joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141794e6c
Capabilities:
Encode data using base64

Disassembly:
movsx ebp, byte [rsp + 0xb]
rol edi, 1
neg ecx
ror ecx, 0x7d
lea edi, [rdx + rdi - 0x42665bc4]
mov qword [rsp + rcx - 0x80000], rcx
lea rbp, [rsi*4 + 0x73b40d90]
xor edi, edx
bswap rbp
lea edi, [rdi + rdx - 0x762247a]
rol edi, 3
call fcn.141818d7f
xor dword [rsp + rcx*2 - 0x476cc92a], r11d
mov r10, qword [rsp + rcx - 0x23b6648d]
lea rdx, [rcx + rsi + 0x41add1a8]
movsx ebp, byte [rsp + rcx - 0x23b66495]
btr rax, 0xa6
movsxd r11, r11d
add rbx, r11
lea rdi, [rsi*4 - 0x4165d8e9]
not word [rsp + rcx - 0x23b66494]
mov rcx, qword [r8 + rcx - 0x23b664a3]
mov ebp, dword [rcx + riz]
sub esi, dword [rsp + 3]
mov qword [rsp + rsi - 0x1afde553], rsi
cwd
mov dword [r8 + rsi*4 - 0x6bf7958e], ebp
lea r8, [r8 + rsi - 0x1afde565]
pop rsi
pop rsi
pop rax
jg fcn.1417fa90c
mov eax, 0x181d930a
movsx edx, al
push rax
mov r11, qword [r8 + rax*4 - 0x60764c28]
push rax
mov dil, byte [r8 + rax - 0x181d9302]
pop rax
mov ebp, edx
mov byte [r11 + rdx - 0xa], dil
sal dword [rsp + rdx - 6], 0x6c
mov eax, dword [r9 + rax - 0x181d930e]
sar ebp, 0x59
xor eax, r10d
movsx esi, byte [rsp + rdx - 9]
lea eax, [rax + rdx + 0x5021ad01]
lea r11, [rdx + rbp*2 - 0x635b7b7c]
imul rbp, rbp
not eax
or word [rsp + rdx*4 - 0x23], si
xor eax, 0xf4077c1e
lea eax, [r11 + rax - 0x7c44c32b]
mov qword [rsp + rdx*2 - 0x14], r11
not esi
bts rsi, 0x91
mov qword [rsp + rdx - 0xa], r10
push rbp
jae 0x141795cdf
movsx ecx, bp
xor dword [rsp + rdx*2 - 0xc], eax
mov r10, qword [rsp + rdx - 2]
movsxd rax, eax
jmp 0x1417ed938

Function at 0x14179928b
Capabilities:
Encode data using base64

Disassembly:
neg ax
or dil, sil
xadd di, cx
bt si, di
not ax
inc esi
or ebp, 0xf91e5a3e
mov qword [rsp + r11], r11
bswap esi
neg cl
xadd r11w, cx
sbb esi, 0xf4b19e27
add bpl, 0xa0
movzx eax, cl
neg esi
or qword [rsp + r11], r10
movzx edx, r11w
shr cl, 0x47
xor dword [rsp + r11], esi
movsx edi, al
sal ax, 0x22
pop r10
neg eax
movsxd rsi, esi
adc r11d, 0x72216d18
neg ecx
adc rbx, rsi
dec r11
not r11
mov bp, word [r8 + rcx*2]
lea r8, [r8 + rcx + 2]
sal r11d, 0x86
lea r9, [rcx + r9 - 2]
sub dil, r11b
dec edi
xor ax, word [rcx + r9]
jmp 0x1417fb957
movsx esi, dl
xor ax, r10w
add ax, 0x768f
not edx
shr dx, 0xcc
rol ax, 1
lea rdx, [rsi + rdi*4 - 0x6a5a21d8]
xor rdi, rdi
jae 0x141787648
mov esi, 0x9f189201
movzx r11d, sil
mov esi, dword [r8 + r11*8 - 8]
lea rdx, [r11*4 + 0x3ca87d85]
mov r11d, dword [r8 + r11 + 3]
lea rdx, [rdx - 0x2b692e44]
btc rdx, 0x8b
not esi
movsx ecx, dx
movsx eax, dx
movsx ebp, cx
not r11d
bswap ebp
or esi, r11d
neg ebp
call fcn.141826447
Function at 0x141799929
Capabilities:
Encode data using base64

