joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015e2fc
Capabilities:
Encode data using base64

Disassembly:
lea r8, [rsp + r8 + 0x10]
mov r9w, word [r8 + rdx]
shr qword [rsp + rdx*4 + 8], cl
mov ebx, dword [rsp + rdx*2 + 9]
btc rbx, r11
lea rsi, [rsi + rdx*4 - 2]
bts eax, 0x38
mov word [rsi + rdx*2], r9w
mov qword [rsp + rdx], 0x27b50dbe
pop r9
pop rbx
jb fcn.1401c9c2e

Function at 0x14016bd98
Capabilities:
Encode data using base64

Disassembly:
lea rsi, [rsi + r8 - 0xfdd4]
shr r10w, 3
xor edx, r11d
mov qword [rsp + r8 - 0xfdd8], r10
rol rbx, 0x37
neg edx
ror bl, 0xa7
movsx eax, bl
bswap edx
shl eax, 0x89
jne 0x1401759b2
mov edx, 0x7a0d86b5
movzx edx, word [r8 + rdx - 0x7a0d86b5]
mov r9d, 0x8b2ac4bd
add r8, 2
lea rax, [r9*2 + 0x62a82025]
xor dx, r11w
add al, 0x28
inc dx
rol dx, 1
movzx ecx, al
bts r9, rcx
xor rcx, rcx
neg dx
movzx ebp, cx
lea rbx, [rax*2 - 0x61f0fee3]
lea r10, [rbp + rcx*2 - 0x435198c6]
xor dx, 0xa5a2
inc dx
btc r9d, r10d
bt ebp, ebx
sub rcx, rbx
xor r11w, dx
add rbp, rax
lea rsi, [rsi + r10 + 0x435198c4]
setno al
dec eax
mov word [rsi + rax - 0x78fda900], dx
mov edx, dword [r8 + rax - 0x78fda900]
sal rbx, 0x20
or r10d, ebx
lea r8, [r8 + rax - 0x78fda8fc]
xchg ecx, eax
rol cl, 0x85
xchg bx, r9w
xor edx, r11d
sal r9b, 0xa1
xor ax, r10w
xor ax, 0x35a9
ror edx, 2
bt eax, ebx
cdqe
neg edx
push r9
or bx, 0x9b3f
rol edx, 3
xchg dword [rsp + rax - 0x6ff5f9c3], ebx
neg eax
xor rbp, rax
lea edx, [rdx + r9 + 0x4608328e]
call fcn.14019556d
bswap esi
sub esi, 0xcf0643a4
rol esi, 1
call fcn.1400f0266

Function at 0x14016ce03
Capabilities:
Encode data using base64

Disassembly:
lea r11, [rax + r8 + 0x180fb885]
bt r11w, r9w
xor r8b, byte [rdx + rbp]
sar eax, 0xd
lea rbp, [rbp + rax*8 - 0x152c3f]
lea rcx, [rdx + r9 - 0x147dfb6e]
xor cx, 0x7f36
xor r8b, dil
inc r11w
xor r9, r11
sbb r8b, 0xb9
cqo
inc r11b
ror r8b, 1
add r8b, 0x14
sal cx, 0xa1
xchg al, cl
not r8b
cwde
xor dil, r8b
mov qword [rsp + rdx], 0x7e8c9800

Function at 0x140175a34
Capabilities:
Encode data using base64

Disassembly:
mov r15, qword [rsp + rax*2 - 0x1c8]
mov r11, qword [rsp + rax - 0xd8]
cwde
not rcx
mov rsi, qword [rsp + rax - 0xd0]
mov r13, qword [rsp + rax - 0xc8]
mov rcx, qword [rsp + rax - 0xc0]
mov rax, qword [rsp + rax - 0xb8]
call fcn.140166376
Function at 0x1401777cc
Capabilities:
Encode data using base64

Disassembly:
cld
call fcn.14027b9c5
jmp 0x1401e3279
lea r8, [r8 + r9 - 0xbf]
mov word [r8 + r9 - 0xbd], cx
sub dword [rsp + r9*4 - 0x2f1], esi
lea rdi, [rdi + r9*8 - 0x5ec]
mov r11d, dword [rdi + r9*2 - 0x17a]
xor r11d, ebx
xor r9b, r9b
inc r11d
imul dx, si
lea rbp, [rdx - 0x6a4df5d2]
ror r11d, 3
lea r11d, [r11 + r9*4 + 0x4fa3cf98]
lea rcx, [rsi*2 - 0x694dcee6]
btc bp, 0x23
lea rax, [rsi*8 + 0x25378a0d]
rol r11d, 3
dec r11d
xadd cx, bp
adc r9w, r9w
mov qword [rsp + r9 - 1], rbx
xor rdx, 0x692e2db1
cdq
xor dword [rsp + rdx*8], r11d
rol r9, 0xd5
xor r9d, 0x192d3817
not bp
pop rbx
jns 0x14025d81b
mov qword [rsp], rsi
mov edi, 0x211fd28b
push rdi
lea rsi, [rdi + rdi - 0x3fce02ef]
pushfq
pop rdi
mov qword [rsp + rsi - 0x271a227], rdi
push rsi
mov rsi, rdx
push 0xffffffff9ca4132b
mov rdi, r8
sar byte [rsp + 4], 0xc1
jp 0x1400e5b2a
mov rsi, qword [r9]
mov eax, 0x8c9b639a
call fcn.14011e2a3
add rbp, rsp
mov cx, word [rcx + rbp - 0x7c2715bd]
push r11
jmp 0x140163928
xor cl, 0xb6
movsxd r11, r11d
adc r10, r11
bswap r9d
btr dx, 0xa2
jae fcn.1401f4401
xor dword [rsp + rsi - 0x9462], eax
movzx edi, r8w
add dx, 0x8c07
mov r10, qword [rsp + rcx - 0x701ec4ff]
movsxd rax, eax
inc cl
sub qword [rsp + rcx - 0x701ec508], rdi
adc r11, rax
mov qword [rsp + rcx - 0x701ec508], r11
ret 8

