joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140deeff8
Capabilities:
Authenticate hmac

Disassembly:
and rdx, qword [rsp + rbx - 0x523cbdff]
lea r9, [r9 + rbx - 0x523cbdfd]
lea rdi, [rdi + rbx - 0x523cbe01]
movzx ebx, word [rdi + rdx*4]
jg 0x140dd7960
xor bx, r11w
div r8w
rol word [rsp + rdx + 4], 7
rol bx, 1
sub bx, 0x4d2b
xor bx, 0x4f3e
not bx
shr dword [rsp + rdx*2 - 2], 0x4b
add dword [rsp + rdx], edx
pop rdx
xor r11w, bx
mov ebp, eax
push rcx
or cx, ax
lea rbx, [rsp + rbx + 8]
mov dword [rsp + rbp*2 + 2], eax
or dword [rsp + rbp*2 + 1], ecx
mov word [rbx + rbp*4], r10w
mov qword [rsp + rbp], rsi
ret
xor dword [rsp + r8 - 0x605fffe8], edx
mov r11, qword [rsp + r10*2 + 0x16]
sar qword [rsp + r10*2 + 0xe], 0x7e
sub r8b, 0x19
movsxd rdx, edx
add rsi, rdx
mov rbx, qword [r9 + r8 - 0x606000e7]
imul r8d
mov al, byte [r9 + r10*2 + 6]
mov qword [rsp + r8 - 0x606000e7], rbp
jo 0x140db330e
jmp 0x140e11b5f
mov ebp, 0x8fac1da4
mov r8d, 0x189e5e84
lea rdi, [rdi + r8*2 - 0x313cbd0c]
mov ecx, dword [rdi + r8 - 0x189e5e84]
lea rax, [rbp + r8*4 + 0x6da24203]
xor ecx, r11d
lea rbx, [r8 + rbp*2 + 0x49122e96]
cwde
ror ecx, 1
imul r8b
lea rdx, [rbx*4 - 0x68e87f7e]
not ax
bswap ecx
jae 0x140e1a3a4
xor ecx, 0xcdbf4a1c
neg ecx
cdq
push r11
movzx r11d, dx
xor dword [rsp + r8 - 0x189e5e84], ecx
not al
or rdx, rbx
ror rbp, 0xa4
pop r11
cwde
je 0x140dd2eb0
movsxd rcx, ecx
adc rsi, rcx
mov rcx, qword [r9 + r8*4 - 0x62797a10]
lea r9, [r9 + r8 - 0x189e5e7c]
lea rdi, [rdi + r8*4 - 0x62797a12]
xor ax, 0xbea4
jg 0x140df8eed
sar dl, 1
and byte [rsp + rbx - 0x1480f91a], r8b
not r10b
mul qword [rsp + rbx*2 - 0x2901f236]
xor r11b, r10b
mov ecx, dword [rsp + rbx - 0x1480f918]
div r8
lea r10, [rsp + r10 + 8]
mov cx, word [r10 + rbx*2 - 0x2901f236]
shl al, 0x66
call fcn.140dbb2fc

Function at 0x140def20a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r8d, [r8 + rcx*2 - 0x6ec4f17d]
mov qword [rsp + rcx - 0x1d96dbf9], rax
not r8d
add edx, dword [rsp + rcx - 0x1d96dbf9]
sub al, al
mov qword [rsp + rcx - 0x1d96dbf9], r11
xor dword [rsp + rcx*4 - 0x765b6fe4], r8d
lea r11, [rax*2 - 0x6ef31efc]
and ax, bp
cwde
pop r11
and rcx, 0x60aae7be
rol bp, 0x81
movsxd r8, r8d
add rsi, r8
cdq
rdtsc
movzx ebx, bp
xor ebp, 0x7118e281
and cl, cl
lea r9, [r9 + rcx*2 - 0x1058778]
adc bl, bl
inc cl
mov dword [r9 + rcx*4 - 0x20b0ee0], eax
movzx r10d, bpl
add cx, r10w
mov dword [rcx + r9 - 0x82c44b], edx
dec r10d
jne fcn.140e0aedf
Function at 0x140df1a4e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov ebp, dword [rdi + r8 - 0x104]
lea rdi, [r10 + rdi - 0x711eed14]
add dword [rsp + r8*4 - 0x3f9], r8d
xor ebp, r11d
not ebp
and byte [rsp + r8 - 0xfc], 0x9e
pop rcx
inc ebp
xor ebp, 0x121c2701
jmp 0x140dcea65
jmp 0x140dceb9c
cwde
rol ebp, 1
call fcn.140dcded1
mov r10d, 0x2fbcec91
mov r10, qword [r10 + r9 - 0x2fbcec91]
mov ebp, 0xccb3f10f
mov al, byte [r9 + riz + 8]
add r9, 0xa
lea rcx, [rbp + 0x70152f2c]
mov byte es:[r10 + riz], al
sub rdi, 4
mov ecx, dword [rdi + riz]
movsx r10d, bpl
xor ecx, r11d
movsx ebx, bp
dec ecx
mov eax, ebp
sal ebx, 0x99
neg ecx
bswap ecx
ror r10d, 0xac
not ecx
sar bp, 0x41
and r10b, al
movsx r8d, bpl
push r11
mov r11d, ebx
add r11b, 1
xor dword [rsp + r10*4 - 0x3c00000], ecx
add r10, 0x3923eb01
mul ebx
pop r11
sub ax, bp
movsxd rcx, ecx
call fcn.140dcc6fd
movzx bx, byte [rdx + r10 - 0x711eed10]
mov qword [rsp + r8 - 0xf], rax
sub r8b, r10b
mov word [r9 + r8 - 0x101], bx
dec r10w
jno 0x140db5956
Function at 0x140df5515
Capabilities:
Authenticate hmac

