joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180e9ee83
Capabilities:
Authenticate hmac

Disassembly:
mov r10d, dword [rsi + riz]
mov edi, 0x8fb2602d
lea r9, [rdi*2 - 0x3871fee8]
xor r10d, r11d
xor r9, rbp
movzx edx, r9b
xor r10d, 0xfd169f8a
dec r10d
jmp 0x180ea8056
mov dword [rbx + r10*4 - 8], ecx
mov qword [rsp + r10*2 + 0x10], 0xffffffffa7b0491e
lea rbx, [rbx + r10 - 8]
mov edi, dword [rsi + r10*4 - 8]
movzx ecx, bp
lea rsi, [rsi + r10*2 - 8]
btc cx, bp
mov qword [rsp + r10*2], 0x729d839
xor edi, r11d
neg dword [rsp + r10*4 + 0x10]
pop rbp
lea edi, [rdi + rdx - 0x1c2f78d1]
neg byte [rsp + rbp - 0x729d82d]
bswap edi
jo 0x180e78d94
ror edi, 2
sar qword [rsp + r10*2 + 8], cl
xchg ch, cl
movzx eax, bpl
lea edi, [rdi + r10*2 - 0x351e43b5]
mov qword [rsp + r10], r9
mov qword [rsp + r10 + 8], r11
xor dword [rsp + r10 + 8], edi
jmp 0x180e8bf7c
not r10d
inc edi
setnp dl
lea r10d, [r9 + r10 - 0x303c754c]
ror rbp, 0x6b
movzx eax, bpl
or r9b, 3
xor r10d, 0x80842a2c
push r11
xor dword [rsp + r9 - 0x143b8a43], r10d
pop r11
movsxd r10, r10d
rol al, 0xa1
adc r8, r10
mov r9d, dword [rbx + r9*2 - 0x28771486]
mov ebp, dword [rbx + rdx*2 + 4]
lea rbx, [rbx + rdx + 4]
lea r10, [rcx + 0x2a8d1baa]
and r9d, ebp
mov ebp, 0x33280285
shl r10d, 0xb4
not r9d
xadd ax, r10w
mov dword [rbx + rdx*2], r9d
add rdx, r8
jmp rdx

