joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140e0feb3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r8, [rbx + rbp*4 + 0x252a692a]
xor bpl, bpl
mov ebx, dword [rdi + rbp - 6]
mul ebp
xadd dx, cx
lea rdi, [rax + rdi - 6]
shr ax, 0x43
xor ebx, r11d
shr ebp, 0xf9
not r8b
call fcn.140df54ea
mov ebx, r8d
mov edx, ebx
jb 0x140dcc7ee
mov ecx, 0x7b86291
lea rdi, [rdi + rcx*2 - 0xf70c526]
mov edx, dword [rdi + rcx*8 - 0x3dc31488]
lea rbx, [rcx - 0x527b5ad9]
movsx r8d, cx
xor edx, r11d
mov r10d, ebx
xor edx, 0x24a38b81
movsx ebp, r10b
or cl, 0xa6
inc edx
neg r10w
ror edx, 1
neg edx
push r11
xor dword [rsp + rcx*4 - 0x1ee18adc], edx
dec r8d
pop r11
movsxd rdx, edx
add rsi, rdx
movsx eax, bp
push r8
mov cx, word [r9 + rcx - 0x7b862b7]
lea rdx, [rbx*8 + 0x37884817]
mul bx
jno 0x140de21b3
lea r9, [rbx + r9 + 0x4ac2f84a]
lea rdi, [rdi + r8 - 0x6291]
call fcn.140dbef19
sub rdi, 4
call fcn.140df2161
call fcn.140dfde7a
push r10
sal dword [rsp + rbp - 0xa8e], 0xa
mov r10d, dword [rdi + rbp*4 - 0x2a6c]
mov r8d, eax
movzx ecx, bpl
xadd bp, cx
lea rdi, [rbp + rdi - 0xb38]
ror qword [rsp + rbp - 0xb34], cl
sbb word [rsp + rbp - 0xb2c], 0x3b25
xor r10d, r11d
call fcn.140dc93b5
xadd r8b, dl
and cx, bx
not cx
mov word [r9 + rax*2 - 0x9482000], cx
lea rcx, [r8 + 0x5fa35211]
jmp rsi
not r8b
imul ebp, ebp
mov qword [rsp + rbx*2 - 0xaa6c], 0xfffffffff2aefd9d
lea rdx, [rbp*4 + 0x53a42d0a]
neg r8b
sar word [rsp + rbp - 0x60b4e763], 0xa1
dec r8b
bt dx, bx
pop rdx
rol r8b, 1
sal bl, 0x64
neg r8b
push rbx
bts ebx, 0x14
xor r11b, r8b
xor dword [rsp + rbx*2 - 0x20aac0], edx
sar bp, 0xcc
dec qword [rsp + rbp - 0x60b4fff8]
mov qword [rsp + rbp - 0x60b4fff6], rdi
shl rdx, 0x11
btc edx, ebx
sar qword [rsp + rbx*2 - 0x20aac0], 0x52
mov qword [rsp + rbx - 0x105560], rsi
push r11
btc edx, ebx
mov rbp, r9
adc dx, bx
imul edx, ebx
jb 0x140dd321e
mov edx, 0xb399c3a6
movzx r10d, dx
mov ecx, dword [rdi + r10 - 0xc3a6]
push r10
movsx ebp, dx
pop rbx
xor ecx, r11d
dec ecx
sub r10w, dx
shr bl, 0x45
xor ecx, 0x8938a580
call fcn.140df2b6b
add eax, ebp
rol r8w, 1
sal bp, 3
cbw
neg r8w
rol r8w, 1
rol al, 0x64
cmovb ax, bx
jb 0x140dc0a3a
xor r11w, r8w
bts eax, ebp
lea rcx, [rax + r10*8 + 0x69051022]
adc r8, rsp
rol dx, 0x8f
and bx, 0xa08c
mul r10d
mov r10d, dword [r10 + r8 - 2]
setae dl
mov dword [r9 + rbp - 0x14], r10d
jae 0x140dcdd7b

Function at 0x140e10372
Capabilities:
Authenticate hmac

Disassembly:
cbw
mov qword [rsp + rbx - 0x2657f8], rsi
ret 8
lea rcx, [rax + rax*8 - 0x54e152e0]
mov rbp, qword gs:[rdx + rbx*2 - 0x4caff0]
mov qword [rsp + rbx - 0x2657f8], rax
mov r10d, ebx
mov qword [r9 + rbx - 0x2657f8], rbp
jb 0x140e02bcb
neg dl