Disassembly:
mov byte ss:[rax + rbx*8 - 0xc8], r8b
mov qword [rsp + rcx - 0x410ec2e7], rcx
sal byte [rsp + rbx*4 - 0x63], cl
pop rbp

Function at 0x140df782e
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
sub rdi, 4
mov ebx, 0x7bb9e41a
movsx r8d, bx
lea r8, [rbx + rbx*8 + 0x528491b9]
mov ecx, dword [rbx + rdi - 0x7bb9e41a]
imul ebx, r8d
lea rbp, [r8 + r8 - 0x42cd7fd2]
xor ecx, r11d
lea ecx, [rbx + rcx - 0x674c0762]
not r8b
bswap ecx
mov eax, ebp
neg ecx
lea rdx, [rbp + r8*8 - 0x22771745]
shr bpl, 5
ror ecx, 1
neg ecx
bswap ecx
shl eax, 0xe
push r11
lea rdx, [rdx + 0x62a180b8]
xor dword [rsp + rax - 0x6b5d0000], ecx
bts bp, bx
lea rbx, [rbx + r8*4 + 0xc96fbac]
pop r11
movsxd rcx, ecx
sub rbx, rdx
sar dx, 0x82
add rsi, rcx
inc bl
mov r10d, 0xf81f7aac
lea rdi, [rdi + rax - 0x6b5d0001]
btc rbp, 0x2d
jae 0x140de6a66
push r10
bswap eax
mov qword [rsp + r10*4 + 0x68723ef8], r11
neg cx
xor dword [rsp + r10 + 0x1a1c8fd6], eax
movsx edx, r10b
mov r11, qword [rsp + r10 + 0x1a1c8fd6]
sub ecx, ecx
movsxd rax, eax
not word [rsp + rcx + 2]
shl edx, 0xf8
add rbp, rbx
add rsi, rax
lea r8, [rbp + 0x2d911ba8]
mov qword [rsp + rcx*4 + 0x20], rdx
rol edx, 0xb5
mov r9w, word [r9 + rcx*2]
pop r8
pop r8
pop rax
pop rbp
pop rcx
jae fcn.140e0aedf
sub rdi, 4
mov r10d, 0xea00c939
movzx ebp, r10w
mov eax, dword [rdi + rbp*2 - 0x19272]
lea rbx, [rbp*8 - 0x5f4bc3cd]
xor bpl, bpl
imul bx, bp
xor eax, r11d
lea eax, [rax + rbp - 0x5c8a1e3a]
bswap eax
push r10
rol eax, 1
movsx edx, r10b
inc eax
xchg qword [rsp + rbp - 0xc900], r10
sar word [rsp + rbp - 0xc8fe], 0xc3
sal dword [rsp + rbp - 0xc8fe], 0x8d
bswap eax
rol eax, 2
inc eax
movzx r8d, dx
inc bl
add qword [rsp + rdx*2 - 0x72], r8
mov qword [rsp + rbp*4 - 0x32400], r11
lea rcx, [rbx*2 - 0x67f27d48]
lea r11, [rbx - 0x54d4ebec]
lea r11, [rcx + rdx*8 + 0x329ea3d]
xor dword [rsp + rbp*2 - 0x19200], eax
shr rcx, 0x4b
bts cx, 0x96
pop r11
lea rdx, [r8*2 + 0x13894487]
sar rcx, 0x9f
setbe r8b
movsxd rax, eax
lea r10, [rdx*2 - 0x7b4692c3]
imul cx, bp
jno 0x140e19299
lea rdi, [rdi + rbp - 0x1f00e0ec]
inc dword [rsp + rbp*2 - 0x3e01c1bd]
movzx ebx, r10w
mov edx, dword [rdi + rbp - 0x1f00e0e8]
movsx ecx, r10b
mov r10, qword [rsp + 8]
add r10, 0xffffffffffffdc79
jmp r10
movzx r8d, byte [rdi + rax - 0x6b5d0000]
mov ecx, eax
lea r9, [rcx + r9 - 0x6284]
sal r8b, 0x27
call fcn.140dc6e18
sub rdi, 8
mov edx, 0xa53a9092
lea rax, [rdx*4 + 0x1c311d05]
movsx r10d, al
mov rbp, qword [r10 + rdi - 0x4d]
or dx, r10w
xor rbp, r11
lea rbp, [rbp + r10 - 0x394a29cd]
neg rbp
mov ebx, 0x262d1c36
ror rbp, 5
mov ecx, 0xab7ab7
ror ebx, 0x27
and r10w, r10w
not rbp
and edx, edx
rol rbp, 5
xor r10, r10
bswap rbp
not cx
mov r8d, ebx
dec r10
xor r11, rbp
xor r8b, 0x9f
lea r9, [r9 + r10*4 - 4]
mov qword [r9 + r10*4 + 4], rbp
bswap rdx
push rcx
call fcn.140dc0236
jmp 0x140dd6df2
Function at 0x140df88f0
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [rdi + rax*8 - 0x6f]
sar byte [rsp + rax + 2], 0x62
ror qword [rsp + rax*4 - 0x24], cl
or byte [rsp + rax + 9], cl
lea rdi, [rdi + rax*2 - 0x21]
xadd word [rsp + rax - 3], r8w
xor ebx, r11d
and al, byte [rsp + rax*8 - 0x51]
shl word [rsp + rax + 0xa], 0xa8
and r8b, byte [rsp + rax*4 + 0x14]
lea ebx, [rbx + rax*2 - 0x42a6dfb9]
not rcx
bswap ebx
movsx edx, bpl
imul ebp, ecx
xor ebx, 0x70eab82
sar ecx, cl
sal qword [rsp + rcx*2 - 0x21de], 0x71
call fcn.140dcc658
inc bl
mov qword [rsp], 0x7a9e7734
shr word [rsp + 5], 0x84
shr rax, 0x54
xor bl, 0x8a
rol bl, 1
dec bl
ror rax, cl
not word [rsp + 5]
ror byte [rsp], 0xc4
xor r11b, bl
sar word [rsp + 3], 0xc8
not r10
lea rbx, [rsp + rbx + 8]
btc r8d, edx
xor al, byte [rbx + riz]
not word [rsp]
mov word [r9 + riz - 2], ax
push rcx
movzx edx, word [rdi + riz - 3]
movsx eax, r8b
lea rbp, [r8*2 - 0x445115d2]
movzx ebx, bpl
xor dx, r11w
dec dx
push r10
neg dx
dec qword [rsp + rax*2 - 0xd]
shr r8w, 8
sbb dx, 0xc393
neg dword [rsp + rax - 8]
not dx
xchg qword [rsp + rax*4 - 0x24], rbx
ror dword [rsp + rax - 4], cl
or ebp, ebp
xor r11w, dx
mov word [r9 + rax - 0x11], dx
dec qword [rsp + rax - 7]
ror byte [rsp + rax - 2], 0xc3
lea r9, [r9 + rax*2 - 0x1e]
ja 0x140dda1da

