joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406380d1
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
pop r8
pop rcx
pop rbp
pop r11
jmp fcn.140677d1f
movsx r8d, r11b
dec eax
rol eax, 1
inc eax
shl r8b, 0x66
bswap eax
movzx ebp, r9w
movsx edx, r9w
jb 0x1404b78d5
push rbx
mov ecx, ebp
xor dword [rsp + rbp*4 - 0x10e60], eax
sub r11w, r9w
add ebp, r9d
pop rbx
movsxd rax, eax
sbb dx, cx
not ebp
adc r10, rax
btc r11, 0x27
bswap rdx
mov rbp, qword [rsi + rdx]
movzx cx, byte [rbp + rdx*2]
xadd r11, r9
neg r8
sar r11w, 0x2a
lea rsi, [rsi + rdx + 6]
jnp 0x14058dbae
add rdi, 4
xor eax, ebx
mov r9d, r11d
jmp 0x1404fd9b3
shl edx, 0x95
dec r11b
mov word [rsi + rdx], cx
add r9, 0x337fb1
call fcn.140654964
or cx, dx
lea r10, [rdi + rax*2 + 0x2f8dd29f]
cbw
not cx
mov word [rbx + rax*2 - 0x5854006a], cx
lea r8, [r8 + rax - 0x2c2a0039]
movsx r9d, di
dec r9b
mov r10d, dword [r8 + rax - 0x2c2a0035]
call fcn.140552a0c
or rax, rax
movsxd r8, r8d
neg ecx
call fcn.140653f17
neg bl
rol bl, 1
not bl
call fcn.1404eda5f
inc bl
jmp 0x14063594f
mov qword [rsp + rax*2 - 0x240cdb06], r9
mov r10, qword [rsp + rax - 0x12066d77]
setb r8b
lea rdi, [r9*4 + 0x270f560f]
xchg rcx, r8
movsxd rbp, ebp
mov qword [rsp + rax - 0x12066d87], rdi
call fcn.1404baccc
dec r8d
neg r8d
sub r8d, 0x9d3b8db4
mov qword [rsp + rax - 0xb6], r9
xor dword [rsp + rax - 0xb6], r8d
sar eax, cl
pop r9
sal ax, 0xed
jbe 0x1406069bb
mov ebx, 0xa6840a1a
movsx esi, bx
mov r11, qword [r8 + rsi - 0xa1a]
jmp 0x14066f83e
movzx cx, byte ss:[r11 + rsi - 0xa1a]
lea r8, [r8 + rsi - 0xa14]
mov word [rsi + r8 - 0xa1a], cx
mov ebp, dword [r10 + rsi*4 - 0x2868]
call fcn.14055339e
mov eax, dword [rdi]
mov r11d, 0xf2254398
jmp 0x14057e829

Function at 0x14063d59f
Capabilities:
Encode data using base64

Disassembly:
xor r9b, 0xa7
mov rsi, qword [rsi + rbp - 0x8e]
mov qword [rsp + rbp - 0x8e], 0xffffffffd5a55992
pop rbp
pop r9
pop r9
pop rdx
pop rax
jne fcn.140621ffc
add rbp, 4
lea rdi, [rcx + rcx*2 - 0x75704775]
call fcn.14062f8b9

Function at 0x14063dd16
Capabilities:
Encode data using base64

Disassembly:
movzx ebx, word [rbp + riz]
imul cx, cx
setb cl
adc rbp, 1
xor bx, r9w
mov qword [rsp], rsi
mov qword [rsp + 8], rcx
ror bx, cl
movzx eax, byte [rsp]
add bx, 0x83ac
rol bx, cl
mov edx, 0xc5a4082e
xadd r8, rcx
not bx
push rax
setg byte [rsp + rax - 0xa5]
xor r9w, bx
jmp 0x1405e4bd4
Function at 0x140641369
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140538ea5
lea r8, [rdx + r8 + 4]
mov ebp, edi
bswap edi
or dil, 0xae
lea rbx, [rbx + rdx - 1]
shl ebp, 0x88
movzx ebp, byte [rbx + rdx*4]
shr rdx, 3
xor bpl, sil
not edi
dec bpl
rol bpl, 1
sub bpl, 0x3c
ror eax, 0x2d
not bpl
xor sil, bpl
div eax
not edi
add rbp, rsp
btr edi, eax
xor rax, rax
mov dword [rbp + rdx*4], ecx
xchg di, dx
shr dil, 0xe6
mov ebp, edi
lea rbx, [rdx + rbx - 0xb0]
jp 0x1405edbc2
inc ebx
btc edx, 0x8f
lock xadd dword [rdi + rdx*2 - 0x10000], ecx
pushfq
pop rdi
mov dword [rdx + r9 - 0x7ff8], ecx
xor dx, 0x38c
movsx ecx, dx
mov qword [r9 + rdx*4 - 0x20e30], rdi
shl ax, cl
jne 0x14058f194
jmp r11
mov qword [rsp + rdx], r10
idiv dword [rsp + rdx + 9]
lea rsi, [rsp + rsi + 0x10]
idiv word [rsp + rdx + 0xd]
movzx r9w, byte [rsi + rdx]
movsx esi, cl
jmp 0x1405e239b
lea r8, [r8 + rdx*4 - 2]
add cx, di
mul r10w
mov word [r8 + rdx], r9w
pop r9
pop rdi
jno fcn.1404cedee
xor eax, dword [rbx + rax*4]
shr edi, 0x12
xor eax, esi
dec eax
dec edx
mov r10d, 0xdf3a0a89
movsx r9d, r10w
not eax
bswap eax
imul edi, edi
inc eax
not r9b
ror eax, 1
rol r10b, 0xe2
bts r10, r9
push rsi
bt r9d, r9d
xor dword [rsp + rdx - 0xab], eax
call fcn.14053f869
mov qword [rsp + rax + 0x9a], rbx
call fcn.1404b3c38
mov edx, 0x60b3000e
movzx eax, dx
movsx edi, dl
mov ecx, dword [rdx + r8 - 0x60b3000e]
cdq
jmp 0x1404d236f
Function at 0x14064264b
Capabilities:
Encode data using base64

