joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1413db6b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1413db6bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1413db6cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1413db6b5
lea eax, [rcx + 1]
jmp 0x1413db6db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1413db6ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1413db6d4
sub eax, 3
jb 0x1413db70e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1413db75d
sar eax, 1
movsxd rbp, eax
jb 0x1413db744
jmp 0x1413db71c
add ebx, ebx
jne 0x1413db71a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1413db744
inc ecx
add ebx, ebx
jne 0x1413db72a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1413db744
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1413db73d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1413db72c
add ecx, 2
jmp 0x1413db749
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1413db672
jmp 0x1413db6bd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x13c5000]
mov eax, dword [rdi]
or eax, eax
je 0x1413db7bd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x141d0e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1413db76d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1413db7b7
mov qword [rbx], rax
add rbx, 8
jmp 0x1413db78d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1413db801
cmp al, 0xef
ja 0x1413db7e9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1413db7c9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1413db7d8
mov eax, dword [rdi]
add rdi, 4
jmp 0x1413db7d8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1413db880], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1413db880
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1413db870
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x14252daf6
Capabilities:
Authenticate hmac

Disassembly:
mov rsi, qword [r10 + rbp - 0x66af9a0c]
lea rdx, [rcx + rcx*8 - 0xa6ec4e4]
sal dx, cl
ror ecx, 0x76
mov rax, qword [rsi + rbp - 0x66af9a0c]
movsx esi, dl
mov qword [r10 + rsi*8], rax
or bp, si
rol bp, 0x2a
rol bp, 0x28
mov ebx, dword [rbp + r11 - 0x66af6836]
lea rdi, [rbp*4 + 0x7522481e]
xor ebx, r8d
mov qword [rsp + rbp - 0x66af6832], 0x3a819d9b
sar word [rsp + rsi + 5], 0xe7
lea ebx, [rbx + rbp + 0x46537253]
jb 0x1425390eb
sets byte [rsp + rbp - 0x66af6831]
not byte [rsp + rsi*4 + 2]
ror ebx, 1
inc ebx
push rcx
xadd dword [rsp + rbp - 0x66af682e], edi
shr bp, 0x27
neg ebx
xor ebx, 0x8321e5b5
xor dword [rsp + rbp - 0x66af00cd], 0x20b5383c
bswap ebx
mov qword [rsp + rbp - 0x66af00c8], r8
xor dword [rsp + rsi + 8], ebx
pop rsi
movzx r8d, sil
pop r8
movsxd rbx, ebx
add dil, 0x82
sbb rcx, rdi
call fcn.142567bfe
mov rdx, r10
mov eax, 0x732a31a0
call fcn.14253d4d6
mov esi, 0x850b9f0b
mov ebp, dword [r11 - 4]
lea rdi, [rsi*8 + 0x1c9034bc]
inc si
js 0x1425932bb
not rbx
sal di, 0x6f
xchg sil, bpl
inc cl
inc rbx
ror si, 0xa1
jo 0x14259d65f
mov ebp, 0xedabcf3c
jmp 0x14258155d
lea rax, [rsi + rsi*8 - 0x68514fc4]
xor dword [rsp + rsi], ecx
pop r8
shr dil, 0xa7
sbb rsi, rdi
lea rbx, [rdi + rax - 0x32db4f5b]
movsxd rcx, ecx
jo 0x14253f830
dec ebp
adc r9, rcx
sub edi, eax
shr esi, 0xe5
lea rdx, [rsi + 0x71388831]
adc rsi, r9
jmp rsi
ror ecx, 1
add ecx, 0xb1180f9b
push r8
jmp 0x14254fc2a
adc esi, esi
mov qword [r10 + rsi*2], rbp
lea r11, [r11 + rsi*8 - 4]
movsx edi, si
mov ecx, dword [r11 + rsi*2]
lea rbp, [rsi - 0x5360e3c1]
xor ecx, r8d
rol ecx, 1
bswap ecx
jmp 0x14256e60b
mov esi, dword [r10]
movzx ebx, bpl
mov eax, dword [r10 + rbx*2 - 0x74]
call fcn.14253bc8e
neg di
mov eax, dword [rbp + r10]
mov cl, byte [r10 + rbp + 4]
pop rdx
setns dl
shl qword [rsp + rbp*2 - 8], 0xc1
lea r10, [rbp + r10 + 2]
shld ebx, eax, cl
call fcn.14253b571
xor ebp, r8d
lea rcx, [rdi*8 - 0x2ee555d]
neg rsi
movzx edx, dil
bswap ebp
ror dil, 7
lea rax, [rdi + rdx*8 + 0x780a0a93]
inc rcx
neg ebp
rol cx, 0xaa
rol rsi, cl
not ebp
xchg edi, eax
adc edx, eax
lea ebp, [rdx + rbp - 0x4b0de84f]
setle sil
push r8
sbb al, dl
neg rdx
xor dword [rsp + rax - 0x44ed2deb], ebp
pop r8
xor si, dx
movsxd rbp, ebp
movzx ebx, al
rol rdx, 0xc2
add r9, rbp
rol rbx, cl
add al, sil
movzx eax, byte [rbx + r11 - 0x1d6005]
xor al, r8b
rol rbx, cl
add ecx, ecx
dec al
neg dx
xor al, 0x36
shr ebx, 0x5e
ror cl, 0xe7
dec al
xor di, si
sbb rdi, 0x16a6be82
xor al, 0xae
jmp 0x14259c0f3
call fcn.14259c77e
mov rcx, qword [r10]
mov esi, 0xf8006093
or si, 0xd831
mov ebp, esi
mov rbp, qword gs:[rcx]
sbb rsi, rsi
jle 0x142580029
Function at 0x14252efa1
Capabilities:
Authenticate hmac

