joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140826dfe
Capabilities:
Encode data using base64

Disassembly:
bswap ebp
inc ebp
shl rdx, 0x8d
xor ebp, 0xaba0bdbc
movzx ecx, r11b
movzx ebx, r11w
mov qword [rsp + rcx - 0xf6], r10
bswap rdx
bswap rcx
lea rax, [rdx + rbx*8 - 0x5dfc6bed]
xor dword [rsp + rbx - 0x1ef6], ebp
btc r11d, eax
pop r10
jae 0x140847c90
mov ebp, dword [rdi + rdx - 0x5b04dc25]
mov qword [rsp + r11 - 0x5b04dc25], rdx
lea r11, [rdx + rdx + 0x1c1266ac]
lea rdi, [rdi + rdx - 0x5b04dc21]
neg dl
xor ebp, r10d
not qword [rsp + rdx - 0x5b04dcdb]
neg ebp
ror dl, 0x66
jae 0x140822088
mul ecx
bts rcx, 0x14
movsxd rbp, ebp
adc r8, rbp
movzx r11d, word [rdi + rdx]
lea rdi, [rdx + rdi + 2]
xor r11w, r10w
sub r11w, 0x3421
call fcn.14084e6e4

Function at 0x140827f5a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jmp 0x14080627e
lea rsp, [rsp + 0x20]
jne 0x140819461
mov r8, rax
push 0x39311892
push 0x1b9a293
lea rsp, [rsp + 0x10]
jmp 0x1408508ef
Function at 0x14082c434
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ret 8
push rbp
bts cx, si
xor r10b, r11b
shr eax, cl
mov dword [rsp + rbp - 0xe5c], ecx
lea r11, [rsp + r11 + 0x28]
lea rbx, [rdx*2 - 0x12f176f0]
shl rcx, 0xff
add eax, dword [r11 + rbp*8 - 0x73e0]
call fcn.14080d087
mov eax, 0x25bffa12
mov rbp, qword [r9 + rax - 0x25bffa12]
mov esi, 0x872811a7
movsx ecx, sil
movzx ecx, byte [rdi + rax*2 - 0x4b7ff424]
lea rbx, [rsi + rsi*4 - 0x4af8b1c4]
lea r11, [rbx*4 - 0x63f1bb46]
ror r11, 0xf5
xor cl, r10b
xor ax, 0xe11c
xor cl, 0xab
xadd ax, si
inc cl
div bl
and eax, r11d
neg cl
call fcn.1407ef1a0
lea rdx, [rbp*8 - 0x43ebf075]
lea ecx, [rcx + rax - 0x46bfe62c]
lea rbx, [r11 + rdx - 0x22c3d77c]
xchg si, bp
lea rbp, [rbp + rdx*4 - 0x6b5a0be7]
ror ecx, 1
xor ecx, 0x28a7ef87
ror ax, 0xae
bt ebx, r11d
dec rsi
push r10
xor dword [rsp + rsi - 0xed2c], ecx
mul rdx
btr r11w, si
sbb al, 0xaf
pop r10
cmovs r11d, eax
imul r11
push rbx
movsxd rcx, ecx
pop rdx
btc bx, dx
add r8, rcx
lea rcx, [rdx*8 + 0x62b6bf9f]
shl cx, 0x29
jbe 0x1407f7cb1
mov rax, qword [r9 + rsi*8 - 0x76960]
mov rbp, qword [r9 + rsi*8 - 0x76958]
btc r11d, esi
mov qword ss:[rsi + rax - 0xed2c], rbp
lea rcx, [rbx*4 - 0x37f34b57]
imul bx, r11w
movzx esi, byte [rdi + rsi*4 - 0x3b4ac]
lea rbp, [rbx*8 - 0x5fd301e8]
adc rdi, 4
xor sil, r10b
ror sil, 1
movsx eax, dx
call fcn.1407f1977
mov eax, dword [r9]
mov ebx, 0xa8a5c889
lea r11, [rbx + rbx*8 + 0x4b89ca9c]
movzx ebp, byte [rdi + riz]
shl r11d, 0x7c
and bl, bl
lea rdx, [r11*2 + 0x2b8f2c9a]
xor bpl, r10b
movzx esi, bx
xor bpl, 0x36
add bpl, 0xa3
xor bpl, 0x9c
sar dl, 4
adc bpl, r11b
inc sil
push rdx
xor r10b, bpl
lea rbp, [rsp + rbp + 8]
dec byte [rsp + rsi - 0xc888]
shr word [rsp + rsi*2 - 0x19113], 0x6c
btr si, 0x33
mov dword [rsi + rbp - 0xc882], eax
mov rdx, qword [r9 + rsi - 0xc87e]
add sil, r11b
sub r11b, byte [rsp + rsi*8 - 0x64410]
mov rsi, qword [r9 + rsi*8 - 0x64404]
sub ebx, ebx
mov qword ss:[rbx + rdx], rsi
movzx r11d, byte [rdi + rbx + 1]
rol qword [rsp + rbx], 0x5d
shl byte [rsp + rbx + 7], 0xa3
jne 0x14085048f
mov eax, dword [rdi + rcx - 0xa7c4]
movzx ebx, dx
shr rdx, cl
lea rdi, [rdi + rcx - 0xa7c0]
movzx esi, r11b
rol rsi, 0x1b
cmovne si, bx
xor eax, r10d
btc rbp, rsi
shl r11w, cl
xchg rsi, rbx
neg eax
sal edx, cl
xor eax, 0x6114d4b6
imul cx, si
rol cl, 0xa5
sbb eax, esi
not eax
and ecx, 0x9c2a219b
push r10
dec rcx
jae 0x140830c93
jmp 0x14083f2f4
sal dword [rsp + rbp*4 - 0x39e7], 0x70
lea rdi, [rbp + rdi - 0xe75]
sub byte [rsp + rax*2 + 0xa], ah
sub rcx, qword [rsp + rbp*2 - 0x1cd9]
pop rax
xor r11b, r10b
ror rsi, cl
sbb r11b, 0x8f
xor r11b, 0x80
sub cl, 0x81
adc r11b, 0xa8
movsx eax, word [rsp + rbp - 0xe79]
neg r11b
not r11b
jmp 0x1408272d7
xor r11b, r10b
sub r11b, 0xb
push rbx
call fcn.140857fb5