Disassembly:
or ebp, ecx
dec bl
neg ecx
not ebp
cdqe
xor r11b, bl
and rdi, rax
lea rdx, [rdx + rax*8 - 0x1dec9a4b]
adc rbx, rsp
movzx bp, byte [rbx + rcx - 0x49c6d6e6]
lea rsi, [rsi + rdi - 0x290a]
mov word [rcx + rsi - 0x49c6d6e6], bp
btc edi, ecx
lea r10, [r10 + rcx - 0x49c6d6ea]
call fcn.1405f061a
adc r11, r9
movzx r9d, dil
ror ebp, cl
jmp r11
xor bl, r11b
movzx eax, dx
ror r8d, 0xc8
inc bl
neg bl
or dil, r8b
cmovle rdi, rax
xor bl, 0x1b
neg bl
xor bl, 0xf
and dil, 0x2c
ja 0x14059f750
not ebx
push r11
and r10, rdx
xor dword [rsp + rax - 0x7a35729c], ebx
ror dl, 0xc6
pop r11
movsxd rbx, ebx
bswap ecx
sar dil, cl
bts edi, r10d
adc r9, rbx
mov bx, word [rsi + rdx - 0xa2]
bts edx, 0xa2
rol r8b, 0x21
jae 0x14062579b
jp 0x1405b0ae0
mov ecx, 0xb639291a
movsx edi, cx
lea r10, [r10 + rdi*8 - 0x148d1]
movsx r8d, cl
movzx ebx, byte [r10 + rdi*4 - 0xa468]
mov edx, ecx
mov ebp, r8d
jmp 0x1405cfd5a
mov cx, word [rsi + rax - 0x7a35729a]
jno 0x14054dcc8
mov ebx, 0x292cb7b4
neg bx
lea rbp, [rbx + rbx - 0x5363a472]
mov ebx, dword [r10 + rbx*2 - 0x52589098]
mov esi, ebp
movsx ecx, sil
lea rdi, [rcx + rcx*8 - 0x4cd1efec]
lea r10, [r10 + rbp*4 + 0x42c4f6c]
movsx edx, si
xor ebx, r8d
call fcn.1405e97d1
movzx edi, al
lea r9d, [r9 + r10 - 0x746d3374]
neg r9d
lea rbp, [rax + rcx*8 - 0x6ac328d3]
not al
not r9d
dec r9d
sub bp, 0x3f93
mov qword [rsp + rax + 0x1a779943], rsi
xor dword [rsp + rax + 0x1a779943], r9d
pop rsi
or di, di
movsxd r9, r9d
jne 0x1405e0094
sub r10, 4
mov edx, 0x3b18cfa3
lea rdx, [rdx + rdx*4 + 0x784c81c]
mov ebx, dword [r10]
jmp fcn.140603c63
mov r9d, dword [r8]
push 0xffffffffe58864a7
mov r10d, 0xddaa5607
mov cl, byte [r8 + 4]
lea rdx, [r10*8 + 0xd9c9238]
add r8, 2
mov qword [rsp + 8], 0x3c8d040d
dec word [rsp]
shr r9d, cl
mov dword [r8], r9d
xor dword [rsp + 9], r10d
pop rax
lea rbx, [rbx + rax*2 + 0x34ef36b0]
btr rax, r10
lea rcx, [rax + r10*4 + 0x6f28ff9a]
xor rcx, rdx
mov r9d, dword [rbx + rax*2 + 0x34ef37b4]
and word [rsp + rax*2 + 0x34ef37b8], ax
xor r9d, esi
not r9d
rol ax, cl
jae 0x14062cf5b
add byte [rsp + rax*2 - 0x1f82a], 0x3d
xadd word [rsp + rax*2 - 0x1f82d], r9w
mov qword [rsp + rax - 0xfc17], r10
and dil, r9b
xor dword [rsp + rax*4 - 0x3f05c], ebp
add dl, 0xbc
movsx r10d, r9b
pop r10
jl 0x140590fe5

