassembly:
inc byte [rsp + rax - 0x68b5fffb]
adc r9, rdi
mov qword [rsp + rdx - 0x528bffff], r9
ret 8
lea rcx, [rbx + rax*8 - 0x7b76937f]
inc r8b
movsxd rdi, edi
shl r8d, cl
jp 0x140501e2f
inc edi
bts rbx, 0x39
or qword [rsp + rax - 0x68b5ffad], r11
mov r11d, r8d
xor dword [rsp + rdx - 0x528bfff7], edi
sar ax, 0x4a
mov qword [rsp + rax - 0x68b5ffff], r10
mov r11, qword [rsp + r10 - 0x728b4789]
jbe 0x140571e2b
Function at 0x14062657f
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r8*4], r9
ret
pop r10
xadd cl, dl
neg rax
neg bpl
movsxd r9, r9d
shr dl, 0xa2
btr eax, r8d
jb 0x1405fa2ac
push rax
movsxd rcx, ecx
xchg word [rsp + r8*2 - 0x564555a], di
mov ebp, 0xcd115213
add r9, rcx
cwd
cqo
mov rbp, qword [rsi + rdx + 1]
inc qword [rsp + r8*2 - 0x564555c]
mov al, byte [rsi + r8 - 0x2b22aa6]
sar r8d, 0xbe
sar rdi, 0xf4
sar byte [rsp + r8 + 6], 0xa1
lea rsi, [rsi + r8*4 + 0xa]
neg byte [rsp + r8 + 2]
mov ecx, 0xdb19532a
mov byte [rbp + r8*4], al
movzx eax, byte [rsp + r8*2 + 4]
jbe 0x1404c6f1f
xadd dx, ax
neg cl
push r10
jl 0x140621197
movsx ecx, sil
lea rsi, [r9 + r9 - 0x64ed6be6]
xor edx, r11d
bswap edx
shr rax, 0xaa
lea edx, [rax + rdx - 0x4627808c]
call fcn.14053851b
call fcn.1405919d5
add r11, r9
jmp fcn.140621ffc
shl ebp, 0x3d
xor dword [rsp + rbp], r9d
movsx r10d, dx
jmp 0x14054e303
xor ecx, r11d
not ecx
mov qword [rsp + r8*2 - 0x564555a], r8
lea rax, [r8 + r8*4 + 0x3bb46129]
lea rdx, [r8 + rax + 0x61aeb72f]
xor ecx, 0x399a6817
neg rdx
and qword [rsp + r8 - 0x2b22aad], rdx
sar word [rsp + r8 - 0x2b22aa8], 0xe6
not ecx
btr r8w, 0xa1
movzx edi, r8b
lea ecx, [r8 + rcx - 0x2ceab1b5]
neg word [rsp + r8*8 - 0x15915566]
mov qword [rsp + r8 - 0x2b22aad], r11
inc r8b
xor dword [rsp + r8 - 0x2b22aae], ecx
lea rdi, [rdx + rax*2 - 0x2b773e4d]
lea rax, [rdi*4 - 0x655727c3]
pop r11
jmp 0x140560e1c
Function at 0x140628813
Capabilities:
Encode data using base64

