joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401704bc
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
adc bx, bx
mov qword [r10 + rbx*2 - 0x64c8403a], r11
movzx r11d, bl
movzx eax, r11b
sbb r11, rax
mov r9d, dword [rdi + rbx*2 - 0x64c8403a]
movsx esi, ax
mov qword [rsp + rbx - 0x3264201d], rcx
add rbx, rcx
lea rdi, [rbx + rdi - 0x32642107]
xor al, 0x59
cdq
rol cx, cl
xor r9d, ebp
push rbx
call fcn.1401b1535
mov ebx, 0xea1600ab
mov r9d, ebx
shr bl, 0x41
mov dx, word [r10 + riz]
lea r11, [r9 + r9*4 - 0x2cd3d135]
mov cl, byte [r10 + riz + 2]
neg r11d
push r9
adc r11b, 0x88
adc r10, 1
ror qword [rsp], 0xb6
sbb r9w, r9w
push rbx
shr dx, cl
or r9b, r9b
mov word [r10 + riz], dx
sar r11w, 0x4b
or byte [rsp + 9], 0xca
mov r11d, dword [rdi + riz]
js 0x1401b7b85
adc edx, ebx
rol ecx, 1
jmp 0x1401b0646
neg byte [rsp + rbx - 0x43ee16a4]
rol r11d, 2
bswap r11d
movsx eax, bx
inc byte [rsp + rbx - 0x43ee169f]
sar al, 1
xor r11d, 0x1dad729b
inc r9b
jno 0x14019bf43
dec bl
neg r11d
not qword [rsp + rbx - 0x43ee16a1]
sal si, 0x28
not sil
mov qword [rsp + rbx - 0x43ee16a1], rbp
sets bl
mov ebp, 0x649be165
xor dword [rsp + rbx - 0x43ee15f8], r11d
shr rsi, 0xbf
xchg rsi, rax
mov rbp, qword [rsp + r9 - 0x2edfff9]
movsxd r11, r11d
pop rsi
ror r9w, 0xae
adc r8, r11
mov qword [rsp + r9 - 0x2ee0004], r8
ret
push rbp
xor dword [rsp + rbx*2 - 0xf0], ecx
pop rbp
neg si
call fcn.1401825a4
mov r9d, 0x651fd4bc
mov rbx, qword [r10 + r9 - 0x651fd4bc]
lea rsi, [r9 + r9 - 0x4244387a]
mov eax, r9d
mov rax, qword [r10 + rax - 0x651fd4b4]
movsx r11d, sil
imul rbx
push rsi
lea rcx, [rsi*2 - 0x554861ec]
push rcx
mov qword [r9 + r10 - 0x651fd4bc], rdx
call fcn.1401a851b
adc rdi, 4
xor r11d, ebp
xchg dword [rsp + 7], r9d
movzx esi, bl
or esi, dword [rsp + r9 - 0x2edfff8]
bswap r11d
add rbx, qword [rsp + r9*4 - 0xbb7fff8]
inc qword [rsp + r9 - 0x2edfff8]
rol bl, 0xe1
xor r11d, 0x4ca875b3
or ebx, r9d
jae 0x14019043c

Function at 0x140170af4
Capabilities:
Manually build aes constants

Disassembly:
bt rsi, 0xfe
dec r11d
mov qword [rsp + r9*2 - 0x4b2f17d0], rcx
shl byte [rsp + r9 - 0x25978be7], 0xc1
ror dword [rsp + r9*2 - 0x4b2f17ce], 0x9a
ror r11d, 2
dec r9d
dec si
je 0x1401714e8
bswap r11d
jno 0x14018cbaf
bswap ebx
call fcn.1401a6729
neg bl
mov qword [rsp + r9 - 0x25978be7], rbp
adc ecx, 0x360c485e
xor dword [rsp + r9 - 0x25978be7], r11d
bt ecx, 0x29
pop rbp
movsxd r11, r11d
call fcn.14016e515
rol dx, 0x8d
neg ebx
neg si
neg ebx
sbb si, bx
bt rcx, 6
rol si, 1
jmp 0x1401af701