Disassembly:
sub eax, 0xbe8d5f2a
mov qword [rsp + r11*4 - 0x250], rcx
ror eax, 1
dec dword [rsp + rdi*4 - 0x22460]
setl cl
sal word [rsp + rdi*2 - 0x11230], 0x4d
bswap eax
inc byte [rsp + rdi - 0x8914]
jae 0x14182caea
jmp rdx
xor bpl, byte [rsp + rdi*2 - 0x93b]
xor r10, rax
or word [rsp + rdi - 0x49b], 0x4b11
mov qword [rdi + r8 - 0x4b4], rax
lea r8, [rdi + r8 - 0x4b4]
pop rcx
jp fcn.1417fa90c
inc eax
mov edx, edi
neg edx
jg 0x14179f72c
bswap eax
xchg di, r11w
not sil
mov qword [rsp + rdi*4 - 0x250], r10
push rdi
xor dword [rsp + rdi*2 - 0x120], eax
mov r10, qword [rsp + rdi - 0x8c]
movsxd rax, eax
mov qword [rsp + rdi - 0x8c], rdx
add rbx, rax
ror r11, cl
lea rbp, [r8 + rdi*2 - 0x12c]
mov qword [rdi + r8 - 0xa0], rbp
movsx ebp, cx
mov rax, qword [r9 + rdi*2 - 0x138]
pop rdi
xchg bp, cx
lea r9, [rdi + r9 - 0xa4]
shl di, 0xc3
bt ecx, 0x33
xor rax, r10
bswap rax
dec rsi
lea rax, [rdi + rax - 0x29bee755]
add cl, dil
ror r11d, 0xa2
sub cl, ch
bswap rax
ror byte [rsp + r11 - 0x1121], cl
xor qword [rsp + rdi*8 - 0x2500], 0x48939190
dec rax
jmp 0x1417adcb2

Function at 0x141799af8
Capabilities:
Encode data using base64

Disassembly:
lea r9, [rsi + r9 - 0x75bd]
movzx ecx, dx
mov qword [rsp + rsi - 0x75b9], 0x25079009
push rdi
mov r11d, dword [rdi + r9 - 0x4790aff0]
jne 0x14180e41b
mov qword [rsp + rsi - 0x75b1], rdi
seta dil
xor r11d, r10d
xor r11d, 0xc7bb4d8e
shr dx, 0x8e
add r11d, edx
movsx eax, dx
sub rdx, 0xffffffffc8bd421d
and rsi, 0x53112627
ror r11d, 2
rol byte [rsp + rdx*2 - 0x6e857bc3], 0x41
seto dil
neg r11d
movsx ebp, ax
dec rsi
pop rax
rol r11d, 1
mov qword [rsp + rsi*2 - 0x4840], r10
movzx r10d, si
not bpl
dec al
xor dword [rsp + rsi*4 - 0x9080], r11d
push rcx
sub bp, ax
mov r10, qword [rsp + rsi*4 - 0x9078]
sub edi, eax
movsxd r11, r11d
push rcx
add rbx, r11
call fcn.1417a903a

Function at 0x1417a3cd5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rdx*8 + 0x10], rdx
lea r9, [r9 + rbp - 0x48946f84]
xor dx, bp
js 0x141822c25
jno 0x1417b7555
mov ecx, dword [rbp + r9 - 0x48946f80]
pop rdi
pop rdi
xor ecx, r10d
xor qword [rsp + r11 - 0x48946f80], rdx
neg r11b
adc dword [rsp + rbp - 0x48946f7e], ebp
ror ecx, 2
dec r11
movzx edi, dx
movsx eax, byte [rsp + rbp - 0x48946f7f]
dec ecx
push rbp
jmp 0x1417cd77b
sbb rbp, rax
lea r8, [r8 + r11*2 - 0xc3fa]
neg rdi
neg r11b
lea r9, [r9 + r11*4 - 0x18bfd]
call fcn.1417a2a93
shr rdi, 0xfc
xor ecx, edx
and bp, si
lea rax, [rdi*8 - 0x8cadb45]
btr r11, rsi
xor ecx, 0x950caa12
bswap ecx
mul r11
push r10
adc r11w, di
xor dword [rsp + r11*8 - 0x31008], ecx
pop r10
cdqe
movsxd rcx, ecx
xadd bp, ax
adc rbx, rcx
not esi
xor bpl, 0x8f
mov rdx, qword [r8 + r11 - 0x6201]
jae 0x141801299
Function at 0x1417a81a2
Capabilities:
Parse pe header

