joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c4a8
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002c4b0
push rbx
sub rsp, 0x540
mov rax, qword [0x14004e988]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002c52d
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14002c54d
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002b7b0
add rsp, 0x540
pop rbx
ret

Function at 0x14002c4b0
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002c4b0
push rbx
sub rsp, 0x540
mov rax, qword [0x14004e988]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002c52d
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14002c54d
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002b7b0
add rsp, 0x540
pop rbx
ret
Function at 0x1413334f7
Capabilities:
Authenticate hmac

Disassembly:
mov cx, word [rsi]
mov qword [rsp], 0x358993b0
mov edi, 0x249b8f0a
lea rbp, [rdi + rdi*4 - 0x62fe24fe]
mov ax, word [rsi + rbp - 0x540ba632]
mov r10d, 0x72396422
lea rbp, [rbp + 0x71cdf3e]
add word [rsp + rbp - 0x5b28856e], di
imul cx
sal rdi, 0x4c
lea r8, [r10 + r10*8 + 0x38ad76a6]
lea r8, [r8 + rbp*4 + 0x1d896a07]
mov word [r10 + rsi - 0x72396422], dx
movsx ecx, r10b
shl word [rsp + r10 - 0x7239641d], 0x6e
jp 0x1413d7fb3

Function at 0x1413376b7
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions
Parse pe header

Disassembly:
movsx r10d, cx
btr eax, ebp
rdtsc
mov qword [rsp + rbp*2 - 0x5b70423c], rbp
btr r8d, ebp
lea rsi, [rbp + rsi - 0x2db82126]
sar dword [rsp + rdi + 0x52b90003], 0xd1
mov dword [rsi + rbp - 0x2db8211a], eax
sar rbp, 0x3b
inc cl
xadd r8w, r10w
mov dword [rsi + rbp], edx
lea rdx, [rcx + rcx - 0x39516754]
dec dword [rsp + rdi + 0x52b90004]
pop rax
jne fcn.141341236
movzx edx, cl
xor ebp, ebx
lea rdi, [rcx - 0x52ed254f]
ror ebp, 3
call fcn.14136fcce

Function at 0x141337bfc
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
xchg r8w, cx
xor bl, al
btr r8, rdx
lea rax, [rsp + rax + 0x20]
mov qword [rsp + rdi*2 - 0x49691b38], rcx
mov word [rax + rdi*2 - 0x49691b40], r10w
ror bpl, 0xa3
movzx edi, byte [rbp + r9 - 0x28000105]
lea r9, [r9 + rbp*2 - 0x50000204]
sbb dword [rsp + rbp - 0x280000ef], edx
shl bpl, 0x63
or dword [rsp + rbp - 0x280000f0], 0xaa21bb0f
xor dil, bl
xchg byte [rsp + rbp*2 - 0x500001df], r8b
not dil
movsx eax, cx
mov qword [rsp + rbp - 0x280000f8], rcx
add dil, 0xa7
movsx r10d, al
bswap r10d
and cl, r10b
xor dil, r10b
rol ax, 1
xor dil, 0xe
push rbp
or r8b, dl
rol dil, 1
add dil, r10b
push r8
xor bl, dil
jmp 0x14139a9fa
xadd dword [rsp + rcx - 0x5b6e57e0], edx
lea rdi, [rsp + rdi + 0x30]
ror al, 0xe2
movzx ax, byte [rdi + rdx - 0x6e57ef00]
jbe 0x141340c1f

