joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180e6e034
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
ror ax, cl
lea r10, [rsp + r10 + 8]
mov qword [rsp + rdi - 0x53851a99], 0x540c6080
not dil
mov ebp, dword [rdx + r10 - 0x29]
mov r9d, 0x1f24470d
mul r9b
cwde
mov dword [rdx + rbx - 0x27], ebp
sal byte [rsp + rdi - 0x53851a60], 0x61
mov r9d, dword [rsi + rdx - 0x2e]
pop rcx
xor r9d, r11d
mov r10d, ecx
sub r10w, dx
sbb edi, ecx
lea r9d, [r9 + r10*2 + 0x3b01c6dc]
movsx ebp, dx
js 0x180eafcbf
sub cl, dil
not eax
lea rsi, [rdi + rsi - 0x8746b4]
btr cx, r10w
xor bpl, r11b
inc cx
mov r9d, 0xde31b09a
neg ecx
neg bpl
inc eax
jg fcn.180e89a87
btc rax, rcx
not bpl
xor bpl, 8
cwde
inc bpl
xor edi, r10d
push r10
shl rcx, cl
xor bpl, 0x1c
xor eax, 0xcf3806a4
sar qword [rsp + rdi - 0x548b26f9], 0x51
rol bpl, 1
xor bpl, 0xbb
dec bpl
jmp 0x180e6ad72
bswap r9d
btr rbp, rax
bswap ebp
rol edx, 0xc1
ror r9d, 2
lea r9d, [r9 + rdx*4 - 0x351e44fd]
sar rcx, 0x7e
seta bpl
push r11
xor dword [rsp + rcx], r9d
and rbp, rdx
pop r11
or dx, cx
movsxd r9, r9d
xadd dl, dil
neg edi
mul ebp
adc r8, r9
imul ecx, r10d
adc bpl, byte [rdi + rsi - 0x8746b4]
jmp 0x180e9fc9a

Function at 0x180e6e7b4
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
xor r11b, bpl
lea rbp, [rsp + rbp + 8]
push r10
mov dword [rbp + r10*2 - 0x5ac], edx
mov rdi, qword [rbx + r10*2 - 0x5a8]
mov rcx, qword [rbx + rax*8 - 0xa80134]
mov qword [rsp + r10*2 - 0x5a4], r10
rol ax, 0x64
adc rdi, rcx
movsx ecx, byte [rsp + r10*2 - 0x5a2]
mov r10, rdi
lea rax, [rax*2 + 0x58a17480]
ror r9d, 1
xadd eax, ecx
mov r9d, dword [r10 + rax - 0x58cb7980]
movzx edi, ax
not word [rsp + rdi*8 - 0x3cbf9]
mov dword [rax + rbx - 0x58cb7970], r9d
mov r10d, edi
and di, word [rsp + rcx - 0x58cb7979]
jne 0x180ed28b0
lea rbx, [rax + rbx - 0x58cb7970]
movzx r9d, al
mov qword [rsp + rax - 0x58cb7980], r8
ret 8

Function at 0x180e6ee2c
Capabilities:
Authenticate hmac

Disassembly:
xor eax, r11d
btc ecx, 0x31
mov qword [rsp + rdx*2], r10
adc byte [rsp + rdx], 0xa9
dec eax
lea r9, [rcx + rcx*4 - 0x59f40f65]
push rcx
inc cx
rol eax, cl
neg edx
lea eax, [rax + r9*2 - 0x42c2ed47]
rol r10w, cl
neg r9b
sal dx, cl
not eax
jbe 0x180ee38c6
ror eax, 2
mov qword [rsp + rdx*2 + 8], r11
sal r10, cl