Disassembly:
rol al, 1
xor al, 0x9f
and ecx, ecx
inc al
mov qword [rsp + rdi - 0x2cdffdbd], rdi
add edx, esi
inc di
xor al, 7
sar ebp, 0x82
rol byte [rsp + rdi - 0x2cdffdb7], 0x81
or r11d, 0x69af3389
dec al
inc dil
ror al, 1
xor word [rsp + rcx - 0x73aa1ffc], di
neg al
add esi, edx
xor dl, 0x2f
xor r10b, al
xchg byte [rsp + rdi - 0x2cdffdb9], r11b
sal rcx, 0x45
sal cl, 0xe3
lea rax, [rsp + rax + 0x10]
lea rdx, [rdx + rcx - 0x77646dc8]
inc rbp
mov r11, qword [rax + rdi*2 - 0x59bffb7e]
mov qword [rsp + rdi*2 - 0x59bffb76], rsi
not bp
pop rdi
movzx edi, word [r9 + rbp*2 - 0x144e71a9]
rol bp, 0x8f
xor di, r10w
inc di
call fcn.14180ace2

Function at 0x1417a95c1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], 0xfffffffff39e543b
cmp ebx, 2
jmp 0x14181b354
push 0x3721c4ab
call fcn.1417a6029
Function at 0x1417ab471
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor dil, r10b
div rbp
xadd dword [rsp + rsi - 0x5f7efff9], esi
dec r11w
sbb dil, 0x9a
cwd
cdqe
not ecx
neg dil
xor sil, 0x36
dec qword [rsp + r11 - 0x5bdff26]
ror dil, 1
cwd
neg dil
cdq
shr cx, 0xe9
xor r10b, dil
shl si, 0xc2
lea rdi, [rsp + rdi + 0x10]
or rcx, 0xffffffffda8bff22
adc al, 0x1c
mov eax, dword [rdi + rcx*2 + 0x40a80102]
inc dx
imul ecx, r11d
mov dword [r8 + rcx - 0x41ce6c61], eax
xchg dword [rsp + rdx*2 + 7], edx
movzx edi, byte [rsp + r11 - 0x5bdff23]
bswap ecx
lea r8, [r8 + r11 - 0x5bdff33]
pop rsi
pop rax
jb fcn.1417fa90c
mov qword [rsp + rdi*4 - 0x2c3fc], rax
add dl, 0x80
xor ecx, 0x110e243e
and r11, qword [rsp + rdi - 0xb0ff]
pop r11
movsx esi, r11w
bswap ecx
div si
sub dword [rsp + rdi - 0xb0fe], 0x94bf11a1
xor qword [rsp + rdi*2 - 0x161fa], r10
call fcn.14179abc2
mov ebp, 0xa1125ca9
mov r11d, dword [r9 + riz - 4]
movzx esi, bpl
lea rcx, [rbp - 0x1e5dd4c5]
movzx edi, sil
xor r11d, r10d
jmp 0x14183131e
dec r11b
mov qword [rsp + rax - 0x39], rax
rol r11b, 1
ror dword [rsp + rax*2 - 0x71], 0x21
and byte [rsp + rax - 0x38], dil
xor r11b, 0x34
push rdi
imul sil
and qword [rsp + rax - 0xca9], 0x9258e26
ror r11b, 1
and qword [rsp + rax - 0xcad], rbp
inc r11b
xadd cx, si
rol ebp, 0x16
xor r10b, r11b
or dword [rsp + rax*2 - 0x1961], 0x7c2bbd31
mov word [rax + r8 - 0xcb7], r11w
mov edi, dword [r9 + rax - 0xcb7]
xor edi, r10d
add rcx, rax
adc ecx, 0xe496d086
lea r11, [rax*2 + 0x18946e9f]
inc edi
cdq
ror edi, 3
ror dword [rsp + rax*2 - 0x1956], cl
sal ecx, 0xcb
bt edx, ecx
xor edi, 0x2bb62ea1
shr byte [rsp + rax*2 - 0x195f], 5
mov word [rsp + rax - 0xca4], bp
adc edi, edx
lea rsi, [rbp + rsi*2 - 0x364873e2]
imul si, word [rsp + rax*4 - 0x32b9]
xchg dword [rsp + rax - 0xcb1], r11d
not edi
rol si, 0xce
rol eax, 0x46
imul rax
lea edi, [rdi + rbp + 0x3235b148]
bts esi, 0x38
btc rsi, rcx
mov byte [rsp + rsi - 0x5f7efffc], 0x24
mov qword [rsp + rsi - 0x5f7efff9], r10
sar ebp, 0x74
lea r10, [r11*8 - 0xe62ade6]
xor dword [rsp + rdx + 8], edi
mov r10, qword [rsp + r11*8 - 0x2deff948]
xchg dword [rsp + rsi - 0x5f7efffe], eax
xchg word [rsp + rax*2 - 0x48f82e], ax
mov qword [rsp + rax - 0x24008c], rcx
movsxd rdi, edi
bswap rbp
add rbx, rdi
inc qword [rsp + rax*8 - 0x120049b]
movzx edi, byte [rsi + r9 - 0x5f7f0008]
setle al
xadd rax, rdx
sar si, 0x6f
lea r9, [r9 + rsi - 0x5f7f0007]
jnp fcn.141787727
inc si
ja 0x1417872c7
call fcn.1418120b5