Function at 0x1401793dd
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov qword [rsp + rsi - 0x6e49], rdi
xor dword [rsp + rsi - 0x6e49], r11d
mov rdi, qword [rsp + rsi - 0x6e49]
ror dl, 0xc1
btr ebx, 0x31
mov qword [rsp + rsi - 0x6e49], 0x4f136788
movsxd r11, r11d
add rbp, r11
lea r10, [r10 + rbx*2 - 0x568ee87]
movsx eax, byte [rsp + rsi*4 - 0x1b939]
neg si
movzx ebx, byte [r10 + rsi*4 - 0x246bc]
cdq
mov r11d, 0x603e2a21
xor bl, dil
mov qword [rsp + rdx*8], 0x2081fe03
add r9b, 0xac
shr rcx, cl
sbb bl, 0x36
not bl
inc bl
ror bl, 1
imul ax
or r9w, 0x1d0f
neg eax
xor dil, bl
lea rbx, [rsp + rbx + 0x10]
imul ax, cx
mov r11, qword [rbx + rdx]
sub r9d, ecx
btc r9w, cx
lea r8, [r8 + rdx*2 - 8]
cbw
or al, ch
mov qword [r8 + rdx*2], r11
pop rax
pop rcx
ja fcn.1400dc126
Function at 0x140182264
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
cwd
xor dword [rsp + r10 - 0x5d850000], ebp
pop r9
call fcn.140193916
rol esi, 0xe1
shr ecx, 0xa3
adc r8w, bp
and cx, r11w
and r11d, r11d
movsx ebp, cl
mov word [rcx + r10 - 0x8750020], r8w
imul dl
jb 0x1400edfc9
mov eax, 0x4595babf
cbw
movzx r11d, al
lea r10, [r10 + rax - 0x4595ffc3]
mov eax, dword [r11 + r10 - 0xbf]
movzx ebx, r11b
movzx esi, r11w
mov ecx, 0x449e8a0a
xor eax, edi
ror eax, 1
shr r11w, cl
movsx edx, bl
sbb eax, 0xc52a3f26
bswap rdx
not eax
shl r11w, 0x24
sbb eax, 0xad915e1d
lea rsi, [rsi + r11*8 - 0x12fb6841]
xor cx, cx
and dx, si
push rdi
sal r11, 0xb7
imul r11d, esi
movsx r9d, dx
xor dword [rsp + r11*4], eax
pop rdi
bt esi, r11d
movsxd rax, eax
jae 0x140276d27
mov eax, 0x2e87a32c
mov esi, 0xd91c56b1
lea rdi, [rdi + rax*2 - 0x5d0f465c]
mov r11d, esi
mov edx, dword [rax + rdi - 0x2e87a32c]
xor edx, ebx
movzx ecx, al
btc ecx, ecx
inc edx
dec al
cwde
neg si
rol edx, 1
movsx ebp, sil
shr r11b, 0xe1
sbb rsi, rbp
inc edx
imul ecx, esi
neg edx
dec edx
shr bpl, 3
ja 0x14013adfd
dec ecx
xor edx, 0x99ac561b
shr eax, cl
add bp, si
inc edx
call fcn.14025d216
inc rcx
mov byte ss:[rax + rsi - 0xa902], r8b
movzx r11d, bpl
lea rdx, [rbp + 0x7e296c84]
mov ebp, dword [rsi + rdi - 0xa902]
shl ecx, cl
btc r11d, edx
movzx r8d, si
lea rdi, [rsi + rdi - 0xa8fe]
mov eax, r11d
setb al
idiv cx
xor ebp, ebx
bswap ebp
sar eax, cl
ror ebp, 3
add al, 0xaa
not r8
sbb cl, 0x88
sbb ebp, 0xb4b72f82
bts rsi, rdx
shr eax, 0xdc
ror ebp, 1
imul r11w
push rbx
sal r8, 0xb0
xor dword [rsp + rsi*8 - 0x54810], ebp
xadd rsi, rdx
mul rax
pop rbx
movsxd rbp, ebp
sal r8w, 0x2f
shl rsi, cl
adc r9, rbp
xor rdx, r9
jmp rdx
mov rcx, qword [rbp + riz]
movzx bx, byte [rcx]
mov edx, 0xcaad7493
add rbp, 6
mov word [rbp + riz], bx
mov qword [rsp], 0x1d8bfd0d
mov r8d, dword [rsi + riz]
not byte [rsp + 2]
xchg qword [rsp], rdx
shr word [rsp + rdx - 0x1d74fd0a], 0xa
lea rsi, [rdx + rsi - 0x1d74fd09]
lea rax, [rdx + rdx*8 + 0x70a4bd34]
jnp 0x14015f67d
push rax
xor r8d, r11d
neg dl
lea r8d, [r8 + rdx + 0xdb50a8f]
not r8d
lea r8d, [r8 + rdx - 0x397a8097]
movzx r10d, al
neg r8d
movsx ebx, dx
cbw
dec byte [rsp + rdx*2 - 0x3ae9fbd8]
ror r8d, 1
ror r10w, 0x81
lea rcx, [r10*4 + 0x5d3b5830]
lea r8d, [r8 + r10 - 0x56b40f7d]
ror r8d, 2
xchg al, bl
inc dword [rsp + rdx - 0x1d74fdeb]
lea r8d, [r8 + rdx*2 - 0x3dec5a8e]
xchg qword [rsp + rdx*2 - 0x3ae9fbde], r10
neg r8d
xor word [rsp + rdx*2 - 0x3ae9fbe3], bx
div qword [rsp + rdx*4 - 0x75d3f7c8]
call fcn.140139320
call fcn.14028d19c
mov r8d, 0xcea48925
mov rax, qword [rsi + riz]
mov r8, qword ss:[rax + riz]
call fcn.140238c4e