Function at 0x14133d0ad
Capabilities:
Encode data using base64

Disassembly:
mov rbx, qword [rsp + rcx*2 + 0x1e]
mov qword [rsp + r10 - 0x5f200000], 0x4b000797
movsx eax, word [rsp + rcx + 4]
sub qword [rsp + rcx + 0x17], 0xffffffffd2922402
movsxd rbp, ebp
adc qword [rsp + r10 - 0x5f1ffffb], r8
adc r11, rbp
mov r8d, dword [r9 + r10 - 0x5f200008]
lea r9, [r9 + rcx*8 - 0x10]
neg dl
xor r8d, ebx
add r8d, ecx
shl dword [rsp + r10 - 0x5f1ffff9], 0x68
add ax, ax
xchg word [rsp + r10 - 0x5f1fffe5], dx
xor r8d, 0x47be7605
mov qword [rsp + rcx + 0x1f], rcx
neg r8d
xadd rcx, rax
bswap rdi
call fcn.141350529
Function at 0x141347f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, cl
mov qword [rsp + rcx - 0x79a0c694], r10
xor ebp, ebx
lea ebp, [rbp + r10*2 - 0x2f13e85f]
shl word [rsp + rcx - 0x79a0c68f], 0x41
neg ebp
dec dword [rsp + rcx - 0x79a0c691]
btc dx, 0x8a
inc ebp
mov word [rsp + rcx - 0x79a0c693], 0xf482
movzx edi, word [rsp + r10*2 - 0x18d24]
bswap ebp
mov r8d, r10d
movzx eax, byte [rsp + rcx - 0x79a0c691]
mov qword [rsp + r10 - 0xc694], rbx
imul r10d, ecx
sub cl, 0x17
xor dword [rsp + rdx*4 - 0x1250], ebp
not eax
ror r10b, 0xa2
pop rbx
cbw
sbb r10b, 0x1a
xor r8, rdi
movsxd rbp, ebp
btc dx, dx
add r11, rbp
call fcn.141365fb5
Function at 0x141347fc3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb eax, 0xdbb1b8b5
shr rdx, cl
bt dx, cx
xor rdi, qword [rsp + rdi + 0x44]
mov qword [rsp + r8*8 + 8], rbx
call fcn.14134de09
mov ebp, r8d
mov byte [r10 + rcx*2], al
mov eax, dword [rcx + r9 - 5]
rol dl, 0x45
sal rcx, 0xc6
lea r9, [rcx + r9 - 5]
btr bp, bp
shr bp, 1
xor eax, ebx
lea eax, [rdx + rax + 0x402251d0]
movzx r10d, cl
neg rbp
bswap eax
and r8w, r10w
sub r10, 0xfffffffff8929529
lea eax, [rax + rcx*8 + 0x13a66a9f]
neg eax
xadd ecx, ebp
sbb eax, 0xae09ce13
mov qword [rsp + rdi + 0x44], 0xffffffff9e25769a
xor eax, 0xcca70b1f
mov qword [rsp + rdi + 0x3c], 0x35326e31
bts dx, cx
neg eax
imul dx, r10w
sal r8, cl
dec edx
dec eax
ror r8b, cl
bswap ecx
jae 0x14136b4b0
bswap eax
sbb rbp, r10
xchg dword [rsp + rdi + 0x45], ebp
jne 0x141338709
mov ecx, 0x18bae27
lea r11, [rcx*2 - 0x737429e1]
add cl, r11b
mov r9, qword [r8 + rcx*4 - 0x62eba50]
mov r10d, ecx
mov edi, 0x228af38d
mov rax, qword [r8 + rcx*2 - 0x3175d20]
imul r9
sar cl, 0xc1
mov qword [r8 + rcx*2 - 0x3175d94], rdx
mov qword [r8 + rcx - 0x18baec2], rax
movsx edx, di
lea rbp, [rbp + rcx - 0x18baece]
movzx eax, dl
mov r9d, dword [rbp + rcx*2 - 0x3175d94]
shr edx, cl
xor r9d, ebx
bts rax, 0xa1
setae dil
not r9d
xor r11d, 0x7e2885b5
ror eax, 0xb2
inc r9d
or rdi, 0x40375c09
add r10w, 0x4212
add rax, 0x41b9dda5
bswap r9d
add di, 0xcca2
ror r9d, 2
sub eax, 0xb0ba8833
adc rdx, rax
lea r9d, [r9 + rax - 0x326e2dd7]
sub r10d, r11d
rol rdx, 0x67
rol r9d, 3
idiv edi
push rbx
shl ecx, cl
cwd
movsx ebx, r11b
xor dword [rsp + rcx*2 - 0x5d765000], r9d
add dl, 0xae
pop rbx
sub rax, rax
call fcn.1413c30a5
push 0x19318311
mov r11d, dword [rsp + 9]
add r8, 8
add dword [rsp + 8], r11d
sar byte [rsp + 4], 0xc2
adc word [rsp + 0xe], 0x7818
and rcx, rdi
mov qword [rsp + 0x10], 0x49086b00
not rcx
mov qword [r8 + riz], rcx
or qword [rsp + 8], 0xffffffffbd8d3094
sbb qword [rsp + 0x10], r11
sbb rbp, 3
rol qword [rsp + 7], 0xf4
sal dword [rsp + 0xa], 0x91
movzx ecx, r11w
mov r11d, dword [rbp + rcx - 0xb0b5]
movsx eax, word [rsp + rcx - 0xb0a3]
xor r11d, ebx
movzx r9d, cx
dec r11d
add rcx, qword [rsp + rcx*8 - 0x58598]
push r9
ror dword [rsp + rax - 0x4944], 0x67
xor r11d, 0x7883659d
lea r10, [rcx*4 + 0x398e6382]
ror r11d, 3
sar byte [rsp + rax - 0x494f], 1
movzx edx, cl
push rcx
dec r11d
mov qword [rsp + rax*2 - 0x9280], rbx
shr r9, 0xde
cdqe
xor dword [rsp + rax - 0x4930], r11d
btc eax, edx
mov rbx, qword [rsp + rax*2 - 0x9282]
movsxd r11, r11d