Function at 0x140dfcaf2
Capabilities:
Authenticate hmac

Disassembly:
mov qword [r9 + rax - 6], rbx
movzx ecx, bpl
mov qword [rsp + rax*2], rbp
lea r9, [r9 + rax - 6]
movsx ebx, byte [rsp + rax*2 + 3]
pop rdx
jne fcn.140e0aedf

Function at 0x140dfd481
Capabilities:
Execute anti-debugging instructions
Manually build aes constants

Disassembly:
jle 0x140ddb548
mov r10d, 0x7b367199
movsx ebx, r10b
mov rbx, qword [r10 + r9 - 0x7b367199]
jmp 0x140df08be
mov dword [r9 + riz], edx
sbb rdi, 3
mov ecx, ebp
shl ecx, cl
mov edx, dword [rdi + riz]
xor r10, rcx
lea r8, [rcx + rbp*2 - 0x3547fad7]
sbb r10, rbp
xor edx, r11d
jmp 0x140df6ffe
call fcn.140de489b
ror eax, 1
movsx ecx, r10w
mov qword [rsp + rbx - 0x60cb86b6], rcx
bswap eax
xor eax, 0xcdbf4a1c
mov edx, dword [rsp + rcx - 0x48a5]
xor bpl, dl
call fcn.140de4263
rdtsc
sub r9, 8
mov dword [r9 + 4], eax
mov ecx, 0x9292ca3c
mov dword [r9 + riz], edx
mov eax, ecx
sub rdi, 4
lea rbp, [rcx*4 - 0x29de5bc1]
xor ebp, 0x822ae71e
lea r8, [rbp - 0x116a9fe0]
mov r8d, dword [rdi + riz]
movsx r10d, bpl
xor r8d, r11d
lea rdx, [r10 + r10*2 + 0x783daaa5]
shr r10b, 0x63
ror r8d, 3
neg r8d
bts r10w, ax
shl cx, 2
xor r8d, 0x99a35b8
sar r10d, 0x39
shl al, 0xa2
lea r8d, [r10 + r8 - 0x3397398b]
ror r10d, cl
not r8d
push r11
mov ebx, ecx
inc cx
xor dword [rsp + r10], r8d
or ax, 0x640b
shr rcx, 0x4a
pop r11
or rdx, rax
and cx, 0xf99
or rax, 0x32918112
movsxd r8, r8d
dec bpl
sub r10w, dx
imul r10d
add rsi, r8
xadd al, r10b
jno fcn.140e0aedf
mov r9, rbp
ror dx, cl
jns 0x140dfed45
mov edx, 0xbe2a96a7
lea r10, [rdx + rdx*8 - 0x50d8724e]
movsx ebp, r10b
rdtsc
sub r9, 8
mov dword [r9 + riz + 4], eax
xadd r10w, bp
jne 0x140db333e
Function at 0x140dfd8da
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [rdi + rdx*4 - 0x466d6a48]
movzx ecx, dl
xor eax, r11d
mov qword [rsp + rdx - 0x119b5a8a], 0x622a1c30
movzx ebx, dl
mov qword [rsp + rdx - 0x119b5a92], rcx
rol eax, 3
mov byte [rsp + rdx*2 - 0x2336b51e], 0x36
sar cx, 1
rol byte [rsp + rcx*2 - 0x91], 0x22
bswap eax
lea r10, [rcx + rbx*2 + 0x7a6cb19]
ror eax, 1
ror byte [rsp + rdx - 0x119b5a8f], 0xa5
bswap rcx
lea eax, [rax + rdx*2 + 0x2d7a218a]
sal edx, 0xdb
xor eax, 0x883cdc3a
dec edx
lea r8, [rcx*2 + 0x5687ae10]
sub r10, 0xffffffff91a656bc
rol eax, 2
btr edx, 0xab
neg word [rsp + rbx*2 - 0x11b]
xor eax, 0x23b19121
xadd dword [rsp + rbx - 0x8f], r8d
mov qword [rsp + r10 - 0x760075c2], r11
movsx r11d, cl
xor dword [rsp + rbx - 0x8a], eax
add dword [rsp + rbx - 0x91], 0x2f3db921