Function at 0x140183ad3
Capabilities:
Manually build aes constants

Disassembly:
lea r11, [r11 + rdx*2 - 0x1c50a]
dec cx
mov r10d, 0x7d0c068f
movzx r10d, word [r11 + rdx*2 - 0x1c508]
xor r10w, r9w
push rsi
neg al
mov qword [rsp + rsi - 0x5780e279], rax
ror r10w, 1
or rax, 0x324ed8b
rol cl, 0x84
adc r10w, bp
mov qword [rsp + rsi - 0x5780e271], 0x21289314
neg r10w
pop rcx
sub r10w, 0x2c00
xor r9w, r10w
lea r10, [rsp + r10 + 0x10]
movzx cx, byte [r10 + rdx - 0xe284]
jmp 0x14021ca9a
Function at 0x1401858f3
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
call fcn.1400ded9b
xor edx, 0xf7b28d00
ror edx, 3
or ecx, ecx
and rcx, 0x24af92ae
not edx
mov qword [rsp + r9*2 - 0x5ffffff0], r8
sar rcx, cl
pop r8
mov qword [rsp + rcx - 0x8284], rbx
lea rax, [r9*8 - 0x67e900da]
xor dword [rsp + rcx*4 - 0x20a28], edx
sal r11b, 0xc7
jns 0x14020c698
sal byte [rsp + rax - 0x4c685142], 0x22
mov qword [rsp + rax - 0x4c685144], rdx
push rbx
sub si, si
mov qword [rsp + rax - 0x4c6850f4], r11
or si, si
cbw
xor rsi, 0x6e241db0
push rbx
push rdi
movsx r8d, ax
shl esi, 0xd
mov r11d, r8d
lea rdi, [rsp + rax - 0x4c680064]
push r9
jp 0x140223afa
lea r9d, [r11 + 0x1fffbc]
movsx ecx, si
sal r9, 0xb
cqo
push rcx
lea rsi, [rax + rdi - 0x4c68025c]
neg r11d
jl 0x140110cc0
mov edx, 0x54b28128
lea r8, [rdx*8 - 0x37d840f6]
dec r8b
lea rbp, [rbp + rdx - 0x54b2812c]
mov ecx, dword [rdx + rbp - 0x54b28128]
mov eax, 0x55adf3a8
call fcn.1401381c1
Function at 0x14018e00a
Capabilities:
Manually build aes constants