Disassembly:
mov rsi, qword [rax + rdi - 0x62bcab]
mov qword [rsp + rdi*2 - 0xc57956], rdi
shl rbx, cl
xor rdx, 0xffffffffb3019190
lea r10, [rdi + r10 - 0x62bcb3]
sar rdi, cl
inc edi
jbe 0x1425577aa
lea rsi, [rsp + rsi + 0x18]
mov word [rbx + rsi], di
push rbp
mov qword [rsp + rbx*2], r9
ret 0x18
dec bl
add r9, rcx
sal rbx, 0x53
xchg rbx, rdi
bswap ebx
jmp r9
add edi, 0xb52ee837
call fcn.142577a72
xchg esi, edx
movsxd rcx, ecx
setns bpl
jne 0x14253ffd2
pop r8
movsxd rsi, esi
adc r9, rsi
push rdx
xchg rdx, rbx
mov r10, qword [rbx + r10]
pop rdi
jmp fcn.142588eba
dec cx
xor sil, r8b
dec sil
rol bp, cl
xor sil, 0x36
movzx ebx, cl
movzx edi, ax
dec sil
xor sil, 0xae
call fcn.142599e38
shl dil, 0x46
neg esi
neg edx
inc rdi
bswap edx
sar ebx, 0xb5
sbb edx, 0xf03c8314
xadd esi, eax
neg cl
xor edx, 0x9526d935
not bx
lea edx, [rcx + rdx - 0x639b39d]
inc rax
push r8
xor dword [rsp + rcx - 0xec], edx
rol bp, 0x49
not ebx
pop r8
lea rsi, [rbp*2 + 0x2f12c13e]
dec rdi
or rbx, rbx
movsxd rdx, edx
adc r9, rdx
xchg rbp, rax
dec rbp
cmovns rax, rbx
mov rax, qword [r10 + rcx*8 - 0x760]
mov bpl, byte [r10 + rcx*4 - 0x3a8]
or rsi, 0x4182e5b2
lea r10, [r10 + rcx*4 - 0x3a6]
and rbx, rdi
movzx edx, sil
not dx
mov byte es:[rax + rcx*8 - 0x760], bpl
shr rsi, 0x5f
movzx eax, dx
jmp r9
mov qword [r10 + rdi*8 - 8], rsi
lea r11, [r11 + rdi*8 - 0xc]
jae 0x142547138
xchg dword [rsp + rdi + 1], ebp
jbe 0x142561c2d
mov edi, dword [r11 + rbp - 0x62]
dec dx
push rbx
and qword [rsp + rbp*2 - 0xbb], rcx
xor edi, r8d
bswap edi
not edi
rol dword [rsp + rbp - 0x4e], 0xa8
lea rax, [rcx + rdx*2 - 0x234262ec]
jae 0x14258079b
sar ebp, 0x43
adc rbp, rdx
bswap ecx
mov esi, edx
shl ax, 9
lea ecx, [rcx + rax*8 + 0x5b95b539]
mov edi, eax
not ecx
shr si, 0xa8
jae 0x14259256e
neg edi
bswap rcx
jmp 0x14254267d
or qword [rsp + rbx + 0x18950984], rbx
not word [rsp + rdx + 0x4c5eff2d]
rol sil, 1
not ebx
inc cl
sal al, 0xc5
dec sil
inc rcx
rol rdx, 0xca
xor sil, 0x13
pop rdi
neg byte [rsp + rbx - 0x1895097c]
xor r8b, sil
xchg al, bpl
lea rsi, [rsp + rsi + 0x10]
jmp 0x14255d9fc
cmovs ebx, esi
dec cx
rol edx, 1
jmp 0x142555b44
dec ecx
push r8
sar rax, 0x14
xchg bpl, al
xor dword [rsp + rax - 0x11], ecx
and dx, 0x3e19
or rdx, rsi
movzx r8d, bp
pop r8
movsxd rcx, ecx
push rdx
adc r9, rcx
mov di, word [rax + r10 - 0x11]
or word [rsp + rax - 0x10], ax
lea rbx, [rax + rbp*2 + 0x7192a49f]
movzx ebx, byte [r11 + rax*8 - 0x8d]
mov ecx, eax
xor bpl, sil
add dword [rsp + rcx*2 - 0x22], 0xaeb5e030
xor bl, r8b
sal edx, cl
rol bl, 1
sar byte [rsp + rax*2 - 0x21], 0x61
xor dl, 0x12
not bl
lea rax, [rbp*2 - 0x6b6831f5]
xor dword [rsp + rcx*8 - 0x85], ecx
shl cx, 0x48
xor bl, 0xad
shl byte [rsp + rdx - 0x4c5e0011], 0xe5
and bpl, 0x22
neg bl
pop rcx
sub bl, 0xaa
not rdx
push rax
xor r8b, bl
shr dl, 3
lea rax, [rax - 0x397f4965]
lea rbx, [rsp + rbx + 8]
mov byte [rdx + rbx + 0x4c5e00e3], dil
movzx esi, byte [rdx + r11 + 0x4c5e00dd]
neg dx
push rbp
lea r11, [rdx + r11 + 0x4c5eff17]
push rcx
jle 0x142589654
xor sil, r8b
lea rbx, [rbp + rdx*2 - 0x606f316a]
xor sil, 0x1d
jmp 0x142582846
Function at 0x142531bc4
Capabilities:
Encode data using base64