Function at 0x180ea1435
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
sub ax, di
adc edx, edx
bswap r9d
xor rcx, qword [rsp + rbp - 0x86cc]
lea rdx, [rdx*8 + 0x1db84692]
lea r10, [rdx + rdi*2 + 0x4205ed29]
ror r9d, cl
call fcn.180eae2a1
mov r9d, 0x682ebd9e
mov r9, qword [rbx + r9 - 0x682ebd9e]
mov eax, 0xd8b27d06
mov rcx, qword [r9 + riz]
dec rax
movsx r10d, ax
mov qword [rbx + r10*4 - 0x1f414], rcx
movsx ecx, al
mov edi, dword [r10 + rsi - 0x7d09]
movsx edx, r10w
sal r10, cl
xor edi, r11d
neg rcx
idiv r10
add edi, 0xff95ac11
ror r10w, 0xa
ror edi, 1
dec r10
bswap edi
neg ax
push rdx
xchg byte [rsp + r10*2 - 0x1e5048], dl
ror edi, 3
pop r9
inc ecx
xadd cl, al
bswap edi
inc r9
jg 0x180f042ff
lea edi, [rdi + r10*2 - 0x12479fe7]
shl r9d, cl
sub cl, ch
sar r9b, 0xe1
push r11
cbw
cqo
xor dword [rsp + r10*8 - 0x794138], edi
pop r11
movsxd rdi, edi
neg r10
add r8, rdi
mov rdi, qword [rbx + r10*8 + 0x794138]
lea rbp, [rax*2 + 0x21b28c0c]
and r10d, ecx
or r9b, byte [rdx + rsi - 5]
and rax, rbp
lea rsi, [rax + rsi - 0x8c09]
xor r9b, r11b
sub rcx, 0x70135304
dec r9b
jmp 0x180e9e201
Function at 0x180ea18d4
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
mov word [rbx + rbp - 0x34f], dx
lea rsi, [rbp + rsi - 0x353]
mov ecx, dword [rbp + rsi - 0x34f]
xor dword [rsp + rbp - 0x34f], ebp
or word [rsp + rbp*2 - 0x69a], di
xor ecx, r11d
neg word [rsp + rbp - 0x34b]
sal word [rsp + rbp - 0x34c], 0x86
mov r9d, 0xe8204b3b
lea ecx, [rcx + rbp*8 - 0x5d0f56b6]
sar word [rsp + rbp - 0x34a], 0xe2
sub r9b, byte [rsp + rbp*2 - 0x69b]
xadd ebp, r10d
not ecx
ror ebp, 0x88
sar rbp, 0x27
call fcn.180eac1c2
call fcn.180ebdf7d
xor dword [rsp + r9*2 - 0x7d3dfff8], ebp
dec dil
cwde
mov r11, qword [rsp + rdx - 0x3e9efff8]
sub ecx, r9d
movsxd rbp, ebp
add rax, qword [rsp + r9*2 - 0x7d3e0000]
adc r8, rbp
mov bp, 0x18
bswap eax
mov dword [rsp + r9 - 0x3e9efffc], ecx
mov qword [rsp + rdx*2 - 0x7d3dfff8], 0xffffffff9516b43f
movzx ecx, byte [rdx + rsi - 0x3e9f0005]
sal qword [rsp + rdx - 0x3e9efff8], 0xd5
lea rsi, [r9 + rsi - 0x3e9f0005]
xor al, al
and r9d, r10d
rol rdi, 0x93
xor cl, r11b
call fcn.180ebe54f
mov r10d, 0x4128a319
mov r10, qword [rbx + r10 - 0x4128a319]
mov r9d, 0x1e1e449b
mov ecx, r9d
mov edi, dword [r10 + r9*2 - 0x3c3c8936]
add ecx, ecx
mov edx, ecx
ror ecx, 0x1c
lea rbx, [rbx + r9 - 0x1e1e4497]
jb 0x180ec3197
mov r9d, 0xb9880815
mov ecx, r9d
jmp 0x180ead766
lea edi, [rdi + rcx*2 + 0xb9357e9]
ror edi, 1
mov qword [rsp + rcx - 0x7a012a14], rcx
lea r9, [rcx*4 + 0x12b9a6a5]
movsx edx, r9b
bswap edi
movsx r10d, r9b
mov qword [rsp + rcx - 0x7a012a0c], 0xffffffffde8b75a9
ror edi, 3
mov eax, 0x22a84a9f
bswap edi
shl al, 0x86
cwd
and qword [rsp + rcx - 0x7a012a0c], r9
lea edi, [rax + rdi - 0x34d19a59]
add r9b, byte [rsp + rax*2 - 0x45509578]
push r10
adc qword [rsp + rax*2 - 0x4550957a], rdx
mov qword [rsp + rax - 0x22a84ab0], r11
rol edx, 0x85
idiv ecx
pop rbp
xor dword [rsp + rcx - 0x7a012a0c], edi
add word [rsp + rcx - 0x7a012a0f], 0x202c
pop r11
shr r10d, cl
pop r11
movsxd rdi, edi
bts r10, 0xe
cqo
adc r8, rdi
sub rcx, rdx
xchg al, bpl
mov rbp, qword [rdx + rbx]
movzx r10d, byte [rdx + rsi - 5]
call fcn.180ef95d9
mov dx, word [rbx]
mov edi, 0xaf22d387
mov r10w, word [rbx + riz + 2]
push rdi
add rbx, 2
or dx, r10w
not dx
lea r10, [rdi*8 + 0x291f6717]
movzx ebp, r10w
jmp 0x180e73a14
call fcn.180e7d990
mov r11, qword [rsp + r9*2 - 0x2ff0]
movsxd rbp, ebp
add r8, rbp
mov qword [rsp + r9 - 0x17f0], 0xffffffffc428a235
sar eax, 0x88
push rax
pop rdi
pop r10
pop rdi
pop rbp
jne fcn.180eb17b9
mov qword [rsp + 0x20], r11
sete byte [rsp]
mov r11d, dword [rsp + 1]
xor dword [rsp + 0x20], ecx
sal r11b, 7
mov r11, qword [rsp + 0x20]
jnp 0x180ecfbd8
mov r9d, 0x688ffeaf
jmp 0x180ee3ac1
movsxd rcx, ecx
je 0x180e6798c
jne 0x180e6a79d
mov ecx, 0xb082b330
sub rsi, 4
lea rbp, [rcx + rcx*8 - 0x8eda1f5]
mov edx, 0x9a8fe8a
add bpl, 0xa5
mov ecx, dword [rsi + rdx - 0x9a8fe8a]
xor ecx, r11d
and bp, bp
not ebp
lea ecx, [rcx + rbp + 0x175dd909]
bswap rbp
bswap ecx
xor ecx, 0x6f1a0f97
not ecx
lea rdi, [rdx*2 - 0x5c19af6]
btr rdi, rbp
lea ecx, [rcx + rdx*2 - 0x545c7143]
push r11
lea rax, [rdx + rdi*4 + 0x18b7a182]
call fcn.180e80a95
Function at 0x180ea295a
Capabilities:
Authenticate hmac