Function at 0x140642824
Capabilities:
Encode data using base64

Disassembly:
inc edx
cbw
call fcn.1405aa992
xadd bp, r8w
ror edx, 3
lea rax, [r11 + r11*8 - 0x4cefdaf8]
jmp 0x14057fe25
lea rdi, [rdi + r11*2 - 0x322c044a]
lea rcx, [r11 + rbp - 0x1ff1a2d0]
shl r11, 0xa7
mov qword [rsp + rbp - 0x15ac9385], r11
xor edx, ebx
bt ecx, 0x11
ror edx, 2
sar qword [rsp + rbp - 0x15ac9385], 0x90
bswap edx
neg edx
mov r8d, 0xdae081e
sub cx, 0x130f
lea edx, [rdx + rbp - 0x32b29d20]
ror byte [rsp + rbp*2 - 0x2b59270a], 0x47
bt ecx, ebp
jb 0x14062201b
not edx
jae 0x14063cddf
mov edi, 0xec94aa32
movsx edx, di
ror edi, 0xc5
mov r8d, dword [rsi]
mov cl, byte [rsi + 4]
mov r10d, 0x8bb2dea6
adc rsi, 1
Function at 0x14064362c
Capabilities:
Encode data using base64

Disassembly:
add rbp, 4
mov eax, 0x2c8e05b1
lea r8, [rax*2 - 0x95cb7fc]
movsx edi, al
xor edx, r11d
inc ax
bswap edx
movsx ebx, al
not edx
setl dil
sal dil, 6
bt ax, 0x2c
dec edx
not edx
push r11
lea rcx, [rax + rbx*8 + 0x1f000e1c]
xadd r8b, al
xor dword [rsp + rax*2 - 0x591c0acc], edx
jmp 0x14051fd8a
sub al, dil
pop r11
dec ebx
movsxd rdx, edx
call fcn.14054c34f
adc r11, r8
xchg rdi, rcx
pop rcx
pop rdi
pop r8
jmp fcn.140621ffc
mov qword [rsp + rbp - 0x1d804230], rbx
or bp, r8w
call fcn.1404a0cc9
lea rbx, [rbx + rax*2 + 4]
shl qword [rsp + rax + 8], 0x10
xchg dword [rsp + rdi*2 - 0xbf3167], edi
xor r8d, r10d
ror r8d, 1
bswap r8d
xchg di, ax
push rax
neg r8d
sub r8d, 0xfca74797
xadd word [rsp + rax*2 + 7], ax
cdq
sal qword [rsp + rax*4 - 0x3affd], cl
mov qword [rsp + rax*2 - 0x1d7f0], r10
setns cl
cdqe
xor dword [rsp + rax*4 - 0x3aff0], r8d
mov r10d, eax
mov r10, qword [rsp + rax*4 - 0x3aff0]
movzx ebp, word [rsp + rax - 0xebff]
cbw
btc r9, rdx
movsxd r8, r8d
btr di, dx
jae 0x1405453bb
mov edx, dword [rbp + riz]
jmp 0x1404fa1c0

Function at 0x1406472f1
Capabilities:
Encode data using base64

Disassembly:
sar byte [rsp + rcx - 0xf409], 2
mov qword [rsp + rcx - 0xf40e], r9
movzx r11d, cx
mov qword [rsp + rcx - 0xf416], rax
xor dword [rsp + rcx - 0xf40e], ebx
mov r9d, edx
neg rsi
mov r9, qword [rsp + rcx*2 - 0x1e824]
jl 0x1406264e8

