joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459e23
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call sym.runtime._traceMap_.put
nop
test bl, bl
je 0x459e1d
mov qword [rsp + 0x18], rax
lea rcx, [sym.runtime._traceStringTable_.put.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a5f80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime._traceStringTable_.put

Function at 0x4647c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x464937
movzx edx, byte [rax]
test edx, edx
jne 0x4647f4
nop dword [rax]
test r8b, r8b
jne 0x4647f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x464807
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4648f7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4648e5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4648d7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46485d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4648a0
mov eax, 1
cmp rax, rbx
ja 0x46488b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4648cf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x464893
mov rcx, r11
mov eax, r12d
jmp 0x464862
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46492d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4648f0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46480d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x465dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465e6f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a5f80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x4692c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a5d68], 0
je 0x4692ce
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x4692e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a5d68], 0
je 0x4692f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x469300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a5d68], 0
je 0x469335
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005a6320]
aesenc xmm0, xmmword [0x005a6330]
aesenc xmm0, xmmword [0x005a6340]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x469340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005a5d68], 0
je 0x469376
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005a6320]
aesenc xmm0, xmmword [0x005a6330]
aesenc xmm0, xmmword [0x005a6340]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback
Function at 0x46a9c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x005a5f80]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x46aa5b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x46ac80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x005a5f80]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x46ad17
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x46b0e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46b114
mov rcx, 0x28
jmp 0x46b11f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005a5f80], rcx
pop rbp
ret

Function at 0x471d80
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4724bf
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x471dad
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x472031
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x47205d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x004b11a0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x0047ea80]
lea rbx, [0x004b0620]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x472082
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4720b7
lea rdi, [0x0047eb00]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x471da3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x47209b
jmp 0x472070
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x472660
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x472677
inc rax
cmp rax, 4
jge 0x47268f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x472674
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4726a0
inc rax
cmp rax, 4
jge 0x4726ae
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4726d7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4726bb
jmp 0x47269d
Function at 0x476420
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4764ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005a5f80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4764cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0047eb80]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4764be
mov edi, 1
lea rsi, [0x0047eb80]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004b0688]
lea rsi, [0x004b0358]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x1802f4dff
Capabilities:
Parse pe header

Disassembly:
bswap r9d
xor bp, 0x8410
inc al
lea r9d, [r9 + rbx - 0x710b9027]
mov qword [rsp + rbx*4 - 0x5337fff8], r11
xor dword [rsp + rbx - 0x14cdfff8], r9d
sar ebp, 0xde
mov r11, qword [rsp + rbx*2 - 0x299bfff8]
movsxd r9, r9d
mov qword [rsp + rbx*4 - 0x53380000], rbx
add r8, r9
mov dx, word [rsi + rbx - 0x14cdfffc]
mov cl, byte [rsi + rbx*2 - 0x299bfffa]
push rdi
and al, ah
shr dx, cl
call fcn.18031ad66
and ebp, edx
jmp 0x180304c60
shl di, 0x4f
jne 0x18035fc4a
mov r9, qword [rsi]
mov ebx, 0xbb320930
sub bx, bx
movsx edi, bl
mov rbx, qword [rsi + rdi*2 + 8]
je 0x180318baf
lea rcx, [rdi + rdi - 0x6fc68dd5]
xor di, cx
adc r9, rbx
add cl, dil
lea rax, [rcx + rdi - 0x443dd46]
mov qword [rsi + rdi*2 - 0xe44e], r9
movzx r9d, al
mov ebx, dword [rdi + r10 - 0x722f]
mov edx, 0xc4097ba1
lea r10, [rdi + r10 - 0x722f]
xor ebx, r11d
bswap ebx
not edx
or edx, edx
rol ebx, 2
bswap ebx
dec r9
lea r9, [rdi + rdi + 0x4f8f92b0]
or rax, rdi
lea ebx, [rax + rbx - 0x1589f4f4]
or r9w, di
push r11
mov r11d, 0xfc2f9c33
xor dword [rsp + rdi*2 - 0xe456], ebx
pop r11
sal rdx, 0x37
movzx ebp, r9w
call fcn.1803652dc