Function at 0x140173e0c
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov cl, byte [r10 + rdx - 0x7730b354]
movsx eax, dx
mov qword [rsp + rdx - 0x7730b364], rbx
btc ebx, 0xca
lea r10, [r10 + rdx - 0x7730b35a]
call fcn.1401b3703
sar bx, 0xaa
inc edx
xor edx, 0xcd3aadb0
sar r9w, 0x8d
bswap ecx
call fcn.1401b470b
Function at 0x14017d38f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rax, [rsi + rbx - 0x6865304d]
neg r11w
mov dword [r10 + rsi*4 - 0x104], r9d
ror r11b, 0xc2
dec eax
mov eax, dword [rsi + rdi - 0x41]
adc cl, 0x55
lea rdi, [rdi + rsi*2 - 0x7e]
xor eax, ebp
mov qword [rsp + rsi*2 - 0x82], rcx
mov edx, dword [rsp + rsi*2 - 0x82]
inc rsi
neg eax
push rbx
inc si
xchg ebx, ecx
ror eax, 1
xor eax, 0xa4038b1c
ror eax, 1
pop rbx
movsx r9d, word [rsp + rsi*2 - 0x85]
mov qword [rsp + rsi*4 - 0x10c], rbp
add r11, 0xffffffffebb39f05
je 0x140193ff4
xor dword [rsp + rsi - 0x43], eax
jmp 0x1401aaf7d
xor r9d, 0xb8a3ac83
shr bx, 0xc8
not dl
bswap r9d
neg r9d
push rbp
lea rax, [rbx + rbx - 0x13e357cc]
xor dword [rsp + rdx*2 - 0x447d1a30], r9d
movzx r11d, dx
lea rcx, [rdx + rdx*4 - 0x24ee0915]
pop rbp
neg ecx
jnp 0x1401ab9cc
mov eax, 0x1c17858a
mov rbx, qword [r10 + rax*4 - 0x705e1628]
movzx r11d, al
lea r10, [r10 + rax - 0x1c178582]
movq xmm0, rbx
mov eax, dword [rax + rdi - 0x1c17858a]
lea rbx, [r11 + r11*8 + 0x190cbdb]
lea rdi, [r11 + rdi - 0x86]
movsx ecx, r11w
xor eax, ebp
ror ecx, cl
xor eax, 0xa0126ad7
not eax
lea eax, [rbx + rax - 0x6c2b5517]
movsx edx, cx
rol r11, 0xf8
bswap eax
dec rdx
shl r11, 0x52
lea eax, [r11 + rax - 0x28087537]
adc edx, 0x840ad071
push rbp
and cx, bx
xor dword [rsp + r11], eax
shl r11, 0xa3
lea r11, [rbx - 0x21dd61f3]
add dx, r11w
pop rbp
sub rbx, rdx
sete dl
neg dl
movsxd rax, eax
adc r8, rax
shr ebx, 0xfb
jmp r8
shl r9, cl
pop rbp
bt rcx, 0x70
shr r11, 0x1d
movsxd rax, eax
inc r9b
adc r8, rax
xadd r9, rdx
jne 0x14018785e
mov r11, qword [rdi]
mov esi, 0xbab2938d
dec rsi
add esi, 0x1cb97061
xor r11, rbp
rol r11, 1
movsx r9d, si
lea r11, [r9 + r11 - 0x5cbfe587]
lea rbx, [rsi + r9*4 + 0x62a73576]
neg ebx
movzx ecx, bx
xor r11, 0xffffffffb53836a5
inc r9w
jge 0x1401af13c
mov r11d, 0xe1fad7a
mov esi, r11d
movzx dx, byte [r10 + r11 - 0xe1fad7a]
mov bl, byte [r10 + rsi - 0xe1fad78]
lea r10, [r10 + r11 - 0xe1fad78]
not dl
movsx ecx, sil
movsx r9d, r11b
xadd r9w, cx
not bl
mov eax, 0x323e5f0e
or dl, bl
add r11w, si
dec r11w
mov ebx, esi
mov word [r10 + r11 - 0xe1f5af3], dx
mov r9d, dword [r11 + rdi - 0xe1f5af3]
and cl, 0x6a
cmovo rcx, r11
lea rdi, [rdi + r11*2 - 0x1c3eb5e2]
not si
xor r9d, ebp
cbw
movsx edx, si
inc r9d
sar rcx, cl
btc ebx, 0xb2
bswap r11
neg r9d
ror sil, 0xa1
shl bx, 0x69
rol r9d, 2
rol eax, 0x7e
not r9d
cwde
sar dl, 0x67
sal bx, 0xc1
lea r9d, [r9 + rsi - 0x354cc514]
push rbp
xor dword [rsp + rsi*2 - 0x1c3ea584], r9d
call fcn.14018ab1b
movsxd r9, r9d
jp 0x1401a0445
lea rsi, [r11 + rax*8 - 0x616aab77]
shl dl, 0x87
adc r8, r9
mov r10d, dword [r11 + r10 - 0x8d18]
lea r11, [rax - 0x24eeef8a]
jmp fcn.1401a6864
neg r11
not ebx
rol bl, 0x65
btc rsi, 0x4a
lea r11, [r11 + r9*4 + 0x419cc69f]
movzx edx, si
xor rbp, r11
ror rbx, 0xcb
mov qword [r10 + r9*2 - 0x7e4], r11
cmovb ebx, edx
ror r9, cl
xadd rdx, rcx
mov r11d, dword [rdi + rbx*2 - 0xe84ca]
xor r11d, ebp
push rdx
push rsi
inc rsi
rol r11d, 3
neg r11d
ror r11d, 2
or esi, esi
mov word [rsp + rbx - 0x74268], cx
neg r11d
sar word [rsp + rbx - 0x74264], cl
Function at 0x14017e579
Capabilities:
Manually build aes constants