Disassembly:
or bx, ax
lea rbp, [rbp + rcx*2 - 0x41ba]
adc al, bl
mov word ss:[rcx + rdx - 0x20e2], r8w
jmp rdi
lea r8, [rdx + r8 - 0x480]
lea rax, [rbx - 0x9f90dd2]
movsx ebp, dx
sub bx, bp
xor r9w, r11w
movzx ecx, bpl
inc r9w
xor dx, ax
cqo
xor rcx, 0xfffffffff2ac3330
rol r9w, 1
lea rcx, [rdx - 0x5c52daec]
bswap r10d
neg r9w
not ecx
xor r9w, 0xa5a2
sub r9w, dx
xor r11w, r9w
inc cl
dec ebp
shr bl, 0x47
lea rsi, [rdx + rsi - 1]
cdqe
sub cl, cl
xchg bx, ax
mov word [rsi + rdx + 1], r9w
mov r9d, 0xc045ca9
cmovbe r9, rbx
mov r9d, dword [r8 + rdx*2 + 2]
add bl, dh
lea r8, [r8 + rdx*4 + 8]
xor r9d, r11d
sal r10d, 0xec
ror r9d, 2
idiv cx
neg r9d
cqo
rol cl, 0xe5
rol r9d, 3
lea r9d, [r9 + r10*2 + 0xed0f28e]
push rbx
call fcn.140294f35
mul cl
movsxd r10, r10d
add rdi, r10
xadd rax, rcx
xor rdx, qword [rcx + rbp - 0x20e2]
movzx ebx, r9b
neg ax
or r8w, word [rbp + rcx*2 - 0x41bc]
mov r10d, ecx
jmp 0x1400f46d5
shr rdx, cl
shr rbp, cl
xor r8d, 0xb10b6e18
xor rax, rbp
not r8d
mov qword [rsp + rdx], 0xfffffffff8098502
not byte [rsp + rax*2 - 0x2c433bfb]
mov qword [rsp + rax - 0x16219e00], rbx
mov r11d, ebp
sar bpl, 0x23
xor dword [rsp + rax*4 - 0x58867800], r8d
pop rbx
movsxd r8, r8d
dec rcx
sal rdx, 0x3b
adc rsi, r8
mov r8, rdi
lea rdi, [rax + rdi - 0x16219e02]
push rcx
rol r11w, 0x6f
or dword [rsp + rax - 0x16219dfe], edx
mov word [rax + rdi - 0x16219e00], r8w
inc byte [rsp + rax - 0x16219dfd]
sar r11, cl
xor rax, rbp
pop rdx
jp fcn.140149fd7
mov ecx, 0xc5b0f803
sub r11, 4
movsx eax, cl
mov ebp, ecx
movzx edi, bpl
mov ecx, dword [r11 + rax - 3]
not rbp
push rax
xor ecx, r9d
lea ecx, [rax + rcx - 0x1906b7c2]
not ecx
bt rax, 0xa9
xor ecx, 0x9e0fa194
xchg rbp, rdi
add ecx, 0xac833a31
not qword [rsp + rax - 3]
mov qword [rsp + rax - 3], r9
xor dword [rsp + rax*4 - 0xc], ecx
lea r9, [rbp*2 - 0x6ac14d00]
movzx edx, ax
pop r9
inc rbp
xor dx, 0x9aa3
movsxd rcx, ecx
or dil, al
adc r8, rcx
movsx r10d, dx
lea r11, [rax + r11 - 4]
xor dx, ax
mov al, byte [r11 + rbp - 4]
mov ecx, r10d
xor al, r9b
rol r10w, 0xa6
inc dx
adc al, dil
movsx esi, r10w
sub ecx, edi
xor al, 0xa0
ror al, cl
add cx, dx
add al, dil
sub rbp, r10
and r10b, sil
xor r9b, al
bswap ecx
add rax, rsp
ror bp, 0xae
lea rcx, [rbp + rcx*8 - 0x7cf6bf0]
and esi, edx
mov dx, word [rax + rdx*2 - 0x13548]
shr sil, 0xe6
jb 0x1401ec61c
ror esi, cl
lea rbx, [rsi + rbx - 0x44000002]
add r10d, ecx
adc cx, bp
xchg r10d, esi
mov word [r10 + rbx - 0x44000000], dx
not bpl
btr ecx, 0xa
jae fcn.1400e4ac0
mov ecx, 0xcb31382b
movzx r8d, cl
movzx eax, cl
mov edx, dword [rbp + r8*4 - 0xac]
lea rbp, [rbp + r8*4 - 0xa8]
xor al, 0x93
mov ebx, r8d
btc r8d, r8d
xor edx, edi
rol ecx, 0x23
bswap edx
lea r9, [rcx*8 + 0x2e2d5d17]
bts rbx, 0x81
neg edx
call fcn.1401b9ab5
not r10d
rol r10d, 1
lea r9, [r9 + r8 + 0x1126689d]
lea r10d, [r10 + rcx - 0x6cef4f81]
sal ecx, 0xaf
sar ecx, 0x15
neg r10d
push r11
movsx edx, r8w
xor dword [rsp + rdx*8 - 0x14228], r10d
movzx r11d, cl
movzx eax, r8w
sal r8d, cl
pop r11
cwd
jns 0x14012997c
mov r9d, 0xc51a0482
movsx edx, r9w
movzx r9d, word [r8 + rdx*8 - 0x2410]
movzx ebx, dx
lea r10, [rbx + rbx + 0xa333d92]
jmp 0x14011f486
Function at 0x140195689
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov rdx, qword [rbp + rdi]
imul r9w, bp
movzx r8w, byte ss:[rdx + rbp*4]
lea rdx, [rbp*2 - 0x42ec5b77]
and r9d, 0x3010f306
mov qword [rsp + rbp*2], r11
lea rdi, [rbp + rdi + 6]
mov word [rbp + rdi], r8w
jne 0x140290f90
mov qword [rsp + rbp], rsi
ret