Function at 0x180e7084d
Capabilities:
Authenticate hmac

Disassembly:
add r8, rax
mov qword [rsp + r10 - 0x28], rdi
ror ecx, cl
lea rax, [rcx + 0x9e2e16]
lea rdi, [rax + rbx - 0x26277e59]
not r10d
jae 0x180ec05eb
mov ebp, 0x28b52b1a
movzx r10d, bpl
lea rsi, [rsi + rbp*2 - 0x516a5638]
movsx edi, r10b
movsx eax, r10b
cdq
add edx, dword [rsi + rbp - 0x28b52b1a]
xor edx, r11d
push rdi
lea edx, [rbp + rdx - 0x5a6fb0bd]
ror edx, 1
sub edx, 0xbf9de02f
call fcn.180e94a1c
shr dword [rsp + rcx - 0x2589503b], cl
mov qword [rbx + rcx - 0x2589504b], rdi
lea r9, [rbp + rbp*8 - 0x38c1e259]
sbb r10d, r10d
lea rbx, [rbx + r10 - 0xc]
sub byte [rsp + r10 + 6], r9b
btr cx, 0xb2
sbb dx, 0x4409
pop rcx
jl fcn.180eb17b9
Function at 0x180e70b4c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
and dword [rsp + rbp - 0x39f5], r10d
xor r11b, r9b
lea rax, [rdi + 0x552be4b1]
cwd
lea r9, [rsp + r9 + 0x18]
mov rdi, qword [r9 + rbp*2 - 0x7402]
cqo
ror cx, 0xc6
mov qword [rbp + rbx - 0x3a05], rdi
sub ax, r10w
lea rbx, [rbx + rbp*2 - 0x7406]
mov r10d, dword [rsi + rbp*4 - 0xe809]
inc byte [rsp + rdx*2 + 0xe]
xchg rbp, rcx
lea rsi, [rsi + rdx*8 - 5]
not dword [rsp + rdx + 0x12]
lea rax, [rcx*4 + 0x3a3630d]
movzx edi, al
xor r10d, r11d
imul eax, ebp
neg qword [rsp + rcx - 0x39f1]
not r10d
movzx r9d, ax
sar cl, 6
setns bpl
xor r10d, 0xc935cb2
lea r10d, [rax + r10 - 0x36df1f57]
sar r9, 0xe6
add dl, 0x22
rol r10d, 2
mov qword [rsp + rcx - 0x39f0], r11
xor dword [rsp + rcx*2 - 0x73f0], r10d
xchg byte [rsp + rdx - 0x18], bpl
call fcn.180e6b02e

Function at 0x180e74a37
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx], 0x22b97428
mov r9w, word [rax + r10]
dec rcx
mov word [rbx + rcx + 7], r9w
jp 0x180edad87

Function at 0x180e75c26
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
lea r10, [rsp + r10 + 8]
mov word [r10 + r9*2 + 0xdb00], ax
not dl
mov qword [rsp + r9*4 + 0x1b600], rdi
pop rdx
jb fcn.180eb17b9
mov eax, 0xc401f02f
mov bp, word [rbx + riz]
cqo
ror ax, 0x26
jb 0x180e876bf

Function at 0x180e75c5a
Capabilities:
Parse pe header

Disassembly:
add r10b, 0x93
mov rdx, qword [rbx + r9*2 + 0x16daf0fe]
lea rcx, [rbp + r9*8 + 0x679f2911]
mov rbp, qword [rbx + r9*4 + 0x2db5e204]
movzx eax, cx
lea rbx, [rbx + r9*2 + 0x16daf106]
btc r9, r10
shl rax, 0x92
sub r9d, 0x63379fb1
not rdx
ror cl, 0xc2
adc r10b, r9b
not rbp
bswap edi
ror rdi, cl
and rdx, rbp
mov ebp, 0x91de98e
mov qword [rbx + rdi*4 - 0x5c489cbc], rdx
inc al
jmp r8
movsx edx, cl
add rdx, qword ss:[r9 + rdx*4]
mov qword [rbx + riz - 6], rdx
sub rbx, 6
and bp, cx
pop rdi
pop rbp
jle fcn.180eb17b9
mov edx, dword [rbx]
mov ebp, dword [rbx + 4]
mov r9d, 0xc20d8d18
movsx edi, r9b
mov ecx, 0x3631dc39
not edx
movsx r10d, cl
add r10d, ecx
ja 0x180f023b3
mov edi, 0xa0a0d58e
movzx eax, di
dec rax
mov r9d, dword [rax + rsi - 0xd591]
xor r9d, r11d
movsx edx, di
mov ecx, eax
dec r9d
cqo
movsx ebp, cl
bswap r9d
lea r9d, [rdi + r9 - 0xb8110d6]
rol r9d, 2
inc di
rol al, 0x87
push r11
mov r10d, ebp
cqo
call fcn.180ef9c92
not ebp
setg dil
sbb ecx, r10d
jge 0x180e6d4b1
or edx, ebp
inc rdi
movzx ebp, di
mov dword [rbx + rdi*2], edx
jle 0x180ed9daa
imul rcx, rbp
lea rax, [rbp + r9*2 + 0x660aba81]
mov r9d, dword [rsi + rdi - 6]
and ecx, 0x76113f8b
and eax, eax
xor r9d, r11d
rol eax, cl
sbb rbp, rdi
inc r9d
not r10d
rol rdi, 0x69
ror r9d, 1
mul rdi
bts r10w, 0xa5
call fcn.180eec2c6

Function at 0x180e77dd4
Capabilities:
Authenticate hmac

Disassembly:
xor eax, 0xf386e68b
mov qword [rsp + rdi*2 - 0xf8], rdi
not eax
jmp 0x180ed279e
xor eax, 0xd63c4b2b
not r9d
dec qword [rsp + rdi - 0x7c]
lea eax, [r9 + rax - 0x5dc1c7b]
jp 0x180e83116