movzx eax, bp
push r8
jmp 0x140e03977
Function at 0x140e10dba
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor dx, word [r9 + rbx*4 - 0xa612]
mov ebp, 0x13043c32
jmp 0x140dd42bc
push rbp
lea r9, [r9 + rbx*8 - 0x14c26]
pop r8
lea rcx, [rbp + rbp*2 + 0x661b8291]
add ax, dx
lea rcx, [r10*8 + 0x27a4a794]
mov word [rbx + r9 - 0x2985], ax
lea rdi, [rbx + rdi - 0x2989]
mov ebp, dword [rdi + rbx*8 - 0x14c28]
or r8d, r10d
xor r10, rcx
xor ebp, r11d
mov eax, r10d
bswap ebp
neg ebp
lea rdx, [r10 + rcx*4 + 0x38908b23]
push rbx
jmp 0x140dda09b
lea ebp, [rbp + rbx - 0x64be0f9d]
bswap ebp
not ebp
mov qword [rsp + rbx*2 - 0x530a], r11
shr rax, cl
shr r8d, 0x7f
xor dword [rsp + rbx*2 - 0x530a], ebp
pop r11
cdq
btr eax, ebx
movsxd rbp, ebp
shl r10b, 0x25
add rsi, rbp
xadd cl, r8b
cwde
ror rbx, 0x20
adc rax, rsi
jmp rax
mov qword [rsp + rbp*2 - 0x1fe], rsi
ret 0x10
xor dword [rsp + rax - 0x22b1cf29], ebp
add ecx, eax
xor ecx, eax
pop r11
movsxd rbp, ebp
jle 0x140dbeec9
inc cl
cdq
adc rsi, rbp
lea rbp, [rsp + rcx - 0x435f95b5]
movzx r8w, byte [rbp + rax*2 - 0x45639e52]
or r10w, ax
xadd ax, dx
sub bx, dx
movzx r8w, r8b
movsx ebp, cl
push rcx
mov cl, byte [r9 + rdx - 0xcf29]
sub eax, r10d
imul r10d, ebp
adc edx, dword [rsp + rax*2 - 0x52f3de51]
shr r8b, cl
rol rbp, 0xc
push rax
mov word [rax + r9 - 0x2979ef2a], r8w
call fcn.140e19cb0
inc r8w
neg r8w
movsx esi, ax
lea rbx, [rax*8 + 0xf074faa]
inc r8w
sar byte [rsp + r15 - 0x5191e4a0], 0x83
movzx edi, r15b
neg r8w
dec r8w
neg r8w
pop rdx
mov r14d, r15d
xor r11w, r8w
jmp fcn.140db2e6c
dec ebp
mov qword [rsp + rax - 0x22b1cf29], r11
jmp 0x140dde5ed
mul ax
bswap r10d
mov qword [rsp + rbp - 0xef], r11
xchg byte [rsp + rbp - 0xf5], bl
sbb ebx, eax
xor dword [rsp + rbp*2 - 0x1ee], r10d
mov r11, qword [rsp + rbp - 0xef]
xor bl, 0x98
idiv ax
movsxd r10, r10d
neg ax
sal word [rsp + rbp - 0xf4], 0xd
add rsi, r10
dec ax
jg 0x140ddb668
jae 0x140dec60c
mov ebp, dword [rdi - 4]
add rdi, 0xfffffffffffffffc
mov eax, 0xad1db3b3
movsx edx, al
mov ebx, edx
xor ebp, r11d
movsx r8d, al
shl bx, 0xe2
mul eax
rol ebp, 2
lea r10, [r8*2 - 0x6c8aa70]
lea rcx, [rax + 0x1c8abba3]
push r10
not ebp
ror ebp, 1
jmp 0x140df02ca

Function at 0x140e139f8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
setbe cl
pop rbx
pop r10
pop r8
pop rbp
pop r8
jae fcn.140e0aedf
Function at 0x140e13a09
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov cl, byte [rax + r9 - 0x312098cf]
or ebp, 0x47bce21a
shr r10b, cl
cqo
mov word [r9 + rax*2 - 0x624131a0], r10w
mov r8w, word [r9 + rax*2 - 0x624131a0]
not dword [rsp + rdx*8 + 4]
lea r9, [rdx + r9 + 4]
and dx, dx
movzx r10d, word [rsp + rax*2 - 0x6241319e]