Disassembly:
inc cx
add r8, rdx
ror r9b, 0xa7
movzx edx, byte [rsi + rax - 0x281fffd]
sbb al, 0x9f
xor dl, r11b
or r9b, r9b
neg dl
dec dl
neg r9
dec cx
not rax
neg dl
neg r10
not dl
neg bpl
xor r11b, dl
inc bp
not ax
add rdx, rsp
xor di, 0x4f97
bts ecx, edi
mov r10w, word [rdx + rax*2 + 0x502014e]
lea r9, [rbp + rdi*4 + 0x4ba76807]
mov edx, 0xa0009eb3
mov bp, r10w
cqo
movzx r10d, r9b
bt edx, 0x21
mov r10b, byte [rsi + rdx*4 - 2]
lea rsi, [rsi + rdi - 0x524e451e]
sar dl, 0x81
push rcx
xor r10b, r11b
shl cl, 0x41
sbb cx, word [rsp + rdi - 0x524e4516]
imul edi, r9d
ror r10b, 1
add r10b, dl
sar byte [rsp + rax*2 + 0x5020151], 0xc1
ror r10b, 1
sub r10b, 1
sar edi, 7
shr qword [rsp + rax + 0x28100a7], cl
idiv r9
xor r11b, r10b
lea r10, [rsp + r10 + 8]
pop rax
mul edx
inc rdi
mov word [rcx + r10 - 0x4785dfcd], bp
jmp r8
cdq
xor r11w, r9w
call fcn.180ef6c22
mov r10, qword [rbx]
mov rcx, qword [r10]
mov edi, 0x47852729
mov qword [rbx + rdi - 0x47852729], rcx
movzx eax, dil
mov edx, dword [rsi + rdi - 0x4785272d]
movsx r10d, dil
neg r10
mov ebp, edi
xor edx, r11d
mov ecx, ebp
lea rax, [r10 + rdi*8 + 0x5689e03f]
movzx r9d, di
rol edx, 2
and rax, rdi
neg ax
xadd rdi, rcx
bswap edx
rol edx, 1
lea edx, [rdx + rdi - 0x5f5fec18]
or ebp, 0x332d6281
bswap edi
cbw
push r11
xor dword [rsp + rdi - 0x524e0a8f], edx
bts di, r9w
pop r11
setb r9b
movsxd rdx, edx
jb 0x180e7316a
rol dword [rsp + 4], 0xaf
mov word [rbx + riz], r10w
call fcn.180ebbeee

Function at 0x180ea2cb2
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rbp*4 - 0x3ef2c], r11
xor dword [rsp + rbp - 0xfbcb], ecx
mov r11d, r10d
mov edi, 0xa69612b2
xor dl, dh
pop r11
dec bpl
cmovne edi, r10d
div rbp
movsxd rcx, ecx
div r9
idiv bpl
bswap r10
add r8, rcx
bswap rax
bts ax, r10w
adc rdx, r8
jmp rdx
ror ecx, 1
and eax, edx
mov qword [rsp + rbp*8 - 0x7de58], 0x6f213707
je 0x180e62902
Function at 0x180ea364e
Capabilities:
Authenticate hmac