Function at 0x1802fdf7f
Capabilities:
Authenticate hmac

Disassembly:
movzx ebx, word [rcx + r10 - 0x3d05]
ror cx, cl
mov qword [rsp + rcx - 0x29e8], rcx
sbb r9b, 3
xor bx, r11w
and byte [rsp + rcx*4 - 0xa79a], ah
xadd rax, rdi
neg r9d
inc bx
lea rbp, [rdx + r9*2 + 0x3385131e]
and word [rsp + rcx - 0x29e4], ax
xor bx, 0x619c
xadd dword [rsp + rcx - 0x29e4], edx
sbb bx, 0x6c35
neg rdi
ror bx, 1
mov qword [rsp + rcx - 0x29e8], 0x49b49085
sub bx, 0x4dbd
sub byte [rsp + rcx - 0x29e6], dil
sal dil, 0xc3
and dl, byte [rsp + rcx - 0x29e4]
xor r11w, bx
lea rbx, [rsp + rbx + 8]
ror rcx, cl
mov ecx, dword [rbx + rdi*2]
lea rsi, [rdi + rsi - 4]
and rdi, 0xffffffffbaa3c89b
call fcn.18033a426

Function at 0x1802ff798
Capabilities:
Authenticate hmac

Disassembly:
movzx ecx, byte [r10 + rdx*4 - 5]
lea r10, [rdx + r10 - 5]
adc r9w, r9w
xor cl, r11b
mov qword [rsp + rdx], rdx
rol cl, 1
lea rdi, [rdx*8 - 0x7b6f4869]
neg cl
mov qword [rsp + rdx + 0x20], 0x29161091
xor cl, 0x38
sal qword [rsp + rdx + 0x12], 0xb6
adc cl, 0x1e
mov word [rsp + rdx*2 + 0x26], dx
not qword [rsp + r9*8 - 0x4e018]
xor r11b, cl
lea rcx, [rsp + rcx + 0x28]
mov eax, dword [rsp + rdx*4 + 1]
xadd qword [rsp + rdx], r9
shl dword [rsp + rdx + 2], 0xf1
mov ebx, dword [rcx + rdx]
mov dword [rsi + rdx*4], ebx
neg r9w
call fcn.18033ac73
xor r11b, al
add rax, rsp
movzx edi, cx
mov bp, word [rax + rcx*2 - 0x51de17fc]
mov word [rsi + rcx*2 - 0x51de17fe], bp
lea rax, [rcx + rdx*8 - 0x6ee6c258]
shr rcx, cl
mov edi, dword [rcx + r10 - 5]
lea r10, [rcx + r10 - 5]
sbb dl, bl
xor edi, r11d
bswap rcx
call fcn.18034619a

Function at 0x180305690
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + r9 - 0x6152f4e9], 0x258dc09e
add r8, rdx
add rbp, rcx
pop rbx
pop rdi
pop rdi
pop rbx
jp fcn.18030f872
Function at 0x1803075fa
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [r10 + rbx - 0xffc9]
sar di, 0x4c
push rbx
ror rbx, 0xd
xor edx, r11d
rol bl, 0xc1
jae 0x180302d60
call fcn.18031d00a
rol ebp, 1
mov qword [rsp + rdx*4 - 0x12cf0], r11
shl r9d, 0x8a
inc cx
jno 0x180357c25
rol cl, 1
add rdx, rax
inc bpl
movzx edi, bpl
xor r11b, cl
add bpl, 0x93
add rcx, rsp
inc eax
inc dl
mov word [rcx + rax*4 - 0x77f00004], r9w
inc rdx
jp 0x1803042bd
xor dword [rsp + r9 - 0x652cf000], ebp
pop r11
rol r9w, 0xad
movsxd rbp, ebp
adc r8, rbp
jmp r8

Function at 0x18030976f
Capabilities:
Encode data using xor

Disassembly:
not edx
adc r8, r9
mov qword [rsp + rax], r8
ret 0x10
mov edx, dword [rbx + rsi - 0x1afb5fbf]
mov cl, byte [rsi + rbx*2 - 0x35f6bf7a]
mov eax, 0x20322530
lea rsi, [rsi + rbx - 0x1afb5fbd]
sar r9b, 0x63
ror bx, 0x47
xadd di, ax
shr edx, cl
add bpl, r9b
mov dword [rsi + rdi - 0x827f], edx
xadd dil, bl
jmp r8
push 0x35bb3739
lea rsp, [rsp + 0x18]
je 0x1803097db
mov ebx, 0x843e6a3a
push r10
lea rbx, [0x180310fc8]
movzx r10d, byte [rbp + riz]
push 0xffffffffd202d133
xor r10d, eax
and r10d, 0xff
mov r10d, dword [rbx + r10*4]
shl qword [rsp], 0xeb
shr eax, 8
push 0x1e1d5112
xor eax, r10d
inc rbp
xor eax, 0x3a00fd9a
dec r9
lea rsp, [rsp + 0x10]
jne 0x18030978d
push 0xffffffffa63cf999
mov r10, qword [rsp + 8]
lea rsp, [rsp + 0x10]
mov ebp, 0xf1018a08
push rbp
push rbp
not eax
xadd qword [rsp + 8], rbp
mov dword [rsi], eax
sbb r10, 4
mov r9d, dword [r10]
xor r9d, r11d
movzx edx, word [rsp + 5]
bswap r9d
movsx eax, dx
lea r9d, [rdx + r9 + 0x6ab0ab2b]
movzx ebx, bpl
push rbx
neg r9d
shr eax, 0x54
not r9d
jbe 0x18030cdd5
mov cl, byte [rsi + rax - 0x7bc80000]
dec rax
inc byte [rsp + rax - 0x7bc7fffc]
shr edi, cl
mov dword [rax + rsi - 0x7bc80001], edi
xadd bpl, dl
mov ecx, dword [rsi + rax - 0x7bc80001]
lea rsi, [rsi + rax - 0x7bc7fffd]
movzx edx, byte [rax + r10 - 0x7bc80005]
movsx edi, word [rsp + rax - 0x7bc7ffef]
lea r10, [r10 + rdi*4 - 0x3dea]
xor dl, r11b
xchg al, bpl
add dl, 0x15
call fcn.180339182
neg eax
dec eax
ror eax, 2
mov r9d, ebp
and r9w, dx
js 0x18035a409
neg dword [rsp + rdx + 3]
mov qword [rsp + rdx + 0x10], r11
xor dword [rsp + rdx*4 + 0x10], r9d
sub byte [rsp + rdx + 1], al
mov r11, qword [rsp + rdx*2 + 0x10]
mov qword [rsp + rdx + 0x10], rbx
jno 0x180339306
movsxd r9, r9d
jge 0x18030800b
movsx edx, di
push rdx
movzx edi, byte [r10 + rbp - 0xb96b]
movsx ebx, byte [rsp + rbp - 0xb964]
xor dil, r11b
not bx
jmp 0x18033c54c
lea eax, [rax + r9 - 0x70a7cf7]
sbb ebx, 0x7a1543a1
push r11
not r9
xor dword [rsp + rbx*2 - 0x35f6be1e], eax
xadd bl, dl
pop r11
movsxd rax, eax
movsx edi, r9w
adc r8, rax
jmp 0x180309598
Function at 0x18030bd6a
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0x7eb13e1c
lea rsp, [rsp + 8]
sub rsp, rcx
call fcn.1802fddd5
mov qword [rsp + rdi - 0x9b22a58], r11
jl 0x180325709
xor r9b, al
xor dword [rsp + rdi - 0x9b22a58], edx
movzx r11d, word [rsp + rdi - 0x9b22a71]
xor byte [rsp + rdi*2 - 0x136454f4], 0xa
sal byte [rsp + rdi*2 - 0x136454f1], 2
mov r11, qword [rsp + rdi - 0x9b22a58]
movsxd rdx, edx
movsx ebx, r9b
sbb rcx, rbp
not ax
add r8, rdx
ror r9b, cl
pop rdx
pop rdx
pop rax
pop rdi
pop rbp
pop rdx
pop rax
jb fcn.18030f872

Function at 0x1803146f1
Capabilities:
Authenticate hmac

Disassembly:
mov dword [rsi + rdi*2 - 0x4008], ebx
dec dword [rsp + rdi - 0x1fe2]
jae 0x18032c69c
movzx r11d, bpl
xor dword [rsp + rbp], ecx
sub eax, edx
pop r11
movsxd rcx, ecx
jne 0x180318380
call fcn.1803564d2
shr edi, 0x34
xor dword [rsp + rdi - 0xfff], edx
pop r11
mov dword [rsi + rdi*2 - 0x2002], edx
mov ecx, dword [r10 + rdi*4 - 0x4004]
movsx ebx, bp
add bp, bx
xor ecx, r11d
and ax, di
setle dil
bswap ecx
xadd bpl, bl
mov edx, 0xc0276206
neg ecx
ror edi, 0xac
movzx r9d, di
dec dil
ror ecx, 1
jmp 0x180335dd9
xchg ebp, ebx
sal eax, 0xe9
bswap ecx
push rax
and dil, 0x89
xor qword [rsp + rbp], r11
jmp 0x18031eace
Function at 0x180325754
Capabilities:
Authenticate hmac

Disassembly:
shl r9w, 3
adc r8, rbp
mov qword [rsp + rbx*8 - 0x7d0], rax
xchg qword [rsp + rbx - 0xfa], rax
mov rdx, qword [rsi + rbx*2 - 0x1f4]
movsx ebp, r9b
shr bx, 0x65
lea rsi, [rsi + rbx*4 - 0x14]
dec eax
lea r10, [r10 + rbx*2 - 0xf]
mov dword [rsp + rbx*2 - 0xe], 0x27207617
lea rdi, [rbp - 0x674da14c]
movzx eax, byte [rbx + r10 - 7]
rol dword [rsp + rbx - 6], 0x53
xor al, r11b
sub word [rsp + rbx - 7], bx
neg bx
xor word [rsp + rbx*2 - 0x1fff0], 0xf4bc
rol al, 1
dec bpl
js 0x18034387a
xor qword [rsp + rcx - 0xffffdc9], rdx
xor edi, 0xf688b006
call fcn.180357bbe

Function at 0x18032636f
Capabilities:
Authenticate hmac

Disassembly:
mov eax, edi
rol r9d, 2
neg r9d
movzx ebx, dx
inc eax
push r11
xor edx, edx
shr edi, 0xf2
xor dword [rsp + rdx*2], r9d
call fcn.18030fda8
add r8, r9
and ebx, dword [rsp + 0xb]
inc rdi
jns 0x180320d96
push rcx
xor dword [rsp + 8], r9d
mov r11, qword [rsp + 8]
mov qword [rsp + 8], rdi
movsxd r9, r9d
neg cl
jge 0x1802fc0f8
movsx edx, r9b
xor cx, r11w
call fcn.180324de9
mov r9, qword [rsi + rbx*2 - 0x62]
mov rdx, qword [rbx + rsi - 0x29]
jo 0x1802f6c2b
mov qword ss:[r9 + rbx - 0x31], rdx
lea rbx, [rdi + rax*8 - 0x3f4c047b]
movzx r9d, word [r10 - 6]
push rcx
ja 0x180327c36
mov cx, word [r9 + r10 - 0x763b0e7c]
lea rax, [r9 + r9*8 + 0x49862104]
ja 0x18031ed66
mov r9d, dword [r10 - 4]
mov edx, 0xdab85881
lea rbx, [rdx + rdx*4 - 0x69688353]
lea rax, [rbx*8 + 0x3885710e]
xor r9d, r11d
rol rax, 0x7b
not bl
dec r9d
movsx edi, bl
rol r9d, 1
mov ecx, edx
not bx
xor r9d, 0xdb2881c
rol r9d, cl
lea rbp, [rcx + rax + 0x483a131f]
dec ebx
push r11
jne 0x18031e7f8
mov edx, ebx
ror edi, 2
mov rax, qword [rsp + 8]
add rax, 0xfffffffffffcbccc
jmp rax
ror qword [rsp + 0x10], 0x27
sbb r10, 6
shl ecx, 0xca
dec cx
xor r9w, r11w
not byte [rsp + 0xb]
inc r9w
add byte [rsp + 1], 0x8b
neg r9w
movzx edx, word [rsp + 0xc]
xor r9w, 0xc43c
not r9w
xchg cx, dx
mov word [rsp + rdx - 0xfbef], bx
xor r11w, r9w
xchg bx, ax
call fcn.18031c767
sub r10, 4
mov edx, 0x46a5861b
mov r9d, dword [r10 + rdx - 0x46a5861b]
xor r9d, r11d
xor r9d, 0x1a0a0f07
mov ebp, edx
lea rdi, [rdx + rbp*2 - 0x5e7185f2]
sub di, dx
dec r9d
jmp 0x1802f847d
Function at 0x180329567
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
rol r9, 0xa8
not edi
ror edi, 1
add r9w, cx
neg edi
push rbp
xor edi, 0x9ba04fb9
mov qword [rsp + rcx - 0x71039ad8], r11
or qword [rsp + rcx - 0x71039ae0], 0xffffffffe91ad0ab
xor dword [rsp + rbx*2 - 0xba], edi
not bl
lea r11, [rbx*2 - 0x4079406f]
shl r9, 0xf3
mov r11, qword [rsp + rbp*8 - 0x360]
xor bx, cx
movsxd rdi, edi
rol r9b, 0xa1
dec r9w
adc r8, rdi
rol qword [rsp + rbx - 0x9b8e], 0x78
movzx edi, bpl
push rcx
mov edx, dword [rsi + rbx*4 - 0x26e30]
lea rsi, [rsi + rbx*4 - 0x26e2c]
xor dil, byte [rsp + rbx*2 - 0x136f5]
and bl, 0xa3
movzx r9d, byte [r10 + rcx - 0x71039b05]
mov qword [rsp + rbx - 0x9b6a], rdi
lea r10, [rcx + r10 - 0x71039b05]
setp byte [rsp + rbx - 0x9b5a]
lea rax, [rbp + rdi*8 + 0x401bd9b]
xor r9b, r11b
add r9b, 0x15
sub dword [rsp + rbx - 0x9b82], 0x5dbe66a8
rol r9b, 1
sub r9b, 0xa5
not r9b
rol cx, 0xa9
setb dil
adc r9b, 0x30
xor r11b, r9b
call fcn.18033234a
sub r10, 1
mov edi, 0x1019e26
add di, 0x76ac
lea rcx, [rdi + rdi*2 - 0x53513bfe]
movzx ebp, byte [r10 + rdi*2 - 0x20229a4]
mov edx, edi
xadd dx, di
call fcn.18032b897
mov rdi, qword [rcx + r9 - 0x7b3a70ae]
shl r9w, 0xe6
add r9b, al
dec r9d
mov qword [rsi + rax - 0x4f85c769], rdi
movsx edi, al
lea rsi, [rax + rsi - 0x4f85c769]
adc r9, rbx
rol dl, 0xa5
mov r9d, dword [rdi + r10 - 0x63]
shl dx, 0x87
lea r10, [r10 + rdi*4 - 0x17a]
or dil, 0x22
not edx
lea rdx, [rdi*8 - 0x48cf95ec]
xor r9d, r11d
rol edx, 0xbc
sar al, 0xa1
shl ebx, 0x7e
lea r9d, [r9 + rdi*2 - 0x46b8a122]
inc bx
neg r9d
rol r9d, 3
not r9d
shr rbx, 0xb5
jb 0x180336899
push r11
mov r11d, ebp
xor dword [rsp + rbx*2], r9d
push rax
push rax
mov r11, qword [rsp + rax - 0x4f85c71e]
movsxd r9, r9d
ror bp, 0xec
adc r8, r9
mov qword [rsp + rbx*2 + 0x10], rbx
ror rdi, 0x35
ror eax, 0x3b
pop rax
pop rbp
pop rbx
jb fcn.18030f872
mov ebx, 0xe8ba261a
mov edx, ebx
sub r10, 4
call fcn.18032d220
inc dl
xor ebx, r11d
lea r9, [rcx*2 + 0xa220abc]
sub rax, 0xffffffffc994f20b
lea rdx, [r9 + rax*4 + 0x7d07a29d]
bswap ebx
call fcn.18036084c

Function at 0x18032dfd6
Capabilities:
Authenticate hmac

Disassembly:
mov r11, qword [rsp + rax - 0xa6]
movsxd rcx, ecx
add r8, rcx
shr rdi, 0x39
mov rbp, qword [rax + rsi - 0xae]
xor r9d, dword [rax + rbp - 0xae]
shr dil, 0x83
mov qword [rsp + rax - 0xae], rdi
ror ebx, 0x3b
lea rsi, [rax + rsi - 0xaa]
movzx ebp, dl
push rbp
mov dword [rsi + rax*4 - 0x2b8], r9d
shr dl, 0x45
call fcn.1802f4440

Function at 0x1803361e7
Capabilities:
Parse pe header

Disassembly:
neg dx
mov dx, word [r10 + rdi*4 + 0x123b8]
xor dx, r11w
movzx ebp, ax
or dil, dil
not dx
call fcn.18030e801
mov eax, ebp
add r10, 0xfffffffffffffffc
rol ebp, 0x3c
call fcn.18035696e
bswap ebp
lea rbx, [rdi + rdi*2 + 0x1933bb9b]
mov eax, ebx
not di
inc ebp
bswap rax
neg ebp
mov ecx, 0x1e29dd21
push r11
sar rcx, 0xf9
dec rbx
xor dword [rsp + rdx - 0x1f94cb81], ebp
lea r11, [rcx + rbx*8 + 0x391aa122]
bswap rax
pop r11
call fcn.18033425e