Function at 0x1417ab5bb
Capabilities:
Encode data using base64

Disassembly:
pop rbp
mov r8, rdi
pop rdi
pop rax
pop rsi
jo fcn.1417fa90c
ror edx, 2
not rbp
not word [rsp + rbp + 0x40000001]
not edx
pop r11
push r10
xor dword [rsp + rbp + 0x40000001], edx
bswap rdi
pop r10
lea rsi, [rdi*4 + 0x623c6618]
lea rcx, [rsi*8 - 0x676d5dfb]
movsx eax, bpl
movsxd rdx, edx
add rbx, rdx
call fcn.14179715b
mov ecx, 0x3a990ebd
push rcx
mov r11, r8
lea r8, [r8 + rcx - 0x3a990ec5]
mov eax, 0x7792891a
neg cl
sub al, 0xa2
mov qword [rcx + r8 - 0x3a990e43], r11
call fcn.1417da6ae
Function at 0x1417b02dd
Capabilities:
Manually build aes constants

Disassembly:
xor ebp, r10d
or dx, ax
mov qword [rsp + rsi*8 - 0x88], rax
not byte [rsp + rsi*8 - 0x87]
not ebp
bt dx, si
lea rcx, [r11*8 + 0x4997fc9c]
shl dword [rsp + rsi - 8], cl
neg ebp
sal cx, 0xaa
xor ebp, 0xc10eb83d
div qword [rsp + rsi*2 - 0x1a]
dec ebp
shr rdx, 0x48
add eax, edx
je 0x1417ea18f
mov qword [rsp + rax - 0x60ed1ddb], r10
xor dword [rsp + rsi*2 - 0x1a], ebp
cdqe
mov r10, qword [rsp + rax - 0x60ed1ddb]
mov qword [rsp + rax - 0x60ed1ddb], rcx
imul qword [rsp + rax - 0x60ed1ddb]
cqo
movsxd rbp, ebp
xchg edx, eax
sar word [rsp + rax + 5], 0x67
adc rbx, rbp
add rax, qword [r8 + rax + 2]
sub sil, cl
mov rdi, qword [r8 + rsi*2 - 0x18]
adc rax, rdi
mov qword [r8 + rdx - 0x41fceff6], rax
movzx eax, dl
or rax, qword [r9 + rsi*8 - 0x96]
sar esi, 0xcd
mov edi, edx
lea r9, [rdx + r9 - 0x41fcf00e]
seta byte [rsp + rdx - 0x41fceff6]
push rcx
rol dword [rsp + rsi + 3], 0x3c
xor rax, r10
lea rax, [rax + r11 - 0x77c09784]
add rdx, 0xffffffff889b2ca0
call fcn.141801636
push 0xffffffffa50d791a
mov edi, dword [rsp + 3]
lea rbp, [rdi*4 + 0x70b07990]
mov esi, dword [r8 + riz]
ror qword [rsp], 0x4c
lea rcx, [rdi*2 + 0x699c113b]
sar cx, cl
movzx edi, byte [r9 + riz - 1]
movsx r11d, word [rsp + 1]
xor dil, r10b
xchg word [rsp + 5], cx
mov word [rsp + 6], r11w
imul r11d, ebp
adc dil, 0x35
ror qword [rsp + r11 - 0x1454b340], 0x65
adc byte [rsp + r11*4 - 0x5152ccfb], r11b
neg dil
not ecx
add ebp, 0x1cbbf529
call fcn.1417db758

Function at 0x1417b7d46
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd rsi, esi
xadd rbp, rcx
movzx eax, di
xor dil, 0xe
adc rbx, rsi
push rax
lea r9, [r9 + rdi - 0x71b0c91f]
sal qword [rsp + rdi - 0x71b0c91b], 0x60
mov qword [rsp + rbp*4 - 0x368040a0], rbp
mov edi, dword [r9 + rdi - 0x71b0c91b]
xor edi, r10d
sal dl, 0xc5
setns byte [rsp + rbp - 0xda01023]
or eax, 0x8a15b21a
neg edi
xchg edx, r11d
movsx esi, al
rol rax, cl
dec edi
and dword [rsp + rbp - 0xda0102a], edx
mov byte [rsp + rbp - 0xda0101f], dh
bswap edi
sal ax, cl
dec edi
push rcx
lea r11, [rax + r11*4 + 0x690c2a0d]
bswap edi
mul rdx
imul qword [rsp + rbp*4 - 0x368040a2]
mov qword [rsp + rbp - 0xda0100a], r10
sal rsi, cl
xor dword [rsp + rbp*4 - 0x36804088], edi
rol dword [rsp + rbp*8 - 0x6d008135], 0x23
mov r10, qword [rsp + rbp*2 - 0x1b402034]
lea r8, [r8 + rbp*2 - 0x1b402058]
inc rdx
dec rsi
mov dword [r8 + rbp - 0xda0102a], edi
pop rbp
pop rdx
pop rbp
pop rax
pop rax
jge fcn.1417fa90c