Disassembly:
inc al
ror ecx, 1
push rax
bswap ecx
mul bpl
shl dword [rsp + rdi*4 - 0x1fe], 0x7e
neg ecx
dec r10
sar ebp, 0xd9
mul bpl
ror ecx, 1
cbw
shl qword [rsp + rbp - 0x26], 0xf2
dec r9
inc ecx
mul byte [rsp + rbp*2 - 0x67]
xchg dx, r9w
neg ecx
neg word [rsp + rbp - 0x22]
and r9b, byte [rsp + rbp - 0x21]
not ecx
bswap ecx
pop rdi
add r9w, 0x603d
not ecx
setne bpl
btc r10, 0x38
sar bpl, 0xc6
xor qword [rsp + rdx + 0x1d53f651], r11
xor dword [rsp + rbp*8 + 8], ecx
sub ebp, edi
rol qword [rsp + rbp*4 - 0x754d6d14], 0x7c
ror dword [rsp + rbp - 0x1d535b43], 5
mov r11, qword [rsp + rdx + 0x1d53f651]
btr r10w, 0x38
mov dword [rbx + rdx + 0x1d53f649], ecx
adc qword [rsp + rbp*2 - 0x3aa6b68a], r8
ret 8
lea r11, [rbp + r10*4 + 0x2da09083]
mov r11, qword [rsp + rdx*8 - 0x8931018]
mov qword [rsp + rdx*8 - 0x8931018], 0x6d2f0020
cwde
movsxd r9, r9d
add r8, r9
movsx edi, cx
bts eax, 0xa6
mov r9w, word [rbx + rdx*2 - 0x224c408]
xchg dil, r10b
mov dx, word [rbx + rdx - 0x1126202]
mov qword [rsp + rax - 0x7ff7], rcx
and r9w, dx
not r9w
mov qword [rsp + rax - 0x7fff], r10
mov cx, r9w
pop r10
lea rdx, [rax + rdi*2 - 0x1d53dc4b]
mov r9w, word [rax + rbx - 0x7ffb]
imul eax, dword [rsp + rax - 0x7ffe]
push rax
adc cx, r9w
cbw
dec r10w
mov word [rax + rbx + 4], cx
mov ecx, dword [rax + rsi - 8]
js 0x180ec2420
bswap ecx
lea r9, [rdi*2 + 0x31a908b2]
jbe 0x180e99c39
cbw
imul rbp, r10
lea rsi, [rsi + rax*2 - 8]
xor eax, edx
dec r10w
xor ecx, r11d
rol ecx, 1
shr dword [rsp + rdi - 0x7b], 0x9a
jns 0x180ebdfb2
mov edx, 0x36008384
mov eax, edx
xadd edx, eax
mov rax, qword [rbx + rdx - 0x6c010708]
movzx ebp, dx
mov dil, byte [rbx + rdx - 0x6c010700]
lea rbx, [rdx + rbx - 0x6c0106fe]
cmovs rdx, rbp
sar ebp, 0x29
movzx r10d, bp
mov byte es:[rax + rbp*2 - 6], dil
mov eax, 0x1971b0d
jp 0x180ec92c4
mov ecx, ebp
lea rsi, [rsi + rbp - 7]
inc r10b
movsx r9d, ax
mov edx, dword [rsi + rbp*2 - 6]
xor edx, r11d
or ecx, r9d
xor edx, 0xae83c028
neg edx
btr bp, r9w
rol edx, 3
mov edi, 0x7ab82904
jmp 0x180eb871b

Function at 0x180ea49c0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
xor eax, r11d
mov edi, dword [rsp + 0xb]
call fcn.180e9b354
Function at 0x180ea4cff
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
mov rax, rbx
mov qword [rsp + r10 - 0x72ba59e2], r9
adc byte [rsp + r10 - 0x72ba59d6], dl
xor r9w, r10w
mov qword [r10 + rbx - 0x72ba59fa], rax
xchg ebp, edx
pop rcx
push r10
lea rbx, [rbx + r9*4 - 0x167d0]
lea rcx, [r10 + r9*4 - 0x2ccf54c3]
pop rax
pop r9
pop rdx
pop r9
jae fcn.180eb17b9
mov r9d, 0x4c2d5308
mov rdi, rbx
mov qword [rbx + r9 - 0x4c2d5310], rdi
lea rcx, [r9*8 - 0x54d8eed8]
mov r10d, ecx
movsx edi, r10w
mov ebp, dword [rsi + r9 - 0x4c2d530c]
call fcn.180e932b9
mov qword [rsp + 8], rdx
sub eax, 0x32293604
push rdx
xor eax, 0x7d8e2497
inc qword [rsp + 0xc]
bts rdx, rdx
sal byte [rsp + 0x12], 0x61
sbb eax, edx
movzx r9d, dl
bswap eax
or dl, 0xbc
mov ebp, edx
push r9
mov qword [rsp + rbp - 0xa5], r11
lea r11, [rbp + rbp*2 + 0x4db233b4]
sbb ebp, dword [rsp + r9 + 5]
mov ecx, 0x900b7f9e
xor dword [rsp + r9 + 0x17], eax
neg dword [rsp + r9 + 0x11]
jp 0x180e99378
Function at 0x180ea5273
Capabilities:
Authenticate hmac