Function at 0x180e78d0c
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xffffffff8c9dca03
cmp ebx, 2
lea rsp, [rsp + 8]
jne 0x180e708c9
mov edx, 0x932016b8
mov rdx, rax
jmp 0x180ea9403
Function at 0x180e78d6c
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xffffffff9a1154a4
lea rsp, [rsp + 8]
jmp fcn.180ed9d2f

Function at 0x180e791b8
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor rdi, rcx
shl dil, 0xc5
mov eax, dword [rsi + rdi - 0x5704]
movzx r9d, word [rsp + rdi - 0x56f8]
lea rbp, [rcx*2 + 0x3a74ebf]
sbb byte [rsp + rbp - 0x3a7fd22], 5
lea rsi, [rsi + rbp - 0x3a7fd2f]
movzx r10d, r9w
xor eax, r11d
push r9
movsx edx, r9w
bswap eax
and edx, ebp
sub edx, edi
bt r10w, bp
lea eax, [rax + rcx - 0x7296a5da]
xor eax, 0x8e2b33b5
lea eax, [rax + rbp*4 - 0x4dac67d2]
ror eax, 2
mov qword [rsp + rbp - 0x3a7fd1b], r11
xor dword [rsp + rbp*2 - 0x74ffa46], eax
mov qword [rsp + rbp*2 - 0x74ffa4e], r10
pop rcx
mov r11, qword [rsp + rbp - 0x3a7fd23]
push rcx
dec dword [rsp + rdi*4 - 0x15bfa]
movsxd rax, eax
inc byte [rsp + rbp - 0x3a7fd1c]
pop rbp
not r10b
add r8, rax
neg edi
mov bp, word [rbx + rcx*4 - 0x38006]
mov qword [rsp + rcx*8 - 0x70008], rdx
shr dx, 0x24
je 0x180edf073
mov cx, word [rbx + rcx - 0xdffe]
not bp
mov eax, edx
xchg byte [rsp + r9 - 0xdff7], r9b
not cx
shr dword [rsp + r9 - 0xdff9], 0x76
xor r9b, al
or bp, cx
xadd dword [rsp + r9*8 - 0x7048f], r9d
mov byte [rsp + r9 - 0x7a], r9b
mov word [rbx + r9*8 - 0x444], bp
pop r10
lea rdi, [rbx + r9*8 - 0x444]
mov qword [rbx + r9*8 - 0x44c], rdi
xadd r10, rdx
lea rbx, [rbx + r9*8 - 0x44c]
adc word [rsp + r9 - 0x84], ax
lea rcx, [r10 + r10*4 - 0xef9a7c1]
movsx ebp, r9w
pop rdx
jns fcn.180eb17b9
adc r9d, ebp
btr rbp, 0x16
xor dil, r11b
sal al, 0x67
adc dil, 0x8f
neg dil
ror dil, 1
sal bp, 0x27
not dil
movzx ecx, r10b
cdq
xor r11b, dil
or r10d, ecx
lea rbx, [rbx + rax*4 - 2]
jo 0x180ef983b
mov word [rbx + rax*2], di
jae fcn.180eb17b9
ror ecx, 1
xor ecx, 0x398a7e99
movsx eax, di
sal r9b, 0x46
mov r10d, ebp
inc ecx
div r9b
sal bp, 0x81
xor rbp, 0xffffffffc43e3f1e
rol ecx, 1
mov edx, edi
bswap ecx
xor ecx, 0xe11dcd03
xchg r9d, edi
and r10, 0xffffffffd00e1387
setle dl
not ecx
inc rdx
div r9w
mul r10b
ror ecx, 1
ror r9d, 0x5b
shr rax, 0x15
push r11
sub r9d, ebp
cmovnp bp, di
movzx r11d, r10b
xor dword [rsp + rdi*2 - 0x180], ecx
xchg r9d, r10d
pop r11
cwd
btr r9w, ax
shr r9w, 4
movsxd rcx, ecx
adc r8, rcx
lea rsi, [rsi + rdi*4 - 0x301]
sub bpl, bpl
mov dil, byte [rsi + r9 - 0x80000000]
jns 0x180ed3ace
xadd rdx, rax
call fcn.180efb367

Function at 0x180e7c4df
Capabilities:
Authenticate hmac

Disassembly:
push 0x758a612c
lea rsp, [rsp + 0x18]
jne 0x180eba5a9
push 0xf00f8a2
mov r9, rax
lea rsp, [rsp + 8]
jmp 0x180eeef4a
mov eax, 0x9f8b2320
inc eax
call fcn.180efc8f8