mov r11, qword [rsp + rbx - 0x8a]
movsxd rax, eax
adc rsi, rax
btc bx, cx
btr ebx, r10d
mov r10, r9
lea rax, [rbx*4 - 0x2ed14451]
call fcn.140e06790
mov ebx, dword [rdi - 4]
mov r10d, 0xc39aca2d
xor ebx, r11d
push r10
not ebx
inc ebx
rol ebx, 1
xor qword [rsp], r10
lea ebx, [rbx + r10 - 0x730b1111]
mov ebp, 0xa90b5808
rol ebx, 1
bswap ebx
mov r8d, 0x6b84c698
shl r10b, 0xc5
neg ebx
call fcn.140dd17ac

Function at 0x140dfe41c
Capabilities:
Authenticate hmac

Disassembly:
not edx
bt r10d, ebx
inc edx
mov qword [rsp + rcx - 0x2246091], rbx
bts cx, r10w
rol edx, 3
not rcx
xor dword [rsp + rcx + 0x2246093], ebx
xor edx, 0x1e3f04a8
mov ebp, 0xf512928a
dec edx
not edx
jmp 0x140dc61c8
Function at 0x140dff9e5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor r8d, 0x2c036a98
pop r10
mov qword [rsp + rdx - 0x25], r11
xor dword [rsp + rdx - 0x25], r8d
mov r11, qword [rsp + rdx*8 - 0x198]
movsxd r8, r8d
inc qword [rsp + rdx - 0x2d]
add rsi, r8
cqo
movzx r10d, byte [rsp + rdx*2 + 9]
mov eax, dword [r9 + rdx]
movzx ebp, word [rdx + rdi - 6]
add rdx, rbx
mov ecx, r10d
xchg word [rsp + rbx*2 - 0x77e9c1f2], dx
xor bp, r11w
inc dword [rsp + rdx - 0x3bf3fff7]
mov qword [rsp + rdx - 0x3bf3fff0], 0xffffffffb1061597
rol bp, 1
xor bp, 0xc492
and dx, 0xbbbf
sbb bp, 0xfb99
xadd rbx, r10
adc bx, 0x8180
mov qword [rsp + rbx - 0x3bf46280], 0x5192608a
not bp
sal qword [rsp + rdx - 0x3bf40000], 0x9d
xor r11w, bp
lea rbp, [rsp + rbp + 0x18]
mov dword [rbp + rdx*2 - 0x77e80000], eax
movzx r10d, byte [rbx + rdi - 0x3bf46287]
xchg word [rsp + rbx - 0x3bf4627d], cx
movsx r8d, dl
and bx, word [rsp + rdx - 0x3bf3fff9]
lea rdi, [rdi + rdx*2 - 0x77e80007]
mov ebp, ecx
xor r10b, r11b
xor word [rsp + rbx*2 - 0x77e84400], cx
not word [rsp + rdx - 0x3bf40000]
neg r10b
shl rbp, 0xdb
pop r8
adc r8, qword [rsp + rdx - 0x3bf3fffb]
sbb r10b, 0xb0
not r10b
push rdx
sal ebp, 0x14
jb 0x140e0cbbe
adc r10b, 0xb5
ror r10b, 1
dec r10b
xor rbp, rdx
rol r10b, 1
sar r8w, 0xac
sal r8d, 0xa1
adc r10b, dl
xadd rbp, r8
jb 0x140dc0a5f
xadd qword [rsp + rdx - 0x3bf3fff0], rdx
xor r11b, r10b
xchg byte [rsp + rdx + 0x4ef9ea72], r8b
lea rax, [rdx + r8*4 - 0x3f63eb44]
push rbp
mov word [r9 + rbx - 0x3bf421fe], r10w
xor ebp, ebx
xor rax, qword [rsp + rbp - 0x5043dde6]
dec dword [rsp + rbx - 0x3bf421f2]
lea r9, [rbx + r9 - 0x3bf421fe]
adc eax, dword [rsp + rbx - 0x3bf421f5]
pop r10
neg r8b
mov qword [rsp + rbx - 0x3bf42200], rsi
ret 0x10
ret 8
Function at 0x140e0020b
Capabilities:
Authenticate hmac