Disassembly:
xadd cl, r11b
adc sil, al
xor r9b, r11b
neg r9b
xadd esi, r11d
ror r9b, 1
btc rdx, 0xfe
inc r9b
mov ebx, 0x3da73336
or r11d, 0x3eac4bac
xor bpl, r9b
sub eax, esi
ror ebx, cl
call fcn.14019c758
mov edx, 0x8d21438c
movzx ecx, dl
mov ebx, dword [rcx + r10 - 0x8c]
mov ecx, dword [r10 + rcx - 0x88]
neg rdx
btr dx, dx
adc r10, 3
movsx esi, dx
lea r11, [rdx + rdx*2 + 0x65321a74]
add ebx, ecx
mov r9d, edx
movzx ecx, dl
mov eax, r9d
mov dword [r10 + r9 - 0x72debc64], ebx
add eax, r11d
mov eax, dword [rcx + rdi - 0x64]
call fcn.1401917e7
sub bx, r11w
lea rdi, [rdi + rdx - 0xf3]
pop rsi
sal byte [rsp + rdx - 0xf4], 0xc4
dec bl
xor r9d, ebp
movsx eax, r11w
call fcn.1401b32e9
add r10, 4
mov ecx, r9d
mov dword [r10 + riz], r11d
mov r11d, dword [rdi + riz]
neg r9d
movsx esi, r9w
lea rdi, [rdi + rsi*8 - 0xb2dc]
bswap r9d
movsx ebx, dl
xor r11d, ebp
jmp 0x1401b739d
pop rbp
sal si, 0x6f
movsxd r11, r11d
call fcn.14018c94e
lea rax, [rsi*8 - 0x215e9fa3]
movzx r9d, byte [rdi + rsi - 0x74d9]
btc dx, 0xe8
cqo
not ecx
lea rdi, [rdi + rdx + 6]
jb 0x1401a0b30
inc rdx
inc ecx
xor r9b, bpl
jmp 0x1401714ef
inc r9d
shr rcx, cl
not r11d
bts r9d, ebx
ror rcx, 0x9f
bswap r11d
mov eax, ecx
cdqe
cdq
not r11d
push rcx
adc qword [rsp + rdx], rcx
or sil, sil
inc r11d
sal qword [rsp + r9 - 0x5c16ce77], 0xfc
ror rax, 0x4e
bswap r11d
inc eax
xor qword [rsp + r9 - 0x5c16ce77], rbp
add ax, bx
and ax, 0xd3e4
xor dword [rsp + r9 - 0x5c16ce77], r11d
mov ebp, r9d
jmp 0x1401952b8

Function at 0x1401817b4
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov word [rsp + rsi - 0x2a284af7], ax
not r11d
bts rbx, rcx
bswap r11d
lea r11d, [rsi + r11 - 0x653acf42]
add rsi, rsi
mov qword [rsp + rsi - 0x545095f6], rbp
mov qword [rsp + rdx - 0x9f7], rdx
xor dword [rsp + rsi - 0x545095f6], r11d
mov rbp, qword [rsp + rsi - 0x545095f6]
bswap esi
ror bx, 0x4d
shr edx, 0x9b
movsxd r11, r11d
inc r9b
and rdx, qword [rsp + rdx*2]
adc r8, r11
call fcn.1401b5d5b

Function at 0x1401825a4
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
movsxd rcx, ecx
pop rax
sub esi, ebx
adc r8, rcx
call fcn.14017e2e1