mov qword [rsp + rax*4 - 0x12524], 0xb0951b6
adc rsi, r11
mov qword [rsp + rax*2 - 0x92a2], rsi
ret 0x20
Function at 0x14134b5c6
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea rsi, [rsi + r8*4 - 0x52af3604]
mov qword [r8 + rax - 0x14abcd85], r10
lea r9, [r9 + r8*2 - 0x29579b0e]
mov edi, dword [r9 + r8*2 - 0x29579b0a]
movsx edx, bp
and dl, bpl
jp 0x14137d5dc
xor edi, ebx
add r8w, dx
movzx eax, bp
not edi
ror edi, 1
mov r10d, edx
not edi
add edx, r10d
cdq
cdqe
xor edi, 0x41ab7c87
cwde
neg r8w
lea rcx, [r8*2 + 0x4b35be89]
push rbx
jns 0x1413b3400
movsxd r9, r9d
add rsi, r9
movzx r11w, byte [r8 + rdx*4 - 0x5490]
xchg qword [rsp + rdx - 0x1520], rax
mov cl, byte [r8 + rdx*8 - 0xa91e]
pop rax
lea r8, [r8 + rdx*2 - 0x2a46]
bswap r10d
add r11b, cl
cqo
call fcn.1413915e5
xor dword [rsp + rdi*2 - 0xcdca], r9d
mov qword [rsp + rdi*8 - 0x33768], rdi
imul dword [rsp + rdi*2 - 0xcdda]
mov qword [rsp + rdx - 0x151c], 0x6632cea8
mov rbx, qword [rsp + rdx - 0x1514]
jo 0x1413c4f51
mov rax, qword [rsi]
mov r8d, 0x14abcd85
movzx ebp, r8b
mov r10, qword [rsi + r8*4 - 0x52af360c]
lea rdi, [rbp - 0x71c786e4]
jmp 0x1413240da
sal bp, 0xe
xor dword [rsp + rbp - 0x4000], edi
lea rbx, [rdx + rdx*2 + 0xb848d20]
pop rbx
sub eax, r10d
movsxd rdi, edi
cqo
dec r10d
call fcn.14136bf80
jo 0x14132e254
Function at 0x14134fff1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movzx r9d, byte [rbp + rax*2 - 5]
lea rbp, [rax + rbp - 5]
xor r9b, bl
call fcn.1413d810b
mul r10
movsx edi, ax
movsxd r9, r9d
shr r10d, 0xf0
mov qword [rsp + rdx*2 + 8], 0xffffffffaf3d4d91
adc rsi, r9
shl word [rsp + rdx + 0xa], 0x2f
rol word [rsp + rdx*4 + 5], 0xe4
mul eax
mov edx, dword [rdx + r8 - 0x1006a5]
not r10d
shr dword [rsp + rax*8 - 0x3a6d318], 0x3d
sub r11, 0xffffffffa99fab2d
lea r8, [r8 + rax - 0x74da60]
jl 0x141383fa6
seta byte [rsp + rax - 0x74da5c]
lea rbp, [rax + rbp - 0x74da65]
and r10d, 0x8d89ca0f
xchg word [rsp + rax - 0x74da61], r10w
and r10w, word [rsp + rax*2 - 0xe9b4c2]
movzx r11d, byte [rbp + r11 - 0x5660555d]
bts rax, 0x81
xor r11b, bl
lea r9, [rax + rax - 0x4acc8b72]
sub r11b, 0xb7
not byte [rsp + rax - 0x74da5b]
ror r11b, 1
not rdi
xchg byte [rsp + rax - 0x74da63], ah
cbw
xor r11b, 4
jmp 0x1413c29d3
mov qword [rsp + rcx], rdi
xor r11b, 0xb5
mul al
sbb r11b, 0xc
neg r11b
add ax, 0x553c
and dword [rsp + rdi - 0x4b8a5ffc], r10d
lea rsi, [rdi + rcx + 0x193abf14]
inc r11b
sub rcx, rcx
xchg word [rsp + rsi - 0x64c51f0e], r10w
xor r11b, 0xaa
sub rdi, 0xffffffffc0830097
mov ebp, dword [rsp + rcx + 1]
neg r11b
or bpl, byte [rsp + rcx*8 + 6]
not r11b
push rdi
xor r11b, 0xaf
rol ecx, 0xfc
jae 0x141384afe
xor ecx, 0x1a365424
mov eax, 0xde97658a
movzx r10d, ax
movsx r9d, r10b
push rbx
push r10
movsx edi, word [rsp + r10*2 - 0xcb14]
xor dword [rsp + rdi*2 - 0xcb0c], ecx
pop r10
pop rbx
movsxd rcx, ecx
btr eax, 0x34
sar rax, 0x29
lea r11, [r10 + r9*8 - 0x60fbef7b]
adc rsi, rcx
mov edx, dword [r8 + rax*4]
jmp 0x141339514
inc r11b
cdq
xor r11b, 0x9f
lea rdx, [rbp*8 - 0x77f3d858]
inc word [rsp + rcx + 4]
dec rbp
dec r11b
shr al, 0x41
jge 0x14134bb49
ror r11b, 1
mul ebp
xor bl, r11b
lea r11, [rsp + r11 + 0x10]
not cl
shr bp, 0xe1
mov rdx, qword [r11 + rax - 0x6894730]
mov r10, rdx
and cl, bpl
imul rbp
mov r9, r10
pop rdx
and rdi, rcx
xchg word [rsp + rdi*2 - 0x3e], bp
mov rsi, r8
shl bp, 0x88
sar rdi, 0xb3
pop rax
jp 0x14132931d
bswap r10d
mov ecx, 0x5a86a50c
sub rcx, rcx
rol r10d, 2
jmp 0x1413ebd62
add r11b, 0xbc
xor bl, r11b
pop rax
sar al, 0x62
neg edi
lea r11, [rsp + r11 + 8]
pop rcx
push r10
or r9b, byte [rsp + r9 + 0x49e2d6ab]
mov dword [r11 + rcx*2 + 0x2000000], edx
inc ecx
lea rcx, [rdi*2 - 0x3bc3876b]
mov qword [rsp + r9 + 0x49e2d6a6], rsi
ret
bswap r10d
lea r9, [r11*2 + 0x3aa1fca3]
neg r10d
mov edi, r11d
call fcn.1413ae19c