Function at 0x14064a3c0
Capabilities:
Authenticate hmac

Disassembly:
or r9b, bpl
jmp 0x1405e5bc3
mov word [r8 + rdx], r9w
pop rax
mov r9d, 0x3e0aa2a3
xor rdx, r11
jmp rdx
lea rcx, [rdx + rbx*4 - 0x7a504277]
push r8
xor r10d, r11d
shl byte [rsp + rcx*2 - 0xfba4c74], 0x66
sub word [rsp + rcx*2 - 0xfba4c71], 0x7ea5
ror r10d, 1
xor r10d, 0xd99d8b93
dec word [rsp + rcx - 0x7dd2636]
bswap r10d
movsx eax, word [rsp + rcx*2 - 0xfba4c76]
jge 0x140596d20
rol r10d, 1
push rbx
movzx edi, word [rsp + rcx*8 - 0x3ee931d5]
sub r10, rax
add r11, rbp
mov qword [rsp + rdx - 0x14c4], 0x31229ba8
jmp 0x1406565ee
movzx r9w, byte [r8 + rdx - 0x14c4]
div r10d
cqo
mov ebp, 0x511abfbe
mov bpl, byte [r8 + rdx + 2]
shl edx, 0x4d
lea r8, [r8 + rdx*4 + 2]
rol qword [rsp + rdx], cl
not r9b
and ecx, ecx
bswap rcx
not bpl
neg dl
jle 0x140510646
mov ecx, 0xcc066609
mov r10d, dword [rbp + riz]
movsx ebx, cx
lea rdx, [rcx - 0x49da957b]
mov r8d, 0xf00035ab
lea rbp, [rbp + rbx - 0x6605]
jmp 0x1406366bc
Function at 0x14064c66a
Capabilities:
Encode data using base64

Disassembly:
xor edi, r11d
cdq
bswap edi
movsx r10d, r9w
not edi
not rax
rol edi, 1
cdq
sub edi, 0xe9bd8eba
push r11
xor dword [rsp + r10*2 - 0x5400], edi
movsx r11d, r9w
pop r11
lea rdx, [rax + r10*4 - 0x3544c164]
mul edx
movsxd rdi, edi
add rbx, rdi
mov rsi, qword [r8 + rax*2 - 0x6a8832ca]
mov edi, dword ss:[rax + rsi - 0x35441965]
bts rax, 0x9c
shr r10w, 0xe5
lea r8, [rax + r8 - 0x35441961]
and r9w, r9w
mov dword [r8 + rax*2 - 0x6a8832ca], edi
mov ecx, r9d
and r9b, r10b
add r9d, eax
jmp rbx
sub cl, 0x1e
movsxd r9, r9d
bt dx, dx
div cl
movsx r10d, cl
add rbx, r9
lea rsi, [r10 + rdx*2 + 0x408bd496]
mov r10, qword [r8 + rcx*8 - 0x6ad58]
push rax
call fcn.140542b50
jmp 0x14058d7f5
bts dx, 0xb0
rol r9d, 1
mov qword [rsp + rdx*2 - 2], 0x5b1ccb39
sub r9d, 0xe9bd8eba
btr edi, 0xa5
cdq
mov qword [rsp], r11
xor dword [rsp], r9d
movzx ecx, ax
btc rsi, rax
not cx
pop r11
jae 0x1405b0188
movsxd r9, r9d
movzx esi, dil
add rbx, r9
pop rax
mov rdx, qword [r8 + rcx*2 - 0x12260000]
mov qword [rsp + rcx - 0x9130000], 0xffffffffec0b2302
mov r10w, word [r8 + rcx*2 - 0x1225fff8]
xchg byte [rsp + rax*2 - 0x52264e6d], cl
xor edi, esi
push rcx
lea r8, [rcx + r8 - 0x91300f5]
mov word ss:[rdx + rcx - 0x91300ff], r10w
call fcn.14052d2e5
mov r9d, 0xc0ae2a9c
shl r9b, 0xe6
sbb rbp, 3
movzx eax, r9b
mov edi, dword [rax + rbp]
or r9w, r9w
jae 0x1404e2e88
call fcn.140609688

Function at 0x140650fc4
Capabilities:
Encode data using base64

Disassembly:
ror r8d, 2
mov qword [rsp + r11 + 0x44cdffc0], rbx
mov qword [rsp + r9 - 0x5d42c678], r11
cqo
xor dword [rsp + rdx + 8], r8d
jmp 0x140661d48