Function at 0x1417b7f82
Capabilities:
Encode data using base64

Disassembly:
lea r11, [rax*2 - 0x4fdeb76]
neg edx
mov ecx, dword [rsp + r11*2 + 0x9fbd6f6]
mov qword [rsp + r11*2 + 0x9fbd6ec], rdi
jmp 0x141799d52
Function at 0x1417b8c94
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
btc di, di
dec edi
xor ebp, 0x383f215
imul rdx
adc dil, dl
ror ebp, 2
push rdx
push r11
sub ebp, ecx
add sil, r11b
mov qword [rsp + r11 - 0x842c], r10
div dl
xor dword [rsp + r11 - 0x842c], ebp
xor word [rsp + r11 - 0x8433], r11w
mov r10, qword [rsp + r11 - 0x842c]
xor rsi, rsi
mov qword [rsp + rsi + 8], rdi
setp cl
movsxd rbp, ebp
push rsi
adc rbx, rbp
bt rcx, 0x2b
add rdi, qword [rsp + rsi + 0x10]
shr rax, 0x2f
movzx edx, word [r9 + r11*4 - 0x210d6]
sal r11d, cl
call fcn.141823a3f
neg eax
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
jmp 0x1417deb3f
jmp 0x1417feba1
call fcn.1417edd6e
mov esi, 0xfa248433
movzx r11d, si
mov eax, dword [r8 + r11 - 0x8433]
mov ecx, dword [r8 + r11 - 0x842f]
lea rdx, [rsi*4 - 0x75e893ed]
movsx ebp, r11b
add eax, ecx
movzx edi, r11w
dec dx
mov dword [r11 + r8 - 0x842f], eax
sar edi, 0x2f
cmovb ebp, esi
mov ebp, dword [r9 + r11 - 0x8437]
movsx ecx, dx
adc r11d, edi
xor ebp, r10d
add di, dx
sar cx, 0x4e
lea rax, [r11*2 - 0x67eb687b]
lea ebp, [rbp + r11 + 0x573b326e]
bswap ebp
jne 0x14179529f
mov r11, r8
mov esi, 0x7c158d0e
mov ecx, esi
mov qword [r8 + rcx - 0x7c158d16], r11
mov r11d, dword [r9 + rsi - 0x7c158d12]
sar sil, 0xc7
rol si, cl
mov eax, 0xcd9f29ba
xor r11d, r10d
movzx edx, al
xor r11d, 0x6a818693
lea rbp, [rcx*4 + 0x773f49bb]
xor rcx, 0x113d4c99
bswap r11d
rol r11d, 1
jmp 0x141802d62
call fcn.1417a9e34
lea r11, [rsi*8 - 0x7a45c6f3]
movzx r11d, byte [r9 + riz - 1]
xor r11b, r10b
movzx ebp, si
lea rdi, [rbp + 0x7c37ac29]
push rdi
dec r11b
shr si, 0x81
lea rdx, [rdi - 0x2356d164]
rol r11b, 1
push rsi
not edi
not r11b
lea rcx, [rdx + rsi*2 - 0x2c6b96ce]
lea rsi, [rdi + 0x4c39ae85]
add r11b, 0x2f
pop rdi
or dl, sil
xor r10b, r11b
neg rcx
lea r11, [rsp + r11 + 8]
btr rcx, 0x88
movzx cx, byte [r11 + rbp - 0xf48c]
neg dx
adc edx, 0x181383b1
mov word [r8 + rbp*2 - 0x1e91a], cx
sbb dword [rsp + rdx - 0x70f4b3d2], 0xb025c883
xadd dword [rsp + rbp - 0xf48a], esi
mov esi, dword [r9 + rsi - 0x505675]
lea r9, [r9 + rbp*4 - 0x3d235]
lea r11, [rbp + 0x4c16ed3d]
xor esi, r10d
push rbp
btr rbp, rdi
inc esi
mov word [rsp + rbp - 0xf484], 0xbea6
push rdx
ror esi, 3
or bp, word [rsp + rbp*2 - 0x1e905]
adc word [rsp + rbp*4 - 0x3d7ab], 0xb43b
xor esi, 0x2bb62ea1
call fcn.1417a1932
lea rsp, [rsp + 0x10]
jne 0x141833ddc
mov eax, 0x378672a2
shl al, 0xc2
mov rax, qword [rbp + rax*2 - 0x6f0ce510]
push 0x530cc8ae
neg dword [rsp]
or dword [rsp], 0xb01ea5bf
sbb rsp, 0x18
jmp 0x1417cbaf3
cwde
xor r11d, 0x563b8d89
cwde
xor rbp, rcx
ror r11d, 3
inc esi
push r10
movzx edi, cl
lea rsi, [rax + rcx*8 - 0x14f2c7cc]
xadd ebp, ecx
xor dword [rsp + rcx - 0xabdbc64], r11d
shl rcx, 0x33
inc rbp
pop r10
sal dil, 0x41
jl 0x141837b8e
mov eax, 0x36bcf1ae
jmp 0x14179ab7a
Function at 0x1417ca8ea
Capabilities:
Encode data using xor