Disassembly:
sbb dl, 0x8b
xadd al, bpl
pop rcx
lea rbp, [rbp + rax*2 - 0x2dcc0347]
neg dl
xor rax, 0xffffffff960c242f
rol dl, 1
lea r8, [rbp*2 + 0x56bf2d22]
xor r10b, dl
btc bp, 0x88
add rdx, rsp
mov r9d, dword [rdx + rdi*2 - 0x5a60]
lea rdx, [rcx + rcx - 0x185e51cc]
ror di, 0x2e
or al, r8b
lea rsi, [rsi + rdi*8 - 0x5a604]
bts rdx, 0xac
mov dword [rsi + rdi - 0xb4c0], r9d
cbw
mov r9d, 0x318e0fbc
mov edi, dword [rdi + rbx - 0xb4c0]
inc ax
js 0x140575c9d
btr r8d, 0x17
lea rbp, [rbp + r8 - 0x24063f92]
cmovae r8d, eax
xor edi, r11d
inc edi
xor edi, 0x14bfe01e
lea rcx, [rax - 0x1e78c7ef]
not edi
shl rcx, cl
rol edi, 3
rol ax, 0xe3
jb 0x14056eb86
lea r8, [r8 + rbx*4 - 0xf2]
push rdx
and r11b, byte [rsp + rdx - 0x561aa13a]
or rdx, qword [rsp + rdx - 0x561aa137]
sal ax, cl
mov word [r8 + rbx*4 - 0xf4], ax
sal word [rsp + r11 - 0x561aa0fb], 0xc7
mov qword [rsp + r11 - 0x561aa100], rdi
ret 0x10
shr r9b, cl
mov word [rsi + rdi - 0xb2f6def], r9w
shl dword [rsp + rdi - 0xb2f6dec], 0x70
shl dl, 0x81
jle 0x1406675c8
movzx edx, byte [rbx]
mov ebp, 0xb6922d30
add rbx, 1
movzx edi, bp
lea rax, [rdi*8 - 0x5453d05d]
xor dl, r10b
shr ebp, 0xe7
inc dl
xor dl, 0x20
bt ebp, 0x2b
push rbp
jae 0x1405032f7
call fcn.140588f1d
inc esi
ror esi, 2
mov edi, 0x9eb5ef0e
inc esi
sal ecx, 0xf0
bswap esi
shl edi, 0xb5
mov r9d, edi
movzx eax, r9w
push rbp
movsx r10d, cl
xor dword [rsp + rax], esi
jmp 0x14053182c
xor r8d, r11d
rol r8d, 2
movsx r10d, byte [rsp + rdi*4 - 0x12cb8]
lea r8d, [r8 + rdi - 0x5983315e]
ror r8d, 1
xadd r10b, dl
add rcx, rcx
sar dword [rsp + rdi*2 - 0x9658], 0xf4
dec r8d
xor r8d, 0xa81c7b27
bt ecx, edi
mov qword [rsp + rdi - 0x4b29], r11
bswap rdi
xor dword [rsp + rdx*2 - 0x203215f8], r8d
add word [rsp + rdx*2 - 0x20321600], 0xf033
mov r11, qword [rsp + r10*8 - 0x5f8]
push r10
movzx ebx, cx
movsxd r8, r8d
inc dword [rsp + rdx*4 - 0x40642bf8]
lea rax, [rdx + rcx*4 - 0x5c75d552]
add r9, r8
ror rbx, 0x16
movsx r8d, ax
lea r8, [rdx + 0x102f2817]
pop rcx
pop rbx
pop rbx
jae fcn.1405be54a
sub rdi, 0xffffffffaf267984
pop rbp
bts eax, 0x32
movsxd rsi, esi
and r10d, edx
adc r11, rsi
xadd rax, rdi
xor r10, r11
jmp r10
push r11
movzx ebx, r8b
mov edx, r8d
xor dword [rsp + rbx*8 - 0x4b0], edi
pop r11
jmp 0x1406785b1
sar r8w, 0x2c
lea rbx, [rax + rbx - 0x3da1ffdb]
add cl, cl
xor edi, r10d
call fcn.1405bec54
mov cl, byte [rsi + rdi - 0xb2f920e]
bts edx, edi
mov qword [rsp + rdi*2 - 0x165f2420], 0x718431b1
lea rsi, [rsi + rbp*4 - 0x2483e]
not di
jb 0x1405190ad
lea rcx, [rsp + rcx + 0x10]
movsx edx, dil
neg word [rsp + r10*4 - 0x18612c8d]
adc rdx, 0x10190b99
mov r10w, word [rcx + r10*4 - 0x18612c98]
mov ecx, dword [rsp + rdi - 0x4b1a]
lea rsi, [rsi + rdi*2 - 0x964e]
rol dil, 3
mov word [rsi + rdi - 0x4b31], r10w
mov r8d, dword [rbp + rdi - 0x4b31]
mov word [rsp + rdi*2 - 0x965b], dx
sub ecx, edx
jae 0x1406117ce
lea rbp, [rbp + rdi - 0x4b2d]
jnp 0x14052733b
mov ebp, dword [rbx + rdi - 0xb2f6def]
call fcn.1405708a4
movsxd rdi, edi
call fcn.1405003c2
Function at 0x14062bb5a
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0x22a9dcb1
movzx ecx, dx
mov rsi, qword [rdx + r8 - 0x22a9dcb1]
mov eax, 0x9ea06033
call fcn.1405fa59b
lea r8, [rdx + r8 - 0x14]
sal r9d, cl
sar r10d, 0x43
mov word [rdx + r8 - 0x12], ax
shr edx, cl
call fcn.14058308a
mov qword [rsp + rax - 0x7828a312], 0xffffffff8b8e02af
lea rbp, [rbx + rax*4 - 0x197f51ff]
adc r9, rdx
lea r10, [r10 + rax - 0x7828a314]
mul byte [rsp + rax - 0x7828a30d]
movzx ebp, word [rax + r10 - 0x782811ee]
xor bp, r11w
rol rax, cl
rol bp, 1
movsx edx, byte [rsp + 2]
not bp
add rdx, 0xffffffffd31e23a3
sbb bp, 0x8e3e
ror bp, 1
shl word [rsp + 1], 0x69
xchg dl, cl
not bp
xor r11w, bp
lea rbp, [rsp + rbp + 8]
add al, byte [rbp + riz]
call fcn.140674eab
jmp 0x1404b1c60
Function at 0x140634446
Capabilities:
Encode data using base64