Function at 0x141359069
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r8 - 0x9cff], 0x67a02a21
xor dword [rsp + r8*2 - 0x139f6], edi
xadd dword [rsp + r8*4 - 0x273fa], ebp
mov rbx, qword [rsp + r8 - 0x9cf7]
cdqe
mov qword [rsp + r8 - 0x9cf7], rax
movsxd rdi, edi
ja 0x1413ea9ad
Function at 0x14135cc24
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
sal ecx, cl
bswap r9
xor r9, 0x31b5350e
call fcn.1413b7e3c
ror ax, 0x8e
mov r9d, dword [rbp + riz]
xor r9d, ebx
mov qword [rsp + 0x10], rax
mov ecx, dword [rsp + 0xf]
lea rdx, [rcx + rcx*2 - 0x7568745b]
dec r9d
sal eax, cl
sbb dl, 0xa1
inc rax
rol r9d, 1
not r9d
pop rdx
add r9d, eax
bswap r9d
ror qword [rsp + rax*2 + 4], 0x95
adc cl, byte [rsp + rax*2 + 9]
pop rdx
lea r9d, [r9 + rdx*8 - 0x5ddac7f5]
adc rdx, rax
mov qword [rsp + rax*2 - 2], rbx
xor dword [rsp + rax - 1], r9d
bts rdi, 0x22
mov ebx, edx
inc al
pop rbx
movsxd r9, r9d
jae 0x1413702c8