and r10w, r10w
movzx eax, word [rdi + rax - 0x312098d7]
sar byte [rsp + rdx + 4], 0xa4
neg byte [rsp + rdx + 3]
lea rdi, [rdi + rdx - 6]
mov ebx, dword [rsp + rdx*8 + 0xa]
rol dword [rsp + rdx + 9], 0x98
xor ax, r11w
neg ax
and r10, 0x24089dac
sar rbp, 0x7c
pop rdx
ror ax, 1
call fcn.140dec476
mov qword [rsp + r8 - 0x5d9500c2], r11
jmp 0x140de356c
not byte [rsp + r8 - 0x5d9500c5]
lea rax, [rcx + 0x49ae7897]
xor dword [rsp + r10 - 0x20], ebp
call fcn.140db194c
neg ebx
mov qword [rsp + rax - 0x549aae10], rdx
mul ebp
inc rax
not ebx
add r10b, 0x17
mov qword [rsp + rdx - 0x549a597c], 0xffffffffd40a6db2
setno bpl
rol ebx, 1
or rcx, 0x4ab06516
bts rdx, 0x96
dec ebx
and word [rsp + rax*2 - 0x624131a2], cx
rol bpl, 0xa1
mov qword [rsp + rax - 0x312098c9], r11
sbb al, byte [rsp + rax*2 - 0x6241319e]
xor dword [rsp + rdx - 0x54da597c], ebx
not qword [rsp + rdx - 0x54da5984]
mov r11, qword [rsp + rdx - 0x54da597c]
movsxd rbx, ebx
xor rdx, 0x3592e1a5
cdqe
mov qword [rsp + rax - 0x312098c9], rcx
adc rsi, rbx
movzx r10w, byte [r9 + rax - 0x312098d1]
jmp 0x140ddacef

Function at 0x140e142d1
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 4
mov qword [rsp], 0x5c239ea5
jmp 0x140e150a2

Function at 0x140e14995
Capabilities:
Authenticate hmac

Disassembly:
btr r8, r8
sbb cl, 0x39
inc ebp
push r8
add dl, r8b
xor cl, 0xb0
mov r10d, edx
jmp 0x140e0016b
movsxd rax, eax
sar rcx, 0xcc
dec word [rsp + rcx*2 - 0x5d1a0]
sal bpl, 0x67
adc rsi, rax
push rbx
call fcn.140db6860
mov ecx, 0xaa11a73b
lea rbx, [rcx + rcx*4 + 0x2d988e9e]
movzx ebp, bx
movzx ecx, byte [rdi + rbp*2 - 0x1a58b]
movsx r8d, bx
xor cl, r11b
movsx edx, r8b
inc bx
neg cl
add bp, r8w
jle 0x140deb6bc
Function at 0x140e1632d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r10, [rax + 0x75ade016]
not ecx
cqo
and rax, 0x2d2de8bc
mov qword [rsp + rax - 0x1088898], rbp
mov qword [rsp + rax*4 - 0x4222260], r11
add bp, ax
push r10
lea r11, [rbp*8 - 0x58d3094a]
xor dword [rsp + rax - 0x1088890], ecx
mov ebx, eax
mov byte [rsp + rbx - 0x1088892], 0x8e
mov r11, qword [rsp + rax*2 - 0x2111128]
rol dl, 0x25
movsxd rcx, ecx
adc rsi, rcx
bt rbp, rax
dec byte [rsp + rax*4 - 0x4222259]
setbe byte [rsp + rax*8 - 0x84444c0]
lea rcx, [rsp + rax - 0x1088758]
mov rbx, qword [rdx + rcx]
mov qword [r9 + rax - 0x108889c], rbx
mov qword [rsp + rax*2 - 0x2111128], r8
imul r10b
ror r8d, 0x7a
lea r9, [rax + r9 - 0x10820ec]
add rdx, qword [rsp + rax - 0x10820e5]
cqo
pop r10
pop rdx
jae fcn.140e0aedf

Function at 0x140e163cf
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebx, 0xc52ae831
jmp 0x140df3ea4
neg ebx
neg r10d
lea ebx, [rbp + rbx - 0x41bbe6ac]
xor r8d, dword [rsp + rbp - 0xe]