Function at 0x180e8189b
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r9], rbp
movzx edx, word [rsp + r10 + 1]
mov r11, qword [rsp + r9 + 8]
xchg qword [rsp + r9], rdx
movsxd rcx, ecx
mov qword [rsp + r9 + 8], 0xffffffffa8a63938
add r8, rcx
xor dx, word [rsp + r9 + 9]
push r9
call fcn.180ee9014
Function at 0x180e81bec
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 4
call fcn.180f03579
mov r9d, 0x84182932
mov rdi, rbx
lea rcx, [r9*2 - 0x434e0563]
movzx eax, r9w
lea rbx, [rax + rbx - 0x293a]
mov qword [rbx + rax*4 - 0xa4c8], rdi
movsx edx, cx
lea rsi, [rax + rsi - 0x2936]
movsx edi, dx
sub cl, ch
lea rcx, [rcx*2 - 0x6cf18d4c]
mov edx, dword [rsi + rax*2 - 0x5264]
push rdi
mov ebp, eax
jp 0x180ecd397
xor edx, r11d
lea rbp, [rbp*2 + 0x3284c626]
neg edx
btc eax, 0x84
sal word [rsp + rax - 0x291d], 0xa5
dec edx
pop rcx
xor di, bp
shr rdi, 0x53
neg edx
rol r9, cl
movzx r10d, r9w
shl dil, 5
inc edx
shl ax, 0xeb
sal r10d, 0x5c
not edx
shl cx, cl
push r11
xor dword [rsp + rcx*4 - 0x26808], edx
push rdi
btr r10w, r9w
neg dil
mov r11, qword [rsp + rcx - 0x99fa]
imul bp, di
not r9w
pop r10
movsxd rdx, edx
mov qword [rsp + rcx*4 - 0x26808], r10
bts cx, r9w
add r8, rdx
cqo
pop rax
jmp fcn.180eb17b9

Function at 0x180e81c44
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0x2b009f05
xor edi, eax
push 0x703966a4
shl qword [rsp + 8], 0x10
push 0x189b5e2f
and edi, 0xff
jmp 0x180edd57a
sal dx, 0xe3
xor al, 0x1b
mov ecx, r9d
ror r10d, 0x99
sar dx, 8
sbb al, 0x9e
movsx ebp, di
ror edi, 0xe3
lea rcx, [rdi*2 + 0x1e241887]
neg al
shr r9, cl
rol al, 1
add rdi, 0x79be4116
cmovb edx, r9d
sal r9, 0x26
inc al
xadd r10d, r9d
rol al, 1
shl r10d, cl
rol r9w, cl
xor r11b, al
btc rdi, 0x99
imul edx, edi
inc r9w
add rax, rsp
bt r10, rbp
mov dx, word [rax + r10 - 0x3b514f40]
shl ebp, cl
or ecx, 0x3104ef17
sbb bpl, r10b
mov r9w, dx
not di
adc bp, r10w
bts bp, r10w
lea r10, [rsp + r10*2 - 0x76a29db8]
movsx edx, bpl
mov word [rdx + r10 - 0x41], r9w
push rcx
mov edi, dword [rsi + rdx - 0x46]
dec dword [rsp + rdx - 0x3d]
pop r10
xor edi, r11d
movzx eax, cl
rol rbp, cl
inc edi
xor ebp, r10d
movsx r9d, dl
neg edi
not cx
sub dl, cl
rol edi, 1
dec edx
bswap edi
idiv r10b
xor edi, 0x4881a424
push rbp
mov qword [rsp + r10 + 0x531069], r11
push rdx
call fcn.180efc2fb
movsx edi, byte [rsp + rdx*2 - 0x7fd]
mov qword [rsp + rdx*4 - 0xffc], r11
xor dword [rsp + rdx*2 - 0x7fe], eax
shr r10w, 0x2f
mov r11d, r10d
ja 0x180ef83a1
shr eax, 8
neg word [rsp + 0xc]
call fcn.180e7b77c
mov edi, dword [rsi + rdi*4]
ror qword [rsp], 0x5a
jae 0x180eb4f0c
mov eax, 0xba363986
cwde
movzx eax, byte [rsi + rax*2 - 0x730d]
mov r10d, 0xf533b514
lea rdi, [r10 + r10*2 - 0x1d7a5342]
movzx r9d, dil
xor al, r11b
movzx edx, r9b
sub al, 0x11
jmp 0x180e85788
pop r11
movsxd rax, eax
or edx, edx
lea r9, [r10 + rdi*8 - 0x79755669]
adc r8, rax
or r10w, bp
xadd di, dx
movzx ax, byte [rbx + rdx - 0xffff]
btc rdx, 0x15
ror r10, 0x44
mov cl, byte [rbx + rdx*4 - 0x83fffa]
sbb ebp, ebp
bt bp, dx
lea rbx, [rbx + rdx*2 - 0x41fffc]
adc rbp, 0x6a34109b
shr ebp, 0xce
rol ebp, 0xff
shr al, cl
mov word [rbx + rbp*2 - 0x1a8d0], ax
sub edi, edx
movsx eax, r9w
mov ecx, edx
jmp r8
Function at 0x180e8493c
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
xor dx, 0xec18
not ecx
mov r10d, edx
inc ecx
not ecx
mov qword [rsp + rbp - 0x13], r11
push r10
xor dword [rsp + r9*2 + 0x10], ecx
add byte [rsp + rbp*2 - 0x31], r9b
bts rax, r10
rol al, 0x66
mov r11, qword [rsp + rbp - 0xb]
mov qword [rsp + r9*4 + 8], rax
movsxd rcx, ecx
mov qword [rsp + rbp*8 - 0xc8], rax
shr qword [rsp + rbp - 0xb], 0xe9
adc r8, rcx
push r10
add r9, qword [rbx + rbp*2 - 0x2c]
mov rdx, qword [rbx + rbp*2 - 0x24]
xor r10d, 0xfba13fb0
rol rbp, 0x36
adc rbp, rbp
adc r9, rdx
cqo
dec qword [rsp + rdx + 0x18]
call fcn.180e9cd60