Disassembly:
xor al, 0xb0
not r8
sar r8b, 5
neg al
movsx ecx, r10b
mov word [rsp + rdx - 0xfffd], 0xc6b4
shr ebp, cl
dec al
not r10b
or ebp, r8d
ror al, 1
xor bl, 0x16
lea rbp, [r8 + rbx - 0x34d5826e]
inc al
inc rcx
xchg qword [rsp + rdx*4 - 0x3fff8], r10
xor al, 6
imul cx, bp
adc r10b, byte [rsp + rdx*2 - 0x1fffa]
sbb al, 0x93
xor r11b, al
lea rax, [rsp + rax + 0x10]
pop rbp
mov ecx, dword [rax + rdx*4 - 0x40000]
dec qword [rsp + rdx - 0x10000]
mov dword [r9 + rdx*4 - 0x40000], ecx
add bx, 0x9f01
push rbp
lea rbp, [r8 + rbp*2 + 0x4799ad37]
mov qword [rsp + rdx - 0x10000], rsi
ret 8
movsxd rbp, ebp
adc rsi, rbp
not dl
imul bl
mov ecx, dword [r9 + r10*4 - 0xa61c]
sub r8b, r8b
mov qword [rsp + r8*2], rax
or r8d, dword [r9 + r10*8 - 0x14c34]
div r10b
cwd
or ecx, r8d
not ecx
mov dword [r9 + r10 - 0x2983], ecx
push r10
add rbx, 0xffffffffac9fd813
movzx eax, byte [rdi + r10*2 - 0x5313]
inc dword [rsp + r10*2 - 0x5302]
imul rbx, rdx
sub r10d, edx
lea rdi, [rdx + rdi - 0x10005]
xor r10d, 0x1318748d
rol qword [rsp + rdx*2 - 0x1ffff], 8
xor al, r11b
neg al
mov r8d, r10d
sub al, 0x39
lea rbp, [rbx + rdx - 0x4cf55370]
rol r8w, 0xc8
jb 0x140ddaef2
mov r10d, 0xd1297abb
mov ecx, 0x340d241d
movzx ebx, byte [rdi + rcx - 0x340d241e]
mov edx, ecx
movzx eax, cl
lea r8, [r10 + rax - 0x24ce9748]
xor bl, r11b
add bl, 0x29
ror bl, 1
neg bl
inc bl
or r10d, 0x7509412b
inc al
xor r11b, bl
sar cx, 0x81
sar dx, cl
movzx ebp, r10w
add rbx, rsp
shr rbp, cl
btr r10w, bp
lea rax, [rcx*4 - 0x407e9f46]
mov r10, qword [rbx + rcx - 0x340d120e]
mov qword [r9 + rcx*2 - 0x681a2424], r10
mov ecx, dword [rcx + rdi - 0x340d1213]
mov r10d, ebp
bts edx, r8d
xor ecx, r11d
lea ecx, [rbp + rcx - 0x5598c62b]
sub rbp, rdx
xor ecx, 0x2b893591
sub r10d, 0x32ad8eb1
ror ecx, 1
xadd bpl, r10b
cdq
xor ecx, edx
dec bpl
cwde
bswap ecx
xchg rdx, rax
movzx ebx, al
push r11
jp 0x140ddf53d