Function at 0x1406573c2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not dx
lea rcx, [rcx + rdi*2 - 0x784a2662]
neg rcx
or r10w, cx
rol dx, 1
sal r9, cl
sbb dx, r9w
bt rsi, rsi
push rsi
sbb r9d, 0xcf8b6983
xor r11w, dx
bt si, si
jae 0x140652792
lea r8, [r8 + r9*2 - 0x60e92cfa]
setb byte [rsp + r9 - 0x30749679]
xor sil, 0x90
call fcn.140642d13
neg rsi
add rbx, rax
sar dx, 0xe2
lea rdx, [rcx*4 + 0x62a35e01]
sbb rbp, 1
and r10, r10
inc rsi
movzx edx, word [rbp + riz]
xor dx, r11w
mov qword [rsp], 0xffffffffa11eb406
sub dx, 0x9f93
lea r9, [r10 + r10*8 - 0xdcdb744]
jmp 0x14058d407
Function at 0x14065e83c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and r9w, cx
not ebp
lea rdi, [rax + r9*2 - 0x468f15e]
sub r9d, 0x6686c215
dec ebp
bswap ebp
rol cl, 0xa5
inc ebp
call fcn.1405e0541
mov r11d, edx
lea rbp, [rbx + rbp - 0x5d150002]
btr r11, r11
xor bl, dh
xor ecx, r9d
movzx eax, dx
inc ax
ror ecx, 1
div al
xor ecx, 0x6ab7df86
bswap r11
mov esi, r11d
bswap r11d
lea ecx, [rcx + rbx*2 + 0x11575274]
lea r8, [rax + 0x50b29e24]
not ecx
add esi, r11d
call fcn.140544148
mov word [r8 + r11*4 - 0x64], bp
push rbx
mov r11d, dword [r11 + r10 - 0x19]
jb 0x14062f054
jae 0x1406115f1
mov cl, byte [rdi + 4]
call fcn.140586d9c
jmp 0x1404d6e56
adc r10, 4
xor r11d, r9d
lea rbp, [rbx*2 + 0x55accf83]
push rbx
call fcn.1405ca05b
shl r13, 6
lea rsp, [rsp + 8]
mov r8d, 0xc78dcb3e
movzx edi, r8b
lea r8, [r8 + r8*4 + 0x2b8f76a4]
lea rcx, [0x14065e845]
sal r8b, 0x22
jp 0x1405da72c
sal di, 0xc3
movabs r8, 0x14065e845
btc rdi, rdi
sbb rcx, r8
call fcn.140675580
call fcn.1404e2598

Function at 0x140661d18
Capabilities:
Encode data using base64

Disassembly:
xor r9w, 0xeebb
dec r9w
xor r9w, 0xdba1
movsx edx, di
btc cx, 0x92
adc r9w, 0x6daa
btc rsi, rsi
xor bp, r9w
btc ax, 0x9a
inc edx
lea r9, [rsp + r9 + 8]
shl si, 0x47
adc ax, word [rsp + rcx - 0x2536d6b0]
mov si, word [r9 + r10 + 0x58854d1a]
lea rbx, [rbx + rcx - 0x2536d6b5]
sbb rdx, rdx
push r10
mov word [rbx + rcx*2 - 0x4a6dad66], si
movsx r9d, byte [rsp + rcx*2 - 0x4a6dad5f]
pop r9
pop rax
je fcn.140666d61
rol r8d, 1
mov qword [rsp + rdx + 0xb], r11
xor dword [rsp + rdx + 0xb], r8d
movzx r10d, dil
ror rcx, 0x4f
call fcn.140586579
or r10d, 0xa9a5461f
movzx eax, r10b
mov eax, dword [rdi + r8 - 0x35]
movsx ecx, r10b
bswap rdi
xor eax, ebp
bswap ecx
call fcn.14052a481
shl qword [rsp + rsi + 0x61243c1c], 0x73
jb 0x1405200ab
bswap edi
push rsi
mov qword [rsp + rdx - 0x21], rbp
movsx eax, r9b
mov ebp, edx
xor dword [rsp + r9 - 0x51993e21], edi
mov rbp, qword [rsp + rdx - 0x21]
movsxd rdi, edi
mov qword [rsp + r9 - 0x51993e21], rax
add r11, rdi
movsx edi, r9b
mov dl, byte [rdx + rbx - 0x29]
mov al, byte [r9 + rbx - 0x51993e27]
call fcn.14059d387
mov ecx, 0x69d602b
movsx r8d, cx
mov ebp, dword [rdi + rcx - 0x69d602b]
xchg r8, rcx
movzx r9d, r8b
lea rdi, [rdi + rcx*4 - 0x180a8]
movsx edx, r8b
xor ebp, ebx
and r8d, ecx
movzx r11d, r8b
bswap ebp
jge 0x140552496
xor edx, ebp
movzx edi, sil
inc r9d
not edx
movzx eax, di
xor edx, 0x26be7222
xor r9b, 0x94
movsx ecx, si
neg edx
inc edx
bswap rdi
push rbp
inc esi
mov r10d, r9d
ror r10, 0x48
xor dword [rsp + r9*8 - 0x140], edx
jmp 0x140561f98
pop rbp
dec rax
jns 0x14053a95b
sub ebp, 0xa4a956ab
pop rbx
neg ebp
lea rdi, [rcx + rax*4 + 0x210bb638]
rol ebp, 3
mov byte [rsp + rdx*4 - 0x168], ch
lea ebp, [rbp + rdx*8 + 0x64a2333c]
ror ebp, 3
sal qword [rsp + rdx - 0x5a], 0x17
call fcn.140600104
call fcn.14057fb48
mov r10d, 0xfa35b135
movsx edi, r10b
lea r8, [rdi + r8 - 0x39]
jmp 0x140541006

Function at 0x140668556
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rdi - 0xe0b], ebp
mov r10, qword [rsp + rdi - 0xe0b]
cqo
movsxd rbp, ebp
and ax, cx
call fcn.140634b0c
Function at 0x140670239
Capabilities:
Encode data using base64