Disassembly:
movzx edi, bp
xor r9d, r11d
sal ecx, 0xe4
or rdi, rdi
lea r9d, [r9 + rcx + 0x274ac8a]
not rdi
bswap r9d
ror r9d, 2
mov qword [rsp + rbp - 0xe0a5db0], 0x26bfe894
push rdi
mov qword [rsp + rbp*2 - 0x1c14bb5e], 0x622c162e
lea r9d, [rbp + r9 - 0x4328a165]
dec ebp
sub rcx, rcx
call fcn.180f051d9
mov ecx, 0x629331a7
mov eax, dword [rcx + rsi - 0x629331ab]
mov ebp, ecx
xor eax, r11d
dec rcx
movzx edx, cl
cmovns rdx, rbp
lea eax, [rax + rcx*2 - 0x670c7ac9]
rol eax, 1
lea rdi, [rbp + rdx - 0x22d4ca6a]
not cl
ror cl, 0xa1
inc eax
rol eax, 1
lea eax, [rcx + rax + 0x4cf10cef]
xadd edx, edi
shl cx, cl
push r11
sal dx, 0xea
jne 0x180e9de44

Function at 0x180ea6bcc
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x10]
jmp fcn.180ed9d2f

Function at 0x180ea7a42
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xchg edi, ecx
lea rbp, [r9 + rdx + 0x1537389a]
lea rsi, [rsi + rcx - 0xbf]
ror edi, cl
mov eax, dword [rsi + rcx - 0xbb]
add r9d, r9d
mov qword [rsp + rcx*2 - 0x176], r9
xor eax, r11d
inc eax
ror eax, 1
shl qword [rsp + rdx*2 - 0x17372], 0x6b
setp byte [rsp + rcx - 0xbb]
xor eax, 0x398a7e99
ror r10b, 0xa5
and rdi, qword [rsp + rcx - 0xbb]
ror r10d, 0x6f
adc eax, edi
or r10w, word [rsp + rcx - 0xb6]
or r10d, r10d
neg word [rsp + rcx*4 - 0x2ec]
rol eax, 1
bswap eax
shr dword [rsp + rcx - 0xb8], cl
call fcn.180edbb85
mov ecx, 0x62158ab3
movzx edx, cx
movzx eax, cx
mov edi, dword [rsi + rcx - 0x62158ab7]
lea rdx, [rax*8 - 0x4fe31648]
xor edi, r11d
lea rbp, [rdx + rax*8 - 0x3dd7c450]
movzx r10d, bp
lea edi, [rdi + rcx*2 + 0x3b6a96ab]
movsx r9d, al
xadd al, cl
jp 0x180eb2108

Function at 0x180ea8bd0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
pop rdx
mov ecx, dword [rsi + riz]
or r9w, r9w
setns r9b
xor ecx, r11d
neg ecx
inc ecx
movzx ebp, r9w
movzx eax, bpl
not rbp
ror ecx, 3
shl bp, 0x63
neg rax
neg ecx
movzx r10d, bpl
lea rdi, [rbp + r9*4 - 0x6dfc8b41]
sub ecx, 0x8682e628
shl r10d, 0x49
push r11
xor dword [rsp + rbp*4 + 0x34040], ecx
mov edx, edi
pop r11
movsxd rcx, ecx
not bpl
add r8, rcx

Function at 0x180eaf926
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x18]
jne 0x180efabfc
mov rdx, rax
call fcn.180e99b1f
Function at 0x180eb1044
Capabilities:
Authenticate hmac