Function at 0x140e012bc
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r10 - 0x5d3e668e], r11
bts ebx, r10d
xor dword [rsp + r10 - 0x5d3e668e], r8d
xadd r10d, edx
pop r11
cmovno eax, ebp
cmovne cx, r10w
mul bpl
movsxd r8, r8d
xadd bp, bx
push rdx
sar ebp, 0x72
adc rsi, r8
shl eax, cl
ror word [rsp + rbx - 0x5b39], 0x6f
call fcn.140dd4751
Function at 0x140e01b62
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov dword [r9 + rdx*2 - 0x7fffe458], ebx
movsx ebx, dx
lea rdi, [rdi + rdx - 0x3ffff230]
movsx ecx, dl
xchg r8, rdx
mov edx, dword [rdi + rdx - 0x4000001e]
sub bpl, 0xae
bt eax, ebp
xor edx, r11d
shr ebx, cl
inc r8w
adc bp, 0xb9bb
inc edx
sub ebp, ebx
bts rcx, rax
xor bx, 0x48b2
rol edx, 3
inc ax
sub bpl, bpl
lea edx, [r10 + rdx - 0x372b4a1d]
sal r10, cl
ror edx, 1
push r11
sal bp, cl
xor dword [rsp + r8 - 0x3ffff22d], edx
jmp 0x140e069dd
xor r9d, r10d
not byte [rsp + 4]
and r9d, 0xff
inc qword [rsp]
dec dword [rsp + 3]
mov r9d, dword [rsi + r9*4]
shr r10d, 8
xor r10d, r9d
shl byte [rsp + 3], 0xe7
inc rcx
xor r10d, 0x8785b009
add qword [rsp], 0xfffffffff58b8f06
push 0xffffffff8812332c
dec rbp
jmp 0x140dd27e3
pop rsi
not r10d
mov r8d, 0xfa9da9ad
movzx edx, r8b
movsx ebp, r8b
mov dword [rdx + r9 - 0xad], r10d
inc rdx
lea rdi, [rdi + rdx - 0xb2]
movsx ebx, bp
mov r10d, dword [rdi + rdx*8 - 0x570]
xor r10d, r11d
rol r10d, 2
dec bx
lea r10d, [r10 + rdx*2 + 0x14068246]
bt r8, rbx
not r10d
lea rax, [rdx + rdx + 0x3ca31325]
setb dl
ror r10d, 3
dec rbx
push r11
sal al, 0xa5
mul bp
bts ax, r8w
xor dword [rsp + rdx*2 - 0x2832], r10d
btc rdx, r8
pop r11
cdq
movzx ecx, dl
movsxd r10, r10d
adc rsi, r10
add rdx, rsi
jmp rdx
lea rsp, [rsp + 0x10]
jne 0x140e08e04
pop r9
jmp 0x140dc6222
mov qword [rsp], 0x39b90b97
neg word [rsp + 5]
mov ebp, dword [rdi]
xor ebp, r11d
sar byte [rsp + 2], 0x41
mov edx, 0x7904fe3b
rol ebp, 3
neg ebp
ror word [rsp + rdx - 0x7904fe35], 1
pop rdx
bswap ebp
movzx eax, dl
not ebp
push r11
mov r11d, 0x87ad78bc
mov ebx, eax
lea rcx, [r11*2 - 0x325ce47d]
xor dword [rsp + rdx*2 - 0x73b8172e], ebp
inc r11d
movsx r10d, r11w
mul rbx
pop r11
jno 0x140e08d98
movsxd r10, r10d
adc rsi, r10
add rbx, rbp
ror r8d, cl
or rbp, rsi
jmp rbp
sar cx, cl
imul r10, r10
pop r11
lea rax, [rcx*2 + 0x548fdf34]
movsxd rdx, edx
sar ebx, 0xaf
inc ecx
adc rsi, rdx
cdq
jmp 0x140e12127
jno 0x140e11ac4
mov rcx, qword [r9]
mov ebp, 0xd72b31bf
mov rbp, qword [r9 + riz + 8]
push 0xffffffffd622c69a
add r9, 0xc
xor byte [rsp + 6], 0x94
seta byte [rsp + 4]
xor r10d, r10d
not byte [rsp + 3]
push 0x2b117f17
test rbp, rbp
lea rsp, [rsp + 0x10]
je 0x140dc6223
push 0xffffffffcc8e2c39
mov qword [rsp], rsi
mov esi, 0x521454ae
imul si, si
push r9
jae 0x140dba874
movsx r9d, si
add r9b, sil
lea rsi, [0x140e07740]
movzx r9d, byte [rcx]
push 0xffffffffad1bc30c
rol word [rsp + 2], 0x81
jo 0x140dbc8d5
movsxd rbp, ebp
movsx r8d, ax
bt edx, r10d
adc rsi, rbp
movsx ebp, cl
bts r10w, cx
btc r10, rbx
mov bp, word [r9 + rdx*2]
sar dl, 0x27
and rax, r8
mul ecx
mov r10w, word [r9 + rbx*2 - 0x12c]
call fcn.140df101b
and bl, bl
or r10, rsi
jmp r10

Function at 0x140e02c46
Capabilities:
Authenticate hmac

Disassembly:
add ebp, 0xdfbcd182
jmp 0x140ddb60d
Function at 0x140e03330
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0xeb0fca05
sar eax, 0x50
sar ax, 0xa9
mov rax, qword [rbp + rbx*8 + 0x20]
jp 0x140e1d6bb
movsx edx, cl
bswap eax
not eax
mov ebp, 0x2f09bf28
jle 0x140db8128
lea rsp, [rsp + 0x18]
jne 0x140dda233
push 0xffffffff963fdda5
pop r9
mov r9, rax
call fcn.140dd0e57
sub rdi, 4
mov eax, dword [rdi]
mov ecx, 0xdab66e92
xor eax, r11d
xor eax, 0x488a7c91
inc cl
jne 0x140df78ba