Disassembly:
lea r8, [r8 + rcx - 0x6f808006]
lea r9, [rcx + r9 - 0x6f808009]
movzx edx, byte [r9 + rcx - 0x6f808008]
call fcn.1418002b2
xadd al, dh
movsxd r11, r11d
dec edx
mov qword [rsp + rdx - 0x1007ff], rcx
mov qword [rsp + rdx*2 - 0x200fee], rbp
adc rbx, r11
and word [rsp + rcx - 0x6f807ffe], 0x23bc
mov bp, word [r8 + rdx*2 - 0x200ffe]
idiv di
xadd byte [rsp + rcx - 0x6f807ff5], sil
jb 0x14178f050

Function at 0x1417ccab6
Capabilities:
Encode data using base64

Disassembly:
add si, dx
neg edi
mov qword [rsp], rbp
mov qword [rsp], r10
dec rcx
bts edx, edx
call fcn.1417dc266

Function at 0x1417d0451
Capabilities:
Encode data using base64

Disassembly:
inc eax
rol cx, 0xe4
pop rsi
movsx edx, dil
xor eax, 0x62a9730
push r10
add dl, r11b
xor dword [rsp + rcx*4], eax
ror di, 0xaf
call fcn.1417a6942

Function at 0x1417d0f3f
Capabilities:
Encode data using base64

Disassembly:
test rbp, rbp
call fcn.1417c9171
jmp 0x1417a736b
Function at 0x1417d7d66
Capabilities:
Encode data using base64

Disassembly:
sbb dl, 0xbd
neg ecx
rol cl, 0xa5
not dl
jae 0x14179c82b
push rbp
sbb dl, sil
add rax, qword [rsp + rdi*2 - 0x7b112380]
jno 0x1418321e1
Function at 0x1417de719
Capabilities:
Authenticate hmac