Disassembly:
dec r9w
mov dword [rdi + r10], edx
lea rbp, [rbp + r10 - 4]
lea rdi, [r10 + r10*2 - 0x33de5ff9]
dec rax
shl rsi, cl
mov eax, dword [rbp + r10]
adc r9b, 0x9f
xor r9, rdi
xor eax, r11d
shl cl, 0xc4
not cl
lea eax, [rax + rdi - 0x57329cb5]
bt si, di
not eax
setb r10b
ror r10w, 0xaa
movzx edx, cl
lea eax, [rax + rdi*4 - 0x2ba06436]
bts edi, 0x22
bswap eax
jb 0x1405c8cc8
mov eax, dword [rdx + r10 - 0xffff]
call fcn.14050df6b
mov qword ss:[rax + rdi - 0x673e4c80], rcx
lea rbx, [rax + rbx - 0x673e4c84]
mov r9d, dword [rbx + r10 - 0x673e4ca1]
mov edi, eax
xor r9d, esi
movsx ecx, bp
ror dl, 0x24
sbb r9d, 0xa911b180
btc ax, 0x14
sbb r10d, r10d
sub rdx, rbp
ror r9d, 1
push rbp
call fcn.1404ee654
mov r10d, 0xb49ce228
mov edx, dword [r8]
and r10w, 0x5f2b
lea rsi, [r10 + r10*2 + 0x13bf2f9b]
adc r8, 4
push r10
lea r9, [r10*2 + 0x2af55be]
sub rbp, 1
movzx edi, byte [rbp + riz]
movzx eax, r10b
mov ecx, 0x29bf7c38
xor dil, r11b
xor dil, 0x23
rol dil, 1
pop rsi
inc dil
jmp 0x14053a4e6
ror dil, 1
shr r10, cl
adc dil, 0x34
dec r9w
cwde
xor dil, 0xa
lea rax, [rax*8 + 0x40b48694]
cwde
rol r9, 0x2d
not dil
shl r9b, 0xa6
adc dil, 0xa4
xor r11b, dil
add rdi, rsp
shl r9, 0x24
jns 0x1404a16a0
inc dword [rsp + rdi - 0x76beb8fa]
neg bpl
cdq
movsx ebx, dl
ror bpl, 1
xor r11b, bpl
dec bl
add dword [rsp + rdi - 0x76beb8fb], ebx
mul dword [rsp + rdi - 0x76beb8f9]
lea rbp, [rsp + rbp + 0x10]
mov word [rdi + rbp - 0x76beb904], cx
call fcn.1405e8675
pop rax
not ecx
movsx eax, word [rsp + rsi - 0x293c]
call fcn.14057ce54
lea rbp, [rsp + rbp + 8]
cwd
mov di, word [rbp + rdx*2 - 0x1fffe]
shl qword [rsp + rdx - 0xffff], 0xce
lea rsi, [rsi + rdx*4 - 0x3fffe]
movsx ebp, al
mov word [rsi + rdx - 0xffff], di
setb al
not ecx
lea r10, [r10 + rdx*2 - 0x20002]
rol al, cl
jp 0x1405180ad