Disassembly:
bts ecx, 0x13
call fcn.1404fe35d

Function at 0x1406352ea
Capabilities:
Encode data using base64

Disassembly:
mov rsi, qword [r9 + rbx - 0x7c3ca7ad]
call fcn.1405d1179
mov ecx, 0xb0bba90d
bswap ebp
rol ebp, 3
movzx eax, word [rsp + 2]
pop r9
bswap ebp
ror ebp, 3
movzx edi, r9b
neg ebp
lea rdx, [r9 - 0x307c9372]
lea ebp, [rbp + rax*4 - 0x3ea28424]
and rdi, rcx
movzx r8d, dl
neg ebp
bswap ebp
bswap edi
push rdi
bt dx, r8w
mov qword [rsp + rax*2 - 0x8852], r10
cdqe
sar r9d, cl
xor dword [rsp + rax - 0x4429], ebp
pop r10
shr r8w, 0x23
movsxd rbp, ebp
setne r8b
call fcn.1404df4c7
add rdi, 4
mov r11d, 0xc1983e33
movzx eax, r11b
xor edx, ebx
lea r9, [r11 + rax - 0x2041f0f3]
movsx ebp, r11b
inc edx
bswap edx
lea edx, [rax + rdx - 0x2603005b]
rol edx, 1
cdqe
movsx r8d, r11w
dec edx
bswap edx
push rbx
sub r11b, r11b
xor dword [rsp + rax - 0x33], edx
lea rcx, [rbp + r11 + 0x259d3e26]
jmp 0x140501f5f

Function at 0x140636ce3
Capabilities:
Encode data using base64

Disassembly:
jp 0x1405a2122
xor r11d, r9d
rol r11d, 1
lea rcx, [rsi + rsi*8 - 0x45645563]
mov edx, ecx
inc r11d
or sil, sil
movsx eax, dx
bswap r11d
mov ebx, eax
jg 0x14055b564
sal r8, cl
add rbx, rax
mov qword [rsp], 0x2f9df39f
mov qword [rsi], r8
jns 0x1404b7e2c
mov r11d, dword [rbp + riz]
mov esi, 0xc09ca914
add rbp, 4
btc esi, esi
jb 0x1405a422e

Function at 0x14063786f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.1404fccad
add esi, dword [rdx + r10*2 - 2]
lea r8, [r8 + r10 - 5]
mov dword [r8 + r10 - 1], esi
pop rdx
jmp 0x14064cea8
movsx ecx, dx
sub ebx, 0x948f70a3
shl rdx, cl
lea rbp, [rdx + rcx*4 + 0x29ac6799]
mov qword [rsp], 0xffffffffe6a9cba9
mov qword [rsp + 8], r11
xor dword [rsp + 8], ebx
mov eax, 0xf9a58331
mov r11, qword [rsp + 8]
div byte [rsp + 4]
sal ecx, 0x2e
call fcn.140564e53
adc dl, 0xa7
xor dl, 0x19
ror dl, 1
neg dl
ror qword [rsp + r10*4 - 4], 0xa5
xchg qword [rsp + r10 - 1], rcx
rol dl, 1
xor r11b, dl
lea rdx, [rsp + rdx + 8]
neg cx
je 0x14051d962
ror eax, 1
inc dword [rsp + r9*2 - 0x176]
mov qword [rsp + r9 - 0xb4], rbx
jne 0x14050e300
xor r8d, 0x57b8dd9b
neg r8d
shl esi, 0x91
shr r11w, 0x82
bswap r8d
lea rbx, [rax + rcx*4 - 0x7976eeff]
cdq
call fcn.1405ed79c
jmp fcn.1404cedee

Function at 0x140638033
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
ror edx, 2
jmp 0x1405a8d3b
not di
sub di, 0x8e3f
bts bp, 6
mov qword [rsp + r8*4 - 0x160], rdx
ror di, 1
push rbp
not qword [rsp + r8 - 0x58]
sal rbx, cl
not di
setp byte [rsp + r8 - 0x50]
xor r11w, di
dec qword [rsp + r8 - 0x50]
ror qword [rsp + r8 - 0x54], 0x1c
lea rdi, [rsp + rdi + 0x10]
sbb byte [rsp + r8 - 0x56], dl
bts rbx, 0xb6
movzx cx, byte [r8 + rdi - 0x58]
inc qword [rsp + r8 - 0x58]
lea rsi, [rsi + r8*2 - 0xb2]
bts eax, 0xc
mov word [r8 + rsi - 0x58], cx
lea rdx, [rax - 0x41cb52eb]
movsx edi, word [rsp + r8 - 0x54]
cwd
pop r8
pop rdx
jb fcn.14064d800
inc rdi
neg edx
lea rax, [rdi + rbp*2 - 0x4076f2cd]
ror dil, 0x23
xor edx, 0x25abac9c
shr ebp, 0xcb
jne 0x14050f4e6