Disassembly:
lea r9, [r9 + rdx*2 - 0x5426]
call fcn.141787727
xor esi, r10d
movsx ecx, al
mov r11d, eax
ror esi, 1
rol r11d, cl
ror dil, 0xc1
not r11d
neg esi
dec esi
xor esi, 0x9d0e7a09
bt rdi, rbp
rol rax, cl
btc edi, 1
push r10
lea r10, [rbp*4 - 0x2e4e8542]
push rdi
neg dword [rsp + rdi - 0x14b4a441]
xor dword [rsp + rdi*4 - 0x52d29100], esi
rol bpl, 0x25
add r11d, r10d
not cx
mov r10, qword [rsp + rdi*2 - 0x2969487c]
movsxd rsi, esi
jge 0x1417e6dbd
mov ecx, 0xcd3b9718
sub r9, 4
jmp 0x1417d27c8
lea rax, [r11 + 0x4c31ca96]
push r10
movzx edx, bp
xor dword [rsp + rax - 0x4c31f83f], esi
neg rbp
movsx edi, bp
pop r10
cwde
movsxd rsi, esi
jae 0x14179377b
dec ax
add rbx, rsi
xadd eax, ecx
btc ecx, eax
sub ax, bp
mov rdx, qword [r8 + rax*4 - 0x27ece7a8]
mov rdi, qword [r8 + rax - 0x9fb39e2]
not r11d
call fcn.1417b0878
mov qword [rsp + rsi - 0x4580bac8], rax
xor cx, r10w
xchg dword [rsp + rsi - 0x4580babe], eax
add cx, 0xb2a4
sal sil, 0xc5
xor cx, 0x7e3c
inc cx
pop rsi
lea r11, [rsi + 0x821b398]
rol cx, 1
neg cx
lea rbp, [rax + rax*2 + 0x1da54310]
xor r10w, cx
rol al, 0xc3
jae 0x141825d2e
lea rcx, [rsp + rcx + 8]
movzx edx, word [rsp + rax - 0x4081]
xadd dword [rsp + rax - 0x407f], esi
btc rdx, rax
mov qword [rcx + rax - 0x4081], rdi
cbw
mov edi, dword [r9 + rax*2 - 0x1ff08]
sal sil, 7
btc rsi, 0x3c
or byte [rsp + rax - 0xff7b], 0x89
lea r9, [rax + r9 - 0xff87]
cbw
or rax, qword [rsp + rax*2 - 0x1ff02]
xor edi, r10d
ror edi, 2
dec edi
shl rbp, 0xa2
sub dword [rsp + rdx*2 - 0x6a45], esi
neg edi
neg byte [rsp + rdx - 0x3520]
lea rax, [rdx + rdx*2 - 0x69fbfd58]
adc edi, ebp
xor edi, 0x62a9730
btc dx, bp
mov qword [rsp + rax + 0x69fb5dec], r10
xor dword [rsp + rdx*8 - 0x1a928], edi
pop r10
shl esi, 0xc7
call fcn.14182b6ab
push 0xfffffffff29f429f
mov ebp, dword [rsp + 4]
mov r11d, dword [r9 + riz - 4]
movsx ecx, bpl
movsx eax, cx
xor r11d, r10d
shr byte [rsp + 1], 0x65
lea rdx, [rax*8 - 0x1d5842eb]
adc r11d, 0x5021ad0b
lea rdi, [rax*8 + 0x3d929b0b]
cqo
xor r11d, ebp
mov esi, ecx
xor r11d, 0xf4077c1e
sub r11d, 0xdfa03e9d
push rcx
or edx, edi
cwde
mov qword [rsp + rdx*2 - 0x7b2535fe], r10
xor dword [rsp + rdx*2 - 0x7b2535fe], r11d
mul byte [rsp + rdx - 0x3d929afc]
sub dword [rsp + rdx*2 - 0x7b253604], 0xde940700
mov r10, qword [rsp + rdx - 0x3d929afb]
mov qword [rsp + rdx - 0x3d929afb], rdi
btc rbp, rdx
jb 0x14181554c
neg esi
mov ebp, 0x18b42dad
movsx r11d, bp
xor esi, 0xc10eb83d
lea rcx, [rbp + rax*2 - 0x29c818ca]
cdqe
dec esi
and r11b, 0xa9
jne 0x1417b53d6
sbb ecx, dword [rsp + r11 - 0x792ca484]
and cx, ax
adc rbx, rsi
neg ecx
mov qword [rsp + rdi*2 - 0x2969487c], r11
rol dword [rsp + rdi - 0x14b4a438], 0x1e
mov rsi, qword [r8 + rcx - 0x137c0]
sets dil
setbe al
call fcn.1418377c6
movsxd r11, r11d
btc si, 0xb6
call fcn.1417ec8c4
lea r10, [rsi + r11*8 + 0x5b3efab3]
xor dword [rsp + rbp + 0x73d1098f], eax
sar edx, 0xab
sbb rbp, rcx
bts r10, rdi
pop r10
shr rcx, 0xf1
movsxd rax, eax
adc rbx, rax
xor rcx, rbx
jmp rcx
Function at 0x1417e0cb4
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
pop rbp
pop r10
movsxd rcx, ecx
sub edx, edx
btr r11, rax
add rbx, rcx
movzx ecx, al
lea rsi, [rax*8 - 0x57f1dc4e]
and edx, esi
mov eax, dword [rdx + r8 - 4]
btc r11w, dx
xadd r11, rsi
adc ecx, dword [r8 + rdx]
ror rdx, 0xda
sbb dx, r11w
push rbx
movsx ebx, dil
cpuid
inc r11w
bt esi, 0x9a
mov dword [r8 + riz], eax
sub r11b, r11b
mov dword [r8 + riz - 4], ebx
neg r11b
movsx eax, dil
cwde
mov dword [rax + r8 - 0x21], ecx
setle al
mov dword [rax + r8 - 0xd], edx
shr r11, 0xc4
neg r11d
pop rbx
neg sil
jg 0x1417ef981
Function at 0x1417e94e5
Capabilities:
Encode data using base64