Disassembly:
and bp, 0xe0e
lea rdi, [rdi*4 + 0x61ab6e3c]
lea rsi, [rsi + rbp - 0xe12]
jno 0x180eb0864
adc r8, rbp
cqo
cdq
jmp r8
xchg cx, bp
add r8, rdi
mul rbp
lea rax, [rdx*2 - 0x70617352]
jmp r8
mov edi, dword [rsi + rbp - 0xe0e]
bt cx, 0x84
xor edi, r11d
btc r10d, r10d
bswap edi
xchg cl, r10b
lea rax, [rcx + rcx*8 + 0x150cce10]
mov r9d, 0x2b30080a
lea edi, [rdi + rbp + 0x4c94319e]
adc ax, bp
bswap edi
setae r10b
ror bpl, 0x66
mov edx, ecx
ror edi, 3
cqo
push r11
xadd rax, rcx
xchg r10, rbp
xor dword [rsp + r10*2 - 0x1c70], edi
neg rdx
pop r11
ror ecx, cl
movsxd rdi, edi
setns dl
jb 0x180e8c5c1
shl r10, 0x57
xor dword [rsp], ecx
shl ebp, 0xc1
shr r10d, 0xf9
pop r11
or rbp, rdi
xadd edi, ebp
movsxd rcx, ecx
adc r8, rcx
btc rdi, rdi
movzx eax, bpl
btr r9, r10
or r10, r8
jmp r10
mov qword [rsp + rax - 0x13e6779], rax
xor dword [rsp + rax - 0x13e6771], edx
mov r11, qword [rsp + rax*4 - 0x4f99ddc]
movsxd rdx, edx
mov qword [rsp + rax - 0x13e6771], rcx
pop rdi
movzx r9d, byte [rsp + rax - 0x13e6778]
add r8, rdx
imul ecx
lea rbp, [rdi + 0x914b9ab]
mul dword [rsp + rax*2 + 1]
mov r10, qword [rbx + rax]
xadd dword [rsp + rax + 4], edi
ror qword [rsp + rax*2], 0xfd
bt bp, ax
movzx ecx, byte [rsi + rax*4 - 5]
pop rdx
rol ax, 0x48
lea rsi, [rax + rsi - 5]
lea rax, [rdx + 0x6527682b]
shr edi, 0xbe
jb 0x180e6636b
xor cl, r11b
lea r9, [rbp*4 - 0x7afde7f6]
call fcn.180e9935d

Function at 0x180eb10c1
Capabilities:
Authenticate hmac

Disassembly:
mov word [rbx + r9*2 - 0x61596108], r10w
and edi, 0xf8092dac
mov rdx, qword [rsi + r9 - 0x30acb095]
mov qword [rsp + r9 - 0x30acb07f], 0xffffffffde2becb5
sub dil, 0x89
lea rsi, [rsi + r9 - 0x30acb095]
xor rdx, r11
inc rdx
mov word [rsp + r9 - 0x30acb07a], di
push rcx
not rdx
movsx eax, byte [rsp + r9*2 - 0x615960ec]
lea rdx, [rdx + r9 + 0x30146a8]
shl dword [rsp + r9*2 - 0x615960f3], 0x7c
jp 0x180ec5773
ror rdx, 1
xchg di, cx
pop rbp
xor r11, rdx
mov qword [rbx + r9 - 0x30acb091], rdx
lea rbx, [rbx + r9*2 - 0x61596110]
pop rbp
pop rdx
jmp fcn.180eb17b9
Function at 0x180eb1233
Capabilities:
Authenticate hmac