Function at 0x1401956be
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
mov r10d, 0x56afdb28
lea r11, [r11 + rcx - 0xd]
bts edi, eax
mov edi, dword [rcx + r11 - 9]
lea rsi, [r10 + rdx*4 - 0x10f20ae4]
movzx ebp, word [rsp + rdx*2 - 7]
xor edi, r9d
xor edi, 0xef999223
sub rsi, qword [rsp + rcx*2 - 0xa]
rol edi, 2
bts rax, 0xbc
jae 0x14011c2de
mov ebp, 0xbe2c41ab
movzx esi, bp
mov rax, qword [rsi + rbx - 0x41ab]
lea rcx, [rbp + 0xa21dd19]
mov di, word ss:[rsi + rax - 0x41ab]
xor esi, ebp
adc rbx, 6
mov word [rbx + riz], di
sub r11, 4
push rsi
mov ebp, dword [r11 + riz]
xchg dword [rsp + 2], esi
neg cx
movsx r10d, si
xor ebp, r9d
movzx edx, word [rsp + rsi*4 - 0x2f8ac]
xor rsi, 0xffffffff9c156f0e
sub rdx, qword [rsp + rsi + 0x63ea2ede]
lea ebp, [rbp + rsi - 0x76b6f9b4]
dec cl
not edx
sal cl, 0xa7
ror ebp, 1
not qword [rsp + rsi + 0x63ea2ede]
xor qword [rsp + rsi + 0x63ea2ede], 0xffffffffc12dd1b4
lea ebp, [rcx + rbp - 0x64a175c5]
movsx eax, byte [rsp + rsi + 0x63ea2ee1]
mov edi, edx
call fcn.14010e6db
Function at 0x1401990d3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
push r11
sar r8w, cl
xor eax, 0x13aa5fa5
not r9
bswap eax
jmp 0x1401d3d58
or r11b, byte [rsp + r8 - 0x815e3ee]
lea rcx, [rsp + rcx + 0x20]
cdq
adc r8d, r11d
mov qword [rsp + r8*2 - 0x102bc99e], r11
mov r11w, word [rcx + r8*2 - 0x102bc99e]
or esi, 0x87196e96
lea r10, [r10 + r8 - 0x815e4d1]
mov word [r10 + r8 - 0x815e4cf], r11w
pop rax
pop r11
pop rcx
pop r11
jl fcn.1401c1b7c
sub r10, 4
mov r9d, 0x79ad1aa2
movsx ecx, r9w
push rcx
mov eax, dword [r10 + rcx*4 - 0x6a88]
lea rdx, [rcx + r9*8 + 0x2fb69727]
movsx ebx, word [rsp + rcx*8 - 0xd510]
mov r11d, dword [rsp + rcx*2 - 0x3542]
xor eax, edi
rol byte [rsp + r9 - 0x79ad1aa2], 0x81
sal cl, 0xc3
bswap eax
jp 0x14028cccd
adc eax, r11d
xchg ecx, r11d
sal r11d, 0x17
pop r11
neg eax
call fcn.14028ec18
mov r9d, 0xad8d9609
movsx ebx, r9b
movzx ax, byte [rsi + rbx*2 - 0x12]
movsx edx, r9b
mov cl, byte [rsi + rbx*2 - 0x10]
lea r11, [r9*4 + 0x47a1f126]
lea rsi, [rsi + rbx*2 - 0x10]
lea r9, [rdx + r9*2 - 0x52d27cd5]
not rbx
shr al, cl
movzx ecx, r9w
ror r11w, 0x24
push rdx
mov word [rbx + rsi + 0xa], ax
mov eax, dword [rbx + rbp + 0xa]
rol cx, 0xac
lea rbp, [rbx + rbp + 0xe]
mov r8d, 0xb79ef812
ror ecx, 0x7f
dec rbx
xor eax, edi
inc edx
not eax
jg 0x1401da40e
ror r9, 0xbd
inc eax
jmp 0x140194ef0
mov eax, edi
inc edx
lea rsi, [rax*2 + 0x4015e3aa]
not edx
movzx ecx, al
neg edx
ror edx, cl
push r9
lea r10, [rsi + rax - 0x3ef16264]
xor r10w, 0xf7b5
sal r10, 0x35
xor dword [rsp + rcx*8 - 8], edx
pop r9
mov ebp, edi
cdqe
movsxd rdx, edx
lea rax, [rdi + r10*2 + 0x729febac]
add r8, rdx
mov rcx, qword [rbx + rcx*4 - 4]
sub r10b, sil
lea rdx, [rax*8 - 0x73d62961]
neg r10b
mov rdi, qword [rbx + riz + 8]
bswap rax
btr edx, ebp
not si
lea rbx, [rbx + rdx*4 - 0x9ffb004]
mov qword [rcx + rdx*2 - 0x4ffd80a], rdi
sub edx, 0xa607e980
call fcn.14029c1ec
mov ecx, 0x8c140f26
lea rbp, [rcx + rcx*4 - 0x7f7c2bd2]
lea rsi, [rbp + 0x183e1b87]
mov cx, word [rbx + riz]
bts rsi, rsi
not esi
mov si, word [rbx + riz + 2]
movsx r10d, bp
call fcn.14018920d
xor eax, 0xea98cfa9
not r10d
sub eax, r10d
not r10w
not edi
call fcn.1400dcf47
mov esi, 0xc197940f
sub r11, 4
mov ebp, esi
mov ecx, esi
mov edi, dword [r11 + riz]
not bp
movsx r10d, bp
lea rax, [rsi + r10*8 + 0x37133789]
xor edi, r9d
ror edi, 2
bswap edi
imul sil
xor edi, 0x6b922125
rol edi, 1
mul rbp
call fcn.1402679ae
Function at 0x1401b1a98
Capabilities:
Encode data using base64