setle al
xor ebx, 0x360043bd
mul r8w
lea ebx, [r8 + rbx - 0x1c956380]
jb 0x140db2802
mov eax, 0xc5135c26
and ax, 0x8b1f
mov rax, qword [rbp + riz]
call fcn.140db15d0
mov ebx, dword [rdi + rbp - 0x12]
movsx r10d, r8b
movzx eax, r8w
xor ebx, r11d
movsx ecx, r8b
cqo
lea ebx, [rbx + rbp*2 - 0x1923da32]
sub cl, 0xa0
imul rax, r8
xor ebx, 0x7b843906
push r10
and edx, dword [rsp + rbp*2 - 0x20]
jae 0x140e0aceb

Function at 0x140e167b1
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rbp + 0x2070fec0], 0xffffffff8818ae3a
movzx ebx, byte [rbp + rdi + 0x2070febb]
lea rdx, [r8 - 0x627ca5e4]
lea rdi, [rdi + rbp + 0x2070febb]
xchg dword [rsp + rbp*2 + 0x40e1fd81], r8d
ror dword [rsp + r10], cl
xor bl, r11b
inc rax
call fcn.140dc0698
Function at 0x140e1aa97
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec ax
neg r8d
inc r10w
inc cl
mov qword [rsp + r10*2 - 0x73432d6c], r11
or bx, ax
ror al, 0x41
xor dword [rsp + r10 - 0x39a196b6], r8d
inc cl
btr ecx, 0xa2
div bpl
pop r11
dec rax
xor ecx, 0x4e35fe93
movsxd r8, r8d
inc al
shl dx, 0xb
add rsi, r8
sub rbp, rdx
jmp rsi
rol eax, 0x28
xor r11b, bpl
lea rbp, [rsp + rbp + 8]
mov qword [rsp + r10 - 0x39a196b5], 0x58aac81b
mov word [rbp + r10 - 0x39a196b5], dx
movsx ebx, r8b
mov r8d, dword [rdi + r8 - 0xba]
cdq
cbw
lea rdi, [rdi + r10*2 - 0x73432d6f]
xor word [rsp + r10 - 0x39a196b0], cx
jb 0x140dc030a
xor r8d, r11d
movsx ebp, cl
xor r8d, 0x24a38b81
mov word [rsp + r10 - 0x39a196b5], cx
inc rcx
neg rbx
sub r8d, edx
ror r8d, 1
xor word [rsp + r10*2 - 0x73432d68], 0xc035
js 0x140e18158

Function at 0x140e1b921
Capabilities:
Authenticate hmac

Disassembly:
sar qword [rsp + rcx*8 - 0x63c88], 0xf7
call fcn.140e0c40d
lea ebx, [rdx + rbx - 0x5998b01b]
inc rdx
ror ebx, 1
add cx, 0xf284
inc dx
inc ebx
div r10w
xchg byte [rsp + rbp - 0x31aaae45], dl
mov qword [rsp + rbp - 0x31aaae4a], r11
cwd
mov qword [rsp + rbp*2 - 0x63555ca4], 0xfffffffffb8e518c
call fcn.140dbc765
mov eax, 0x9005c791
mov rbx, qword [r9 + riz]
mov edx, 0xd0c3db5
mov ebp, eax
push rax
movzx edx, word [rdi + rdx - 0xd0c3db7]
xor dx, r11w
sub dx, 0x9496
movzx ecx, bp
cwde
movzx r8d, bpl
not dx
inc dx
jmp 0x140e14987

Function at 0x140e1bb5c
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x10]
jne 0x140e10566
Function at 0x140e1bf0b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
pop r11
idiv bl
mul r8b
shr ecx, cl
movsxd r10, r10d
and bl, bl
cbw
sar edx, 0xef
adc rsi, r10
xor ebp, r8d
jne 0x140dc3dd5
mov ebx, 0x3f80c7bd
movsx eax, bx
mov rbx, qword [r9 + rbx*2 - 0x7f018f7a]
cdqe
mov ecx, 0x1b83c600
mov rax, qword [r9 + rax*8 + 0x1c220]
mul rbx
mov qword [r9 + rcx*4 - 0x6e0f1800], rdx
