joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035260
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140035291
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400352a8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400352cb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400352cd
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140035309
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003539e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140035344
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14003537e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003539e
cmp rbx, rax
ja 0x140035350
test rbx, rbx
je 0x14003539e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
and eax, 0x32161707
invalid
Function at 0x1400357e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140035804
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140035847
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140035847
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140035978
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003588a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400358b5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14003597d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003592a
sub eax, 1
je 0x14003592a
cmp eax, 2
jne 0x140035978
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14003597d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14003595b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140035978
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14003597d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140035b30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140035bf9
cmp byte [rcx + 0x71], 0
je 0x140035bf9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140035bec
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140035ba8
sub eax, 1
je 0x140035bac
cmp eax, 2
jne 0x140035bec
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140035bda
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140035bec
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x1400388c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003890a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003890a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003890a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003890a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003890a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003890c
xor al, al
add rsp, 0x28
ret

Function at 0x140038bc0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x140038c06
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.140038d78
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x140038cff
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140038d78
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x140038c70
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.1400362b0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x140038d4c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140038d4c
call fcn.1400380f8
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x140038d30
mov rcx, r14
call fcn.1400380f8
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x140038bc0
Function at 0x140038d70
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x140038c06
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.140038d78
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x140038cff
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140038d78
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x140038c70
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.1400362b0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x140038d4c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140038d4c
call fcn.1400380f8
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x140038d30
mov rcx, r14
call fcn.1400380f8
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x140038bc0
Function at 0x148009880
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14800988d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14800989d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x148009885
lea eax, [rcx + 1]
jmp 0x1480098ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1480098be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1480098a4
sub eax, 3
jb 0x1480098de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14800992d
sar eax, 1
movsxd rbp, eax
jb 0x148009914
jmp 0x1480098ec
add ebx, ebx
jne 0x1480098ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x148009914
inc ecx
add ebx, ebx
jne 0x1480098fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x148009914
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14800990d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1480098fc
add ecx, 2
jmp 0x148009919
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.148009842
jmp 0x14800988d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x9a00
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x148009979
cmp rsi, rcx
jae 0x148009981
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x148009960
cmp al, 0x8f
ja 0x148009960
cmp byte [rsi - 2], 0xf
je 0x148009966
sub al, 0xe8
cmp al, 1
ja 0x14800994a
cmp rsi, rcx
jae 0x148009981
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x148009950
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x148009981
lodsb al, byte [rsi]
jmp 0x148009960
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x8007000]
mov eax, dword [rdi]
or eax, eax
je 0x1480099de
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x800a570]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14800998e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1480099d8
mov qword [rbx], rax
add rbx, 8
jmp 0x1480099ae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x148009a18
cmp al, 0xef
ja 0x148009a0a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1480099ea
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1480099f9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.148009a97], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.148009a97
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x148009a87
sub rsp, 0xffffffffffffff80
jmp 0x1400010f6
Function at 0x140246772
Capabilities:
Authenticate hmac

Disassembly:
pop r10
xor edi, 0x152ac09f
mov r10d, 0xf9b25daa
mov qword [rsp + rax - 0x6c12022c], rbx
add dl, 0x99
xor dword [rsp + rax - 0x6c12022c], edi
sar dx, 0x69
not dword [rsp + rax - 0x6c120234]
mov rbx, qword [rsp + rdx*2 + 8]
shr rsi, 0xbc
jp 0x14028ccc4
mov dword [rbp + rsi], r10d
sar qword [rsp + r9 - 0x795d020c], 0x25
pop rdx
pop rax
jns fcn.140272fb1
mov qword [rsp + rsi*4 + 8], r9
movsxd rdi, edi
sal r10, 0x20
adc r8, rdi
sal r10b, 0xe2
rol r10w, 0xe1
and r9w, word [rsp + rax - 0x6c120228]
mov r10, rbp
or r9d, dword [rsp + rax - 0x6c120231]
lea rcx, [rax + rdx*4 - 0x7571b662]
lea rbp, [rsi + rbp - 4]
neg rax
jb 0x140287cbe