Function at 0x180e855e2
Capabilities:
Authenticate hmac

Disassembly:
xchg dword [rsp + rbp - 0x4a37539d], r9d
mov qword [rsp + rbp - 0x4a3753a1], r11
xor dword [rsp + rbp - 0x4a3753a1], edi
xchg bp, ax
xadd ebp, eax
mov r11, qword [rsp + rbp - 0x736f16ca]
je 0x180efa0a2
movsx edx, ax
movsxd rdi, edi
sbb cl, bpl
add cl, r10b
mov qword [rsp + r9*8 + 8], 0x1a3ae013
adc r8, rdi
mov edi, dword [r9 + rbx]
shr bp, 0xe7
mov qword [rsp + r9], rdx
mov byte [rsp + rbp - 0x736f0029], 0x22
mov ebp, dword [rbp + rbx - 0x736f0029]
cwde
mov cl, byte [rbx + r9*4 + 8]
lea rbx, [rbx + r9 + 6]
shrd edi, ebp, cl
mov dword [rbx + r9*8], edi
cwd
mov qword [rsp + r9*2], r8
ret 8

Function at 0x180e859be
Capabilities:
Authenticate hmac
Manually build aes constants

Disassembly:
movzx eax, byte [rsi + rdx]
xor al, r11b
dec cx
dec ecx
neg al
imul edi, edi
shl word [rsp + rdx + 0xd], 0xeb
movsx r10d, cx
dec al
rol cx, 0x48
sbb qword [rsp + rdx*2 + 8], 0xffffffffce0bb307
neg al
inc bp
xor cl, bpl
not al
bswap rcx
xor r11b, al
lea rax, [rsp + rax + 0x10]
call fcn.180eeae4e
mov eax, 0xcbb05312
cdqe
mov ecx, eax
movzx r10d, byte [rsi + rax*2 + 0x689f59db]
xor r10b, r11b
lea rdi, [rax + 0x3ea70c8c]
movsx edx, cl
cdqe
xor r10b, 0x3b
sub dl, dh
movsx r9d, cx
dec r10b
and edx, edx
shr rcx, cl
add di, cx
xor r10b, 0x2e
not r10b
imul cl
inc r10b
sub cx, dx
movzx ebp, dl
xor r11b, r10b
add r10, rsp
mov edi, dword [r10 + rax + 0x344f0168]
mov dword [rbx + rax + 0x344f0164], edi
shl rbp, cl
movzx ebp, byte [rsi + rax*2 + 0x689e02ce]
lea r10, [rcx + rax*2 + 0x12b3a281]
shr dl, 0x41
jnp 0x180ec6a04
xor bpl, r11b
sub bpl, 0xa8
add r10, rax
neg bpl
not r9d
ror bpl, 1
mul r9d
bswap r10d
not bpl
bswap r9d
xor r11b, bpl
movsx edi, r9b
mul di
mov word [rbx + rcx*8 - 0x196d6], bp
sar dx, 0x89
bt ecx, r9d
mov r9d, dword [rsi + rax - 0x7f512d4e]
btc rcx, 0x14
movsx ebp, dx
xor r9d, r11d
sub r9d, edi
ror r9d, 1
xchg edx, ebp
xor r9d, 0x398a7e99
neg rax
sub r9d, edi
push r10
jmp 0x180eb503d
and byte [rsp + rcx - 0x1032d7], dh
rol r9d, 1
pop rdi
bswap r9d
rol r10, 0xb7
xor r9d, 0xe11dcd03
not r9d
ror r9d, 1
push r11
xor dword [rsp + rcx - 0x1032da], r9d
btc r10w, 0x93
pop r11
movsxd r9, r9d
and al, dil
sub bp, di
adc r8, r9
jmp 0x180ea4ed2
Function at 0x180e87d55
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
add eax, dword [rsi + rax - 6]
lea rsi, [r9 + rsi - 6]
mov qword [rsp + r9*2], r9
xor eax, r11d
xchg r10w, di
lea rdi, [rdi + rdi*2 - 0x1f07f65]
rol eax, 1
lea rcx, [r9 + r10*2 + 0x511ec998]
sub edi, 0xff2ef8b0
not eax
inc rdi
lea eax, [r9 + rax - 0x211222ba]
shr r9, cl
sal qword [rsp + r9*2 + 2], cl
xadd r10w, di
bswap eax
sar r10, cl
mov qword [rsp + r9*2 + 8], r11
xor dword [rsp + rdi - 0x4c360c91], eax
jmp 0x180f00da9
mov r11, qword [rsp + r9 + 8]
inc r10
or dword [rsp + rdi - 0x4c360c97], ecx
movsxd rax, eax
adc r8, rax
mov cx, word [rbx + r9*4 + 6]
lea rbx, [rbx + rdi - 0x4c360c91]
movsx eax, r10b
call fcn.180eeeef7