Disassembly:
dec eax
pop rdi
xor eax, 0x80977cab
xchg bp, di
mov esi, ebx
ror eax, 1
not eax
sub sil, bpl
push r8
not ebx
xor dword [rsp + rdx - 0x5832379a], eax
pop r8
xor di, 0x2d07
movsxd rax, eax
adc r9, rax
not bpl
sar ebp, 0x6c
mov edi, dword [r10 + rbp - 0x47303]
and si, 0x8804
lea r10, [r10 + rbp - 0x472ff]
not dl
jne 0x142542f14
sub bpl, bpl
lea r11, [rbp + r11 - 0x47301]
movzx edx, byte [r11 + rbp - 0x47300]
xadd sil, bl
mov eax, ebp
xchg sil, al
xor dl, r8b
dec ebp
xor dl, bpl
shl rsi, 0x8a
shr eax, 0x21
sub dl, 0xb7
rol dl, 1
jmp 0x14257cbd9
mov edi, dword [r10 + 4]
push rbp
add r10, 4
mov qword [rsp + 8], rbx
not eax
and bl, bh
lea rcx, [rsi - 0x7879827d]
not edi
shr byte [rsp + rcx - 0x3588db7e], 0xe1
xor ecx, esi
and eax, edi
shl cl, cl
push rbp
mov dword [r10], eax
ja 0x142551348
mov edi, 0xd7b9841b
call fcn.14254df3b
mov eax, 0x43b1a2a8
lea rbp, [rax + rax*4 - 0xb4799ed]
mov ebx, 0x5832379a
lea r11, [r11 + rbx - 0x5832379e]
mov eax, dword [r11 + rbx - 0x5832379a]
mov edx, ebx
push rdx
xor eax, r8d
jmp 0x14252fe18
neg esi
sub dl, 0xc
and ebx, eax
jge 0x142532f60