Function at 0x140246e5f
Capabilities:
Authenticate hmac

Disassembly:
add cl, 0xb6
sub qword [rsp + r9*4 - 0x28], rdi
sar dword [rsp + r9 - 2], 0x7f
add rdx, 0x4317da83
ror cl, 1
dec edi
dec rdx
neg cl
xor sil, cl
sub dl, 0xb2
movsx ebx, dl
lea r11, [r11 + r9*4 - 0x32]
cmovg rdi, rbx
mov word [r11 + rdi*4 - 0xbc], cx
sub dx, 0x588e
sar rdi, 0xb9
pop rax
pop rax
jae fcn.14029bfc2
rol cl, 1
pop rax
jmp 0x140242873

Function at 0x140248a79
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [r11 + r8 - 0x1b8dd34a], bx
pop r11
pop r11
jp fcn.1402dc2e3
dec esi
sar dword [rsp + rcx*8 - 0xdc], cl
lea r10, [rcx*4 + 0x701e6738]
jns 0x1402f7d35
sal rcx, cl
mov rax, qword [rbp + rax - 0x77020000]
shl dil, 0x85
mov rsi, qword [rbp + rcx*4 - 0xf02fff8]
call fcn.140287924
mov edx, eax
movsxd rcx, ecx
adc r10, rcx
and r9, 0xffffffffde04179e
mov edx, dword [r9 + r11]
mov eax, dword [r11 + r9*4 + 4]
ror edi, 0x23
add r9d, dword [rdi + r11 - 0x17fffff8]
and qword [rsp + rdi - 0x17fffff8], rbp
xadd dword [rsp + rdi - 0x17fffffa], ebx
add word [rsp + rbp - 0x630197b], 0xa3a6
lea r11, [r11 + rdi - 0x17fffffc]
call fcn.140269f9f
bswap esi
lea esi, [rax + rsi - 0x36e2d1e8]
bswap esi
movzx edi, cx
lea rdx, [rdi + rax*8 + 0xe8f581a]
mov qword [rsp + rcx*2 - 0x38], rbx
shl r10b, 0xa3
lea rdi, [rdx*4 - 0x66c393dd]
sar ax, 0x6e
xor dword [rsp + rax - 0x77020000], esi
pop rbx
ror di, 0x8b
sbb cx, 0xc410
shl r10b, 0x64
movsxd rsi, esi
mov r9d, eax
xor r10b, r9b
adc r8, rsi
jmp 0x140280d99

Function at 0x14024a2d4
Capabilities:
Authenticate hmac

Disassembly:
shr dx, 0x89
add r10, rbp
jmp 0x1402cf8d8
rol ebp, 3
mov qword [rsp + r9*2 - 0x41a], rbx
mov qword [rsp + r9*2 - 0x412], rsi
not r9w
xor dword [rsp + rax - 0x52007ff8], ebp
jmp 0x1402a7cbb
lea r11, [r11 + rbx*2 - 0x5c]
movsx edx, bx
lea r8, [rbx + r8 - 0x30]
movzx ebp, byte [r8 + rbx - 0x2f]
lea rcx, [rdx*8 - 0x27c4026a]
xor bpl, sil
inc di
ror di, 0xe3
cmovs edi, ebx
sbb bpl, 0xb0
xor bpl, 6
sal ebx, cl
and di, 0x22a5
or cl, dl
inc bpl
mov eax, 0xa2c2029
shl di, cl
add ax, 0xb78f
not bpl
lea rcx, [rcx*2 - 0x45689af7]
xor bpl, 0x36
ror bpl, 1
rol eax, cl
xor dx, ax
xor sil, bpl
add rbp, rsp
call fcn.140260538
not dx
jmp 0x1402f7082
call fcn.140249bc2
mov r9w, word [r11]
mov edi, 0x5913f52f
movsx ebx, dil
jmp 0x1402a6bcb
mov rsi, qword [rsp + r9 - 0xfdea]
or ecx, ecx
adc dword [rsp + r9 - 0xfdf0], ebx
sbb eax, 0xac3aa7b5
movsxd rbp, ebp
sar edx, cl
jb 0x140248656
Function at 0x14025054f
Capabilities:
Encode data using base64