Function at 0x180e8889e
Capabilities:
Authenticate hmac

Disassembly:
sub rsi, 4
jmp 0x180ed8b94
xor edi, r11d
mov qword [rsp], 0x613a8683
mov eax, dword [rsp]
inc edi
movsx r9d, al
btc ax, 0x8b
neg edi
mul eax
rol edi, 1
bswap edi
xor edi, 0x4881a424
mov qword [rsp + rdx - 0x24ed6d64], r11
xor dword [rsp + rax - 0x28b19709], edi
movzx ecx, r9w
shl dx, 0x86
pop r11
movzx ebp, cx
lea r10, [rcx + rdx*2 - 0x46ea00ca]
xor al, r10b
movsxd rdi, edi
adc r8, rdi
ror r10, cl
neg ebp
mov dx, word [rbx + rax - 0x28b197b0]
cmove eax, r10d
movzx ecx, byte [rsi + rcx - 0xff88]
lea rdi, [rax + rax + 0x5caa0808]
dec bpl
lea rsi, [rsi + rax - 0x28b197b5]
jp 0x180e65a85
lea rbp, [r10 + r10*4 - 0x145f3bff]
xor cl, r11b
neg r9
ror cl, 1
dec cl
bswap rbp
xchg r9b, dil
inc r9b
ror cl, 1
shr r10, 0xdf
jne 0x180eaba17
mov ecx, 0x6e1fb218
mov r10d, dword [rbx + rcx - 0x6e1fb218]
movsx r9d, cx
mov edx, r9d
shl cx, 0x6a
movzx ebp, byte [rsi + rcx - 0x6e1f6001]
btc rdx, rcx
sar r9, 0x57
xor bpl, r11b
neg dl
movzx edi, dx
xor bpl, r9b
ror bpl, 1
neg bpl
dec edi
add bpl, 0xa6
xor edi, 0x862c97a7
ror di, 3
btr r9w, dx
xor r11b, bpl
btr cx, 0x8c
btr r9w, cx
add rbp, rsp
inc rdx
sal rdx, 0xda
mov dword [rbp + r9*2 - 0x2fc], r10d
mov r10d, dword [rcx + rsi - 0x6e1f6005]
sar di, 0xae
movzx eax, cx
lea rsi, [rcx + rsi - 0x6e1f6005]
xor r10d, r11d
lea rbp, [rdi - 0x3408250]
dec r10d
xadd edi, ecx
dec ecx
rol r10d, 2
neg cx
shr r9b, 0x46
cqo
lea r10d, [r9 + r10 - 0x542c7119]
setnp al
bswap r10d
shl r9, cl
div eax
bswap rdx
push r11
mul rax
add ax, bp
xor dword [rsp + r9*4 - 0x808], r10d
xadd dx, ax
pop r11
movsxd r10, r10d
bts rcx, rcx
adc r8, r10
cdqe
mov rdi, qword [r9 + rbx - 0x1fe]
movzx r10d, al
mov rbp, qword [r9 + rbx - 0x1f6]
jmp 0x180e922b8
sbb cl, 1
bt eax, 0x13
adc eax, ebp
dec dil
xor r11b, cl
btr rdi, rax
inc ebp
adc rcx, rsp
jmp 0x180eca048