Function at 0x14082d4a6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffc135389d
push 0xffffffff86b51eab
lea rsp, [rsp + 0x18]
jne 0x14082fcd0
mov ecx, 0x418a27af
mov rcx, rax
jmp 0x140800b08
Function at 0x140831c1c
Capabilities:
Hash data using murmur3

Disassembly:
ror ebp, 2
bswap ebp
push r10
movsx ecx, r11w
movzx r10d, dl
xchg cx, ax
xor dword [rsp + r10*2 - 0x114], ebp
sal al, 0xc2
ja 0x140833939
shrd bx, r11w, cl
mov word [r9 + riz], bx
lea rdx, [rbp + 0x139bd48a]
shr dword [rsp + 2], 0x9b
mov eax, dword [rdi + riz]
dec ebp
adc rdi, 4
xor byte [rsp + 4], dl
setne bpl
xor eax, r10d
inc eax
btc edx, edx
imul edx, dword [rsp + 2]
not eax
movsx ebx, dx
xor eax, 0x39aafb8d
bswap ebx
call fcn.14083b3e3
mov rbp, qword [r9]
mov esi, 0xa624a403
mov ecx, dword [r9 + riz + 8]
lea r11, [rsi + rsi*4 - 0x76fad280]
mov dword [rbp + riz], ecx
mov ebp, dword [rdi + riz]
movzx edx, r11w
lea rdi, [rdx + rdi - 0x618b]
lea r11, [rdx + r11*4 - 0x16b0746]
xor ebp, r10d
sub dx, dx
lea rdx, [rsi + rdx*2 + 0x31899623]
rol ebp, 1
mov eax, 0x660b9fba
neg ebp
rol r11b, 5
bt eax, 0x23
bswap ebp
inc ebp
idiv r11
jmp 0x1407fc849
mov bx, word [r9 + riz]
mov r11w, word [r9 + riz + 2]
mov qword [rsp], rbp
mov ecx, 0x2b381b00
add cl, byte [r9 + rcx*2 - 0x567035fc]
add r9, 4
sub rbp, 0xffffffffb81d1883
jns 0x14080d221
movzx esi, byte [rdi]
mov ecx, 0xd0bc903d
xor sil, r10b
movsx edx, cx
lea r11, [rcx*8 - 0x64c9d374]
not sil
neg sil
mov eax, 0xfa060eb5
add sil, 0xbc
movzx ebx, r11w
idiv cl
not sil
ror sil, 1
push rax
xor r10b, sil
cqo
mov ebp, 0xf4b0b8a1
lea rsi, [rsp + rsi + 8]
not rax
push rcx
add rbp, qword [rsp + rdx + 2]
mov bx, word [rdx + rsi]
mov si, bx
and bpl, r11b
movzx r11d, byte [rdi + rdx + 1]
xor r11b, r10b
ror r11b, 1
cqo
add r11b, 0x9f
xor word [rsp + rdx + 0xe], bp
adc ebp, eax
xor r11b, dl
inc dword [rsp + rdx + 0xd]
jle 0x14082ce06
sub r11b, 0xd
xor r10b, r11b
pop rcx
idiv ebp
shr qword [rsp + rax*8 - 0x170], 0xca
lea r11, [rsp + r11 + 8]
shr rcx, 0xde
shr byte [rsp + rcx*2 - 1], 0xc1
mov word [r11 + rcx - 3], si
lea rsi, [rax + rax - 0x38f28fc4]
xchg si, cx
mov eax, dword [rdi + rcx*2 - 0xe12e]
xor eax, r10d
not eax
lea eax, [rax + rsi*2 - 0x773e771f]
bswap rbp
call fcn.14084bbe5
mov esi, 0x7b9961b3
mov edx, dword [rdi + rsi - 0x7b9961b3]
movsx ecx, si
xchg sil, cl
lea rdi, [rdi + rcx*4 - 0x186c8]
mov ebx, 0x8d8fba17
lea r11, [rbx + rcx*4 + 0x2889102d]
xor edx, r10d
or cx, r11w
mov eax, 0x36973f04
xor edx, 0x71ba6d94
not edx
rol ecx, cl
not r11w
neg edx
ror al, cl
lea rbp, [r11*8 - 0x53c4ba46]
bswap edx
lea rax, [rbx - 0x1b484aef]
sub si, 0x4d23
push r10
xor dword [rsp + rax - 0x72476f28], edx
movzx r10d, si
pop r10
rol r11b, cl
shr rbp, 0x7a
shr bp, cl
movsxd rdx, edx
sub r11, rbx
adc r8, rdx
inc rax
mov r9, qword [r9 + rsi - 0x7b991490]
cdqe
jge fcn.1408404ab
mov qword [r9 + rbx*2 - 0x4c00], rax
rol rbx, 0xa3
movzx eax, r11b
lea r9, [r9 + rsi - 0x4e95c9fe]
call fcn.14085b7bb
Function at 0x140833a75
Capabilities:
Authenticate hmac