Disassembly:
push rbp
idiv al
sub r9d, 0x9a92af14
dec word [rsp + r8 - 0x39edd53]
call fcn.1401a594d
mov rsp, r8
call fcn.1400edc14
mov r9d, 0x39b0ab34
mov r8d, r9d
btr r9, r9
mov ebp, dword [r9 + rdi - 0x39b0ab34]
mov ebx, r8d
movzx edx, r8b
mov edx, dword [rdi + r8*2 - 0x73615664]
btc r8d, 0x14
mov cl, byte [rdi + r8*2 - 0x73415660]
bt r8w, r8w
sub r8, 0x3601ad89
shr r9w, 0xe3
lea rdi, [rdi + r8*8 - 0x1cf7ed52]
dec r8d
sal r8b, 0x21
shrd ebp, edx, cl
btr r8d, 0x2d
movsx edx, bx
movzx eax, bl
mov dword [rdi + r9 - 0x39b01566], ebp
lea r11, [r11 + r9 - 0x39b0156a]
movsx ebp, r8b
not edx
cbw
mov r9d, dword [r11 + r9 - 0x39b01566]
setae bl
xor r9d, r10d
xor r9d, 0xfc319cb4
not r9d
bswap r9d
rol rbx, 0xb1
xor r9d, 0x34bcc030
not r9d
jmp 0x140195a82

Function at 0x1401bdee2
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + r9 - 0x4b00890e], r9
neg ebp
call fcn.1400e43dd
or rdx, 0xffffffffba20bb35
js 0x1401ff403
mov ebp, 0x2239bdb3
mov eax, dword [r10 + rbp - 0x2239bdb3]
lea r10, [r10 + rbp - 0x2239bdaf]
lea r9, [rbp + rbp + 0x35948d2d]
xor eax, ebx
call fcn.1401ff393
xor dword [rsp + r9 - 0x294b], eax
pop rbx
movsxd rax, eax
or r9d, 0xfa0fa9bf
adc r10, rax
sub ecx, esi
rol r9, 0x63
or rbp, r10
jmp rbp

Function at 0x1401cff45
Capabilities:
Encode data using base64

Disassembly:
movsx ebp, dl
lea rdi, [rdi + rbp*2 - 0x30]
mov word [rdi + rbp*2 - 0x36], cx
and edx, 0xcf998b1f
movsx ebx, dl
lea r11, [r11 + rbp - 0x1f]
movsx r9d, dl
mov eax, dword [r11 + rbp - 0x1b]
xor eax, r10d
movzx r8d, dl
not eax
sal ebx, 0x36
sal ebx, 0x9c
ror eax, 2
imul r8, rbx
neg eax
mov ecx, ebp
xchg r9w, bp
not eax
rol cx, 0xe1
push r10
sal r8, 0x42
rol ebx, 0x4d
xor dword [rsp + rbp - 0x1b], eax
shr dx, 0xe4
cmovs rbx, r8
pop r10
movsxd rax, eax
sal r9b, 0xe1
dec rcx
shr ecx, cl
adc rsi, rax
inc rbx
seto r9b
lea rax, [r8*4 + 0x7c234f21]
add r9, rsi
jmp r9
add bp, r8w
movsxd rcx, ecx
or rdx, rbp
movsx r11d, bp
btc rdx, r8
add rsi, rcx
call fcn.14026475d
mov r9d, 0xf21bd116
neg r9w
sub r9, 0x6cb22138
mov rdx, qword [r8 + riz]
mov esi, 0x67067813
movsx ecx, si
jp 0x1401de807
mov rdx, qword [rdi]
mov cx, word ss:[rdx]
mov edx, 0xf48c5b1b
jmp 0x1401bebff
mov si, word [rsi + r8 - 0x6706780b]
lea r11, [r9 + 0x45916b11]
inc cx
ja 0x14024c547
lea r8, [r8 + rcx*2 - 0xf01e]
mov word [rdx + rcx*4 - 0x1e050], si
movsx esi, cl
bt r9, r11
mov eax, 0xe5905d94
lea rdi, [rcx + rdi - 0x7818]
call fcn.140261627