Function at 0x14135cc9d
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
push r10
neg ecx
cdqe
bswap ecx
or r11w, 0xb894
rol dl, 0xc6
dec eax
adc qword [rsp + r9*8], rbx
and eax, 0xebb7f589
sal r10b, 0xa7
shr r9d, 0xd5
xor dword [rsp + r9], ecx
pop rbx
imul r11d, r10d
sar dil, 0x44
jbe 0x141392868
call fcn.1413d3ec1
imul dx
lea r9, [r8 + r9 - 0x34]
xor r10d, ebx
dec r10d
movsx ebp, cx
not r10d
lea r10d, [r10 + r8 + 0x29866756]
xor r10d, 0x8828c622
call fcn.14137be1b
mov r10, qword [r8]
mov r9d, 0x3a9701d
mov rdi, qword [r9 + r8 - 0x3a97015]
sub r9b, r9b
adc r10, rdi
sal r9w, 2
mov r11d, r9d
movsx eax, r9b
mov qword [r8 + r9 - 0x3a9bff8], r10
push rax
mov edi, dword [rsp + r9 - 0x3a9bffd]
mov ecx, dword [r9 + rbp - 0x3a9c004]
xadd dil, r9b
bswap r9d
lea rbp, [rbp + r9*8 - 0x605481c]
movzx r10d, al
movsx edx, word [rsp + r9*4 - 0x302a408]
sub di, ax
xor ecx, ebx
inc r9
lea ecx, [rcx + r9 - 0x3a581816]
mul word [rsp + r9 - 0xc0a8fe]
sal ax, 0xe5
bswap ecx
pop r9
imul ax, dx
not ecx
jno 0x1413530ad
add rax, r9
rol ecx, 1
or rdx, rax
xor r11, 0xffffffffad01ce0f
not ecx
jne 0x1413240a3
test ebx, ebx
jmp 0x1413312a5
Function at 0x141369d12
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea rsp, [rsp + 0x28]
jbe 0x141369d36
mov eax, 0x8db6d901
lea rdx, [rax + rax*4 + 0x1890869a]
movsx ecx, ax
mov edx, 4
lea ecx, [rbx + riz - 4]
mov eax, 0x2d3657b3
push rax
shl ecx, 3
shr rax, 0x18
shl edx, 3
xor eax, 0x7227732b
ja 0x141337947
mov ebp, 0x9ab9fc90
movzx ecx, bpl
lea r9, [r9 + rcx*2 - 0x124]
mov edi, 0x69a31500
or rbp, 0x2c8bec07
mov r8d, dword [rcx + r9 - 0x90]
lea rcx, [rcx*4 - 0x7a688ad4]
movzx edx, cl
or rdx, 0xffffffffe710703e
xor r8d, ebx
xadd edi, edx
rol r8d, 1
ror dil, 0xc5
sal bpl, 0xa3
xadd cx, di
inc r8d
rol r8d, 3
movsx eax, dx
cdqe
xadd ebp, edx
not r8d
push rbx
rol rcx, 0x32
mov r10d, ecx
xor dword [rsp + rbp*2 - 0x50be2370], r8d
pop rbx
btr edi, eax
setb dl
movsxd r8, r8d
jae 0x1413d0e55
mov byte [rcx + r11 - 0x7b3dd420], dil
movzx edi, dl
mul r11d
push r10
mov edi, dword [rbp + rdx - 0x7b0b7b4a]
dec r10b
neg byte [rsp + rdx - 0x7b0b7b41]
lea rbp, [rbp + rdx - 0x7b0b7b4a]
xor edi, ebx
dec r11
sal word [rsp + rdx - 0x7b0b7b3f], 0xcb
not edi
movzx ecx, byte [rsp + rdx - 0x7b0b7b43]
cdqe
lea edi, [rdi + rcx - 0x47ab3723]
inc byte [rsp + rax + 0x1ff24840]
shr dword [rsp + rdx - 0x7b0b7b45], cl
bswap edi
xor edi, 0x7c30cf89
neg edi
xadd edx, ecx
adc r11, rcx
mov qword [rsp + rax*4 + 0x7fc92100], rbx
dec cl
and r9w, dx
ror r10w, 0xef
xor dword [rsp + rdx - 0x7b0b7bcb], edi
dec r10w
shl rcx, 0xce
push rax
mov rbx, qword [rsp + rdx - 0x7b0b7bc3]
xor cl, ah
jp 0x14137c4f8

Function at 0x141380aa6
Capabilities:
Encode data using base64

Disassembly:
jmp 0x14139e70a
lea rsp, [rsp + 0x10]
jne 0x1413c67c8
Function at 0x1413853fe
Capabilities:
Authenticate hmac