Function at 0x140182d5a
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
shr dl, cl
mov ecx, ebx
ror cl, 0x83
movsx r9d, cx
mov word [rax + r10 - 0x43f6], dx
mov edx, ebx
cdq
sbb edx, ebx
mov edx, dword [rax + rdi - 0x43f6]
btr cx, r11w
ror al, 0x44
xor rcx, 0x29aa114
lea rdi, [rdi + rax*2 - 0x86da]
cwde
xor edx, ebp
jmp 0x14019f563
mov qword [rsp + rdx + 0x6a637174], rax
pop rdx
pop r11
pop r11
jg fcn.1401a6864
mov eax, 0xf52343f6
cwde
movzx dx, byte [r10 + rax - 0x43f6]
mov cl, byte [rax + r10 - 0x43f4]
movsx ebx, al
lea r11, [rbx*2 - 0x3bc63fe5]
xadd ebx, r11d
lea r10, [r10 + rax*2 - 0x87ea]
jle 0x1401703a5
Function at 0x1401835cb
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov rax, qword [r10 + r9*2 - 0x1e8]
neg edx
lea r10, [r10 + r9*8 - 0x7c8]
lea r11, [rdx + 0x2fa7e213]
or dx, bx
mov qword [rdx + rsi - 0x74c6fffc], rax
mov qword [rsp + r9*4 - 0x3f0], rdx
mov eax, r9d
mov ebx, dword [rdi + r9 - 0xfc]
lea rdi, [rdi + r9*4 - 0x3ec]
xchg byte [rsp + r9 - 0xf7], dl
ror r9b, 0x27
xadd r9b, dl
xor ebx, ebp
not word [rsp + rdx - 0x74c6fff8]
movsx esi, dx
pop rsi
not ebx
push rdx
ror qword [rsp + r9*2 - 0x1f2], 0x71
bswap ebx
xor r11d, 0x57131558
mov ecx, 0x322f1bcf
call fcn.14019b3d0
mov esi, 0xeb93806d
movzx edx, si
mov edx, dword [rdi + rdx*2 - 0x100da]
lea rax, [rsi + rsi*4 - 0x20788097]
add rdi, 4
xor edx, ebp
movsx ecx, al
movzx r11d, ax
add esi, 0xd13b46fe
sbb edx, 0x9e39504a
xor edx, 0x343da10a
sub rax, 0xfffffffff1184e3b
push rsi
inc edx
push rcx
dec word [rsp + r11*2 - 0x314]
xor edx, 0x9a1ebba8
cbw
lea rcx, [rsi*8 - 0x1dcbd81b]
pop rsi
not edx
ror r11, 0x11
cdqe
mov qword [rsp + rax + 0x77afffb1], rbp
xor dword [rsp + rax + 0x77afffb1], edx
pop rbp
bt rax, rax
movsxd rdx, edx
adc r8, rdx
cdq
mov ebx, 0xb2a247b8
lea r9, [rbx*4 + 0x4f11bd1e]
movzx edx, byte [rax + rdi + 0x77afffb1]
sar r11, cl
sar sil, 0xc5
lea rdi, [r11 + rdi + 1]
shr al, 0x61
dec al
xor dl, bpl
bt r11, r11
setae r9b
lea rbx, [r11 + r11*2 - 0x52ed8fc7]
ror dl, 1
inc r9d
cwde
not dl
call fcn.14019acb5
mov ebx, 0x92079f5a
lea rax, [rbx*2 + 0x63833ece]

Function at 0x140183b7c
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
pop rcx
pop rbx
jns fcn.1401a6864
mov ebx, 0xb8105257
movzx esi, bx
mov ebx, dword [rdi + rsi - 0x5257]
lea rdi, [rdi + rsi - 0x5253]
dec si
lea rdx, [rsi + rsi*4 - 0x315e669f]
movzx eax, sil
xor ebx, ebp
bswap rdx
movsx r9d, sil
movsx ecx, si
lea ebx, [rbx + rsi - 0x3f3ad048]
sal rcx, cl
bts dx, 0xde
xor ebx, edx
sar r9b, 0xa2
neg rcx
call fcn.1401b346b

Function at 0x140185471
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov qword [rsp + r9 + 0x6b565988], r8
push rax
movsx eax, r9b
movsx r10d, r9w
bswap r9
push rcx
mov ecx, r9d
not al
jmp 0x1401b55d1

Function at 0x140189856
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
neg dl
xor bpl, dl
mov qword [rsp + r9 - 0x2028c45a], 0x5724e49f
movzx r11d, al
lea rdx, [rsp + rdx + 8]
sar word [rsp + r9 - 0x2028c454], 0xe7
push rsi
call fcn.14017a43d
mov edx, 0x21332d97
push rdx
mov esi, dword [rdx + rdi - 0x21332d97]
and qword [rsp + rdx*2 - 0x42665b2e], rdx
lea rdi, [rdx + rdi - 0x21332d93]
lea rcx, [rdx + rdx*4 - 0x51d59ea4]
xor esi, ebp
ror esi, 1
lea r9, [rdx + rdx*8 - 0x70cbd6ac]
movsx r11d, dx
dec esi
mov byte [rsp + rdx - 0x21332d92], r9b
movzx ebx, r11w
rol esi, 1
movzx eax, r9b
jmp 0x14019c4c1