Function at 0x1401daa7f
Capabilities:
Encode data using base64

Disassembly:
lea rcx, [r9 + r9*2 - 0x16db22d8]
mov r9d, dword [r9 + rdi - 0x2f]
mov qword [rsp + rcx*2 + 0x2db64496], 0xffffffffd9a3f714
xor r9d, ebx
movsx ebp, dl
pop r11
ror r9d, 2
lea rsi, [rbp*4 - 0x347af9d1]
btr esi, 0x8e
dec r9d
not r9d
movsx eax, cl
call fcn.140250424
Function at 0x1401ff250
Capabilities:
Encode data using base64

Disassembly:
mov eax, r9d
neg r8w
mov qword [rsp + r9 - 0x5a29f153], rbp
ror r8w, 1
pop rbp
movzx ecx, word [rsp + r9 - 0x5a29f153]
shl r9d, cl
sbb r8w, 0x5815
cwde
xor bx, r8w
cdq
mul ebp
sbb dword [rsp + r9 - 0x453e2a5e], edx
lea r8, [rsp + r8 + 8]
xchg word [rsp + r9 - 0x453e2a5d], bp
movzx r11w, byte [r8 + r9 - 0x453e2a60]
xor rcx, rax
add word [rsp + r9 - 0x453e2a5a], 0x9524
lea rdi, [rdi + rdx - 0x5a297f31]
mov word [rdi + rbp - 0x5a29d626], r11w
mov r8d, dword [rsp + r9 - 0x453e2a5c]
pop rcx
jl fcn.140149fd7
lea rsi, [rsi + rax*2 - 0x640886a8]
not rbx
xor r8d, r11d
add ecx, 0xa4875689
dec cl
dec r8d
inc rbx
xor r8d, 0xbd27c782
movzx r10d, r9b
btc r9d, 0x24
bswap r8d
sub dx, 0x34a9
xadd r10b, al
xor r8d, 0x4f977989
bswap edx
cdqe
not r9w
push r11
inc r10w
setne cl
and rbx, 0x78ade235
xor dword [rsp + rax - 0x32044371], r8d
sub r9b, r9b
pop r11
xadd ecx, ebx
sar r9b, 1
bswap r10
movsxd r8, r8d
push rcx
adc rdi, r8
imul rdx
shr al, 0x67
mov qword [rsp + rbx - 0x9d28201], rdi
ret

Function at 0x1402060c8
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rax*4 - 0x2ab50], 0x2cba4091
pop rbx
pop rdx
jp fcn.1400dc126
mov byte es:[r11 + rcx - 0x4f41ac80], bl
movsx ebx, r8w
mov r11d, r9d
jmp r10

Function at 0x140211844
Capabilities:
Encode data using base64

Disassembly:
sbb ebx, 0xc80bce34
mov qword [rsp + r9 - 0xd1b0], rdi
xor dword [rsp + rcx - 0x4f], ebx
pop rdi
mov r11d, ecx
movsxd rbx, ebx
inc edx
sar r9, 0xdb
adc r10, rbx
jmp 0x140285ad0
jmp 0x140186160
or dx, 0xfe93
xor esi, 0x4abcf1bb
add edi, edx
shl r8d, 0x28
rol r8, 0xb0
push r10
idiv al
bswap rax
xor dword [rsp + rbx*4 - 0x4c], esi
movzx r10d, r8w
pop r10
xadd di, ax
movsxd rsi, esi
jle 0x14018b432
mul edi
add r11, rsi
mov r8w, word [r9 + rdi*2 - 0x64bac94c]
lea r9, [rdx + r9 - 0x13cb]
neg di
ror bx, 0x27
lea rbp, [rbp + rdi - 0x325d9b5b]
cwd
call fcn.14025fee4
jnp 0x1400ebfc1
mov ecx, 0xb2893a12
movzx ebx, cl
mov rax, qword [rdi + rbx*2 - 0x24]
movsx r9d, cl
movzx r11d, cx
lea rdi, [rdi + r9*8 - 0x88]
mov r11, rax
movsx ebp, r9b
not rbp
jmp 0x1401012ae
mov qword [rsp + rdx], rbp
lea rdi, [rdx + rdi - 4]
dec rbp
push rax
mov dword [rdi + rdx*4], r8d
mul al
movzx r8d, r9w
pop r9
pop rdx
jo fcn.140149fd7
sub rbp, 4
mov edi, 0xd6346613
mov esi, dword [rbp + riz]
movzx edx, dil
xor esi, r10d
mov r8d, edi
neg esi
ror esi, 3
movzx ebx, dx
or r8b, dl
lea esi, [rsi + rdx*2 - 0x42883c37]
lea rax, [rdi*2 - 0x1bcedbe1]
neg esi
div eax
imul dx
btr bx, 0x38
not esi
neg esi
jmp 0x1400f61b7
movsx ebx, dx
xor rdx, 0x1c0bc3b7
mov rcx, qword [rsi + rdx*2 - 0x6243d4e8]
call fcn.14013733e
Function at 0x14022e4d9
Capabilities:
Manually build aes constants