Disassembly:
lea r9, [r9 + rsi - 0x404]
xor ecx, r10d
neg ecx
pop rbp
rol sil, 0x65
not ecx
xadd sil, dil
dec ecx
sub rdi, 0x52978325
inc rdi
ror ecx, 1
inc ecx
lea rax, [rdx*8 - 0x11e2f84f]
neg ecx
or si, ax
jno 0x1417e5b05
cdq
movsxd rsi, esi
adc rbx, rsi
lea rsi, [rax + rdx*4 - 0x2bc6e155]
push r11
sub word [rsp + rax*2 + 6], 0x5a95
mov r11w, word [r9 + rax - 7]
call fcn.141810535
xor dword [rsp + rbp - 0xfefe], edi
neg cx
xchg qword [rsp + rbp*8 - 0x7f830], rdx
rol word [rsp + rbp - 0xff04], 0x49
mov r10, qword [rsp + rbp - 0xfefe]
neg r11b
pop rax
mov qword [rsp + rbp*4 - 0x3fc18], rax
movsxd rdi, edi
neg ebp
add rbx, rdi
shr rsi, 0x32
mov qword [rsp + rcx], rbx
ret
neg al
not ecx
neg sil
not ax
call fcn.1417f52cd
sar r11d, 0xb7
xor si, 0xbc8e
add si, 0x83a8
xor r10w, si
add rsi, rsp
dec r11w
mov qword [rsi + rbp - 0x7628a714], rdi
call fcn.1417d185c
mov ebp, 0xda1038b
movzx di, byte [rbp + r8 - 0xda1038b]
mov al, byte [rbp + r8 - 0xda10389]
btc ebp, 0x37
ror ebp, 0xc7
movzx edx, bp
and dil, al
mov eax, edx
bt edx, edx
lea r11, [rax + rdx*2 + 0x701d67ac]
not dil
cwd
mov ecx, edx
mov word [r8 + rbp - 0x161a4205], di
add r11b, al
sub ecx, r11d
setg bpl
mov esi, dword [r9 + rbp*2 - 0x2c348404]
xor esi, r10d
shr eax, cl
dec esi
rol esi, 1
and cl, ah
mul eax
not r11w
xor esi, 0x43acc01f
bswap esi
shl r11b, 0xe6
sbb esi, edx
div r11w
push r10
xor dword [rsp + rbp*2 - 0x2c348400], esi
pop r10
or rcx, 0xffffffffe202000c
sal ax, cl
movsxd rsi, esi
sal dl, 0xc2
btc eax, ecx
adc rbx, rsi
sar rbp, cl
inc ax
mov di, word [rbp + r8 - 0x161a2]
lea r8, [rbp + r8 - 0x161a0]
shl dx, 0x8c
bt ecx, ebp
movzx eax, byte [r9 + rbp*2 - 0x2c34d]
imul ebp, ebp
lea r9, [r9 + rdx*8 - 5]
movzx esi, bpl
add dl, bpl
xor al, r10b
xchg r11, rbp
rol al, 1
ror rsi, 0x79
or dl, 0x8f
call fcn.1417f4658
xor sil, r10b
neg edi
not sil
btc edi, edx
movsx r11d, di
lea rax, [rcx*8 - 0x4c4732ef]
rol sil, 1
xor dl, al
imul edi
lea rcx, [r11 + rdx*8 - 0x17f645c9]
inc sil
xor sil, 4
not cl
shr r11, 0xda
xor r10b, sil
lea rdi, [rcx + rax*4 - 0x4656ec72]
neg r11d
push rcx
lea rsi, [rsp + rsi + 8]
bt r11w, cx
mov byte [rsi + riz], bpl
mov ecx, dword [r8 + riz + 2]
shr r11b, 0xe5
movzx ebp, r11w
mov edi, dword [r8 + rbp*2 - 0x1fe06]
add dl, 0x2f
adc ecx, edi
neg byte [rsp + rbp - 0xff01]
push rdx
mov dword [r8 + rbp - 0xff00], ecx
lea r8, [r8 + rbp*8 - 0x7f82a]
movzx edi, bp
cbw
mov edi, dword [r9 + rbp*2 - 0x1fe11]
movzx ecx, byte [rsp + rbp*4 - 0x3fc13]
dec edx
xchg qword [rsp + rbp*4 - 0x3fc15], rax
lea r9, [rbp + r9 - 0xff0b]
cwd
xor edi, r10d
lea edi, [rdi + rbp + 0x573ab79c]
bswap edi
xor qword [rsp + rbp*4 - 0x3fc10], rdx
xor edi, 0x383f215
not qword [rsp + rbp*8 - 0x7f82a]
ror edi, 2
sal byte [rsp + rbp*4 - 0x3fc0f], 0xe3
mov esi, 0xc0282521
sbb edi, ecx
idiv byte [rsp + rbp*4 - 0x3fc18]
idiv byte [rsp + rbp - 0xfefc]
mov qword [rsp + rbp*4 - 0x3fc10], r10
mov word [rsp + rbp*4 - 0x3fc12], si
jmp 0x1417ddfbb
mov qword [r8 + rcx - 0x403], rax
not ebp
xchg rsi, rcx
inc dl
mov ecx, dword [r9 + rsi*2 - 0x803]
xor ebp, 0x2b0f4b88
mov qword [rsp + rsi*2 - 0x7fe], 0x3a094ca5
jnp 0x1417be800