Function at 0x14018a0a8
Capabilities:
Manually build aes constants

Disassembly:
movzx eax, bl
movzx ecx, word [rsp + r9 - 0x211b]
mov qword [rsp + r9*8 - 0x10910], rbp
rol rcx, cl
jb 0x1401801ac
Function at 0x14018d546
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
push r11
lea rbx, [r14 + 0x3526bfa9]
mov rsi, qword [rsp + r14 - 0x94]
mov r14, qword [rsp + r14*2 - 0x178]
mov r11, qword [rsp + rbx - 0x3526c02d]
mov qword [rsp + rbx*2 - 0x6a4d80f2], 0x7820ea09
bswap rbx
mov rbx, qword [rsp + 0x70]
call fcn.140190e92
mov ebx, 0x1b3eace9
movsx edx, bl
mov esi, dword [rbx + r10 - 0x1b3eace9]
movsx eax, bx
rol rbx, 0x95
mov r9d, eax
movzx eax, byte [rdi + riz]
jb 0x140182e1c
lea r11, [rdx + 0x21301095]
xor al, bpl
bt r11d, 0x7f
adc al, 0x13
xchg ebx, r11d
rol al, 1
xadd rbx, r9
or bx, dx
dec al
rol r9, 4
not al
inc bl
rol al, 1
jmp 0x1401af0a0

Function at 0x14018e6ce
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor sil, bpl
neg r9
sal ax, 0xe1
ror sil, 1
xor al, 0x17
not sil
lea r11, [r9 + rbx*2 - 0x6f5bf623]
call fcn.14017e835
cqo
adc r8, rbx
mov r11, qword [r10 + rdx]
sal word [rsp + r9 + 5], 0x66
xor rax, qword [r10 + rdx + 8]
shl word [rsp + rdx*2 + 1], 0x41
seta r9b
lea r10, [r10 + rdx*8 + 8]
and r9b, byte [rsp + rdx + 4]
adc r11, rax
xor dl, 0xda
mov qword [r10 + rdx*4 - 0x368], r11
push rcx
mov qword [rsp + r9*2 + 0x10], rcx
mov qword [rsp + rdx*4 - 0x368], r8
ret 0x10
sub dl, 0x6b
xor dl, 0x8c
pop rcx
movzx eax, bx
sub dl, 0x47
xor r11b, r11b
btc rax, rax
xor bpl, dl
neg r11d
sub al, 0x4f
jle 0x140192acb
push 0xffffffff8b92d245
mov ebx, dword [rdi]
add rdi, 4
mov r11d, 0xf43939f7
lea rsi, [r11*8 - 0x7c47cbe8]
xor ebx, ebp
rol ebx, 1
dec rsi
movsx edx, byte [rsp]
call fcn.1401700e7
movsxd rsi, esi
add r8, rsi
rol dx, 0x64
pop rbx
pop r11
pop r9
pop rdx
pop rdx
pop rbx
pop rdx
pop rcx
pop rbx
pop rcx
pop rdx
jb fcn.1401a6864
add rdx, rsp
bt bx, si
rol rbx, 0xfc
mov qword [rsi + rdx + 0x74dc6f45], r9
mov edx, r11d
adc si, bx
adc r11b, dl
mov ebx, dword [rdi + r11*2 - 0x18683201]
adc rsi, rax
mov r9d, r11d
xor ebx, ebp
lea ebx, [rbx + rsi*2 + 0x4b7dc1fb]
xor ebx, 0x343da10a
inc ebx
xor ebx, 0x9a1ebba8
lea rax, [rsi*2 + 0x44321023]
btc r9d, r11d
not ebx
cbw
ror edx, 0x1c
push rbp
mov ebp, r11d
xor dword [rsp + rsi + 0x74db8923], ebx
mov ecx, r9d
pop rbp
push r9
call fcn.140185d00
mov ecx, 0xd036b58f
mov r9d, ecx
mov cx, word [r10 + riz]
movsx eax, r9w
movsx ebx, ax
movzx esi, ax
movzx esi, byte [rsi + rdi - 0xb58f]
rol bl, 0xa6
cbw
jb 0x140176edb
Function at 0x14018e75a
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov r9d, dword [rdi + rdx*2 - 0xc0]
lea rdi, [rdx + rdi - 0x5c]
call fcn.14019e707
lea rdi, [rdi + rbx - 0x721b]
inc r9d
pop r11
movsx r11d, sil
xor eax, ebp
shl r11b, 6
xor eax, 0xba05c27b
neg si
add rcx, rsi
not eax
rol eax, 1
btr rdx, rsi
jae 0x140198282
or rsi, rdx
ror al, 0x43
movzx ebx, r11b
not rsi
lea rbx, [rax + r11*2 + 0x42af60ea]
mov rax, rsi
mov ecx, 0xec97c318
movsx r9d, bl
mov rdx, qword [r10 + riz + 0x10]
or cl, 0xc2
shl r11, 0xb1
add rax, rdx
and r11, r11
or r11d, 0x12bd8b34
mov qword [r10 + r11 - 0x12bd8b24], rax
mov esi, 0xdc1cf160
push rbx
lea rax, [rsi*2 - 0x58fffc30]
lea r10, [r10 + r11*4 - 0x4af62cc0]
btc cx, cx
jae 0x140194a75
inc eax
inc rsi
lea rdx, [rbx + rsi*8 - 0x7f5198ae]
call fcn.14017e677
dec eax
call fcn.14017bc0f
mov ecx, 0xcd24b237
mov esi, 0xda29eddc
mov rax, qword [r10 + riz]
lea r9, [rsi + rcx*4 - 0x42437ca5]
push r9
mov r11d, dword [r10 + riz + 8]
lea rbx, [r9*2 - 0x5f4207c6]
and rsi, rsi
adc r10, 0xc
mov dword [rax + riz], r11d
movzx edx, bl
ror esi, 0xb4
jb 0x140172a78