Disassembly:
pop rbp
bswap edx
bt r10, rcx
xchg cx, di
push rdi
mov qword [rsp + rax], r11
xor rax, rcx
ror cx, 0x86
and edi, 0xc6884826
xor dword [rsp + rdi*2], edx
rol ecx, 0xdc
sar eax, 0x25
pop r11
xchg bpl, r9b
movsxd rdx, edx
adc r8, rdx
lea r10, [rsp + rdi*2 + 0xb0]
xadd dil, al
sbb eax, ecx
cdq
movzx cx, byte [rdi + r10]
rol r9b, 3
sbb r9w, bp
lea r10, [rax + rax + 0x221f34a6]
mov word [rdi + rbx - 0xa], cx
lea rbx, [rdi + rbx - 0xa]
dec al
neg r10
jb fcn.180eb17b9
mov rbp, qword [rbx]
mov edx, 0x2b21eeb5
ror dl, 0xa7
sub rdx, rdx
mov r10, qword [rbx + rdx*2 + 8]
mov qword ss:[rdx + rbp], r10
mov r9d, dword [rsi + rdx*2 - 4]
bts dx, dx
xor r9d, r11d
not rdx
neg r9d
rol r9d, 3
movzx r10d, dl
mov edi, 0x2f09d629
bswap r9d
lea rbp, [rdx + rdi*2 + 0x208d31a0]
bts edx, edx
xor r9d, 0x3b917b21
sar r10d, 0x3e
movzx eax, r10b
push r11
ror di, 0x87
xor dword [rsp + r10*2], r9d
idiv edi
lea rbp, [r10 + rax*2 - 0x6b634660]
pop r11
shl r10, 0xf2
adc edi, edi
movsxd r9, r9d
imul ax, dx
add r8, r9
movzx ecx, byte [rsi + r10*2 - 5]
lea rsi, [r10 + rsi - 5]
not dil
sal bp, 0x21
shr rdi, 0x5e
xor cl, r11b
lea r9, [rbp*4 + 0x28267c88]
sub cl, 0xad
dec dx
rol cl, 1
jmp 0x180ee8286
neg r10
neg byte [rsp + rbp*2 - 0x4623fff6]
xor r11, r10
btr edi, edi
mov qword [rsp + rdi - 0x73bbb712], 0x42279b36
mov qword [rbx + rdx*4 - 0x5a48], r10
imul di
and dil, cl
add edx, dword [rsi + rdi - 0x73bbb71c]
sub rcx, rax
or ecx, r9d
inc di
lea rsi, [rax + rsi - 0xc]
rol dword [rsp + rbp - 0x2311fff7], 0xec
shl rdi, 0xfb
xor edx, r11d
inc qword [rsp + rbp - 0x2311fffe]
or word [rsp + rbp - 0x2311fff2], bp
shr word [rsp + rbp*2 - 0x4623fff4], 0x24
rol edx, 1
pop r10
shl byte [rsp + rbp - 0x2311ffff], 0x86
or r9w, 0x6a9c
not edx
lea edx, [rbp + rdx - 0x442422ba]
jae 0x180e6ead1
movzx edx, byte [rsi - 1]
xor dl, r11b
mov ebp, 0x93b8010c
mov eax, 0x7988489d
sal rbp, 0x59
sbb dl, 0x95
movsx r9d, bpl
ror ax, 0x2f
ror dl, 1
movsx edi, ax
mov r10d, r9d
push rbp
add dl, 9
sar bpl, 1
pop r9
neg dl
sal r9, 0x90
xor r11b, dl
add rdx, rsp
and rdi, 0x2f18e816
movzx ax, byte [rdx + rax - 0x7988913a]
mov ecx, ebp
sar r10, 0xa8
xor r10w, ax
movzx edx, byte [rsi + rdi - 0x2f188014]
inc edi
shl di, 0x45
xor dl, r11b
ror dl, 1
xadd dil, bpl
rol rbp, 0xb6
call fcn.180e6a7e8
mov eax, 0x58e668a
shr rax, 0xbc
btc eax, eax
mov rax, qword [rbp + rbx*8 + 0x20]
push 0xffffffff878a59b0
mov qword [rsp], rax
bt eax, 0x29
adc cl, dil
rol cl, 1
imul edx, edi
cdqe
xor r11b, cl
or rbp, rax
adc rcx, rsp
and rdx, 0x74b33b37
xor r10b, byte [rdx + rcx - 0x54110037]
mov word [rdx + rbx - 0x54110029], r10w
add r9d, 0x91213700
idiv r9w
mov r10d, eax
lea rbx, [rbx + rdx - 0x54115b12]
jmp r8
Function at 0x180eb2bed
Capabilities:
Authenticate hmac