Function at 0x140673fe6
Capabilities:
Authenticate hmac

Disassembly:
cwde
xor ecx, 0x64217216
rol ecx, 1
mov qword [rsp + rsi - 0x33aa], r11
call fcn.1404d1bf4
Function at 0x140675580
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
call fcn.14057b213
mov eax, 0xe8a33f15
movzx r9d, ax
movzx ax, byte [r9 + rsi - 0x3f15]
sar r9w, 0xea
mov cl, byte [rsi + r9*2 - 0x1c]
call fcn.140512ff1
adc dil, dil
lea r8, [r8 + r10*8 - 8]
mov edx, r10d
rol dl, 0x21
mov qword [rdx + r8], rsi
setb dil
sub edx, 0x9117c9e
jne fcn.1404cedee
pop r8
pop rax
pop r9
jb fcn.140677d1f
sal r8b, 0x41
rol eax, 0x79
xor edx, 0xf2aed28a
lea edx, [rax + rdx + 0x273a2bf]
push r9
movzx r11d, cl
dec r11
xor dword [rsp + rax*2 - 0x278cc98], edx
movzx r9d, cx
pop r9
and sil, cl
call fcn.1405aef87
or bpl, bpl
push rax
jo 0x1404a20f3
push rcx
not ebp
inc bp
mov ebp, dword [rsp + 0x80]
xor ebp, 0xe1a4a1d
movsx r9d, dx
inc ebp
sal r9, 0x1a
imul edx, r9d
xor ebp, 0xc2ad58a9
lea ebp, [rbp + rdx - 0x2da4528c]
call fcn.14062284c
cbw
mov rbx, qword [rsp + rbp*4 - 0x10028a70]
inc ecx
movsxd r8, r8d
cwde
add r10, r8
sar rbp, cl
jne 0x1404a4fe0
mov ebp, dword [r10]
mov r11d, 0x212dccac
movzx ecx, r11w
movsx ebx, cl
lea r10, [r10 + r11*2 - 0x425b9954]
shl rbx, 0x72
xor ebp, r9d
ror ebp, 2
sub ebp, 0xcfad4814
mov edx, r11d
lea rsi, [rbx + rdx - 0x52653700]
xor ebp, 0x8f9a7692
dec ebp
and ecx, edx
bswap ecx
shl ebx, 0xb1
not ebp
lea ebp, [rbp + r11*2 - 0x129e9b3e]
lea rax, [rcx*8 + 0x100199a3]
push r9
inc sil
setnp al
mov r9d, 0x4f1de520
xor dword [rsp + r11 - 0x212dccac], ebp
bswap rdx
inc r9d
pop r9
ror r11b, 0xa2
movsxd rbp, ebp
ja 0x14065cbde
call fcn.140546df0
bswap r10d
push rdi
shl cx, 0xcb
rol r10d, 3
lea r10d, [r10 + rdi*2 + 0x7de82edb]
xor r10d, 0x7f040897
dec di
mov qword [rsp + rcx - 0x67f0], r11
xor dword [rsp + rdi - 0x3a11fd09], r10d
movzx eax, di
mov r11, qword [rsp + rcx - 0x67f0]
mov qword [rsp + rdi - 0x3a11fd09], rax
dec rax
movsxd r10, r10d
add rbx, r10
movsx esi, al
pop rax
pop rax
pop rdi
jmp fcn.1404cedee
adc rdi, rbp
movsx ebp, dl
shr r11, 0x86
imul cx, bx
mov rsi, qword [r8 + r11 - 0x84b730]
lea rdx, [rbp*8 - 0x29e5a900]
mov ecx, dword [r8 + rbx*2 + 8]
sbb bp, r11w
add dx, ax
setae bl
lock xadd dword [rsi + rbx*8 - 8], ecx
jmp 0x14063ade2
mov qword [rsp], rdi
lea rdi, [rsp - 0x30]
mov qword [rsp], rdx
mov edx, 0x2b3f9808
or edx, 0x3b1cb188
dec dx
mov qword [rsp + rdx*2 - 0x767f72c6], r12
jbe 0x14053969f
sal rdx, 0x20
push rbp
push r15
movsx ebp, dl
push r11
movsx r11d, dl
add rbp, r11
bts ebp, edx
lea r11, [rdi + rbp*2 - 0x212]
sal dx, 5
and r11b, 0xf0
shl ebp, 0xb7
imul dx, dx
push r9
jae 0x140590cff
adc r11, rdx
mov qword [rsp + rax*2 + 8], rbp
mov rdi, qword [r9 + rax*4]
add rax, qword [r9 + rax*2 + 8]
shr qword [rsp + rcx*4 - 0x210], 0x57
add word [rsp + rcx*2 - 0x106], bx
xchg qword [rsp + rcx*4 - 0x210], rbp
mul rdi
and esi, 0xb316a00f
mov qword [rbp + r9 - 0x15b], rdx
add cl, 0x23
call fcn.1405ea4a5
Function at 0x14067622f
Capabilities:
Parse pe header

Disassembly:
mov r11, qword [rsp + rcx - 0x2dd40e06]
dec bpl
movsxd rdx, edx
dec rax
mov qword [rsp + rcx*2 - 0x5ba81c1c], rbx
adc r9, rdx
dec rbp
mov qword [rsp + rcx - 0x2dd40e16], r9
ret 0x10
mov cl, byte [rdi + 0x10]
movzx edx, r11w
lea rdi, [rdi + rdx*8 - 0x7f5c6]
shrd r8, rbx, cl
push r11
movsx ecx, byte [rsp + rdx*8 - 0x7f5d0]
movzx eax, dx
mov qword [rdx + rdi - 0xfeba], r8
not qword [rsp + rdx - 0xfeba]
shr cx, 0xe8
mov ecx, dword [rbp + rdx - 0xfeba]
mov ebx, dword [rsp + rdx*2 - 0x1fd73]
lea rbp, [rdx + rbp - 0xfeb6]
rol qword [rsp + rdx - 0xfeba], 0xd8
xor ecx, r9d
neg qword [rsp + rdx*2 - 0x1fd74]
ror ecx, 1
bt rax, rax
call fcn.1405fbf69
movsx edx, r11w
lea r8, [r8 + rsi*2 - 0x50]
sub dword [rsp + rbp - 0x6e], ebx
bt r11d, ebp
mov word [r8 + rsi - 0x27], cx
push rbp
jae 0x1404f7501
add r11, r8
mov rax, qword [r9 + rsi - 0x473623a7]
xchg dword [rsp + r9 - 0x473623a6], r9d
push rcx
movzx bp, byte ss:[rax + r9 - 0xffffff]
dec dx
jns 0x14061ec53
bts ecx, ecx
lea rsi, [rsi + r9 - 0xfffff9]
setb cl
movsx edi, dx
mov word [rsi + r9*4 - 0x3fffffc], bp
shl word [rsp + r9 - 0xfffff7], 0xed
call fcn.14051c1f6
xor dword [rsp + rcx - 0x2dd40e06], edx
mov qword [rsp + rcx*2 - 0x5ba81c2c], r8
or ebx, 0xab216bbc
jle 0x1404d80f8
call fcn.14059fee7
mov r8, qword [rdi]
mov rbx, qword [rdi + 8]
mov r11d, 0xfb0bfeba
jmp 0x1405bb1ca