Disassembly:
dec eax
shl r11b, 0x83
call fcn.140836991
mov ebp, dword [r9]
mov esi, 0x6bd5da8
movzx eax, si
mov ebx, dword [rsi + r9 - 0x6bd5da4]
lea rdx, [rax + rsi*4 - 0x31d8d5c9]
movsx ecx, si
and ebp, ebx
not ebp
mov dword [rsi + r9 - 0x6bd5da4], ebp
mov edx, dword [rsi + rdi - 0x6bd5da8]
movsx ebp, al
jmp 0x140842f07
lea rdi, [rdi + rsi*2 - 0xd7abb4c]
mov r11d, 0x4b15ad16
btr rsi, r11
imul eax, esi
xor edx, r10d
dec r11w
lea edx, [rsi + rdx - 0x78dc46d9]
movzx ebx, al
setno sil
neg edx
xchg si, ax
inc edx
xor r11, r11
sbb al, bpl
not edx
cbw
lea edx, [rdx + rsi*2 - 0x7c928fbe]
sar bpl, 0xa6
call fcn.14083ccc4
call fcn.1408226d0

Function at 0x140836880
Capabilities:
Authenticate hmac

Disassembly:
jb 0x14084ddab
mov ecx, dword [rdi]
mov ebp, 0x2637dd1b
movsx r11d, bp
movsx esi, bp
lea rdi, [rdi + rbp*2 - 0x4c6fba32]
movzx ebx, bpl
xadd r11, rsi
dec bx
xor ecx, r10d
rol esi, 0xda
imul rbp, rsi
neg ecx
bswap ecx
movsx eax, r11b
sar ax, 0x29
mov edx, esi
not ecx
bswap ecx
add ebp, esi
and r11, 0xffffffffe99c2c8a
not ecx
bts ebp, ebp
jb 0x14083b658
movsx ebx, cx
neg al
movzx esi, dl
lea rcx, [rbp*2 - 0x43f05ce2]
ror al, 1
lea rsi, [rsi*2 - 0xdaa14e]
rol esi, 0x6b
sbb al, 0x93
add dl, 0x3d
btr ecx, 5
xadd rbx, rcx
ror al, 1
sub al, 0x84
xor r10b, al
add rax, rsp
or si, 0x1418
rol rsi, 0xaf
mov ecx, dword [rbp + rax - 0xa953386]
lea rax, [rdx*8 + 0x5b094604]
cwde
xadd bpl, al
mov dword [r9 + rbp - 0xa953362], ecx
sbb sil, dl
lea rsi, [r9 + rbp*2 - 0x152a66cc]
or rbp, 0x550e56b0
cdq
sar ebx, 0xcd
mov qword [r9 + rdx*2], rsi
cwd
movzx r11d, bx
xor rdx, r8
jmp rdx
push r10
xor dword [rsp + rsi - 0x6fffff74], ecx
pop r10
movsxd rcx, ecx
dec bpl
add r8, rcx
cqo
mov rbp, qword [rbp + r9 - 0x597314af]
jmp 0x14084798c
xor rax, qword gs:[rbp + rsi - 0x6fffff74]
rol si, 0x2c
neg r11d
mov qword [r11 + r9 - 0x1663d7fe], rax
movzx eax, sil
or rdx, r8
jmp rdx
movzx ecx, word [rsp + rsi*2 - 0x1f0f6]
lea rdi, [rdi + rsi - 0xf885]
or rcx, 0x731622b4
call fcn.1407f9bf3
mov rsi, qword [r9]
mov ecx, 0xad8060a9
movzx r11d, cl
movzx ebx, r11w
mov rcx, qword [rsi + r11*4 - 0x2a4]
movsx eax, r11b
mov edx, eax
cdq
mov qword [rbx + r9 - 0xa9], rcx
movsx esi, dx
rdtsc
mov dword [r9 + rbx*8 - 0x54c], eax
mov dword [r9 + r11*4 - 0x2ac], edx
xadd ebx, esi
mov edx, ebx
lea r9, [r9 + rbx - 0xb0]
sub rdx, 0x32207297
movzx eax, bx
mov ecx, esi
mov esi, dword [rdi + r11 - 0xa9]
lea rdi, [r11 + rdi - 0xa5]
xor esi, r10d
movzx ebp, r11w
sub edx, 0xaab74629
rol esi, 3
xor esi, 0x3d15d295
rol rcx, cl
xor r11w, cx
ror esi, 1
lea rax, [rbp*2 - 0x3ce4c96e]
bt bp, bp
lea esi, [rsi + r11 - 0x5f09d949]
ror cx, 0x6a
xor esi, 0x4638c9ac
inc cl
push r10
xor dword [rsp + r11*2 - 0x152], esi
movzx r10d, dl
pop r10
bswap ecx
cbw
sal cl, 0x41
movsxd rsi, esi
adc r8, rsi
or rbx, 0xffffffffda02b701
jno fcn.1408404ab
Function at 0x140836f4d
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rbx*4 - 0xa200], r10