mov qword [r9 + rcx*2 - 0x37078bf8], rax
lea rdx, [rcx*8 - 0x1966cefb]
lea rdi, [rdi + rcx*2 - 0x37078c04]
movsx r8d, cx
mov eax, dword [rcx + rdi - 0x1b83c600]
push rcx
xor eax, r11d
btc rcx, 0xb0
lea rbx, [rcx*8 - 0x746d3e6f]
not eax
sub qword [rsp], 0xfffffffff2bbf581
bswap eax
neg bx
neg cl
lea eax, [rax + rdx + 0xe86acff]
ror eax, 3
call fcn.140df0b6d
movsx ebx, r8w
neg r8w
xor edx, 0x99a35b8
bts r8d, r10d
sbb edx, 0x3397398b
xchg bpl, bl
imul bx, bp
push rbp
not edx
mov qword [rsp + r8 - 0x7ddb47b5], r11
jae 0x140db0c07
xor dword [rsp + r8 - 0x7ddb47b5], edx
rol cx, 0xe5
pop r11
movsxd rdx, edx
jb 0x140dfa6d4
xadd bx, r8w
js 0x140dda89f
add rsi, rdx
dec cx
xor r10d, ebp
jg fcn.140e0aedf
adc cl, dl
mov r9w, word [r9 + r8*2 - 0x4497a400]
jp 0x140de2840
xor r8d, 0x6e314d23
lea r8d, [r8 + rdx*4 + 0x7dbc5ab7]
rol bx, cl
movsx r10d, bl
and dx, 0x3833
ror r8d, 3
sub r8d, r10d
neg r8d
dec ebx
bt bx, r10w
push r11
xor dword [rsp + rdx*2 - 0x20003064], r8d
pop r11
movsxd r8, r8d
lea r10, [rbx + rbx*4 - 0x4854bdc8]
imul eax
add rsi, r8
lea rbp, [rax + rcx*2 + 0x7034bfbd]
mov ax, word [r9 + rdx]
xor ebx, ebx
shl cx, cl
push rcx
or cl, byte [r9 + rdx*2 + 2]
lea r9, [r9 + rdx*4 + 2]
shr ax, cl
shr rdx, 0x7b
xor r10w, 0x6924
pop rbx
mov word [r9 + rdx], ax
imul r10, rdx
adc rdx, rsi
jmp rdx
lea r10, [rbx*4 + 0x2e8bf805]
jns fcn.140e0aedf
movzx ecx, word [rdi + rdx]
add qword [rsp + rdx*2], 0xffffffffa89ba408
mul dword [rsp + rdx*2]
xor cx, r11w
sar rbx, 0x59
ror cx, 1
sal rbx, 0xf9
lea r8, [rax*4 + 0x7c1eb5a6]
dec cx
ror cx, 1
bt rbx, rbx
pop r10
ror bp, 0xcd
adc cx, 0x960f
cdq
not dx
neg cx
xor r11w, cx
add rcx, rsp
push rax
rol dword [rsp + rdx - 0xffff], 0x4b
movzx r10w, byte [rcx + rbx*4]
cdqe
neg r8
btc ebx, 0x11
lea r9, [rdx + r9 - 0x10001]
movzx ecx, dl
mov word [rdx + r9 - 0xffff], r10w
pop r8
jae fcn.140e0aedf
lea rdi, [rdi + rcx*2 - 0x4008]
rol r8b, cl
mov edx, dword [rdi + rcx*4 - 0x8008]
xor edx, r11d
mov qword [rsp + rcx - 0x2002], 0x67140583
rol edx, cl
movzx ebx, r8w
lea rax, [rcx*4 + 0xf1759a4]
xor ecx, ecx
lea edx, [rcx + rdx + 0x140683a2]
jnp 0x140dc0f10
not edx
ror edx, 3
btr ecx, 0xa8
or byte [rsp + rcx + 6], r8b
sar rcx, 0x9e
mov qword [rsp + rcx], r11
movzx r10d, r8w
not r10b
jbe 0x140dd613f

Function at 0x140e1c68b
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + r8 - 0x1800], ebx
sar al, cl
dec dl
btr edx, r8d
pop r11
setb al
btr rcx, r8
sub rdi, 4
movzx r8d, bx
movzx edx, bx
movsx r10d, r8b
mov ebx, dword [r8 + rdi - 0x1824]
mov qword [rsp + r8 - 0x1824], r10
xor ebx, r11d
or rdx, 0xffffffffc91cc31e
neg ebx
mov ecx, r10d
dec ebx
movsx ebp, r8b
neg ebx
or dx, r8w
movsx eax, bp
not ebx