Function at 0x140676c9d
Capabilities:
Encode data using base64

Disassembly:
mov ecx, ebx
bswap r10d
mov qword [rsp + rdx - 0x10], rdx
lea rax, [rdx + 0x6f3f7639]
neg r10d
mul dil
dec r8d
mov qword [rsp + rdx], r11
sub dx, cx
adc bl, 0x9a
xor dword [rsp + rdx*2 - 0x1e404], r10d
cqo
sub edi, 0x7d3db2b6
mov r11, qword [rsp + rdx*2 + 0x10]
call fcn.1404df195
Function at 0x140679a93
Capabilities:
Authenticate hmac

Disassembly:
add ecx, r9d
mov esi, r10d
bswap ecx
xor ecx, 0x5bbd6e82
xchg dl, sil
push r11
lea rax, [r9*8 + 0xd96703a]
dec edi
call fcn.1404eb5ec
sub rbp, 4
mov r9d, 0x1785f831
mov r10d, dword [rbp + r9*2 - 0x2f0bf062]
mov edx, r9d
movzx edi, r9w
xor r10d, r11d
btr dx, r9w
movsx esi, dx
push rdx
xor r10d, 0x8d09b606
shr dx, 0xcb
and edx, dword [rsp + r9 - 0x1785f82e]
bt edx, edi
dec r10d
xor dl, byte [rsp + r9*2 - 0x2f0bf05f]
ror r10d, 3
not r10d
rol r9b, 0xc5
movsx eax, byte [rsp + r9*2 - 0x2f0bf049]
mov qword [rsp + r9*4 - 0x5e17e098], r11
xor dword [rsp + rdx], r10d
not rdi
pop r11
push r9
inc di
rol rsi, 0x2a
movsxd r10, r10d
bt esi, edi
adc rbx, r10
mov r8, qword [r9 + r8 - 0x1785f826]
pop r9
jmp fcn.1404cedee
call fcn.14065d4a6
movsxd rsi, esi
shr al, 0xa7
adc r11, rsi
mov qword [rsp + rcx - 0x488d1a16], r11
ret 8
bswap ecx
ror ecx, 1
bswap ecx
jmp 0x1404a16fb
adc dl, 0x39
lea rax, [r8*4 - 0x3fc01265]
mov qword [rsp + r8 - 0x6a3e699e], 0xffffffffcaa9fcab
shr word [rsp + r8 - 0x6a3e6991], cl
neg dl
xadd qword [rsp + r8 - 0x6a3e699c], rax
dec cl
not dl
mov r10d, 0xf0307da6
shr eax, cl
xor r11b, dl
xor qword [rsp + rax*4 - 0x7fffe551], rax
lea rdx, [rsp + rdx + 0x10]
mov rbx, qword [rdx + r8 - 0x6a3e699e]
jne 0x14053c8a1
xor dword [rsp + rax + 7], esi
btr rax, 0xb0
inc ecx
mov r8, qword [rsp + rax + 7]
shr word [rsp + rcx - 0x488d1a16], 0x21
inc rbp
jns 0x1405421be
xadd byte [rsp + rdx + 3], dh
shl dl, 0xe1
rol edi, 3
mov r8d, 0x403f750b
xor edi, 0x3ba7548f
xadd r8w, r9w
inc edi
shl dword [rsp + rdx - 0xbfff], 0x4f
call fcn.140522e95
mov r10d, 0x86b7222e
shl r10d, 0xbe
movsx edi, r10b
lea rbp, [rbp + rdi*4 - 4]
movsx edx, r10b
movsx r9d, dx
dec r9
mov ecx, dword [rdi + rbp]
xor ecx, r11d
xor r10, r10
jle 0x14064225a
mov r8d, 0xe41e34b0
movzx edx, r8b
movsx eax, r8b
mov eax, dword [rbp + rdx*4 - 0x2c0]
call fcn.1404b5855