movsx r10d, bx
ror rax, 0xb9
cdqe
xor dword [rsp + rbx*2 - 0x5100], ecx
pop r10
call fcn.140826049
push rbp
mov edx, ebp
ror bl, 1
inc byte [rsp + rbp - 0x7b3ed507]
ror byte [rsp + rcx - 0x7b39], 0x41
not dword [rsp + rcx - 0x7b32]
sbb bl, 0x94
pop rbp
ror bl, 1
sub bl, 0x84
xor r10b, bl
xchg byte [rsp + rbp - 0x7b3ed50f], bpl
lea rbx, [rsp + rbx + 8]
xor dword [rsp + rsi - 0x78], esi
mov edx, dword [rbx + rbp - 0x7b3ed5c1]
lea r11, [rbp*8 - 0x3c75b967]
rol r11b, 0xe6
mov dword [r9 + rbp - 0x7b3ed5c5], edx
jnp 0x14080b3b9
imul rsi, r11
mov edx, 0x269b7030
mov r11d, dword [rdi + rbp - 0x7b3ed5c0]
lea rdi, [rdi + rcx - 0x7b39]
push rsi
setno dl
xor r11d, r10d
movzx eax, bp
lea r11d, [r11 + rcx*4 - 0x2aa2aa05]
movsx ebx, cx
not si
not ax
not r11d
add qword [rsp + rbp - 0x7b3ed5b9], 0xffffffffe3bfd407
cdqe
xor r11d, 0x73b16c97
bswap r11d
rol r11d, 1
cwde
lea rbx, [rsi + rdx + 0xb8bfca0]
mov qword [rsp + rbp - 0x7b3ed5b9], r10
btr ebx, edx
sub rbp, 0xffffffff9c0a9d11
sbb dword [rsp + rcx*2 - 0xf678], ebx
xor dword [rsp + rcx - 0x7b36], r11d
mov r10, qword [rsp + rdx - 0x269b6ff9]
movsxd r11, r11d
btc si, 0xb5
adc r8, r11
not dx
imul bx, word [rsp + rcx*8 - 0x3d9f0]
shr rax, cl
xor eax, dword [r9 + rcx*2 - 0xf680]
shr si, 0xcc
ror esi, cl
xchg qword [rsp + rcx - 0x7b3e], rsi
mov ecx, dword [r9 + rcx - 0x7b3e]
not rbp
cpuid
shr word [rsp + 2], 0x6b
call fcn.1407f383c
Function at 0x14083b6dc
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
not esi
sar bp, cl
or ebp, ecx
mov qword [rsp + r11 - 0xff01], rcx
sbb esi, 0xe9247719
lea rbp, [rbp + rcx*8 + 0x6d9d2a28]
xadd word [rsp + r11 - 0xfefe], bp
or byte [rsp + r11 - 0xff01], 0x30
neg esi
dec esi
not dx
push rbx
mov qword [rsp + r11*4 - 0x3fbfc], r10
lea rcx, [rbp + rbp*4 - 0x50d25371]
xor dword [rsp + r11*8 - 0x7f800], esi
not byte [rsp + r11*2 - 0x1fe01]
mov r10, qword [rsp + r11 - 0xfef9]
dec word [rsp + r11*8 - 0x7f802]
dec bpl
movsxd rsi, esi
push r11
mov qword [rsp + r11*2 - 0x1fdf2], rbx
movsx eax, byte [rsp + r11 - 0xfef1]
add r8, rsi
call fcn.14082c671
movzx eax, byte [rdi]
mov edx, 0x9f176f16
movsx r11d, dx
movzx ebp, r11b
xor al, r10b
mov ecx, 0x992a8892
imul rcx, rcx
not al
mov esi, edx
btr cx, 0x32
xchg bpl, r11b
sbb al, 0x8e
jmp 0x140844191
rol al, 1
sal dl, 0x27
not edx
push rsi
add al, dl
mov ebx, esi
sal qword [rsp + r11 - 0x6f16], 9
neg byte [rsp + r11 - 0x6f16]
xor al, dl
xor r10b, al
push rcx
xor rbp, 0xffffffff970dc7a2
lea rax, [rsp + rax + 0x10]
sal bp, 0xe3
setp byte [rsp + rdx - 0x60e890f3]
mov esi, dword [rax + rdx - 0x60e890ff]
xchg r11b, dl
xor ecx, edx
pop rbx
mov dword [rdx + r9 - 0x60e8901a], esi
sub dx, 0xc399
mov ebx, dword [rdi + r11*4 - 0x1bffb]
xor ebx, r10d
lea rdx, [r11 + rcx*2 - 0x37f6bd41]
sar dword [rsp + r11 - 0x6fff], cl
not ebx
shr dl, 0x84
lea rsi, [rcx + rcx - 0x27f66be5]
neg ebx
inc ebx
add rbp, 0x2432403e
call fcn.14081d7f8