ror byte [rsp + r8 - 0x1820], cl
setns r8b
cwde
mov qword [rsp + r8*2 - 0x3000], r11
js 0x140df4c40
Function at 0x140e1cdd3
Capabilities:
Authenticate hmac

Disassembly:
mov dl, byte [rbx + r9 - 0x25838c14]
btr r10, r10
lea r9, [r9 + rbx*2 - 0x4b07182a]
ror rbx, 0x6e
mov ebp, r10d
mov ecx, ebp
adc al, dl
mov word [r9 + r10*2 - 0x2c], ax
mov eax, ebx
cdqe
not bp
lea rdi, [r10 + rdi - 0x1a]
mov edx, dword [rdi + r10 - 0x16]
div bpl
sar rcx, cl
xor edx, r11d
not edx
movzx r8d, bpl
btc r10w, r8w
inc edx
sub r8b, bl
neg bx
not edx
dec r10d
inc ebp
sal eax, 0xfe
ror edx, 1
shl bl, 0x61
ror bpl, 0xa7
sal bx, 0x21
push r11
lea r11, [rax + rcx + 0x1103410a]
bts r11, 0x27
xor dword [rsp + r10*4 - 0x854], edx
pop r11
shr al, 0xa6
shl rbp, 0x21
sal rcx, 0xc
movsxd rdx, edx
adc rsi, rdx
neg r8w
call fcn.140e1c7dd
mov ebx, 0xd53c1387
lea rdx, [rbx*4 + 0x139346a5]
movzx r10d, bl
lea rdi, [r10 + rdi - 0x88]
mov r10b, byte [r10 + rdi - 0x87]
ror dl, 0xc4
xor r10b, r11b
bts rdx, rbx
movzx ebp, bx
dec r10b
not r10b
bts rbp, rbx
neg r10b
btc bp, dx
and rbx, rbx
btr bp, dx
dec r10b
lea rbx, [rdx - 0x7ec3104f]
or bpl, dl
rol r10b, 1
imul rbx, rbp
neg r10b
ror dx, 0x43
sub bpl, bl
neg ebx
xor r11b, r10b
inc dx
push rdx
mov qword [rsp + rbp - 0x3cc], rdi
or bl, bpl
push rsi
push r11
call fcn.140db84f1
mov r10d, 0xd70e85bc
movzx bp, byte [r9 + riz]
lea rbx, [r10*4 + 0x7e0c3ab0]
add bx, bx
mov r10b, byte [r9 + riz + 2]
and bpl, r10b
movzx ecx, bx
sal rcx, 0xde
not bpl
mov r8d, ebx
movsx eax, cx
mov word [r9 + rax*4 + 2], bp
lea r10, [r8 + rbx*4 - 0x43680577]
mov ebp, eax
sub r8b, 0x9b
mov r10d, dword [rdi + rax*2 - 4]
shl rax, 0xa7
btc ebx, r8d
lea rdi, [rdi + rax - 4]
xor r10d, r11d
mov edx, ecx
ror r10d, 1
inc r8d
sub r10d, 0xdbaa8a80
cwde
not ecx
cwde
ror r10d, 1
lea r10d, [r10 + rcx - 0x3278f16a]
and rcx, 0x7ba404b1
or r8, 0x3d871b9a
not r10d
push r11
xor dword [rsp + rcx - 0x7ba404b1], r10d
xchg ecx, ebx
movsx r11d, cx
pop r11
movsxd r10, r10d
add rsi, r10
btc r8w, 0x8e
mov r8, qword [rax + r9 + 2]
cqo
mov cl, byte [r9 + rbx - 0x7ba404a7]
xchg ebx, ebp
shr r8, cl
mov qword [rbx + r9 + 4], r8
movsx r8d, bp
cdq
imul bp
lea r9, [r9 + rbx + 4]
div r8w
cbw
push rax
xor qword [rsp + rbx], rsi
ret
xor r10d, r11d
mov dword [rsp + r8 - 0x5522c216], ebp
bt r8, r8
jae 0x140df723e
lea r10d, [r10 + rax + 0x1e6af13]
call fcn.140de6d29
bt bp, bp
not qword [rsp + rbp - 0x5722c20f]
mov qword [rsp + rbp - 0x5722c209], r11
movzx r11d, word [rsp + rbp - 0x5722c215]
neg r11
xor dword [rsp + rbp - 0x5722c209], ebx
shr eax, 0x5a
sub word [rsp + rbp - 0x5722c20d], ax
mov r11, qword [rsp + rbp - 0x5722c209]
shr ax, 0xeb
setns bpl
mov dword [r9 + rbp - 0x5722c205], ebx