Function at 0x14018ea30
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
neg esi
mov qword [rsp + rbx*2 - 0xa234], rcx
xchg byte [rsp + rbx - 0x5116], r9b
sal r11d, cl
rol esi, 1
neg ecx
mov qword [rsp + rbx - 0x511a], rbp
sal r11, 0x53
sal bl, cl
xor dword [rsp + rbx - 0x5180], esi
movzx edx, r9b
xor rdx, rax
adc rbx, 0xffffffffb8a5f479
pop rbp
shr al, 0xa7
movsxd rsi, esi
ror r11d, 0x54
bswap eax
adc r8, rsi
sub bx, r9w
mov r9d, dword [rdi + rbx + 0x47597007]
jo 0x1401b4b37
dec ecx
lea rdi, [rbx + rdi + 0x4759700b]
ror r11, cl
rol bl, cl
xor r9d, ebp
cdqe
bt ecx, 0x48
neg r9d
xchg r11w, cx
dec r9d
sal ax, 0xa7
bt bx, dx
neg r9d
lea r9d, [r9 + rbx + 0x51f4ac06]
btc edx, 0x3d
push rbp
xor dword [rsp + r11 - 0xffe5], r9d
push rdx
mov rbp, qword [rsp + rbx + 0x475970c9]
lea rcx, [rbx*2 + 0x40fce45]
lea r10, [rbx + r10 + 0x475970b9]
rol dl, 0xe3
shr qword [rsp + rbx + 0x475970c1], cl
mov qword [r10 + r11 - 0xffe5], r9
xchg rdx, r11
pop rbx
pop rbx
ja fcn.1401a6864