Function at 0x180e89444
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rax - 0x124], r11
mov qword [rsp + rax - 0x134], rdx
lea rdx, [rdx*4 - 0x6579a471]
lea r11, [rdx*4 + 0x23bd881a]
xor dword [rsp + rax*4 - 0x4c0], r9d
xadd r11d, eax
jne 0x180ec0b43
mov r11, qword [rsp + rax - 0x186f666]
lea r10, [rbp + rax*8 - 0x5e7cf2df]
movsxd r9, r9d
and ecx, 0xfd2437b5
xor r10d, ebp
adc r8, r9
pop rdi
mul ax
movzx r9d, al
pop rdi
pop rdi
jb fcn.180eb17b9
jmp 0x180ec6327
Function at 0x180e89bf2
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
movsx edi, cx
neg al
xor edi, 0x5fbd4e26
and ecx, 0x6531e129
dec al
movzx edx, cl
sal ecx, cl
neg al
call fcn.180f010c4

Function at 0x180e8b139
Capabilities:
Authenticate hmac

Disassembly:
not r10b
movzx edi, byte [rdi + rsi - 0x410d6a14]
btr edx, 0xf
lea rcx, [rdx + r10*4 + 0x7196d83e]
xor dil, r11b
add dil, 0xa4
ror ecx, 1
not dil
mov qword [rsp + r10*4 - 0x1abac], 0xffffffffed80e2b0
mov eax, edx
rol dil, 1
movzx r9d, byte [rsp + r10*2 - 0xd5d6]
xor dil, 0x14
inc byte [rsp + r10 - 0x6aea]
imul r10w, word [rsp + r10 - 0x6aeb]
xor r11b, dil
mul qword [rsp + r10*2 - 0x1c520]
xadd ax, cx
lea rdi, [rsp + rdi + 8]
call 0x180ec1b2e
Function at 0x180e8e166
Capabilities:
Manually build aes constants

Disassembly:
mov ecx, dword [rbx + rdi - 0x46b4f981]
adc al, bpl
bswap rbp
not rdi
mov eax, dword [rbx + rdi + 0x46b4f986]
jp 0x180ede952
sbb qword [rsp + r9 + 0x707], 0x3f352535
jo 0x180ec31ca
imul ecx
shl edi, 0xc4
push rdi
mov dword [rbx + r9*2 + 0xdfe], edx
pop r9
pop rdx
add rdx, 0x654f0
jmp rdx

Function at 0x180e949b9
Capabilities:
Authenticate hmac

Disassembly:
sub r9b, byte [rsp + r10 - 0x57b7661c]
adc r8, rdi
not dword [rsp + r9 + 0x5350d932]
mov r10w, word [rbx + r10 - 0x57b7661d]
mov cl, byte [rbx + r9 + 0x5350d931]
lea rbx, [r9 + rbx + 0x5350d931]
call fcn.180ed3a0c
mov eax, 0x9e3d1f30
movsx ecx, ax
mov r10d, dword [rsi + rcx - 0x1f34]
movsx ebp, cx
xor r10d, r11d
inc r10d
not r10d
movzx r9d, cl
not r9
add ecx, 0x473cdf89
xor r10d, 0x7710ccbd
mov edx, 0xbc1c1917
and ecx, eax
inc r10d
mov edi, r9d
neg edx
not r10d
shl r9d, 0x8e
dec r10d
sub bpl, 0xa1
and eax, 0xdaaecd9d
bswap edi
push r11
idiv r9
cdqe
xor dword [rsp + rax + 0x65aa9d6a], r10d
pop r11
push rax
call fcn.180e92005
bswap r10d
push rdi
xchg rdi, rbp
ror r10d, 2
xor r10d, 0x77bfcc9c
movzx r9d, bpl
mov qword [rsp + rbp - 0xfa6c286], 0xffffffff972f0935
lea r10d, [r10 + rbp*2 - 0x5cd97a61]
and ebp, edx
ja 0x180ec2e7e
bswap edi
ror edi, 1
lea r9, [rcx*2 - 0x5350d97d]
dec edi
push r9
movzx ebp, word [rsp + rcx - 0x39]
rol edi, 2
lea rdx, [rax + rax*2 + 0x68842b23]
mov qword [rsp + r9 + 0x5350d911], r10
mov qword [rsp + r9 + 0x5350d911], r11
xor dword [rsp + r9 + 0x5350d911], edi
mov r11, qword [rsp + r9 + 0x5350d911]
sar byte [rsp + r9 + 0x5350d90b], 0x84
movsxd rdi, edi
jb 0x180e82298
xor r10d, 0x11875591
movzx ecx, r9b
mov qword [rsp + rbp*4 - 0x260], r11
or r9w, 0x2b09
call fcn.180e63982