Function at 0x14083db5a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
shl si, 0x69
dec edx
mov qword [rsp + rbp - 0x66041243], 0xffffffffbd36ef87
inc word [rsp + rcx - 0x6604edb7]
mov eax, 0x6d3e2691
rol edx, 1
mov r11d, 0x9694fa88
xadd byte [rsp + rsi - 0x85f5], bh
inc bpl
mov qword [rsp + rbp - 0x6604123c], r10
xchg qword [rsp + rcx - 0x6604edbc], rsi
xor dword [rsp + rcx - 0x6604edb4], edx
or r11d, esi
and word [rsp + rax - 0x6d3e2691], r11w
mov r10, qword [rsp + rcx - 0x6604edb4]
ror bx, 0xc4
jnp 0x1408270c4
movsxd rdx, edx
sub ebx, 0x468d61ac
sar byte [rsp + rbp - 0x66041244], 0x81
adc r8, rdx
mov qword [rsp + rax - 0x6d3e2689], rbx
cqo
xchg byte [rsp + rdx*4 + 0xe], bpl
mov rbx, qword [r9 + rcx - 0x6604edbc]
mul ecx
call fcn.14080e52c
xor dword [rsp + rbx + 0x483c0876], ecx
xadd ebx, esi
sar rbp, 0x23
imul si, r11w
pop r10
jb 0x140829996
Function at 0x14083dd57
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mul edx
lea rdi, [rbp + rdi - 0x9206392]
add rax, 0x7830e32c
xor esi, r10d
movsx r11d, ax
rol esi, 1
and al, r11b
div rax
not esi
shl rdx, 5
cmova rax, rbx
mov ecx, 0x220e99a5
rol esi, 1
bswap rcx
rol rbx, 0x50
lea rdx, [rbp + rdx - 0xec98676]
bswap esi
dec bpl
ror cx, 0x8f
push r10
cqo
dec eax
xor dword [rsp + rbp*4 - 0x24818e54], esi
and ecx, 0xb2a59603
pop r10
btr r11w, 0x8e
ror rax, 0x46
movsxd rsi, esi
push rbp
adc r8, rsi
xadd qword [rsp + rbp - 0x9206395], rdx
cmovae ax, bp
mov rbx, qword [r9 + rbp - 0x9206395]
cwd
sar dl, 0xc4
mov r11, qword [r9 + rbp*4 - 0x24818e4c]
idiv bp
lea r9, [r9 + rbp*4 - 0x24818e4c]
bts edx, 0x8f
cdq
cwde
and rbx, r11
sub dword [rsp + rbp - 0x9206395], 0x71274ea5
push rcx
sub edx, ebp
not rbx
jno 0x1407fcb74
movsx ebx, cx
mov edx, 0xc0b02981
mov qword [r11 + r9 - 0x10], rsi
lea rbp, [rcx - 0x3e562d7f]
lea rcx, [rbx + rax*2 + 0x15106cba]
cbw
lea r9, [r9 + r11 - 0x10]
rol al, 2
mov ebx, dword [rdi + r11*2]
sub ecx, 0xb736a503
setl bpl
inc r11w
lea rdi, [rdi + r11*2 + 2]
cdqe
push rax
cwd
xor ebx, r10d
btr rbp, 0xb1
ror ebx, 1
shr bp, 0x8f
neg qword [rsp + r11*2 - 2]
lea ebx, [rbx + rax + 0x2a9453cb]
push rcx
neg ax
mul cl
neg ebx
add rdx, qword [rsp + rax*4 + 0x283c8]
lea ebx, [rbx + rbp*4 + 0x85632a7]
xor byte [rsp + rax*2 + 0x141ef], cl
mov qword [rsp + rax*2 + 0x141e8], r10
movzx esi, dl
xor dword [rsp + rax*2 + 0x141e8], ebx
mov r10d, 0x40866fbf
push rsi
jmp 0x140840e1a
not r11
movsx ebp, si
dec r11
mul rax
call fcn.14084daff
mov ebp, 0x9206396
movsx edx, bp
movsx ebx, bpl
mov esi, dword [rdi + rbp*8 - 0x49031cb0]
lea rax, [rbx + rbp*2 - 0x415ca2f6]
jmp 0x1407f890c
mov rax, qword [r9 + rbp + 0x2a72d4c2]
or cx, 0x472a
adc dx, cx
sar ebp, cl
mov edx, dword ss:[rax + rsi - 0xa18b]
push rbp
xchg word [rsp + rsi*2 - 0x1430f], r11w
rol cl, 0xa3
mov dword [r9 + rsi - 0xa18b], edx
neg bl
jno 0x140825830
mov qword [rsp + rsi - 0xa18b], r8
ret 0x10
jae 0x140814476
mov qword [r9 + rbp*2 - 0x801131a], rbx
add al, dh
mov eax, dword [rbp + rdi - 0x400898b]
ror ebp, 0x27
lea rdi, [rbp + rdi - 0x1608010f]
dec rdx
adc rbp, 0xffffffffbf852a27
add rsi, rdx
xor eax, r10d
inc esi
push rdx
xadd dword [rsp + rbp*2 + 0x54e5a98e], esi
neg eax
lea rbx, [rbp + rsi*8 - 0x317afd52]
inc eax
shr bl, 0x85
neg eax
movsx r11d, bpl
sal qword [rsp + rbp + 0x2a72d4c6], 0x9f
xor dword [rsp + rbp + 0x2a72d4ca], esi
xor eax, 0x239839a0
push rdx
rol word [rsp + rsi*2 - 0x14306], 0x6d
or sil, bl
mov qword [rsp + rbp + 0x2a72d4ce], r10
xor dword [rsp + rsi - 0xa183], eax
mov ecx, dword [rsp + rbp*2 + 0x54e5a98e]
inc r11w
setnp cl
mov r10, qword [rsp + rsi - 0xa183]
setp r11b
and byte [rsp + rbp + 0x2a72d4c7], bh
movsxd rax, eax
adc r8, rax
jmp 0x1408162bf
mov r10, qword [rsp + rax*4 + 0x283d0]
and al, r11b
adc bpl, 0x26
seto byte [rsp + rax*4 + 0x28408]
movsxd rbx, ebx
adc r8, rbx
lea rsi, [rsi + rsi*2 - 0x55a3760]
pop rbp
pop rax
pop rcx
jmp fcn.1408404ab
Function at 0x14083de96
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub cl, sil
idiv al
sal dx, 0x28
xor r10w, bp
sub word [rsp + rax + 0xa], dx
call fcn.1407f81ee
mov byte es:[rcx + rsi*2 - 0x3646fb28], r11b
dec edx
jmp r8
not eax
and sil, sil
sbb eax, 0xa79c732e
sal dl, 0x82
je 0x1407fc448
not eax
mov qword [rsp + rcx - 0x42], rdx
mov qword [rsp + rcx - 0x42], r10
xor dword [rsp + rcx - 0x42], eax
pop r10
lea rbx, [rsi*4 + 0x41b6ab15]
movsxd rax, eax
imul bx, dx
adc ebp, edx
dec rsi
adc r8, rax
inc si
mov rcx, qword [rcx + r9 - 0x42]
movzx eax, dx
mov r11b, byte [r9 + rsi - 0x1b237d8c]
lea r9, [r9 + rsi*4 - 0x6c8df646]
xchg rbx, rax
jns 0x140822784
Function at 0x1408413c6
Capabilities:
Authenticate hmac