Function at 0x142534546
Capabilities:
Authenticate hmac

Disassembly:
setns bpl
rol edi, 2
pop rdx
neg qword [rsp + rsi*2 - 0x6f]
sal bp, 0x81
mov qword [rsp + rsi - 0x30], r8
bswap rcx
js 0x142534836
xor dword [rsp + rsi - 0x30], edi
shr dword [rsp + rsi - 0x37], 0x51
rol dword [rsp + rsi - 0x37], 0xdf
and word [rsp + rsi - 0x38], 0xf0e
mov r8, qword [rsp + rsi - 0x30]
mov qword [rsp + rsi - 0x30], rcx
inc al
movsxd rdi, edi
jp 0x1425a0319

Function at 0x1425399df
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdx*2 - 0x4a04], 0xffffffffd2384219
call fcn.142574fa6
mov edx, 0xba3c0385
push rdx
add qword [rsp], rdx
mov rax, qword [r10]
and dx, word [rsp + 1]
movzx ebx, byte [r11 - 1]
lea rdi, [rdx + rdx*2 - 0x7af21e58]
setle dl
sbb qword [rsp], 0xffffffffc5851536
xor bl, r8b
sub bl, 0x19
jmp 0x142566287
movsx esi, byte [rsp]
not bl
jmp 0x14255531d

Function at 0x142539fc5
Capabilities:
Authenticate hmac

Disassembly:
call fcn.142569e7a
mov esi, 0x3729a731
mov ebx, esi
mov rbp, qword [rsi + r10 - 0x3729a731]
mov edx, dword [rsi + rbp - 0x3729a731]
mov dword [r10 + rbx*2 - 0x6e534e5e], edx
neg rbx
movzx ecx, si
jno 0x142577eb1

Function at 0x14253dc61
Capabilities:
Encode data using xor

Disassembly:
sub ebp, 0xccbd8d35
shl ax, 0x84
not ebp
push rdi
mov qword [rsp + rax*2 - 0x431860c8], r8
xor dword [rsp + rdi - 0xca96434], ebp
rol word [rsp + rdi - 0xca96447], 0xc5
jb 0x14253dc76
bswap rdi
mov r8, qword [rsp + rax - 0x218c3058]
dec ecx
Function at 0x14253e4d7
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
mov r8, qword [rsp + rax*2 + 0x18]
adc cx, di
xchg rsi, rcx
movsxd rbp, ebp
xadd dword [rsp + rcx - 0x11ffeb], edi
mov qword [rsp + rcx*2 - 0x23fffe], rax
adc r9, rbp
lea rbx, [rsi + 0x62039c9b]
pop rax
movzx edx, byte [r11 + rcx*2 - 0x240003]
sub bl, byte [rsp + rcx - 0x11fff6]
lea r11, [rcx + r11 - 0x120004]
xadd cl, bh
mov qword [rsp + rcx - 0x11ff91], rcx
add rsi, 0xffffffffaf03659c
xor dl, r8b
not dl
mov qword [rsp + rcx*4 - 0x47fe84], rcx
jmp 0x14254551b
sub dl, 0x96
and cx, 0x432d
movzx ebp, al
xor dl, 0xbe
not dword [rsp + rax*2 + 1]
neg dl
sal rsi, 0x28
xor dl, 0xf
sar eax, cl
jle 0x14254da50
mov ebp, 0x3902a00d
movzx ecx, bpl
lea rbx, [rbp + rbp*2 + 0x6d1d6e8a]
movzx eax, byte [r11 + rbp*2 - 0x7205401b]
call fcn.14253df2e
add ecx, 0xdb72a15
bswap ecx
xor r8w, si
sub dl, 0x1a
seta al
adc rsi, rsp
jmp 0x142557e50
lea rsi, [rsi*2 + 0x6da339b6]
xor r8b, dl
jmp 0x1425a3da5
mov word [rsi + rdx - 0xffc6], bx
xor rax, 0x30b24d19
lea r11, [rdi + r11 - 0x3b3bbc6d]
call fcn.142563066

Function at 0x14253f14d
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
rol eax, 1
mov qword [rsp + rdx - 0x19], rdx
call fcn.142569ac7