Disassembly:
mov edi, 0x388d1e1e
mov qword [rsp + rdi*2 - 0x711a3c3c], rdi
movzx eax, byte [rbp + rdi*2 - 0x711a3c3d]
lea rcx, [rdi - 0x568cdc]
xor al, bl
sal dword [rsp + rdi - 0x388d1e1d], cl
xor al, 0x92
btr ecx, 0x27
ror al, 1
or word [rsp + rcx - 0x3836913e], di
inc al
movzx r10d, word [rsp + rdi - 0x388d1e1c]
xchg dword [rsp + rdi - 0x388d1e1c], edi
xor al, 0x2e
movsx r11d, r10w
sal ecx, 0x21
xor bl, al
dec dword [rsp + rdi - 0x1e1ee233]
lea r9, [r11*4 + 0x771d7994]
xor r11w, 0xf112
lea rax, [rsp + rax + 8]
ja 0x141389aa4
mov edx, dword [rdi + rax - 0x1e1ee234]
dec r11b
mov dword [r8 + rdi - 0x1e1ee238], edx
movzx edx, word [rsp + rdi*2 - 0x3c3dc468]
mov eax, edi
mov ecx, dword [rbp + rdi*2 - 0x3c3dc46d]
sar r10, 0x3b
lea rbp, [rdi + rbp - 0x1e1ee239]
not word [rsp + rdi*2 - 0x3c3dc464]
shl ax, 0x85
xor ecx, ebx
push rax
mul r9d
ror ecx, 2
dec ecx
xor di, 0x29b2
lea r11, [r10 + rdx - 0x234ba7e0]
sar dword [rsp + rdi - 0x1e1ecb7b], 0x7a
ror ecx, 2
not qword [rsp + rdi - 0x1e1ecb80]
btr dx, 0xa6
lea ecx, [rcx + rdi*8 - 0x2e5e65ff]
neg ecx
pop r9
sar ax, 0xca
not ecx
cwd
sete r11b
mov qword [rsp + r10*2], rbx
dec rdx
shl dx, 1
xor dword [rsp + rdi - 0x1e1ecb86], ecx
xadd edx, edi
movsx ebx, dl
add r11d, 0x2f2298aa
pop rbx
sal dl, 0x82
and r10d, r11d
xchg r11d, eax
movsxd rcx, ecx
adc rsi, rcx
mov eax, dword [r8 + rdi*2 - 0x1c07fffc]
shl dl, 0x41
mov ecx, dword [r8 + rdi*2 - 0x1c07fff8]
add dl, dil
push rbx
cpuid
mov dword [r8 + rdi*2 - 0x1c07fff8], eax
mov dword [r8 + rdi*4 - 0x380ffff4], ebx
add r11, rdi
mov dword [r8 + rdi*4 - 0x380ffff8], ecx
mov ebx, r10d
call fcn.1413eb1cc

Function at 0x1413871f0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey

Disassembly:
rol r9d, 3
neg r9d
call fcn.1413bc8b0
call fcn.1413754da
mov edx, 0x87bf660b
shl dx, 0xe1
movsx eax, dx
mov rdx, r8
lea r9, [rax - 0x3b6426c1]
jge 0x1413c4b2a
mov dword [r8 + riz - 4], edx
and al, al
mov edx, dword [rbp + riz - 4]
lea rax, [rax*8 + 0x490b3335]
movzx r11d, r9b
cbw
xor edx, ebx
movsx r10d, r11b
lea rcx, [r11 + r11*4 - 0xa5ace77]
not edx
and r11, 0x7c99e6b2
dec edx
lea rdi, [r11 + rcx*2 - 0x30f6d8f1]
btc rdi, rax
xor edx, 0x6b209533
rol r11d, 0xac
sal cx, 0x85
sal r10b, 0xe4
dec edx
sal r9b, 0xe3
and r11d, r10d
bt r9d, 0x18
xor edx, 0x5c15f606
shl di, 0x44
push rbx
xor dword [rsp + r11*4], edx
mov ebx, eax
inc rbx
call fcn.141389035
lea r9d, [r9 + rcx*4 + 0x21782f55]
rol eax, 0x21
ror al, 0x87
not r9d
lea rdx, [rdi + r10*4 + 0x2bb1da30]
adc r11d, edx
jp 0x141352eab
Function at 0x14138812f
Capabilities:
Authenticate hmac