Function at 0x14019585d
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
sal word [rsp + rdx*4 - 0x1ffffeb], cl
movzx eax, r9w
mov word [r10 + rdx*8 - 0x4000000], bx
cqo
pop rsi
pop rbx
pop rbx
jne fcn.1401a6864
Function at 0x140198ff9
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
inc dl
xchg ebx, r11d
not ebx
movzx r9d, cx
xor dl, 0xa5
mov qword [rsp + r11 - 0x5ca25dcc], r9
xor bpl, dl
not rbx
xchg rbx, r9
call fcn.1401b77a6
push 0xffffffffdb9537ea
mov r9d, 0xc2189970
movzx edx, word [rdi + riz]
sal qword [rsp], 0x5e
xchg byte [rsp + 4], r9b
js 0x1401a3f5d
mov r11d, dword [rdi]
sub rdi, 0xfffffffffffffffc
mov ebx, 0x848a4de3
movzx ecx, bl
mov esi, ebx
xor r11d, ebp
lea rax, [rsi + rbx*2 + 0x70bed238]
inc r11d
movsx edx, bl
movzx r9d, bl
xor ebx, r9d
neg r11d
rol r11d, 2
shr dl, 0xe4
push rcx
not bx
not r11d
lea r11d, [r11 + rcx*8 - 0x272d796a]
sbb rsi, 0x59abf8e6
mov qword [rsp + rcx - 0xe3], rbp
xor dword [rsp + rcx*2 - 0x1c6], r11d
sub bl, dh
pop rbp
neg ax
adc r9d, r9d
movsxd r11, r11d
jns 0x14019f6b3
mov r9d, 0xcc814096
lea r11, [r9*8 + 0x6a8acc2e]
mov ecx, dword [rdi + riz]
lea r11, [r9 + r11*4 + 0xd2d60f2]
rol r11w, 0x6d
movsx ebx, r11b
adc rdi, 4
mov esi, r9d
xor ecx, ebp
inc r11d
add r11w, 0x2881
not ecx
movzx eax, bx
sbb r11d, 0xe22bdc17
lea ecx, [rcx + rax*2 - 0x753d1e09]
push r11
shr al, 0x41
xchg byte [rsp + r11 - 0x31d56905], r9b
xor ecx, 0xd8b64166
dec esi
xor byte [rsp + rax - 0xff49], bh
sub rbx, r11
ror ecx, 3
jmp 0x14018150e
sbb cx, dx
add r8, r11
and rsi, rcx
call fcn.140180ca1
mov r9d, 0xde2fe28f
movzx edx, r9b
movsx ecx, dl
mov r9d, dword [r10 + rdx*4 - 0x23c]
call fcn.14018718a
xor dx, bp
mov esi, 0x3f20b39a
inc dx
neg word [rsp + rsi - 0x3f20b39a]
setge byte [rsp + rsi - 0x3f20b393]
dec qword [rsp + rsi - 0x3f20b39a]
not dx
movsx ebx, si
xor dx, 0xa307
dec dword [rsp + rsi*2 - 0x7e416731]
sar word [rsp + rsi*2 - 0x7e416732], 0x2b
movsx ecx, word [rsp + rsi*2 - 0x7e416730]
rol dx, 1
movzx eax, bl
xor bp, dx
xchg r9d, ecx
and cx, cx
pop r9
mov word [rsi + r10 - 0x3f20b39c], dx
sub r9d, esi
movzx r11d, al
mov r9d, dword [rdi + rsi - 0x3f20b398]
lea rsi, [rcx*4 - 0x13543018]
xor r9d, ebp
cwde
shl ebx, cl
ror r9d, 1
bts esi, r11d
dec r9d
rol r9d, 1
or ecx, esi
dec rsi
adc ebx, 0xea35b979
xor r9d, 0xd599a26e
sub bx, cx
inc r11d
movzx edx, r11w
sbb r9d, 0xd32991b9
add esi, ecx
jb 0x1401a667b
push rbp
xor dword [rsp + rax*4 - 0x268], r9d
movsx ebp, bx
btr dx, 0x77
pop rbp
lea rsi, [rsi + rbx*8 - 0x637701ea]
push rcx
movsxd r9, r9d
pop rax
sbb dx, cx
neg ebx
add r8, r9
movzx r9d, byte [rdi + r11 - 0x95]
bswap r11
btr rsi, rcx
lea rdi, [rdi + rdx - 0x4019]
sbb r11, r11
adc dl, 0x41
not ebx
xor r9b, bpl
not r9b
call fcn.1401a3716
Function at 0x14019da39
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov qword [rsp + r11 - 0x8716], r8
ret
mov qword [rsp + r11 - 0x8716], rcx
or dword [rsp + r11*4 - 0x21c58], 0xa51b8f36
xor dword [rsp + r11 - 0x870e], eax
neg esi
pop rbx
adc bx, r11w
pop rbp
xor rbx, rsi
jge 0x1401acdb6
btc cx, si
xor dword [rsp + rsi - 0x644e1330], r11d
pop rbp
shl esi, cl
movsxd r11, r11d
neg rcx
add r8, r11
xor r9, rbx
shl ebx, 0xf4
mov rax, qword [rdi + rdx - 0x600df14b]
add rcx, 0xffffffffdb94c64f
lea rdi, [rdi + rbx*2 - 0x3ffff8]
xchg rbx, rcx
xor rax, rbp
inc rbx
movsx r11d, bl
bts rbx, r11
neg rax
bswap rax
sar ebx, 0x28
add si, r9w
xadd ebx, ecx
ror rax, 3
neg ebx
dec rax
bts dx, r9w
not rax
xor rax, 0xffffffffa9abd8d6
lea rsi, [rsi*2 + 0x7b2540c6]
sub r9, 0xffffffffec35a4d0
push r11
lea rax, [rax + rcx*4 - 0x30f5a160]
call fcn.14018c346
or r9d, 0xb69f9f62
jl 0x140185923
movsxd rax, eax
push rbx
adc r8, rax
jmp 0x1401aae88

Function at 0x1401a026b
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
and dword [rsp + rsi*2 - 0x27f0], r11d
mov qword [rsp + rsi - 0x1402], r11
not rbx
mov qword [r10 + rsi - 0x13fa], rbx
movsx eax, r9w
movzx edx, word [rsi + rdi - 0x1402]
xor dx, bp
neg esi
mov qword [rsp + r11 - 0x13fa], 0x798753e
ror dx, 1
movzx ebx, r9b
sub dx, bx
pop r9
mov byte [rsp + r11 - 0x13f7], 0x8c
rol dx, 1
neg dx
inc r9
xor bp, dx
call fcn.1401ad780