Disassembly:
mov edx, edi
lea r11, [rdi + r11 - 0x7ad33a8]
mov ebp, edx
mov qword [rsp + rdi*2 - 0xf5a6760], rbp
mov r8, rax
mov r9d, edi
neg dword [rsp + rdi*2 - 0xf5a6758]
jne 0x1402b05c6
rol dil, 6
push rdi
adc edx, 0x21a481b8
movsx r9d, dil
not edx
movzx r10d, byte [rsp]
rol edx, 1
Function at 0x14025c9e2
Capabilities:
Authenticate hmac

Disassembly:
rol dx, 1
neg rcx
neg dx
pop rax
xor bx, dx
call fcn.1402ecf42
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x1402dc6a2
mov r9, rax
jmp fcn.1402dc6a8
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
Function at 0x14026e27f
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
jmp r10
adc r8, rdx
shr byte [rsp + 0xc], 0xe1
mov qword [rsp], rdi
mov r9w, word [rbp + riz]
jns 0x140298f9d
jmp 0x14029d7a4
movsx edx, di
rol dx, 0x43
mov cl, byte [rbp + rdx - 0x3040]
ja 0x1402f3871
jbe 0x14026027d
lea r8, [r8 + rdi - 0x6a1ac82b]
jp 0x1402ad061
lea ecx, [rcx + r11 - 0x785445f8]
mov qword [rsp + r11 - 0x4ea6faeb], rdi
movsx edi, sil
xor dword [rsp + r11 - 0x4ea6faeb], ecx
pop rdi
jmp 0x14027ad4c
movsxd rcx, ecx
sar al, 0x22
add rbp, rcx
mov rbx, qword [r9 + r8]
mov sil, byte [r8 + r11 - 0x4ea6fae3]
lea r8, [r8 + r9*4 + 0xa]
lea rcx, [r11 + r9*4 - 0x6bfaa1cc]
xadd edx, r11d
mov byte [r11 + rbx - 6], sil
push r9
cmovns rcx, qword [rsp + r11*2 - 0xc]
xor qword [rsp + r11*2 - 0xc], rbp
ret
sub byte [rsp + rdx*8 - 0x18209], ah
add al, al
lea rbp, [rbp + rdx*2 - 0x6082]
neg dword [rsp + rdx - 0x303f]
shr r9w, cl
mov word [rbp + rdx*4 - 0xc108], r9w
call fcn.1402c1189

Function at 0x140275ee8
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [r11*8 + 0x58399b20]
rol bl, 1
sub dword [rsp + r11 - 0x3b46ee38], 0x219040e
and cx, 0xb89f
xor dil, bl
shr dword [rsp + r11 - 0x3b46ee3a], 0x6e
lea rbx, [rsp + rbx + 0x10]
or dx, word [rbx + r11 - 0x3b46ee43]
sub eax, esi
lea r8, [r11 + r8 - 0x3b46ee45]
mov word [r8 + r9], dx
dec r11b
mov edx, esi
or byte [rsp + r11 - 0x3b46ee38], r11b
pop rsi
pop rbx
jae fcn.1402dc2e3

Function at 0x14027b070
Capabilities:
Authenticate hmac

Disassembly:
xor rdi, rdi
mov qword [rsp + rdx - 0x820008], rdx
mov rdi, qword [rsp + rdx - 0x820000]
movsxd r11, r11d
not edx
jno 0x140297ac1
mov edx, 0xb4290495
movsx esi, dx
movsx eax, dx
mov edx, dword [r10 + rsi*2 - 0x92a]
mov ecx, 0x8f88c019
movzx r9d, al
lea r10, [rsi + r10 - 0x491]
xor edx, edi
lea rbx, [rax + rax + 0x45a4d0b0]
neg edx
lea r11, [rcx + 0x3a3d2c82]
sub al, r11b
shr ax, 0xa5
not edx
push r9
inc edx
jmp 0x14025a9ef