Function at 0x14254006d
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
dec dl
jmp 0x14259d45a
neg esi
rol esi, 2
neg esi
mov qword [rsp], rax
push rax
lea esi, [rsi + rax - 0x1719676d]
dec word [rsp + 1]
mov qword [rsp + 8], r8
jno 0x142569c72
mov esi, 0x69b70624
jmp 0x14256fad2
movzx ebx, ax
not dword [rsp + rbx*8 - 0x41ccc]
xor dword [rsp + rbx - 0x8392], esi
jmp 0x14255ffed
mov di, word [r10 + rsi - 0x69b70624]
movsx ecx, sil
movzx edx, byte [r11 + rcx*8 - 0x121]
movsx eax, cx
movsx ebp, sil
xadd eax, ebp
xor dl, r8b
jmp 0x142536f6e
Function at 0x142542cb8
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
rol dl, 0xc6
push r8
xor dword [rsp + rsi - 5], edi
shl bl, 0xe1
pop r8
setne cl
jp 0x142545087
push rbp
xor ebx, r8d
dec ebx
xor ebx, 0xd395c08f
mov ecx, dword [rsp + rdx*2 - 0x5c6cbd1d]
ror ebx, 1
mov dword [rsp + rdx - 0x2e365e8d], edx
jmp 0x14253c034
mov edi, dword [r11]
mov qword [rsp], rcx
xor edi, r8d
ror word [rsp + 4], 0x8f
movzx edx, cx
add dword [rsp + rdx - 0xd3b0], 0x3115d197
lea edi, [rdi + rdx*8 + 0x577ebe6f]
pop rdx
jg 0x14259d27d
jg 0x142555692
mov rbx, qword [r10]
mov rsi, qword [r10 + 8]
call fcn.14254eaab
movsxd rdi, edi
sub bx, cx
add rcx, rdx
adc r9, rdi
mov edx, dword [r10 + rsi*8 - 0x28]
mov eax, dword [r10 + rsi*4 - 0x10]
lea rbp, [rcx*4 - 0x1be97971]
mov esi, dword [r10 + rsi + 3]
sal bx, 0x21
and rcx, rcx
lea rdi, [rcx*2 - 0x38f1455c]
adc r10, 4
shl ebp, 0x6e
div esi
sar bp, cl
adc bl, bh
mov dword [r10 + rbp - 0x47d1ffff], edx
mov dword [r10 + rbp - 0x47d1fffb], eax
movzx eax, dil
lea rax, [rcx + rcx*4 + 0x8305c02]
mov esi, 0x9a2e5d37
jmp r9
jge 0x14253401d
call fcn.1425448ba
mov qword [r10 + rbx*2 - 0x717e1d12], rsi
rol edx, 0xf5
mov esi, dword [r11 + rcx - 0x38bf0e90]
push rbp
lea r11, [r11 + rbx*2 - 0x717e1d1e]
xor esi, r8d
call fcn.14256c3fd
mov esi, 0xcc129828
sub r11, 4
mov edx, dword [r11]
xor edx, r8d
movsx edi, sil
not sil
not esi
ror edx, 3
lea rbp, [rsi + rdi*8 + 0x380143b3]
push rdi
push rdi
bswap edx
lea rsi, [rbp*2 - 0xfe7de58]
lea edx, [rdx + rdi - 0x6e8f014a]
jmp 0x14254d1fe
lea rbx, [rcx*4 + 0x409a3b35]
ror edi, 1
add edi, 0x143fba90
movsx esi, bl
bswap edi
and dx, cx
jne 0x142532958
bswap edx
jmp r9

Function at 0x1425445c4
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa
Hash data using murmur3

Disassembly:
inc ecx
mov edx, 0x11a3d31c
xor bx, word [rsp + rdx - 0x11a3d2fd]
ror ecx, 2
movsx eax, sil
bswap ecx
dec al
sar eax, 0xe5
xadd rdi, rax
inc ecx
not ecx
lea rax, [rdi + rbp*2 + 0x158ccbbc]
dec rsi
dec bl
bswap ecx
mov qword [rsp + rsi - 0x191db6f3], r8
or sil, sil
jl 0x142573a65
adc dl, 0xbd
xor dword [rsp + rsi - 0x191db6f3], ecx
push rdi
mov r8, qword [rsp + rsi*4 - 0x6476dc3c]
sar bl, 0xa4
movsxd rcx, ecx
and eax, edx
adc r9, rcx
lea rbx, [r10 + rsi - 0x191db723]
mov rbp, rbx
rol eax, 0xab
mov qword [rsp + rsi*4 - 0x6476dc3c], 0x549c0fa8
mov rcx, qword [rbp + rsi - 0x191db71b]
rol di, 0x44
mov qword [r10 + rsi - 0x191db72b], rcx
push rax
lea r10, [r10 + rsi*2 - 0x323b6e46]
push rax
pop rcx
pop rax
pop rcx
pop rcx
pop rdx
pop rsi
pop rax
pop rcx
pop rdx
jb fcn.142588eba
Function at 0x142545bf4
Capabilities:
Authenticate hmac