Function at 0x140e03ac9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r8 - 0x55000032], 0xffffffffee920c1f
sbb dx, 0x302a
cdqe
not word [rsp + r8 - 0x55000030]
ror ecx, 0x25
not dx
ror dx, 1
not dx
sal word [rsp + rcx - 0x6e01d067], 0xa3
sbb dx, 0x6e15
bts rbp, 0x94
ror dx, 1
ror ebx, cl
add word [rsp + rbx - 0x7ff3e1e0], bp
pop r8
sbb dx, 0xd198
sal qword [rsp + rbx - 0x7ff3e1fc], 0xff
sal qword [rsp + rcx - 0x6e01d07a], 0x1d
setp byte [rsp + rbp*2 - 0x2001b5]
xor r11w, dx
xadd rcx, rbp
jbe 0x140e0e342
shr qword [rsp + rcx - 0x6e11d15f], cl
lea r9, [rbx + r9 - 0x7ff3e205]
add qword [rsp + rcx - 0x6e11d171], rbx
sbb ax, r8w
Function at 0x140e063b3
Capabilities:
Authenticate hmac

Disassembly:
call fcn.140e1c68b
xor ebp, r11d
ror ax, cl
ror ebp, 3
movsx r10d, cl
lea ebp, [rbp + rbx*2 - 0x5998adc3]
ror r8d, 0x71
sal eax, 0x68
ror ebp, 1
rol rcx, 0xa8
ror dx, 0x8a
adc ebp, ecx
push rax
shr r10w, 0x87
je 0x140ddb612
mov qword [rsp], 0xffffffffe3a64a8a
cmp ebx, 4
push 0xfffffffff3b77806
call fcn.140e03330
mov ebx, 0xa6811824
jmp 0x140de74aa
jmp 0x140e02b51

Function at 0x140e07e1a
Capabilities:
Encode data using base64

Disassembly:
movsx r11d, bx
xor dword [rsp + r10*2 + 8], edx
xchg ebx, r10d
mov r11, qword [rsp + r10*2 - 0x9c]
movsxd rdx, edx
mov qword [rsp + r10 - 0x52], rbx
add rsi, rdx
call fcn.140e07cde
Function at 0x140e096f6
Capabilities:
Authenticate hmac

Disassembly:
ror bl, 1
btr rdx, 0x83
dec bl
push rcx
rol bl, 1
neg ebp
inc bl
sal rdx, cl
adc al, byte [rsp + rdx*4 - 0x1ffedc]
push rbp
xor r11b, bl
bt edx, ebp
idiv ecx
call fcn.140dc8990
mul ebp
xor dword [rsp + r8 + 0xdc299ff], ebx
or rcx, r8
and eax, edx
movsx r11d, al
pop r11
movsxd rbx, ebx
sub ax, 0x1725
add rsi, rbx
idiv r10
mov rbx, qword [r9 + r8*8 + 0x6e14cff8]
and cx, cx
setl r10b
dec r8w
lea r9, [rcx + r9 + 0xd42000d]
lea rdi, [rdi + r8*2 + 0x1b8533fe]
movzx r10d, word [rdi + r8 + 0xdc29a00]
xor r10w, r11w
cdqe
cdq
call fcn.140dbe705
adc bl, 0xb5
mul r10b
mov r8d, r10d
jb 0x140dd1de0
call fcn.140e17cea
or rbx, r10
ror eax, 1
bswap eax
mov qword [rsp + r8*2 - 0x7934b918], r11
lea r11, [rcx*2 - 0x5fe2b2fd]
bswap r8
dec r8
xor dword [rsp + r10 - 0x19cecb5], eax
neg cx
or r8w, 0x453a
pop r11
neg bx
bts cx, 0xb8
movsxd rax, eax
adc rsi, rax
jmp rsi
mov r9, qword [rsp + 8]
lea rsp, [rsp + 0x10]
mov r10d, 0x54377887
not ecx
mov dword [r9 + r10 - 0x5437787b], ecx
movzx r8d, r10w
mov r10d, dword [r10 + rdi - 0x5437788b]
movsx ecx, r8b
lea rbx, [r8*2 + 0x6824358d]
xor r10d, r11d
mov ebp, r8d
bt ebp, ecx
movsx eax, bl
rol r10d, 2
xchg bl, bpl
or ebp, ebx
setno cl
lea r10d, [r8 + r10 + 0x14060b1b]
movzx edx, bx
push rbp
not r10d
add rbp, r8
idiv rcx
rol rbx, 0xcb
ror r10d, 3
not eax
push rbp
sub dl, ah
mov qword [rsp + r8*2 - 0xf106], r11
sbb byte [rsp + r8*2 - 0xf10e], al
neg qword [rsp + r8 - 0x7887]
xor dword [rsp + r8*2 - 0xf106], r10d
xchg byte [rsp + r8*2 - 0xf10b], bl
dec rbx
sub byte [rsp + r8*8 - 0x3c437], bl
mov r11, qword [rsp + r8 - 0x787f]
adc dx, word [rsp + r8 - 0x7882]
sal rcx, 0xc4
movsxd r10, r10d
shl r8, cl
xor bp, bx
sar dx, 0xc7
adc rsi, r10
shr dl, 0x87
movzx ebp, word [r8 + rdi - 0x78870006]
lea rdi, [rdi + rdx*2 - 0x4c740006]
xchg qword [rsp + r8 - 0x78870000], rdx
xor bp, r11w
inc bp
not bp
ror bp, 1
rol rcx, 0xf2
xor bp, cx
xor r11w, bp
lea rbp, [rsp + rbp + 0x10]
mov qword [rsp + r8 - 0x7886fff8], 0x788e7782
call fcn.140deb2fd
jl 0x140ddcb25
mov r10d, 0x159cecb5
push r10
movzx dx, byte [r9 + r10*2 - 0x2b39d96a]
mov cl, byte [r9 + r10*2 - 0x2b39d968]
lea r9, [r9 + r10 - 0x159cecb3]
neg word [rsp + r10 - 0x159cecb2]
or dl, cl
lea rcx, [r10*8 + 0x907b2b0]
mov r8d, 0x3c9a5c8c
not dl
sub ecx, r10d
mov word [r9 + r10*4 - 0x5673b2d4], dx
lea rdi, [rdi + r10*2 - 0x2b39d96e]
movsx ebp, cx
rol bp, cl
mov eax, dword [rdi + r10 - 0x159cecb5]
lea rbx, [r8 + r8*4 + 0x2aa0198e]
and r10, qword [rsp + r10 - 0x159cecb5]
xor cl, byte [rsp + r10 - 0x19cecb0]
xor eax, r11d
sub eax, 0xf535f194
ror word [rsp + r10*2 - 0x339d965], 0xe1
bswap eax
lea eax, [rax + r10*4 + 0x6330ae46]
bswap eax
mov edx, r8d
jno 0x140df6bd4