Function at 0x14027b4cb
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [rcx + r8 - 0x2f16b6a5]
pop r9
xor ebx, esi
mov eax, 0xc8b914ae
inc ebx
mov qword [rsp + rcx - 0x2f16b6a5], rcx
movzx edi, ax
ror ebx, 1
movsx r9d, word [rsp + rdi*2 - 0x295b]
sal rdi, 0x37
movzx ebp, ax
sbb ebx, 0xea2f09a1
push rax
xadd word [rsp + rcx - 0x2f16b697], cx
inc bp
ror ebx, 2
movsx edx, r9b
sal r9w, 0xce
neg qword [rsp + r9*4 - 0x1fff8]
mov qword [rsp + r9 - 0x7ff8], rsi
or r9b, 0x91
shl r9b, 0xe2
xor dword [rsp + rcx*2 - 0x5e2bfff8], ebx
mov rsi, qword [rsp + rcx - 0x2f15fff8]
shl ecx, 0x53
xadd bpl, cl
movsxd rbx, ebx
mov qword [rsp + rcx - 0xa7], r9
adc r10, rbx
and qword [rsp + rcx - 0xa7], rdi
movzx ax, byte [rcx + r11 - 0xaf]
add cx, r9w
sbb dword [rsp + rcx - 0x80f3], edi
mov cl, byte [r11 + r9*4 - 0x2010e]
jae 0x14025209c
movsx r9d, dl
lea rcx, [r9 + r9*8 - 0x10cf024c]
lea r11, [r11 + rdx*2 - 0x10]
lea rax, [rdx + rcx*8 + 0x15bc63bb]
neg rax
xor r10d, ebx
push rsi
not r10d
shl sil, 0x61
rol r10d, 1
xchg rsi, r9
dec r10d
push rsi
shr dword [rsp + rdx*2 - 9], cl
xor byte [rsp + rdx*2 - 0x13], 0x12
rol r10d, 2
and rax, rax
neg rdx
jp 0x14024c547
Function at 0x14027b5cb
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1402eebcb
call fcn.1402877f1
pop rbx
movsxd rdx, edx
mov r9d, 0x610aee24
call fcn.14027f51f
mov rbx, qword [r8 + 8]
mov esi, 0x388deb06
movzx r11d, sil
movzx edx, r11w
lea r8, [r8 + rdx + 2]
not rax
movzx ecx, r11w
xor edx, esi
not rbx
mov r9d, ecx
or rax, rbx
movsx ebx, sil
xadd bl, r11b
mov qword [rsi + r8 - 0x388deb06], rax
rol r11b, 0x43
not r11d
jae 0x14029bcdb
call fcn.140254dfb
mov eax, dword [r8]
lea rbx, [rcx - 0x3265616b]
xor eax, esi
movsx r9d, cx
xadd rbx, rcx
call fcn.1402f61e5
movsx esi, di
bswap edx
ror rdi, 0x75
neg edx
push rbx
movzx ebx, r10b
shl si, 0xc5
xor dword [rsp + rbx*2 - 0x9a], edx
xadd rsi, r9
cmovs edi, esi
pop rbx
ja 0x140246da2
mov esi, dword [r10 + rdx - 0x388deb00]
movsx eax, r9w
lea r10, [r10 + rdx*2 - 0x711bd5fc]
call fcn.140269a72
mov qword [rsp + r9 - 3], rbp
ret 0x18

Function at 0x14027c088
Capabilities:
Authenticate hmac

Disassembly:
push rdx
xor ecx, edi
movzx r9d, dl
ror ecx, 1
push r9
lea ecx, [rcx + r9*2 + 0x68892ca7]
add word [rsp + r9 + 9], r9w
not ecx
pop r9
adc word [rsp + r9*2 + 4], dx
lea ecx, [r9 + rcx + 0x5b2e390e]
neg qword [rsp + r9*8]
ror ecx, 1
movzx r11d, word [rsp + r9*2]
mov qword [rsp + r9], rdi
xor dword [rsp + r9], ecx
pop rdi
movsxd rcx, ecx
add rbp, rcx
mov rcx, r8
inc r9w
jnp 0x14025c8e8
neg qword [rsp + r11 - 0x3ffefff1]
xor dil, r9b
inc bl
jle 0x1402d1ba5
mov edx, 0x9981f411
movsx ecx, dx
mov ecx, dword [r10]
sal dl, 0xe6
dec dl
adc r10, 4
sal dx, 0x6b
jne 0x140265710

Function at 0x14027cc17
Capabilities:
Authenticate hmac

Disassembly:
ror dil, 1
not word [rsp + rdx*2 - 0x4a]
xor bl, dil
push rax
call fcn.1402a36fe
not cx
pop r9
pop rsi
push rcx
mov rcx, qword [rsp + rcx - 0xfff6]
call fcn.14024d7f0