Disassembly:
rol edx, 0x5c
xor r10b, cl
sub esi, edx
ror r11d, 0xbf
lea rcx, [rsp + rcx + 0x10]
mov byte [rdx + rcx - 0x6cbdec0], bl
shl sil, 0xc7
mov ebx, eax
mov rax, qword [rdx + r9 - 0x6cbdebe]
mov qword [rsp + rdx - 0x6cbdec0], rdx
jne 0x140832a58
mov esi, dword [rax + rdx*4 - 0x1b2f7b00]
shl r11, 1
mov qword [rsp + r11 + 8], rdx
mov dword [r9 + rdx - 0x6cbdeba], esi
inc rbx
sub qword [rsp + rdx - 0x6cbdeb8], r11
lea r9, [r9 + rdx*2 - 0xd97bd7a]
rol qword [rsp + rdx*4 - 0x1b2f7afa], 0xdf
mov edx, dword [rdx + rdi - 0x6cbdebf]
lea rdi, [r11 + rdi + 5]
movsx eax, r11w
xor edx, r10d
btr ebx, eax
sar qword [rsp + r11*2 + 8], 0x70
ror edx, 1
pop rbp
bswap eax
xor edx, 0x6e0f76ae
movsx ecx, bx
bswap edx
rol bx, 0xce
not edx
mov qword [rsp + r11], rax
call fcn.1407fcbed
mov rbx, qword [r9]
mov edx, 0x47b88d07
mov r11, qword [r9 + rdx - 0x47b88cff]
lea rax, [rdx + rdx*4 - 0x70cb8fd6]
movsx esi, al
movsx ebp, sil
mov cl, byte [rdx + r9 - 0x47b88cf7]
rol bpl, 0xa7
add sil, 0xa8
lea r9, [r9 + rsi*4 - 0x3ca]
shr rdx, 3
jp 0x140834314
inc word [rsp + rbp + 0xe]
mov qword [rsp + rbp*4 + 4], r8
ret 0x10