Disassembly:
imul ecx, ebx
xor dword [rsp + rbx - 0xf0aa], eax
pop rdi
movzx r11d, si
or r9, rbx
movsxd rax, eax
adc rbp, rax
xor bl, sil
add r11b, r9b
mov ecx, dword [r8 + rbx - 0xf0a0]
neg r9w
lea rax, [r11 + rbx + 0xa20ae80]
sar rbx, 0xd6
xor ebx, dword [r8 + rbx*2 + 4]
xor sil, r9b
lea r8, [r8 + rsi - 0x7907b558]
ror r9, 0xad
mov edx, r11d
add al, 0x19
adc ecx, ebx
mov dword [r11 + r8 - 0xb5b4], ecx
or r9b, r9b
cmovbe r9w, dx
jmp rbp
inc eax
mov esi, ecx
xor eax, 0x8d9ec403
and sil, 0xa
push rdi
jp 0x14016dfc9
lea rsi, [rsi*2 - 0x702167]
sub edi, edi
lea rbx, [rdx + rbx - 0xe286]
xadd word [rsp + rdx*2 - 0x1c500], si
mov word [rbx + rdx - 0xe284], cx
pop rdx
pop rdi
jp fcn.1400e4ac0
pop rax
pop rcx
pop r8
pop r9
pop rdx
ja fcn.1402226a6
mov r9d, 0x8d18f8ab
mov eax, 0xc33cad88
sub r10, 4
btr r9w, 0xb
mov eax, dword [r10 + riz]
mov ecx, 0x79074a81
xor eax, edi
xor eax, 0xef90ba13
neg cx
bswap eax
dec r9
movzx ebx, r9w
jp 0x14021ca86
mov eax, 0x2022a592
lea rcx, [rax + 0x5a8020b3]
mov esi, eax
mov r11, qword [r8 + rax*2 - 0x40454b24]
mov rcx, qword [rax + r8 - 0x2022a58a]
movzx ebx, si
lea r8, [rax + r8 - 0x2022a582]
mov qword [rax + r11 - 0x2022a592], rcx
lea r10, [r10 + rax - 0x2022a596]
mov ecx, dword [r10 + rsi - 0x2022a592]
movzx r11d, al
mov r9d, eax
jmp 0x140164c52

Function at 0x1402394ee
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
adc edx, dword [r8 + rbp - 0x67ffffc]
lea rsi, [rcx + rbp*2 - 0x4766bb52]
lea r8, [r8 + rsi*2 + 0x74cd76a8]
jmp 0x14013e97e
xor dword [rsp + r8 - 0x3b277bb8], edi
cdq
pop r10
call fcn.140248f17
cbw
inc r9d
mov qword [rsp + rdx - 0x27340000], rdx
not qword [rsp + rbp - 0x67ffff8]
neg r9d
sub dword [rsp + rbp - 0x67ffff5], edx
imul rbp
movzx r11d, si
not r9d
sbb r9d, 0xc80694ac
movzx ecx, r11b
push rbp
or al, 0x90
mov qword [rsp + rdx*2 + 0x10], rbx
and qword [rsp + rdx + 8], r11
mov ebx, ebp
xor word [rsp + rdx*2 + 4], cx
xor dword [rsp + rdx*4 + 0x10], r9d
mov rbx, qword [rsp + rdx + 0x10]
xchg byte [rsp + rdx + 0xf], r11b
movsxd r9, r9d
add r10, r9
shl byte [rsp + rdx + 0xa], 0x84
sbb bpl, byte [rsp + rdx + 0xa]
mov qword [rsp + rdx + 0x10], rsi
mov r11d, dword [r8 + rdx*2]
sets bpl
lea r9, [rsi*8 - 0x225aec79]
jns 0x1400deab7
inc byte [rsp + rax - 0x401111bc]
lea r10, [rsp + r10 + 0x30]
movsx ebx, word [rsp + rdx*4 - 0x1fcf6a1]
sal eax, 0xd8
mov rdx, qword [r10 + rdx - 0x7f3dad]
or qword [rsp + rbx - 0xe2], r9
mov ebp, ecx
mov qword [rsp + rbx*2 - 0x1d6], rbx
lea rsi, [rbx + rsi - 0x107]
push rbx
cbw
mov qword [rsi + rbx*8 - 0x7f8], rdx
sbb cl, 0x85
sar word [rsp + rbx*2 - 0x1f5], 0xc4
mov edx, r9d
pop rbx
pop r10
pop r10
pop rdx
pop rbx
pop rbx
pop rax
jp fcn.1401ec884
mov r8d, 0x3b277bb8
lea rbp, [r8 + rbp - 0x3b277bbc]
movsx esi, r8w
mov ebx, 0x9bb3a6ad
mov edi, dword [rbp + r8 - 0x3b277bb8]
xor edi, r10d
bts ebx, ebx
add rsi, 0xffffffffc924e599
bts bx, bx
lea edi, [rdi + rsi*2 + 0x407be756]
mov eax, ebx
movsx edx, r8b
not edi
inc edi
movzx ecx, ax
neg bx
bswap edi
and si, 0xbf02
inc ecx
push r10
jg 0x1401fd3bb