Disassembly:
mov r11, qword [rsp + rcx - 0x770157f8]
btc ecx, 0xb9
cbw
sar edi, 0x33
movsxd rbp, ebp
mov qword [rsp + rcx - 0x750157f8], 0xfffffffffe13bc28
ror r10w, 0x6b
pop r10
adc r8, rbp
rol ax, 0x62
cbw
setae cl
movzx r9d, byte [rsi + rcx - 0x75015809]
sbb word [rsp + rcx - 0x750157fa], di
shr dil, 0x45
sub al, 0xa2
xor r9b, r11b
xor r9b, 0xa2
not r9b
mov ebp, edx
bts di, dx
ror r9b, 1
sub r9b, 0x31
rol r9b, 1
not ax
add r9b, 0x1e
pop rcx
idiv al
ror r9b, 1
neg r9b
sal di, cl
or r10d, 0x9aa8d91b
sbb r9b, 5
neg r9b
dec eax
xor r11b, r9b
inc r10w
ror edx, cl
setne al
mov word [rbx + rdx - 0x2328c5bf], r9w
adc r10, 0xffffffffb83ada2d
setbe bpl
inc rdx
movzx edx, byte [rax + rsi - 0x651f000b]
movsx r9d, bp
ror cx, cl
lea rsi, [rsi + rbp - 0x28c5b90b]
sets cl
xchg edi, r10d
xor dl, r11b
cdqe
xadd al, ah
sbb dl, 0xad
rol dl, 1
sal r10b, 0x85
adc dl, al
jmp 0x180ec8781
mov qword [rsp + rcx - 0x770157f8], r11
mov qword [rsp + r9*8 - 0x59770], rax
xor dl, byte [rsp + rcx - 0x770157fe]
xor dword [rsp + rcx - 0x770157f8], ebp
div rax
jmp 0x180e7b148
shr r10w, 0x49
rol dl, 1
push rbp
shl rdi, 0xbf
bswap r10d
xor r11b, dl
lea rdx, [rsp + rdx + 8]
xadd r9b, bpl
shl edi, 0xad
movzx r10w, byte [rdx + rdi*2]
cbw
or byte [rsp + rdi*2 + 4], cl
js 0x180f089cb
mov word [rbx + rdi*4 - 8], r10w
add word [rsp + rdi*4], cx
lea rbx, [rbx + rdi*8 - 8]
rol dil, 6
lea rdx, [rcx*4 + 0xeaadf34]
add rdi, r9
pop r10
jge fcn.180eb17b9
mov r11, qword [rsp + rdx*2 - 0x1c4]
dec r9d
pop rcx
adc rcx, 0xffffffffffff8eb2
jmp rcx
Function at 0x180eb8bf0
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
movsxd rax, eax
mov qword [rsp + rdi - 0x781aec00], 0xffffffffe4b0fd26
adc r8, rax
movzx bp, byte [rbx + r10*4]
xadd di, cx
sal byte [rsp + r10*2 + 1], 0x23
sal rdi, 0xea
or cl, byte [r10 + rbx + 2]
lea rbx, [rbx + r10 + 2]
ror r9, 0xb0
xor dword [rsp + r10 + 2], 0xe4973b92
and edi, r10d
sal bpl, cl
neg di
jnp 0x180e8c120
mov word [r10 + rbx], bp
mov qword [rsp + r10], 0x3f962313
movsx eax, di
inc dword [rsp + r10 + 3]
mov qword [rsp + r10], r8
ret

Function at 0x180eb9855
Capabilities:
Authenticate hmac

Disassembly:
xor r9d, 0x8c85da8e
movzx ecx, byte [rsp + rdx + 0x8091c9]
sub edx, edi
mul ecx
neg r9d
lea r9d, [r9 + rdi*2 - 0x3300acd7]
mul eax
ror r10d, 0x58
jae 0x180e6461f
btc edx, 0x20
push rdi
sbb r9b, 0xb1
neg r9b
movzx ebp, word [rsp + rdi + 0x10]
add r9b, 0xb4
inc ax
sar qword [rsp + rdi*2 + 0xb], 0xd8
neg r9b
xor r11b, r9b
sal ebp, cl
cqo
lea r9, [rsp + r9 + 0x18]
mov byte [r9 + rdi - 2], r10b
mov qword [rsp + rdi*4 - 8], r8
ret 0x10
dec dil
cbw
xor r9d, r11d
bswap edi
cwde
mov qword [rsp + rdx + 0x80330b], 0xffffffffce186600
lea r9d, [r9 + rdi + 0x35d83367]
lea r10, [r10 + r10*8 - 0x445da45f]
neg r9d
xadd di, dx
not r9d
jp 0x180e89f87
mov word [rbx + riz], r9w
lea rdi, [rdx + rax*2 - 0x23c82053]
dec rax
movsx r9d, dil
sub rsi, 4
lea rbp, [rdi*2 + 0x76b86813]
xor dl, dil
mov eax, dword [rsi + riz]
xor eax, r11d
bts di, dx
mov r10d, edi
setae bpl
xor eax, 0xc8a4b700
xadd r9w, di
bswap rbp
not eax
lea rdx, [rdx + rdi*8 + 0xc23a733]
xor r10b, dil
xadd rdx, rdi
sbb eax, 0x2382b322
neg edx
call fcn.180ee8496
mov eax, 0x9f976e92
mov eax, dword [rbx + riz]
jmp 0x180ef0334
mov edx, 0x743c438e
inc rdx
mov edx, dword [rbx + rdx - 0x743c438b]
mov ebp, 0xf72871b4
mov r9d, ebp
btc bp, bp
or eax, edx
lea rdx, [r9 + r9*2 + 0xb17d7b8]
not eax
sal ebp, 0xc5
call fcn.180e6fb47
mov edx, 0x63824389
call fcn.180e63422
jmp 0x180eef842