neg dword [rsp + rbp - 0x5722c1f5]
mov qword [rsp + rbp - 0x5722c1f1], rbp
pop rax
mov r10d, dword [rdi + rax - 0x5722c221]
jp 0x140de1ed7
movzx ax, byte [r9]
mov ebx, 0x25838c16
movzx r10d, bl
jmp 0x140db09d4
mov qword [rsp + rbp - 0x5522c219], 0xffffffffbabf1c0b
ror ebx, 1
bts ebp, ebp
lea ebx, [rbx + rbp*2 - 0x48bdce17]
ror ebx, 1
or qword [rsp + r8 - 0x5522c211], rax
push rbp
bswap ebx
jns 0x140e08c54
Function at 0x140e1d34a
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + rcx - 0x23230715], r8d
mov r11, qword [rsp + rcx - 0x23230715]
jmp 0x140df5cad
xchg dword [rsp + rcx*2 - 0x46460e36], ebp
bts r10, rbx
movsxd r8, r8d
adc rsi, r8
mov r8d, ebx
lea rdi, [rcx + rdi - 0x23230725]
div r10b
cdqe
mov rax, qword [rdi + rcx - 0x2323071d]
pop r10
sal bl, 0xa1
mov qword [rsp + rcx*2 - 0x46460e3a], 0x4909072b
xor rax, r11
xor dl, bh
not word [rsp + rcx - 0x23230718]
lea rax, [rax + rcx - 0x5c6d309d]
lea rdx, [rcx + rbx*2 - 0x6c5d90d0]
lea r8, [rcx + r8*2 - 0x2255f5e5]
neg rax
shr bpl, 0x87
xchg qword [rsp + rbp*4], r8
ror rax, 5
shr r8, cl
shr word [rsp + rbp*4 + 4], 0xab
setae dl
not rax
sar byte [rsp + rcx - 0x2323071a], 0xc2
not rcx
rol rax, 5
bswap rax
xor r11, rax
lea r9, [rcx + r9 + 0x23230716]
btc r8, 0xb9
mov byte [rsp + rcx + 0x23230720], 5
xadd r8d, ebx
mov qword [r9 + rbx - 0x7fff802], rax
pop rax
jae fcn.140e0aedf
push r10
movzx bx, byte [r9 + riz]
movsx r8d, r10w
mov cl, byte [r8 + r9 - 0x4228]
rol r10d, 0xeb
and bl, cl
mov qword [rsp + r8*8 - 0x21148], r8
not bl
mov ecx, r8d
xadd qword [rsp + r8*8 - 0x21148], rcx
movzx bx, bl
mov ebp, ecx
dec word [rsp + r8 - 0x4222]
jbe 0x140ddfbfc
mov bpl, byte [r9 + r8*4 - 0x108a4]
and bl, bpl
not bl
mov word [r9 + r8*2 - 0x8450], bx
lea r9, [r9 + r8*8 - 0x2114c]
shr dword [rsp + r8 - 0x4221], cl
mov ebp, dword [rdi + r8 - 0x422e]
xadd cl, r8b
mov edx, 0xd990b828
lea rdi, [rdi + r8 - 0x422e]
xor ebp, r11d
mov eax, 0xa3b3f007
bswap ebp
dec ebp
neg dword [rsp + r8*2 - 0x844d]
bts r8d, edx
xor ebp, 0xa51e123d
btr ax, 0x36
not ebp
movzx ebx, word [rsp + r8*2 - 0x864c]
and r10w, 0x3aaf
mov qword [rsp + r8*2 - 0x864c], r11
ror ax, 0xe1
cwde
shr byte [rsp + r8*4 - 0x10ca7], 7
xor dword [rsp + r8 - 0x4322], ebp
imul ax, bx
lea r8, [rbx + 0x7491e138]
mov r11, qword [rsp + rcx*4 - 0x10948]
movsxd rbp, ebp
sub dword [rsp + rcx - 0x4253], r8d
add rsi, rbp
sar rax, cl
mov qword [rsp + r8 - 0x7492e0e5], rsi
ret 8

Function at 0x140e1dd37
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov rbx, qword [r9 + riz]
mov rax, qword [r9 + riz + 8]
mov cl, byte [r9 + riz + 0x10]
not ebp
or r8w, bp
mov qword [rsp], rbp
adc r9, 0xa
movsx edx, byte [rsp + 1]