Function at 0x1401a40d0
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov qword [rsp + r11 - 0x50e4fffe], rsi
bts cx, r11w
xor dl, al
xchg r11d, eax
add dword [rsp + rax - 0x50e4fffd], ecx
js 0x1401928c9
Function at 0x1401a40ee
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
shl esi, 0x2c
ror edx, 3
sar dword [rsp + r11 - 0x46b66efb], 0x81
xor ebx, ecx
sub eax, 0xa2870cc3
lea edx, [rdx + rsi*2 - 0x3f8ab5c3]
rol sil, 0x21
mov qword [rsp + r11 - 0x46b66ef8], rbp
neg bl
xor dword [rsp + rsi + 8], edx
shr r11, 0xee
sal bx, 0xa6
mov rbp, qword [rsp + r11*2 + 8]
movsxd rdx, edx
mov qword [rsp + r11*4 + 8], rsi
adc r8, rdx
mov ebx, dword [r10 + r11 - 4]
call fcn.14018f3e7
lea r11, [rdx + rdx*2 - 0x2ccc35a]
lea rdi, [rdi + rdx - 0x6420cf22]
push rdx
shr r11, 0x6c
jp 0x1401a26ff
not rbx
adc qword [rsp + rdx - 0xf9bf], r9
adc r9, r11
or rsi, rbx
add dword [rsp + rdx*2 - 0x1f386], edx
xadd byte [rsp + rdx*2 - 0x1f386], cl
mov qword [r10 + rdx - 0xf9c7], rsi
adc rcx, qword [rsp + r11 + 5]
movzx ebx, cl
mov qword [rsp + rdx - 0xf9c7], r8
ret 8
bswap edx
sal qword [rsp + r11 - 0x46b66fd1], 0xf1
adc al, r9b
mov dword [r10 + rdx - 4], ebx
ror qword [rsp + r11 - 0x46b66fd1], 0xc1
adc edx, dword [rdi + rdx + 1]
lea rdi, [rdi + r11 - 0x46b66fcc]
xchg byte [rsp + r11 - 0x46b66fcf], r11b
inc al
mov ebx, 0xde8f2011
xor edx, ebp
xor edx, 0xc5abe2fd
jmp 0x14019aba1
mov eax, dword [r10 + r9*2 - 0x226fb05e]
lea r9, [rbx + r11*8 + 0x49a400e1]
setb bl
push rbx
mov cl, byte [r10 + riz + 8]
or si, 0xb99b
call fcn.14019fe22
mov qword ss:[rax + rbx*2 - 0xf6], r11
or si, 0x412
xadd rdx, rbx
movzx eax, dx
jmp r8
movsx ecx, word [rsp + r11 - 0x46b66efd]
inc al
neg edx
cwde
not edx
push rsi
jmp 0x140178607
xor eax, ebp
inc eax
mov ebx, 0x67b404de
xor rdx, rdx
neg ebx
rol eax, 1
xor bl, 0x79
xor eax, 0xc20544f
xor bx, word [rsp + rdx*4]
btr r11w, r11w
mov byte [rsp + rdx*4 + 2], dh
lea eax, [rax + rdx*2 + 0x3e29a787]
and ebx, r11d
xor eax, 0xd69ab6a8
mov qword [rsp + rdx], rbp
shr bx, 0xab
lea rcx, [rbx + rbx*8 + 0x3089e71d]
xor dword [rsp + rdx*4], eax
movzx ebp, cl
pop rbp
rol r11w, 0xcc
and r11d, r11d
movsxd rax, eax
dec dx
lea r9, [rbx*2 - 0x71cbc87f]
adc r8, rax
push rdx
mov rsi, qword [r10 + rdx - 0xffff]
sar cx, 0x82
adc rbx, qword [r10 + rdx*8 - 0x7fff0]
dec byte [rsp + rdx*8 - 0x7fff3]
lea r10, [r10 + rdx*2 - 0x1fff6]
not rsi
and edx, ecx
push r9
jne 0x1401813b7
mov word [r10 + rsi*2], bx
pop rdx
pop rcx
pop rsi
jae fcn.1401a6864
mov eax, 0x4291532b
lea r9, [rax + rax*8 - 0x45e41451]
mov eax, dword [rax + rdi - 0x4291532b]
lea rdx, [r9 + r9*4 + 0x2086b5f3]
add rdi, 4
lea rbx, [rdx + rdx*2 + 0x638fe4fe]
xor eax, ebp
mov r11d, edx
rol ebx, 0xce
jb 0x140184c13
sbb eax, 0x89a43f3d
lea rbx, [rdx*2 + 0x7a824a94]
neg eax
sal r11d, 0xea
dec eax
ror bl, 0x41
dec r9d
add r9b, r11b
bswap eax
mov ecx, 0xba2bcf12
neg eax
shl cx, 0x89
shl r11, 0x9a
push rbp
movsx esi, dx
xor dword [rsp + r9 - 0x1137d831], eax
bts esi, 0x54
lea r11, [rsi + rbx + 0x5b029823]
pop rbp
inc sil
movsxd rax, eax
lea rcx, [rsi + rsi*2 + 0x3f018c28]
add r8, rax
sar rdx, 0x2d
add edx, dword [r10 + rdx*8]
sub bx, 0xa8e7
movsx eax, r9b
jns 0x1401993e1