Function at 0x180e96fe1
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdx*8 - 0x4d0], 0xffffffffb394c426
xor ebp, 0x7d8e2497
movzx ecx, di
mov eax, ecx
sal r10, cl
dec ebp
or qword [rsp + rdx - 0x94], 0xffffffffd59f1d35
bswap ebp
cqo
mov qword [rsp + rdx + 8], r11
xor dword [rsp + rdx + 8], ebp
mov r11, qword [rsp + rdx + 8]
xchg edx, r9d
pop r10
movsxd rbp, ebp
call fcn.180edba1c

Function at 0x180e970af
Capabilities:
Authenticate hmac

Disassembly:
push rcx
mov rcx, rax
call fcn.180ef8a1b
mov dword [r10 + rax*8 - 0x3b8], ecx
movzx r9d, byte [rsi + rbp + 0x160ba983]
not ebp
mul ax
pop rdi
lea rsi, [rbp + rsi - 0x160ba990]
cbw
xor r9b, r11b
sub r9b, 0x1a
movzx edi, dx
not r9b
movsx r10d, byte [rsp + rbp - 0x160ba97e]
sub r9b, 0x2f
mov ecx, 0x6501ac3f
neg r9b
idiv al
call fcn.180eb1c6e
jmp 0x180eef6a4
mov eax, 0xb505353a
sar rax, 0xd1
mov rax, qword [rax + rbp - 0x5a82]
call fcn.180eeb3b2
je 0x180ea2cda
push 0xffffffffe8bb80b5
mov rax, qword [rbp + rbx*8]
mov byte [rsp + 6], 0xa1
cmp ebx, 1
not byte [rsp + 6]
lea rsp, [rsp + 8]
jne 0x180ec69a4
mov ecx, 0x9a2a6f23
jmp 0x180e84b7a
Function at 0x180e98ac5
Capabilities:
Authenticate hmac

Disassembly:
bt edx, ebp
not edi
add r10, rbp
mul rbp
sar bp, 0xaa
xor edi, 0x86977414
mov qword [rsp + rax], r11
cbw
xor dword [rsp + rax], edi
not rdx
push rbp
div bpl
mov r11, qword [rsp + rax*8 + 8]
mov dword [rbx + rbp*2 - 0x1c90001a], edi
and qword [rsp + rax], rdx
push rbp
xor rax, rbx
mov qword [rbx + rbp - 0xe480015], rax
lea rbx, [rbp + rbx - 0xe480015]
mov qword [rsp + rbp - 0xe47fffd], 0x65a0d609
sar qword [rsp + rbp - 0xe480001], cl
ror word [rsp + rbp - 0xe47fffe], cl
pop rbp
pop rdx
pop r10
jne fcn.180eb17b9
ror eax, 1
movzx edi, cl
jmp 0x180e7d5e5

Function at 0x180e99a5a
Capabilities:
Authenticate hmac

Disassembly:
xor r9b, r11b
ror edx, cl
sub rdi, qword [rsp + r10 - 0x6891bb5c]
sub r10w, di
rol r9b, 1
sal rbp, cl
mov qword [rsp + rdx - 0x241d000], rdi
xor r9b, 8
mov qword [rsp + rdi + 0x76f990af], rbp
add r9b, 0x17
neg al
sbb eax, dword [rsp + rdi + 0x76f990a8]
rol r9b, 1
xor r11b, r9b
lea r9, [rsp + r9 + 0x20]
bts bp, cx
movzx di, byte [r9 + r10 - 0x68914c03]
inc ebp
inc bp
cmovnp r10w, dx
mov word [rbx + rbp*8 - 0x92], di
sal cl, 0x27
or r10d, ebp
xchg byte [rsp + rbp + 1], cl
mov bpl, byte [rbp + rsi - 0x18]
adc qword [rsp + r10 - 0x68914c08], 0xffffffff99b1950d
lea rsi, [rsi + rdx*8 - 0x120e8006]
inc ecx
movzx r9d, ax
dec edx
xor bpl, r11b
ror dx, 0x27
sbb bpl, 0x2c
mov edi, 0xf017cab
dec r9w
or r9d, 0xa3a01b25
neg bpl
neg edx
ror bpl, 1
sar word [rsp + rdi*2 - 0x1e02f93d], cl
mul r9d
xor bpl, 0x98
jmp 0x180e6466f

Function at 0x180e9dd78
Capabilities:
Authenticate hmac

Disassembly:
movsx r10d, r9b
xor cl, r11b
ror r10d, 0xd1
call fcn.180e898a5
mov r9d, 0x882f0f38
mov r10, qword [rbx + riz]
mov eax, r9d
movzx eax, byte [rsi + riz - 1]
movzx edi, r9w
sub rdi, r9
xor al, r11b
add al, 0x11
ror r9b, 0x65
not al
movsx ebp, r9w
rol al, 1
or ebp, 0x2eabe819
xor r9, rbp
movsx edx, bp
not al
bswap r9d
jae 0x180eaac82