shrd rbx, rax, cl
pop rcx
mov qword [r9 + riz], rbx
sub rdi, 4
mov ecx, dword [rdi + riz]
xor ecx, r11d
sar dx, 0x82
movzx ebx, bp
lea r10, [rbx*2 + 0x149ae10f]
bswap ecx
movsx eax, dx
dec ecx
xor ecx, 0x983a1c27
xor bp, r10w
adc r8w, r10w
lea ecx, [rcx + rbp - 0x4785374f]
push r11
sbb r10b, dl
xor dword [rsp + rbx - 0xdba2], ecx
btr r10w, 0xb4
dec r10b
pop r11
movsxd rcx, ecx
sar edx, 1
call fcn.140dc4591
Function at 0x1400018c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002720
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002720
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001930
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400070a4]
mov rbx, rcx
test esi, esi
jle 0x140001a60
mov rax, qword [0x1400070a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000197b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001a05
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001960
mov rcx, rbx
call fcn.1400023a0
mov rdi, rax
test rax, rax
je 0x140001a82
mov rax, qword [0x1400070a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400024e0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400070a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400019fe
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x140001a10
add dword [0x1400070a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400070a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400018c0
nop dword [rax]
xor esi, esi
jmp 0x140001988
mov rax, qword [0x1400070a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400018c0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400018c0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002010
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140007100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x14000206c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140002063
test eax, eax
jne 0x140002063
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002048
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400023a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000241d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002414
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400023c0
add rax, 0x28
cmp rax, r9
jne 0x140002400
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000243f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002448
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000243f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400024e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400024ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002508
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret