joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1806f0b32
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
lea rax, [rdx*8 + 0x6500190f]
xor r8d, edi
call fcn.1807878ba
mov r8d, dword [r10]
mov r9d, 0x9f8bc30f
mov eax, r9d
add r10, 4
or eax, 0x6739e4a0
movzx edi, r9b
jae 0x180750095
mov qword [rsp], 0xffffffffe13f4f2f
sub rsp, 0x18
call rax
mov rsp, qword [rbp + riz - 0x10]
mov esi, 0x642738a0
btc rsi, rsi
mov rbp, qword [rbp + riz - 8]
jae 0x18077c9ea
xor cl, 0x24
sub edi, r8d
xor bl, cl
ror rdx, 0x91
xor rax, rax
jp 0x18075f61f
xor r8d, ebx
inc r8d
ror r8d, 1
mov ecx, edi
or r9w, 0x8336
dec r8d
dec ax
ror r8d, 3
lea rsi, [r9*2 - 0x35c27146]
cqo
sal ecx, 0x61
push rbx
xor dl, dil
xor dword [rsp + rdi - 0xf], r8d
pop rbx
not dil
inc cl
xchg si, ax
movsxd r8, r8d
not r9b
add r11, r8
sal dl, 0xa2
xadd r9w, dx
xadd r9d, ecx
mov di, word [rdi + rbp - 0xf0]
cqo
neg edx
lea rbp, [rbp + rdx*2 + 2]
movzx esi, byte [rdx + r10]
lea rdx, [rdx*8 - 0x40535457]
neg eax
lea r10, [r10 + rax - 0x44eac7]
neg r9w
push rcx
cwde
xor sil, bl
inc word [rsp + rdx + 0x40535459]
setno cl
cdqe
rol sil, cl
not dword [rsp + rax*4 + 0x54e3]
or word [rsp + rax*8 + 0xa9c4], dx
shr cl, cl
adc sil, 0x9b
dec qword [rsp + rax*2 + 0x2a70]
neg byte [rsp + rax + 0x153f]
neg sil
btr rcx, 0xf
cdq
pop r8
sbb sil, cl
cwd
xor bl, sil
bt edx, edx
inc r9b
shl al, 0x44
adc rsi, rsp
sub r8w, 0x7eb4
sar r8b, 0x63
mov word [rsi + rax + 0x1580], di
ror r8w, 0x6b
jmp r11
jb 0x18074383f
movzx ebx, si
mov r10d, ebx
mov qword [rbp + rbx*2 - 0x7140], rax
mov r9d, ebx
movzx ecx, sil
mov r11, rbp
movsx r8d, cl
movsx ebp, sil
not rbx
pop rdi
sal rcx, 0xfa
neg r8b
pop r10
pop rsi
bts rbx, r8
not bp
lea rsi, [rbx + rsi + 0x389d]
movsx edx, cl
jb 0x1807565e9
mov r8d, 0xe0356ac
movzx r9d, r8w
mov ecx, 0xba20a7a8
movzx ecx, byte [r10 + r8 - 0xe0356ac]
and r9w, 0x76b8
xor cl, bl
movsx eax, r8b
cdqe
movsx esi, ax
inc cl
movzx edi, ax
xor cl, 6
bswap rsi
bswap rsi
and r8b, r9b
rol cl, 1
ror al, 0xc1
cdq
jae 0x180738791
xor r9d, 0x402a1e89
shr r8w, cl
or edx, esi
push rbx
xor dword [rsp + rax - 0x5683eb28], r9d
pop rbx
movsxd r9, r9d
and r8b, dl
sal edi, cl
adc r11, r9
btr rcx, rdi
movzx dx, byte [rbp + rdi*2 + 2]
bt edi, 0x89
mov al, byte [rbp + rax - 0x5683eb24]
and rsi, 0xffffffffe6152183
sal dil, 0x63
sar ecx, cl
not dl
sal r8d, 0x9a
sal r8w, 0xa9
not rcx
xor al, cl
and dl, al
mov word [rcx + rbp + 5], dx
neg di
push rcx
adc r8w, word [rbp + rcx + 5]
movsx r9d, byte [rsp + rcx + 4]
lea rbp, [rbp + rcx*4 + 0xa]
movzx eax, r9w
lea r9, [rsp + rcx*2 + 0xb2]
xor di, word [rsp + rcx + 6]
call fcn.1806ede3c
mov ebp, 0xe9ad6508
movzx edx, bp
ror bpl, 0x65
lea rsi, [rsi + rdx - 0x650c]
mov r8d, dword [rdx + rsi - 0x6508]
add edx, ebp
jne 0x1806e1f54
cbw
movsxd r8, r8d
cwde
adc r11, r8
call fcn.1806e0cc5
Function at 0x1806f2e7f
Capabilities:
Hash data using murmur3

Disassembly:
bswap edx
inc ebp
mov byte [rsp + rdx*2 + 0x10], al
movzx r8d, dl
mov ecx, 0x183aee08
neg ebp
mov qword [rsp + rdx*2], r8
not ebp
xor bl, ah
xor dl, 0xa8
jnp 0x1807aa0cd
not cl
or rbx, r9
sub rdx, 0xfffffffff206f33b
and r8b, cl
mov word [r11 + rbp], r8w
mov qword [rsp + rdx - 0xdf90cc5], r10
ret 8
mov qword [rsp + rdx - 0x98], rdi
xor dl, 0x87
adc qword [rsp + rdx - 0x2a], rcx
inc r8
xor dword [rsp + rdx*4 - 0xac], ebp
mov rdi, qword [rsp + rdx - 0x1f]
movsxd rbp, ebp
xadd rbx, rax
adc r10, rbp
mov r8b, byte [r11 + rdx*4 - 0xbc]
cwd
pop rcx
add byte [rsp + rdx*8 + 7], 0x1b
xor cl, byte [rdx + r11 + 2]
lea r11, [r11 + rdx*4 + 2]
neg ax
mov ebp, dword [rsp + rdx*2 + 2]
mov qword [rsp + rdx + 8], rdx
not r8b
xchg dword [rsp + rdx*2 + 0xc], ebp
rol al, 0x65
jbe 0x1807a76d7

Function at 0x1806f6148
Capabilities:
Encode data using base64

Disassembly:
neg eax
inc rdx
mov qword [rsp + r9*2 - 2], 0x50093bb
jno 0x18075b6fe

Function at 0x1806f8939
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + rbx - 0x689f85a6], rbx
movsx ecx, bx
lea ebp, [rbx + rbp - 0x248bc99d]
sal cl, 0x43
rol ebp, 1
rol dword [rsp + rbx - 0x689f85a2], 0xdf
sal qword [rsp + rbx - 0x689f85a6], cl
mov qword [rsp + rbx - 0x689f85a6], rdi
xor dword [rsp + rbx - 0x689f85a6], ebp
add rdx, rbx
pop rdi
lea rcx, [rbx*2 + 0x13bf7e0c]
movsxd rbp, ebp
sbb r8, 0x5c0858b6
jnp 0x1806fd401
lea r9, [rdx + r8*4 + 0x142d102a]
adc r10, rbp
sal rbx, 0x2a
sub r8w, 0x6a97
mov r9d, dword [r8 + r11 - 0x3b58b70d]
mov r8d, dword [r11 + r8 - 0x3b58b709]
or edx, eax
mov cl, byte [r11 + riz + 8]
adc r11, 6
neg dl
sbb dl, bh
shrd r9d, r8d, cl
inc rdx
mov dword [r11 + riz], r9d
mov ecx, 0x37a46824
shl edx, cl
jmp r10

Function at 0x1806fc246
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bswap r9d
push rdx
sub rcx, rsi
mov qword [rsp + r8*2 - 0x616414cc], rbx
sbb qword [rsp + rcx*2 - 0x33e7ba96], rdi
rol cl, 0xa5
xor dword [rsp + r8 - 0x30b20a62], r9d
mov rbx, qword [rsp + r8*2 - 0x616414cc]
not r8w
movsxd r9, r9d
xadd rdx, rax
adc r11, r9
mov dx, word [rbp + r8*2 - 0x6165eb2a]
bts ax, si
mov r9d, esi
setae r9b
mov cl, byte [r8 + rbp - 0x30b2f593]
or qword [rsp + rdi - 0x42a], r8
jne 0x18070351f
rol dil, 0xe1
lea rbp, [r8 + rbp - 0x30b2f593]
sal dx, cl
pop rsi
mov qword [rsp + r8 - 0x30b2f595], r8
not r9b
mov word [r8 + rbp - 0x30b2f595], dx
mov qword [rsp + r8 - 0x30b2f595], r11
ret

Function at 0x1806fc4e0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub rsp, 0x18
call rax
mov r8d, 0x1b37614
mov rsp, qword [rbp + r8 - 0x1b37624]
movzx esi, r8b
mov ebx, r8d
mov rbp, qword [rbp + r8 - 0x1b3761c]
lea r10, [r8 + r8*4 - 0x5de0ab5e]
mov ecx, r10d
mov qword [rbp + r8*4 - 0x6cdd850], rax
call fcn.18077fdd3
mov edx, 0x45876632
lea rsi, [rsi + rdx - 0x45876636]
movsx eax, dl
lea rax, [rax + rax - 0x16ec15c]
mov r8d, dword [rdx + rsi - 0x45876632]
call fcn.18074c2cf
Function at 0x180703de6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
movsx eax, r8w
lea r11, [rax + r11 - 0x37a4]
mov qword ss:[rbx + rax*2 - 0x6f68], rdx
lea rdx, [rax*8 + 0x7d31a398]
movsx ecx, dx
cwd
lea rsi, [rsi + r8 - 0x4c8537b8]
movzx r9d, r8w
xor r9, rax
mov ecx, dword [r8 + rsi - 0x4c8537b4]
lea rax, [rax + rdx*4 - 0x196cd761]
xor ecx, edi
rol rdx, 0x13
neg r8
mov qword [rsp + r8 + 0x4c8537b4], rax
lea ecx, [rcx + r8 + 0x7e1f1536]
adc ax, word [rsp + r8 + 0x4c8537b5]
xchg dx, r8w
ror ecx, 2
and byte [rsp + r9 + 1], 0x29
lea ecx, [rcx + r8*2 - 0x530ca7a2]
rol ecx, 2
push r9
neg ecx
movsx ebx, ax
rol eax, 0x49
xor ecx, 0x9d225107
rol ecx, 2
mov qword [rsp + r8 + 0x4c860008], rdi
sub byte [rsp + r8 + 0x4c860001], 0x8d
xor dword [rsp + r9 + 8], ecx
mov rdi, qword [rsp + r8 + 0x4c860008]
movzx ebp, bx
call fcn.18079e1e7
xor dword [rsp + r8 - 0x77000000], edx
pop rbx
push rdi
movsxd rdx, edx
ror sil, cl
add r11, rdx
movzx edx, byte [rsp + r8 - 0x76ffffff]
dec dx
rol di, 0x44
movzx ecx, byte [r8 + r10 - 0x76fffffb]
xor cl, bl
bts edx, r8d
ror byte [rsp + r9*4 + 1], 3
not cl
inc r8b
lea rax, [r9*2 - 0x13666d4e]
rol cl, 1
sub dword [rsp + r8 - 0x76ffffff], r8d
call fcn.1806f5cba
mov r8d, dword [r11]
mov ecx, 0x3e95df05
mov cl, byte [r11 + rcx - 0x3e95df01]
call fcn.1807412ae

Function at 0x180703f03
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
xor rcx, rdi
sar ebp, 0x65
ror dl, 0xe1
dec rcx
sar bp, 0xf
bswap rcx
xor rcx, 0x29add97
dec rcx
add ebx, 0x6eab8a3a
not dl
bswap rcx
adc rcx, r9
call fcn.180749ba0
mov esi, 0xf191dd19
movsx r8d, si
shr r8b, 1
mov r9, qword [rbp + riz]
mov rsi, qword [rbp + riz + 8]
movzx edi, r8b
lea rbp, [rbp + rdi*4 - 0x28]
and r9, rsi
movsx edx, r8w
movsx ecx, dil
mov eax, edi
not r9
shl r8w, 0x4a
setae dl
mov qword [rdi + rbp - 0xc], r9
mov eax, dword [r10 + rdi*2 - 0x18]
movsx r9d, dx
sar ecx, 0x82
shr r8b, 0x62
lea r10, [r10 + rdi*2 - 0x14]
shl r8, cl
btc di, 0x1d
xor eax, ebx
push rcx
rol cx, cl
mov word [rsp + rdi - 0x2008], r9w
rol eax, 3
inc eax
push rdi
sal r8d, 0x1c
not eax
movzx esi, byte [rsp + r8 + 2]
push rdx
inc eax
not sil
sal dword [rsp + r8 + 0xf], cl
bt edx, 0x8a
rol eax, 1
inc eax
sar sil, 0xa5
not rdx
mov qword [rsp + r8 + 0x10], rbx
xor dword [rsp + r8*2 + 0x10], eax
rol di, 0xcc
sbb edx, dword [rsp + r8 + 9]
mov rbx, qword [rsp + r8 + 0x10]
movsxd rax, eax
adc r11, rax
mov qword [rsp + r8*2], r11
ret 0x10
mov qword [rsp + r9 - 0x25a70000], 0xffffffffc900a92a
push rdx
ror di, 1
sub qword [rsp + r9*2 - 0x4b4dfff9], rsi
jl 0x180761f89
mov ebp, 0x3f98a797
movzx eax, bpl
lea rcx, [rax*4 - 0x6259f959]
mov rbp, qword [rbp + r11 - 0x3f98a797]
cdq
mov r8, qword [r11 + rax*2 - 0x126]
movzx r9d, al
add rbp, r8
movsx ebx, al
and r9d, edx
btr rbx, 0xad
mov qword [r11 + rax - 0x8f], rbp
ror rcx, cl
mov r8d, r9d
mov bp, 0x39
sal r9, 0xa4
sub ebx, edx
mov word [r11 + rax - 0x91], bp
xor cl, 0xae
shl eax, 0xcb
movzx ebp, bl
mov rcx, qword [rsi + rax*2 - 0x97008]
add al, bl
or r9b, r8b
jge 0x1806e4d1c
Function at 0x18070494b
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
jmp 0x18072dd89
cmp ebx, 1
jne 0x180726cd9
push 0xffffffffe78b0c05
jmp 0x18076cc1e
lea rsp, [rsp + 0x10]
jne 0x180745d14
mov eax, 0x693d068a
shr ax, 0x69
call fcn.180760712
mov edi, 0x86a63f20
mov dx, word [rbp + riz]
movzx r9d, di
lea rbp, [r9 + rbp - 0x3f1e]
movsx r8d, r9w
btr edi, r9d
movzx edi, word [r9 + r10 - 0x3f20]
mov esi, r9d
bt r8d, esi
add r9w, r9w
lea r10, [r9 + r10 - 0x7e3e]
movsx ecx, r8b
shr rcx, 0x50
xadd r8, rsi
xor di, bx
shl r9, 0xcd
ror ecx, 0xfd
movzx eax, r8w
rol di, 1
call fcn.180743d52
mov r9w, word [r11]
mov bx, word [r11 + 2]
mov eax, 0x658c5505
movsx edx, ax
inc dl
mov cl, byte [r11 + rdx*2 - 0xaa08]
lea rax, [rax + rdx*8 - 0x5a7e7d80]
lea r11, [r11 + rax - 0xb107fb1]
mov ebp, 0x424bd1e
mov r8d, edx
shrd r9w, bx, cl
or r8d, r8d
btr eax, edx
movsx ecx, bpl
mov word [r11 + rax - 0xb107fb5], r9w
sar rax, cl
lea rax, [rbp*2 - 0x4a6dd85f]
call fcn.1806e67e8
mov rbx, qword [r11 + riz]
movzx r8d, cl
movzx r9d, cl
movsx edx, r8w
mov cl, byte [r11 + r8*2 - 0x2c]
shr rbx, cl
bt r8d, r9d
btc r8w, r8w
mov qword [r8 + r11 - 0x418], rbx
mov rdx, qword [r11 + r8*4 - 0x1066]
lea r11, [r11 + r8 - 0x410]
movzx eax, byte [rsi + r8*4 - 0x1069]
call fcn.1807b6d3c
jmp 0x18075074d
mov rax, qword [rbp + rbx*8]
jmp 0x18072245e
btc bp, r8w
not ecx
btr edx, r8d
neg ecx
sub ecx, 0xe4b69685
rol r8d, 0xb6
sub bl, bpl
push rdi
xor dword [rsp + r9 - 0x36], ecx
movzx edi, dx
pop rdi
dec rbp
neg r8
not dl
movsxd rcx, ecx
add r10, rcx
lea rsi, [rsi + rax*2 - 0x3cfa1ade]
xchg edx, ebp
cqo
sal rbp, 0x43
movzx eax, word [rsi + rax*4 - 0x79f435b8]
btr rdx, rbx
sub bp, 0xe71e
xor ax, di
lea rbp, [rbp + 0x24108833]
sub ax, 0xd1b1
btc bx, r9w
dec r9
push rbx
not ax
neg ax
call fcn.18074c07f
mov r8d, dword [r10]
xor r8d, ebx
xor r8d, 0xa81f3017
rol r8d, 1
mov r9d, 0xb80ed528
push r9
jmp 0x180767c0e
bswap r8d
mov ecx, 0x909f3da4
shl r9, cl
rol r8d, 1
movsx edi, cx
mov qword [rsp + rdi - 0x3da4], rbx
lea r9, [r9 + rdi*8 - 0x11e5be75]
btr edi, ecx
movzx eax, r9b
xor dword [rsp + rdi*2 - 0x7b48], r8d
shr rax, cl
pop rbx
movsxd r8, r8d
adc r11, r8
sal eax, cl
mov rdx, qword [rdi + rbp - 0x3da4]
call fcn.180711edc
push 0xffffffffc5bd8e25
mov rcx, rax
not qword [rsp + 1]
call fcn.180744a8e
Function at 0x18070526d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rdx, edx
ror bl, 0x81
adc r10, rdx
inc rbx
shr rcx, 0xe3
mov qword [rsp + rax*2 - 0x4a97ff2e], 0x2233abf
mov r9, qword [r11 + rcx*2 + 8]
btc r8, rcx
xchg cx, ax
lea r11, [r11 + rax - 0x254afff0]
lea rdx, [r8*8 - 0x3e798ada]
or bpl, bl
mov qword [rsp + rax - 0x254afff0], rax
movzx edx, byte [rsi + rax*2 - 0x4a960006]
rol ebp, cl
lea rsi, [rsi + r8*8 - 0x39d221e]
add rbx, qword [rsp + rcx*2 - 0x1ff36]
btc eax, ecx
xor dl, dil
shl dword [rsp + rax*2 - 0x4a95ffff], cl
btr cx, bx
mov qword [rsp + rax*2 - 0x4a960010], rbx
neg dl
not dword [rsp + rcx*4 - 0x3fe71]
lea rcx, [rbx + rcx*8 - 0x27e03ef1]
xor dl, 0xb5
add dword [rsp + rax - 0x254afff1], 0x853ee092
inc word [rsp + rax - 0x254afff7]
not dl
sbb dl, 0x94
xor dl, 0x26
dec rax
add dl, bl
neg dl
xor dil, dl
call fcn.1806dc716

Function at 0x1807069b6
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
neg dx
lea rsi, [rsi + r9 - 4]
mov r8d, dword [rsi + r9*2]
xor r8d, edi
shr ebx, 0x10
push r9
dec r8d
rol r8d, 2
shr rdx, 0x45
movsx ebp, ax
pop r9
lea r8d, [r9 + r8 - 0x34330824]
xor r8d, 0xb0b19108
or ax, ax
sub rdx, rbx
mov qword [rsp + r9*2], rdi
shl dl, 0x64
xor dword [rsp + r9], r8d
push rcx
mov rdi, qword [rsp + r9*2 + 8]
add bp, word [rsp + r9*4 + 4]
or rbx, 0x7fbf4392
lea r9, [rcx*4 + 0x4a31748a]
movsxd r8, r8d
bt rcx, 0xb8
cwde
push rdx
adc r10, r8
sar byte [rsp + rdx*2 - 0x4e20ff1], 0x43
ror bp, 0x25
pop rbp
pop rdx
pop r8
jbe fcn.180764d25

Function at 0x18070933b
Capabilities:
Parse pe header

Disassembly:
not rcx
pop rsi
not r9
xchg qword [rsp + rdi + 0x1db1], rdi
shl dil, 0xc7
and rcx, r9
lea r9, [rdi*4 + 0x50206f92]
mov qword [rbp + rdi + 0x1d80], rcx
sal di, 0xe
rol word [rsp + rdi + 0x10000], 0xca
mov ecx, dword [rdi + r10 + 0x10008]
lea r10, [r10 + rdi*8 + 0x8000c]
dec ax
xor ecx, ebx
neg dx
inc ecx
ror r9d, 0xbf
neg ecx
ror ecx, 1
not r9d
sub qword [rsp + rdi*2 + 0x20000], 0x78819dbf
bswap ecx
adc r8, qword [rsp + rdi + 0x10000]
sar r8, 0x6e
mov esi, edx
xor ecx, r8d
xor r8w, dx
mov qword [rsp + rdi + 0x10000], rbx
bt r9d, 0x29
lea rbx, [rdi*4 + 0x52951386]
btr rax, 0x86
xor dword [rsp + r8*4 + 8], ecx
xor edx, ebx
sub dil, r9b
pop rbx
neg si
jne 0x18072d089
movsxd rcx, ecx
cmovns edi, esi
sub r9w, ax
shr r9, 4
add r11, rcx
shr r9b, 1
jmp r11
Function at 0x1807093e4
Capabilities:
Parse pe header

Disassembly:
mov rbx, qword [rsp + rcx + 0x10d]
movsxd r8, r8d
and sil, 0
shr di, cl
sbb ecx, esi
adc r11, r8
mov byte [rsp + rsi*2 - 0x105f8], 0xb6
call fcn.180779557
mov r9d, 0xb1a654bd
mov ecx, dword [r11 + riz]
mov r8d, 0xd1bc2e3a
movsx ebx, r9w
lea r8, [rsp + rbx*8 - 0x2a5b0]
mov edx, ebx
not r9b
mov dword [r8 + rbx*8 - 0x2a5e8], ecx
sar rbx, 0xca
sub ebx, edx
movzx r8d, word [rdx + rsi - 0x54bf]
not bl
or r9d, edx
xor r8w, di
lea rcx, [rbx + rdx*8 - 0xdd18f63]
sal dx, 0xc4
or r9b, cl
rol r8w, 1
lea rbx, [r9 + rcx + 0x618c7b19]
ror r9w, 0x64
and rbx, 0x61b4d3b
sbb r8w, 0x6527
shr bl, 0xc7
xor r8w, 0xd838
mov ebp, ecx
xadd ebp, r9d
not r8w
adc r8w, bx
not r8w
inc edx
movzx eax, dx
xor di, r8w
mov dword [r11 + rbx - 0x4030000], r8d
lea rbp, [r9 + r9*8 + 0x81c32ba]
movzx r8d, byte [rsi + rbx*4 - 0x100c0003]
bswap r9d
push r9
xor r8b, dil
sub r8b, 0x1d
sar cl, 0x86
xadd rdx, rbp
xor r8b, 0xb6
add r8b, 0x2f
pop rbp
not r8b
jmp 0x18076ebfe
Function at 0x18070a5b9
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
pop rcx
xor edx, 0xc0a07013
cdqe
inc edx
push rbx
inc cx
and r8, 0x2d9da105
inc cl
xor dword [rsp + rsi - 0x2e27db35], edx
and edi, 0xbca64302
pop rbx
bt r9, r8
inc r9
or r9d, ecx
movsxd rdx, edx
rol rdi, cl
sub esi, 0x496522c
sal r8b, 5
adc r11, rdx
movsx edx, r8b
or esi, edx
or ecx, ecx
jmp r11
adc r8b, 0x1f
xor r8b, 0x9b
inc edx
sal eax, 0x82
mov ecx, edi
sbb r8b, dl
btr dx, si
xadd rdx, rdi
xor bl, r8b
sal ecx, 0x66
sub eax, 0xb12b2419
jae 0x1806ddb2a
add r8, rsp
push rdi
ror si, 0xec
jae 0x1807781e2
lea rcx, [rcx*8 + 0x4530b810]
mov word [rax + rdi*2 - 0x19d7a], r9w
mov r9d, dword [r10 + rdi*2 - 0x19d7a]
and edx, esi
call fcn.180782d10
dec di
lea r10, [rdi + r10 - 0xcebb]
lea r8, [rsi + rsi*2 + 0x4c2ebb9b]
add edx, 0x820ba926
xor ax, bx
xor esi, edx
call fcn.18078034e
setae cl
mov r9, qword [r11 + r9*2 - 0x14a]
add r8, r9
pop rax
lea rdx, [rcx*4 + 0x3e977686]
movsx r9d, bp
mov qword [r11 + rcx*8 + 8], r8
call fcn.18071a73d
mov eax, 0x2691ae97
mov esi, 0x5230fc84
mov ecx, eax
mov di, word [rbp + rax*2 - 0x4d235d2e]
movzx eax, byte [rsi + r10 - 0x5230fc84]
movzx r9d, si
xor al, bl
add cl, 0x2a
movzx edx, sil
xor al, 0xaa
lea rcx, [rdx + rsi + 0x47204c9c]
add r9b, 0x83
xadd si, r9w
adc al, 0xbd
movsx r8d, cl
add r8w, si
neg al
sal ecx, 0xef
jne 0x18074b99d
mov r9, qword [rbp + riz]
mov eax, 0xf226a4b0
add rbp, 8
movzx edi, ax
movzx r8d, byte [rdi + r10 - 0xa4b0]
lea r10, [r10 + rdi - 0xa4af]
shl edi, 0xbc
neg ax
cbw
xor r8b, bl
neg rax
movzx edx, di
rol r8b, 1
or al, dh
mov esi, edi
jne 0x1806e3c2b
and r9w, r9w
sbb al, 0x83
sal rdx, 0xc1
sub esi, edx
jbe 0x180766bd7
neg al
jmp 0x1806f3110
mov qword [r8 + rdi*2], r9
shl rax, 0xdb
xor qword [rsp + rdi], rsi
xchg dword [rsp + rdi*2], ecx
mov r8d, dword [rdi + r10]
call fcn.180791d3f
mov bx, word [rbx + r11 - 0x6f7f980a]
call fcn.18070978f
push 0xffffffffca35d5ab
pop rsi
movzx r9d, si
mov di, 5
or r9w, r9w
mov word [rbp + rsi*2 + 0x6b9454a8], di
mov edx, r9d
movzx eax, sil
btr r9w, 0x2e
mov ecx, dword [r10 + rsi*2 + 0x6b9454aa]
xor ecx, ebx
lea rax, [rdx + r9*2 + 0x628e902e]
mov r8d, 0xb2960fad
lea rdx, [r8 + rax*8 - 0xa5d6fed]
dec ecx
add al, 0xb1
bswap ecx
neg ecx
not al
movsx edi, ax
bswap ecx
call fcn.1807bc18e

Function at 0x18070ee64
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x4320cd1e
shl word [rsp + 3], 0xf
and rax, 0xfffffffffffffff0
call fcn.18075dc83
mov r9d, 0x18f643a
mov edi, 0x24819a8b
movzx r9d, byte [r10 + r9*8 - 0xc7b21d0]
movzx edx, di
mov eax, edx
and al, dl
lea r10, [r10 + rdx*2 - 0x13515]
add edi, 0x3523e0b4
xor r9b, bl
shl eax, 0x8f
mov ecx, 0x9dbed92a
rol r9b, 1
cdq
rol cx, cl
neg r9b
movzx esi, al
shr di, cl
ror r9b, 1
call fcn.1806ebd79

Function at 0x1807117b3
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + r9*2 + 0x30], ebp
not ecx
movzx edi, cx
mov rdi, qword [rsp + r9 + 0x30]
sub rdx, r9
movsx eax, bx
call fcn.1807b1c6a
Function at 0x1807117cd
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.1807cabc3
mov edx, 0xa1b4f6a3
mov ecx, edx
add dx, 0x57a3
mov edx, dword [r10 + riz]
movzx r8d, cx
sal ecx, cl
movsx edi, r8b
lea r10, [r10 + rcx*4 - 0x369ed45c]
neg ecx
add r8w, 0x4c13
xor edx, ebx
bswap edx
inc rdi
movsx r9d, cl
not edx
neg edx
jmp 0x1807c52ad
neg r9
lea ecx, [rcx + rbx - 0x64270b8d]
call fcn.1806f1052
dec bpl
sar ebx, 0x9c
lea edx, [rdx + rbx*4 - 0x7abca02e]
neg edx
call fcn.1806e959d
lea edx, [rdx + rdi - 0x60f43117]
shr ecx, cl
setp cl
push rbx
js 0x1807434c6
movsx eax, cl
xor dword [rsp + r8 - 0x42b6], edx
call fcn.180734cf2
mov ebp, 0xfb04619c
mov r9, qword [r11 + riz]
btr ebp, 0x2f
lea r8, [rbp + rbp*2 + 0x70081c2f]
mov ebx, r8d
mov ecx, dword [rbx + r11 - 0x611540fb]
mov eax, ebp
neg r8b
inc al
lea r11, [rbx + r11 - 0x611540fb]
movsx edx, bx
cwd
lock xchg dword [rbx + r9 - 0x61154103], ecx
inc r8b
mov dword [rbx + r11 - 0x61154103], ecx
lea rsi, [rdx + rsi - 4]
or r8w, bp
xor edx, dword [rbx + rsi - 0x61154103]
xor edx, edi
jmp 0x1807a9480

Function at 0x180717fd7
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1806f11f9
call fcn.180765ab7

Function at 0x180717fe1
Capabilities:
Authenticate hmac

Disassembly:
neg sil
lea rax, [rcx*2 - 0x14408afc]
bswap edx
call fcn.18074ef83

Function at 0x18071a422
Capabilities:
Authenticate hmac

Disassembly:
inc rcx
xor al, dil
movzx edx, r8b
mov qword [rsp + rdx*2 - 0x24], rcx
push rcx
not al
not word [rsp + rdx*2 - 0x1b]
movsx ebx, r8w
rol al, 1
push rbx
mov qword [rsp + rdx*4 - 0x30], rdx
ror rbx, cl
xor al, 0x92
bt bp, bp
movzx r9d, bx
btc r9, r9
adc al, 0x2c
xor dil, al
lea rax, [rsp + rax + 0x28]
sal r8w, 0xa3
mov r9, qword [rdx + rax - 0x12]
neg rdx
jle 0x18076b7e9

Function at 0x18071b329
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r9 - 1], rcx
inc r8
lea r11, [r11 + r9 + 5]
sal r9d, cl
mov ebx, dword [rsi + r9 - 0x80004]
bts r8d, 7
setae byte [rsp + r9*2 - 0xfffff]
lea rsi, [rsi + r9*8 - 0x400004]
xadd word [rsp + r9 - 0x80000], cx
xchg r8d, ecx
xor ebx, edi
dec ebx
not ebx
push r9
xor ebx, 0x7bb29788
call fcn.18078008a
mov rdx, qword [rbp + riz]
mov edi, 0x9041798
lea rcx, [rdi + rdi - 0x126e7ce9]
mov eax, ecx
mov eax, dword [rbp + rdi*2 - 0x12082f28]
mov dword ss:[rdx + rdi - 0x9041798], eax
lea rax, [rbp + rdi*2 - 0x12082f24]
mov qword [rdi + rbp - 0x9041794], rax
sub di, di
mov edx, dword [r10 + rdi - 0x9040000]
lea r10, [rdi + r10 - 0x903fffc]
mov eax, 0xc02d00a8
not cl
movzx esi, dil
xor edx, ebx
sub ecx, esi
neg edx
lea r9, [rax + rcx*2 + 0x1dadf139]
bswap edx
call fcn.18075c2fc
Function at 0x18071d04b
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
btc r8, 0x8e
dec ax
pop rsi
rol ax, 1
sub ax, 0xe288
mov qword [rsp + r8 - 0x1b0b], 0x5a967384
bt r8w, r8w
mov edx, 0x8e158e13
xor bx, ax
xor dil, 0xa5
lea rax, [rsp + rax + 8]
setle byte [rsp + r8*8 - 0xd858]
or r9d, 0xf865c3d
movzx ecx, dx
mov r9w, word [rax + r8*4 - 0x6c2c]
lea rbp, [rbp + r8*2 - 0x3618]
shr word [rsp + r8*2 - 0x3610], 0xaf
mov word [rbp + r8*4 - 0x6c2c], r9w
call fcn.1807a8f90
xor bl, 0x22
movzx edx, cl
lea rax, [rcx + r8*2 + 0x518c8332]
rol bl, 1
call fcn.180768db8

Function at 0x18071f3c2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rdi - 0xc4], rbx
mov ebx, 0x8a8840ba
btr rdi, rcx
jae 0x1807166e3

Function at 0x1807207cb
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
adc r10, 3
pop rcx
lea rcx, [rdi + rdi*2 + 0x42bf3d13]
xor r8d, ebx
btc di, 0x33
rol dil, 0x66
jae 0x1807aeb6a
mov edx, 0xef324d20
movsx ebx, dl
lea rsi, [rbx + rsi - 0x24]
movsx r8d, bx
inc r8b
mov ecx, 0x908b8836
mov r8d, dword [rsi + r8 - 0x21]
xor r8d, edi
shr dx, 0xa1
lea rbp, [rdx + 0x3ead2717]
lea r8d, [r8 + rcx*2 - 0x65657768]
rol r8d, 2
movsx eax, cx
shl edx, cl
inc r8d
not r8d
bts cx, 0x8a
push rdi
cwde
sal rax, cl
xor dword [rsp + rbx - 0x20], r8d
inc r8d
btc ecx, 0xae
shr edi, cl
neg r8d
bts rcx, rdi
sub dil, 0x3c
lea r8d, [r8 + rcx*4 - 0x38f45990]
add cl, 0xbf
bswap r8d
call fcn.18071f3c2

Function at 0x1807219d9
Capabilities:
Authenticate hmac

Disassembly:
jne 0x180726e6b
mov r8, qword [r11 + rbx*2 - 0x63025800]
or ebp, dword [rcx + r11 - 0xd3f8]
movsx r9d, ax
mov qword [rsp + rbx - 0x31812c00], rdx
call fcn.18072265e
sal rbx, 0x6b
neg eax
inc eax
mov qword [rsp + r8 - 0x1103a8f0], rdi
xor dword [rsp + r8 - 0x1103a8f0], eax
mov edi, ebp
push rbx
mov rdi, qword [rsp + r8*4 - 0x440ea3e8]
dec bp
bts ecx, r8d
sub qword [rsp + r8*2 - 0x220751f3], 0xffffffffc110a934
movsxd rax, eax
mov edx, ebx
add r10, rax
lea rsi, [rsi + rbp*2 - 0x21]
and byte [rsp + r8 - 0x1103a8eb], cl
adc bl, 0x1f
or dl, byte [rsi + r8*2 - 0x22075200]
sal cx, cl
btc ebx, r9d
xor dl, dil
sub dl, 0xad
sub r9b, bl
call fcn.1807a695d