Disassembly:
mov qword [r10 + rbp + 0xd38ffb0], rcx
mov rdx, qword [r11 + rbp + 0xd38ffa8]
xchg word [rsp + rbp*2 + 0x1a71ff71], bx
lea r11, [rbp + r11 + 0xd38ffa8]
rol bp, 0x64
call fcn.142591cb2
sal edi, 0x63
mov qword [rsp + rcx - 0x19a832be], rdx
add rdx, 0x7ba6ddaa
sbb bl, 0xc
xor r8b, bl
bswap ecx
jmp 0x14258b368
xor dword [rsp + rsi - 0x5011631b], ecx
pop r8
mov ebx, eax
sal bl, 0xc1
not dx
movsxd rcx, ecx
inc ax
or sil, sil
rol rdx, 0xca
adc r9, rcx
mov di, word [r10 + rbp*4 - 0x18c6c]
movsx ecx, bpl
lea r10, [r10 + rsi - 0x50116319]
bswap eax
sar dl, 0x43
setns cl
lea r11, [r11 + rbp - 0x631d]
jb 0x14253299a
jb 0x14254ad29
movzx esi, word [r11 + rsi - 0x5011631b]
call fcn.142593b6d
sal bp, cl
mov eax, dword [rsi + rdx - 0xaf8c]
sar qword [rsp + rsi*2 - 0x15f10], cl
lea rdx, [rcx*2 + 0x12b465a7]
mov dword [r10 + rsi*2 - 0x15f1a], eax
mov qword [rsp + rsi - 0xaf8c], rbp
lea r10, [r10 + rsi - 0xaf8e]
sar byte [rsp + rsi*2 - 0x15f0d], 0xc1
add di, cx
mov ebx, dword [r11 + rdi - 0x3333f300]
inc bp
neg qword [rsp + rsi - 0xaf85]
lea r11, [rsi + r11 - 0xaf91]
mov eax, 0x213d0eaa
jb 0x14257f8a7
movsx ebp, si
movzx ecx, si
mov ecx, dword [rbp + r11 - 0x631b]
xor ecx, r8d
rol dword [rsp + rbp - 0x6318], 0x32
lea rax, [rbp + rsi*8 + 0x360f7214]
neg ecx
inc ecx
dec rax
mov dword [rsp + rbp - 0x6317], eax
ror ecx, 1
not ecx
movzx edx, byte [rsp + rbp - 0x6318]
mov qword [rsp + rbp - 0x631b], r8
movsx edi, al
jmp 0x142536765
ror ebp, 1
dec ecx
not ebp
setl byte [rsp + rsi*4 + 4]
mov qword [rsp + rsi*4 + 0x10], r8
lea r8, [rdi*2 + 0x2aadb61c]
xadd rdi, rsi
xor dword [rsp + rcx - 0x6a3a1055], ebp
xadd dword [rsp + rcx - 0x6a3a105d], esi
mov r8, qword [rsp + rbx - 0xb432]
jb 0x142583c36
not ebx
add word [rsp + rsi - 0xaff0], 0x2587
shr si, 0x61
sal al, 7
neg ebx
call fcn.14253842c
sar sil, 0xa4
xor ebx, r8d
add edi, 0x5968514
jne 0x142564827
call fcn.142541e23
pop rdx
pop rdi
pop rsi
pop rbp
pop rbp
jb fcn.142588eba
xchg word [rsp + rcx - 0x6a3a105a], cx
movsxd rbp, ebp
movzx eax, sil
pop rax
add r9, rbp
lea rcx, [rdi*2 - 0x3d4690d5]
call fcn.142594b43
not eax
not dword [rsp + rbp + 0xd38ffc8]
movzx edx, cl
sal esi, cl
mov dword [rcx + r10 + 0x239c9d01], eax
pop rax
lea rcx, [r10 + rbp + 0xd38ffb8]
inc dl
jae 0x14256453f
jge 0x1425303be
Function at 0x14254640e
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
neg ecx
movsx ebx, sil
xor ecx, 0x8091b3b0
rol ecx, 2
push rax
mov qword [rsp + rdx*2 + 0x6de32f0], r8
and bx, word [rsp + rdx + 0x36f1975]
lea rbx, [rsi + rbx*4 - 0x7e62e46c]
xor dword [rsp + rdx + 0x36f1980], ecx
rol rdx, 0xba
mov r8, qword [rsp + 0x10]
sal si, 2
call fcn.142558bc1
bswap ecx
sar byte [rsp + rbx*4 - 0x278], 0x44
jp 0x142557962
ror ax, 0x23
adc bp, si
movsxd rcx, ecx
adc r9, rcx
push rdi
mov rsi, qword [r10 + rsi - 0x9f]
jmp 0x142583de7
dec bx
not al
shr rbp, 8
adc al, dl
dec dx
bswap edx
call fcn.14255420f
mov qword [rsp + rbx - 0x9f], r8
rol rdx, 0x62
xadd ebx, esi
xor dword [rsp + rsi*2 - 0x13e], ecx
rol eax, 0xd6
pop r8
jb 0x14254b460
movzx eax, byte [r11 + rdi - 0xa4]
lea r11, [rdi + r11 - 0xa4]
sar rdi, 0xbb
ror qword [rsp + rbp*2 - 0x5639e0d4], 9
xor al, r8b
sub al, 0x19
jmp 0x14254fe68