Function at 0x14084178a
Capabilities:
Authenticate hmac

Disassembly:
lea rdi, [rdi + r11 + 0xcb5d45e]
xor bl, r10b
sub dx, 0xf1a7
not bl
neg bl
cwd
div byte [rsp + r11*2 + 0x196ba8c5]
add bl, 0xbc
xor ax, word [rsp + r11*8 + 0x65aea2f2]
not bl
mov ecx, eax
ror ax, 0xc9
cdqe
ror bl, 1
movzx esi, byte [rsp + r11*8 + 0x65aea2f1]
xor r10b, bl
imul dl
bt bp, ax
lea rbx, [rsp + rbx + 0x10]
jb 0x1407fec92

Function at 0x140844247
Capabilities:
Encode data using base64

Disassembly:
bswap ebp
mov qword [rsp + rsi - 0x1a8dca00], rax
lea ebp, [rbp + rsi*4 - 0x6136a8c1]
xor byte [rsp + rsi*2 - 0x351b93fc], r11b
sub eax, 0x1f0db9a8
call fcn.1407f3640
Function at 0x1408446ba
Capabilities:
Authenticate hmac

Disassembly:
adc r8, r11
mov qword [rsp + rbx - 0x9166d34], 0xffffffffa4841a92
mov rdx, qword [r9 + rbp*2 - 0x3c96c1c2]
pop r11
mov rbx, qword gs:[rbx + rdx - 0x9166d34]
mov edx, eax
push rbp
mov qword [r9 + rbp - 0x1e4b60e1], rbx
jmp 0x14080f185
sar rdx, 0x5c
sal sil, 0xe1
mov qword [rsp + rbp - 0x1e4b60e1], r8
ret
neg r11d
mov qword [rsp + rbx*4 - 0x2459b4d0], rbp
inc qword [rsp + rbx*4 - 0x2459b4d0]
ror qword [rsp + rbx*8 - 0x48b369a0], 0xaf
bswap r11d
lea rsi, [rbx + rbx*4 + 0x2f235ba4]
and byte [rsp + rbx - 0x9166d30], bl
not r11d
push rbp
lea rax, [rsi + rbp - 0xb5efdd3]
bswap r11d
dec byte [rsp + rbx*8 - 0x48b36999]
not r11d
movzx edx, word [rsp + rbx - 0x9166d2e]
add ebp, dword [rsp + rbx*4 - 0x2459b4c8]
adc ebp, 0x51af5800
mov qword [rsp + rbx - 0x9166d2c], r10
mul dl
xor dword [rsp + rbx*2 - 0x122cda60], r11d
sub qword [rsp + rbx - 0x9166d34], rsi
jo 0x140813841
cdqe
mov r10, qword [rsp + rbx*2 - 0x122cda60]
imul rax, rdx
sal byte [rsp + rbx*2 - 0x122cda66], 0x84
sub al, byte [rsp + rbx*2 - 0x122cda62]
movsxd r11, r11d
pop rsi
jle 0x140806010
mov r11d, dword [rdi]
mov ebp, 0x780a698d
lea rdi, [rdi + rbp - 0x780a6989]
mov ecx, ebp
sar ebp, 0xce
xor r11d, r10d
dec r11d
not r11d
lea rsi, [rcx + 0x3a9f88a8]
inc r11d
bswap rcx
xor r11d, 0x44140225
push r10
movsx ebx, cl
lea r10, [rcx*2 - 0x70c9b565]
not r10b
xor dword [rsp + rbp - 0x1e029], r11d
sal rbx, 0xb1
sete cl
pop r10
sal bl, cl
sbb rbp, rsi
shr bp, 1
movsxd r11, r11d
jl 0x14085a3d0
add rdi, 4
xor edx, r10d
push 0xffffffffe6be2c93
bswap edx
rol edx, 3
and qword [rsp], 0x461959ab
seta byte [rsp + 5]
shr word [rsp], 0xa
inc edx
jmp 0x1408306bd
adc r8, r11
neg si
movsx eax, bpl
mov rax, qword [rbx + r9]
mov cl, byte [r9 + rbx*2 + 8]
lea r9, [r9 + rbx + 0xa]
movsx edx, bp
jno 0x14080fa4e
mov edx, dword [rdi]
jmp 0x14084e171