Disassembly:
or r9b, al
call fcn.1413c5802
lea ecx, [rcx + rdi - 0x35b35432]
jae 0x14137b020
pop rbx
and dil, cl
cdqe
inc ecx
movsxd r11, r11d
bt dx, cx
mov r9d, ecx
neg eax
add rsi, r11
mov rax, qword [rbp + rdi - 0xc]
shr rcx, 0x7a
sub rdx, rdi
neg edi
xor rax, rbx
mov r11d, edi
shr rcx, 0x58
bswap rax
xor r10, r9
ror rax, 6
rol rcx, 0x91
neg rax
inc r9
sal r10b, 0xc7
lea rax, [rax + rdi*8 - 0x4e1b271f]
btr r11, r9
sal r9, 0x5e
setb cl
xor rbx, rax
call fcn.1413b18c0
ror dx, 0xf
call fcn.1413995db
mov ebp, 0xc8aa7205
sub r9, 4
lea rbp, [rbp + rbp*4 - 0x55f62776]
lea rcx, [rbp + rbp + 0x20338037]
movsx edx, bpl
mov ebp, dword [r9 + riz]
lea r8, [rcx + rcx*2 - 0x6662b267]
movzx edi, dx
xor ebp, ebx
lea ebp, [rdx + rbp - 0x784b017d]
rol ebp, 2
call fcn.14139cbe2
sub byte [rsp + rax + 3], al
cwde
mov word [rsi + rbp*8 - 0xc400], r8w
cwd
sub word [rsp + rax*4], cx
mul dword [rsp + rax*2]
mov ebp, dword [r9 + rax*4 - 5]
idiv word [rsp + rax]
lea r9, [r9 + rax - 5]
mov r8d, 0x7e35e732
call fcn.14135e91d
jne 0x141389bc3
mov rax, qword [rbp + riz]
sub rsp, 0x20
push 0xffffffff9a19992f
call fcn.14133d11f
xor bl, bpl
lea rbp, [rsp + rbp + 0x10]
mov dword [rbp + r10 - 0x40070], edi
mov edi, 0x633918b3
ror cl, 0x81
lea r9, [r9 + rax*4 - 0x404]
mov r8d, dword [r9 + rax - 0x100]
pop r10
xor r8d, ebx
xor r8d, 0x69b23816
cdq
movzx ebp, di
bswap r8d
btc rdx, rbp
lea r10, [rax*4 - 0x5778c4f4]
inc rdx
sbb r8d, edx
xchg word [rsp + rax - 0xfe], ax
shl rcx, 0x53
jne 0x14132bc77
rol r8d, 1
call fcn.14133f10f
jmp rsi
jmp 0x14134452b
call fcn.141377699
push r9
shl r10d, 0x46
xor ecx, 0xa09bc332
dec rax
dec rax
not ecx
shl eax, 0xe7
sbb r10d, eax
imul al
mov qword [rsp + r10*2 - 0x7dc1280], rbx
xor dword [rsp + r10*2 - 0x7dc1280], ecx
bt r10w, di
xchg r9, r10
pop rbx
movsxd rcx, ecx
adc rsi, rcx
movzx r11d, r9b
movsx ecx, dx
xadd edx, ecx
mov r11, qword [r9 + r8 - 0x3ee0940]
mov rdi, qword [r10 + r11 - 0x53a16938]
lea r11, [r10 - 0x717fa37c]
xor r11, 0x30a94719
mov qword [r10 + r8 - 0x53a16938], rdi
movzx edi, dl
ror rcx, cl
jne 0x141356f84
push 0xffffffffddb2e92f
jmp 0x14138ae4c
mov qword [rsi + rbp*4 + 8], r10
jae 0x14132f702
neg rbx
mov rbx, qword [rsp + rax - 0x3fff7]
rol word [rsp + rax*4 - 0xffffb], 0xaf
mov ecx, 0x2fa8678b
movsxd r8, r8d
add r11, r8
mov bp, word [rax + rsi - 0x3ffff]
lea rsi, [rax + rsi - 0x3fffd]
and rdi, 0x5e9789b0
lea r9, [r9 + rax*2 - 0x80000]
mov r10w, word [r9 + rax*4 - 0xffffc]
inc di
xor r10w, bx
sub r10w, ax
bts cx, di
call fcn.1413a6ba6
jmp 0x1413d4c63
mov eax, 0x2c9559b8
sub eax, eax
or rax, qword [rbp + rbx*8]
jmp 0x141361740
mov dword [rsp + 1], 0xff328784
sub r9, 4
pop r8
call fcn.1413ad3c5
movsx ecx, al
lea rsi, [rsi + rbp*2 - 0x28bd152]
or ebp, edi
inc dil
sub ecx, ebp
jmp r11
call fcn.141398e63
dec ebx
jmp 0x14135ff01
push 0xffffffffe70f8120
neg byte [rsp + 1]
cmp ebx, 2
push 0x569605a9
push 0xffffffffcd915c07
lea rsp, [rsp + 0x18]
jne 0x14138eb98
mov rdx, rax
jmp 0x1413b9aac
Function at 0x141389b8f
Capabilities:
Authenticate hmac

Disassembly:
adc dword [rsp + rdi + 0xe], 0x9fa262a8
bts r9, 8
lea r8, [r8 + rdi - 8]
shl dil, 0xc6
mov dword [rdi + r8 + 0xc], eax
neg qword [rsp + rdi + 0x16]
pop rdi
jne 0x1413e1085
mov dword [r8 + r10 - 0x69a044b2], ebx
call fcn.14137fb87
movzx ecx, word [rsp + rbp - 0x2a81f425]
neg eax
not eax
shr ebp, 6
movsx r8d, r10w
mov qword [rsp + rbp - 0xaa07d0], rbx
imul r10w, cx
bts r10, rcx
xor dword [rsp + rbp*8 - 0x5503e80], eax
pop rbx
movsxd rax, eax
shl bpl, 0xa5
sub r10, r8
shr bp, 1
adc r11, rax
bt rbp, r8
sal ebp, 0xb0
mov esi, dword [rsi + rbp - 0x3800000]
jae fcn.141341236

Function at 0x1413921de
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jmp 0x1413ba7c9
Function at 0x1413abed5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r9*2 - 0x549b6154], r8
mov ecx, 0xe635ffa5
push rbx
call fcn.1413ec515

Function at 0x1413b378c
Capabilities:
Encode data using base64

Disassembly:
xor rcx, r11
jmp rcx
mov qword [rsp], 0x1996fe35
dec r9d
call fcn.14132fff1
mov r9d, 0x508bc629
movzx r11d, r9b
mov rdx, qword [r8 + r9 - 0x508bc629]
movzx r10d, r9b
sub r10w, r11w
lea rax, [r9*4 - 0x685b4b64]
lea r8, [r11 + r8 - 0x21]
jne 0x141332f36
push rax
jae 0x141356195
mov r10d, 0x259ed937
movsx edx, r10w
mov rbp, qword [rsi + r10 - 0x259ed937]
rol rdx, 0x17
movzx eax, r10w
movzx r8d, dx
mov ecx, dword [rsi + rax - 0xd92f]
and r10b, dl
lea rsi, [rsi + r10*2 - 0x4b3db1f4]
sub r10, 0x21818e16
mov edi, eax
sub r10b, r8b
mov dword [rbp + r10*4 - 0x10752ba8], ecx
movzx ecx, r8w
lea r9, [r9 + r10 - 0x41d4aee]
mov edi, dword [r9 + r10 - 0x41d4aea]
sub ax, r10w
xor edi, ebx
cwde
inc edi
push rax
pop r10
lea rbp, [rcx*2 + 0x57b32b34]
rol edi, 2
and ax, bp
sub rbp, rdx
not edi
ror edi, 2
push rbx
xor dword [rsp + r8*4], edi
add r10w, ax
movsx ebx, al
pop rbx
xchg rdx, rbp
div dl
bt edx, ebp
movsxd rdi, edi
not ebp
neg ax
not r8w
add r11, rdi
jmp 0x1413615f8

Function at 0x1413b88af
Capabilities:
Authenticate hmac

Disassembly:
shl dword [rsp + 4], 0x96
adc r8, 8
div r9
mov r9d, 0xa83b5210
mov qword [r8 + riz], rdx
mov qword [r8 + riz + 8], rax
lea rax, [r9*8 - 0x65760d5f]
sub rbp, 4
inc byte [rsp + 3]
mov edx, dword [rbp + riz]
mov ecx, r9d
xor edx, ebx
movzx r10d, word [rsp + 4]
lea rcx, [rcx + r10 - 0x5f48bf53]
btc eax, r9d
not edx
ror eax, cl
neg al
mov r11d, ecx
sbb edx, 0xfabe56ae
shr cx, 0x84
xor edx, 0xd4866619
mov edi, r11d
not edx
inc r10
ror cx, cl
mov qword [rsp + r10 - 1], rbx
xor dword [rsp + rcx - 0x48f22561], edx
ror rcx, 0x2d
mov ebx, eax
neg r10d
pop rbx
movsxd rdx, edx
xadd rax, r9
xchg r11d, eax
or rdi, 0xffffffffb024040c
adc rsi, rdx
dec r9b
setge r9b
xchg di, r11w
jmp rsi
mov qword [rsp], 0xffffffffdc277333
neg qword [rsp]
mov r9, qword [r8 + 0x10]
jbe 0x1413316cb
mov edi, 0xc31d439f
movsx r11d, di
lea rbp, [rbp + r11*8 - 0x21cfc]
mov ecx, r11d
movzx eax, r11w
mov ecx, dword [rbp + r11 - 0x439f]
xor ecx, ebx
lea rdi, [rax + rdi - 0x14dec2d9]
not rax
mul rdi
xor ecx, 0x99b243ba
bswap ecx
inc ecx
jmp 0x1413c2aaf
movsx r10d, r11w
and dx, r11w
not ecx
movzx r9d, r11w
lea ecx, [r11 + rcx - 0x3a3853d0]
idiv r10b
ror ecx, 2
push rbx
rol r11b, 0xe4
div rdi
xor dword [rsp + r11*2 - 0x87f2], ecx
pop rbx
imul di, ax
btr dx, dx
jb fcn.1413b3b40
movsxd rcx, ecx
neg r10
adc al, al
adc rsi, rcx
bt dx, dx
mov r11d, dword [r10 + r8 + 0x439f]
jae 0x14134cd7e