Function at 0x14254ecbf
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, dword [r11 + rsi - 0x41910ad8]
sbb edi, edi
xor ecx, r8d
and dil, bpl
lea rbx, [rbp + rdi + 0x18a31334]
not ecx
dec qword [rsp + rdi]
call fcn.142578e98
mov r11, qword [rsp + r14 - 0x791189f6]
call fcn.1425683e8
je fcn.142588eba
neg ebx
mov qword [rsp + rdi*4 + 8], rax
not ebx
not si
bswap ebx
inc sil
call fcn.14256060f
movzx ecx, word [rsp + rax*2 - 0x9414000]
rol edx, 2
call fcn.1425a1518
mov edx, 0xf68ecb97
movzx dx, byte [r10]
jmp 0x14258140d
mov ebp, ebx
mov edi, dword [r11 + rsi - 0x18020e]
lea r11, [rsi + r11 - 0x18020e]
movsx edx, al
jl 0x142543217
xor edi, r8d
not rcx
bswap edi
shr bpl, 0x26
ror ecx, 0xf7
lea edi, [rdi + rsi*4 + 0x5b369d15]
mov qword [rsp + rsi*8 - 0xc01048], 0x4224f788
not edi
pop rcx
ror ebx, cl
dec edi
push r8
dec rbp
sub dl, 0xb1
neg si
xor dword [rsp + rcx - 0x4224f788], edi
rol si, 0x2a
lea r8, [rdx*8 + 0xb02299c]
pop r8
not rdx
movsxd rdi, edi
jb 0x14257d28d
mov esi, 0x4191ad89
mov cl, byte [r10 + rsi - 0x4191ad87]
shr si, 0xc4
movzx edi, si
push rsi
lea r10, [r10 + rdi*2 - 0x15ae]
neg qword [rsp + rdi - 0xad8]
sal dl, cl
movsx ebp, sil
xchg qword [rsp + rdi - 0xad8], rbp
mov word [rdi + r10 - 0xad8], dx
neg word [rsp + rsi - 0x41910ad7]
ja 0x14253cfa8
lea r11, [r11 + rdi*2 - 0x15b4]
neg qword [rsp + rsi - 0x41910ad8]
or bp, bp
js 0x14252aa75

Function at 0x1425528ed
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [rdi + r10 - 0x1b]
add edx, 0x1c9c1330
add di, dx
sets byte [rsp + rdi - 0x2682]
cpuid
lea r10, [rdi + r10 - 0x26a1]
call fcn.1425393d6
Function at 0x14255382a
Capabilities:
Authenticate hmac

Disassembly:
sub r11, 4
mov edx, dword [r11]
mov ecx, 0x60902e12
xor edx, r8d
lea edx, [rcx + rdx + 0x4c72ac73]
mov qword [rsp + rcx - 0x60902e0a], rcx
pop rbp
ror edx, 1
inc edx
push rcx
neg edx
xor edx, 0x8321e5b5
add dword [rsp + rcx - 0x60902e08], 0xcbae2c95
ja 0x14259954e
sub r11, 4
mov ebx, 0xec87d4a2
mov eax, dword [r11]
mov ebp, ebx
movsx esi, bp
xor eax, r8d
call fcn.14255d529
bswap edx
lea rax, [rcx*2 - 0x105a1ccc]
mov qword [rsp + rcx - 0x60902e0a], r8
xor dword [rsp + rcx - 0x60902e0a], edx
movzx ebp, ax
not bpl
mov r8, qword [rsp + rbp - 0x3f9f]
push rcx
movsxd rdx, edx
add r9, rdx
xadd dword [rsp + rcx - 0x60902e0e], ebp