Function at 0x140e098a8
Capabilities:
Authenticate hmac

Disassembly:
or rcx, rcx
inc bl
not r10d
rol bl, 1
pop rbp
movsx eax, cl
inc bl
inc ax
cbw
not bl
dec bl
cbw
rol eax, cl
cqo
xor r11b, bl
sub cx, 0x2f8c
add rbx, rsp
mov ebp, eax
rol rax, 6
mov ax, word [rbx + rcx*8 - 0x68918]
jae 0x140e10e95
mov word [rcx + r9 - 0xd125], ax
mov ecx, dword [rdi + rcx - 0xd128]
xor ecx, r11d
movsx ebx, r10b
not r10d
jmp fcn.140de53eb
Function at 0x140e0b9eb
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r8d, dword [rdi + rcx - 0x38]
mov qword [rsp + rcx*2 - 0x68], rcx
lea rdx, [rbx + rbx + 0xf07e18a]
mul byte [rsp + rcx - 0x2f]
lea rdi, [rdi + rcx*2 - 0x6c]
mov ebp, ebx
xor r8d, r11d
inc dword [rsp + rax - 0x5399fffd]
imul cl
jno 0x140db9b51

Function at 0x140e0c3df
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x9389159], r11
idiv al
sal rbp, cl
cwde
xor dword [rsp + rbx - 0x9389159], r8d
bt edx, ebp
cqo
neg dl
mov r11, qword [rsp + rdx + 0x18]
seto cl
cwde
movsxd r8, r8d
call fcn.140de2085

Function at 0x140e0c874
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xfffffffff8ae7e83
inc ebp
lea rax, [rcx*4 + 0x721e45bb]
xchg word [rsp + 2], cx
mov qword [rsp + 0x10], r11
lea rdx, [rdx + rcx*2 - 0x24e143c5]
xor dword [rsp + 0x10], ebp
mov r11, qword [rsp + 0x10]
movsx r8d, byte [rsp + 9]
or r8, qword [rsp + 1]
movsxd rbp, ebp
je 0x140db9775
sal cl, 0xa1
btc ax, 0x28
adc rsi, rbp
mov qword [rsp + 0x10], r8
ror rdx, 0xff
cbw
pop rdx
pop rbx
pop r8
jmp rsi

Function at 0x140e0cf39
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebp, r11d
sal rdx, 0xa2
ja 0x140e07d9a
or r8d, r8d
ror ebp, 1
btc r10d, edx
jb 0x140e05548

Function at 0x140e0f09d
Capabilities:
Authenticate hmac

Disassembly:
mov r10d, 0xf4239f17
lea r10, [rbp - 0x3fdb5262]
mov eax, dword [rdi + rbp*4 - 0x4c20]
shr edx, cl
cmovp cx, word [rsp + rbp - 0x12f8]
xor eax, r11d
shl bpl, 0x83
mov qword [rsp + rbp - 0x1340], r10
imul bx, bp
not eax
pop rbp
pop r8
dec eax
ror edx, 0xa1
neg eax
rol ecx, 6
not eax
mov r8d, 0xbea9582e
mov qword [rsp + rbp + 0x3fdb3f5a], r11
sal r8d, 0xfa
xchg r8, rdx
jp 0x140dff324