Function at 0x140844950
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 0x28]
jbe 0x14084496f
mov edx, 4
mov ecx, 0x9a05d2b8
push rcx
lea ecx, [rbx + riz - 4]
lea rsp, [rsp + 8]
mov eax, 0x4b9f9820
shl ecx, 3
call fcn.140831037
mov esi, 0x719afc83
lea r11, [rsi + rsi*8 - 0x35569564]
movsx ebx, r11w
Function at 0x140844a97
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
mov esi, ebp
mov rcx, r11
btr ebx, esi
movzx r11d, al
cmovb edx, eax
movzx ebx, byte [rbx + rdi - 0x3ffb9a]
and rbp, 0xffffffffff96e61c
mul rsi
lea rdi, [rax + rdi + 5]
xor bl, r10b
sar dword [rsp + rax], 0xe9
dec bl
sal qword [rsp + rax*2], 0x3c
cqo
rol bl, 1
xor bl, 0xb1
push r11
inc bl
bt r11d, ebp
setae sil
neg bl
add bl, 0x16
pop rdx
shr dword [rsp + rax*4 + 4], 1
xor r10b, bl
lea rbx, [rsp + rbx + 8]
dec rax
mov qword [rbx + rax + 1], rcx
push rbp
movsx ecx, sil
lea rbx, [rcx + rsi + 0x2eb61cb1]
mov qword [rsp + rax*4 + 4], r8
ret 8
jae 0x1407f4d36
ror edx, 1
pop r11
sub bl, bh
mov qword [rsp + rsi - 0x5a8a19f8], r10
inc rcx
adc cl, 5
movzx eax, bl
xor dword [rsp + rsi - 0x5a8a19f8], edx
shl dword [rsp + rsi - 0x5a8a19fc], cl
neg sil
shr rax, 0x7a
mov r10, qword [rsp + rax + 8]
neg rbx
btr r11d, ebx
rol dword [rsp + rsi - 0x5a8a19fe], 0x56
movsxd rdx, edx
add r8, rdx
xadd r11, rsi
mov qword [rsp + rsi - 0x4a8a19f8], rbp
rol r11, 0xba
mov rsi, qword [r11 + r9 - 0x29450d0]
rol byte [rsp + r11*4 - 0xa514332], 0x83
pop rbx
lea r9, [r11 + r9 - 0x29450c8]
add r11d, ecx
movsx edx, word [rsp + rax*8 + 4]
jl 0x1408514bc
inc r11
ror edx, 1
rol r11, cl
mov qword [rsp + rsi - 0x5a8a1ab8], rbx
sal sil, 0x65
sbb edx, 0xc399302e
shl bp, cl
push rsi
jae 0x140834508
mov r11, qword [rsi + rax]
jae 0x140800d09

Function at 0x140846011
Capabilities:
Encode data using base64

Disassembly:
adc al, 0x28
shr edx, 0xb2
mov byte [rsp + rdx - 0x3be], dh
xor dword [rsp + rdx*2 - 0x784], ecx
movsx r11d, bpl
cdq
lea r10, [rdx + rbp*4 + 0x11027eb9]
mov r10, qword [rsp + rbx - 0x7e5efde2]
mov qword [rsp + rbx - 0x7e5efdf2], rbp
push rax
mov qword [rsp + rbx - 0x7e5efdda], rbp
movsxd rcx, ecx
lea rsi, [rbp*8 - 0x2b5bbe6c]
bts eax, esi
adc r8, rcx
mov qword [rsp + rbx - 0x7e5efdfa], r8
ret 0x20
je 0x14080e7db
je 0x140813a89
lea rsp, [rsp + 8]
sbb rsp, rcx
push 0xffffffffbe001515
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
add rsp, rcx
test ebx, ebx
call fcn.14080c31b