Function at 0x142554c87
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
mov rdi, qword [rsi + rcx*2 - 0x2df8]
sal ebp, cl
mov esi, ebp
rol bp, 0xa
mov rbx, rdi
shl bpl, 0xe1
sub rsi, rbp
mov rax, qword [r10 + rbp - 0x70000000]
mul rbx
ror bp, 0xcf
mov qword [r10 + rcx - 0x1704], rdx
jae 0x142555ce6
lea r10, [rbx + r10 - 0x18050ffd]
lea r11, [r11 + rbx*4 - 0x60144005]
xor ebx, r8d
shr si, 0xe7
movzx edx, sil
bswap ebx
neg ebx
movsx ecx, sil
xchg si, cx
inc cx
not ebx
shl dl, 1
movsx eax, dx
lea ebx, [rbx + rdx*2 - 0x620bcda]
lea rsi, [rbp + rbp*4 - 0x3348a880]
and esi, ecx
js 0x142531dd8
push r8
xor dword [rsp + rsi*4 - 0x48c], ebx
pop r8
xchg bpl, dl
movsxd rbx, ebx
add r9, rbx
push rcx
mov ebx, ecx
ror word [rsp + rsi - 0x120], 0x6b
lea r11, [rsi + r11 - 0x124]
mov dl, byte [r11 + rsi - 0x123]
sal eax, 0x7f
sal byte [rsp + rsi - 0x11f], 0xc5
cmovnp rax, qword [rsp + rsi*4 - 0x48c]
xor dl, r8b
rol bpl, 0x81
dec dl
shr al, 0xc2
xor dl, 0x36
lea rdi, [rbx*4 + 0x71baff8e]
dec dl
xor dl, 0xae
and al, 0x93
neg dil
xor r8b, dl
not qword [rsp + rsi - 0x123]
dec ebp
lea r10, [r10 + rsi - 0x125]
mov word [r10 + rsi*4 - 0x48c], dx
shr dil, 0x24
pop rbx
jae fcn.142588eba
mov r8d, 0x4e92ec8e
movsx esi, cl
xor dword [rsp + rcx*4 - 0x2c41c], edi
neg cl
lea rbx, [r8*2 - 0x4dd9cfd8]
pop r8
movsxd rdi, edi
movsx eax, bp
shr cx, 0xe3
adc r9, rdi
or rbp, rsi
jne 0x14255c351
pop rdi
xchg cl, sil
xor r8b, bpl
and eax, dword [rsp + rdx - 0x438a1084]
lea rbp, [rsp + rbp + 0x18]
ja 0x14255294b
or dword [rsp + rdx*2 - 0x5f], esi
xor eax, r8d
movzx ebx, bpl
neg eax
rol eax, 2
add edi, dword [rsp + rdx - 0x26]
shl dl, 0xe5
neg eax
and edx, dword [rsp + rdx - 0x1f]
sbb dword [rsp + rdx + 0xf], ebx
lea eax, [rax + rbp - 0x16dce3a2]
pop rdx
adc byte [rsp + rdi - 0xc7], 0xbd
push rdi
mov qword [rsp + rdi*2 - 0x18e], r8
not rbx
cmovae rbp, rsi
rol ebp, 0x9a
xor dword [rsp + rdi*2 - 0x18e], eax
not byte [rsp + rdi - 0xc1]
jmp 0x142592328
lea rsi, [rsp + rcx*2 - 0x2be6]
sal cl, 0xe2
jae 0x14252a836
lea rsi, [rbp + rbp*4 + 0xfb32f29]
jmp 0x14254c062
mov r8, qword [rsp + rdi - 0xbf]
inc dx
movsxd rax, eax
add r9, rax
shl dl, 0xa3
shr bp, 0xeb
add bx, dx
pop rbp
pop rsi
pop rcx
ja fcn.142588eba
xor edi, r8d
bswap edi
push rbx
not edi
neg edi
ror byte [rsp + rcx - 0xb106], cl
lea edi, [rdi + rbp + 0x2d039186]
neg bx
mov qword [rsp + rcx - 0xb107], r8
jno 0x14255081d