joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1807721a6
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x20]
jbe 0x1807721bf
mov edx, 4
mov eax, 0xca3374a3
lea ecx, [rbx + riz - 4]
mov eax, 0x3223b83f
ror ax, 0x82
sar eax, 0xfc
shl ecx, 3
sub rax, 0x4c1e5c13
shl eax, 0xe4
adc al, al
sal edx, 3
mov rax, rbp
push 0xffffffffe3243a23
call fcn.1806eb634
shl edx, 0xe3
rol ebx, 1
pop r8
xadd dword [rsp + rdx*8 + 4], eax
shl dword [rsp + rdx*2 + 3], 0x3a
sbb ebx, 0xe6870304
shr ecx, 0xd8
sub r8b, cl
call fcn.1807b306e
push 0xffffffff941ed7b7
sar byte [rsp + 4], 0x25
mov eax, 0xd0292724
mov r9, qword [r11 + riz]
movzx ecx, byte [rsi + riz - 1]
je 0x1807a32d6
xor cl, dil
bts rax, 0x39
cqo
xor cl, 0x26
cqo
neg cl
cdqe
dec cl
rol dword [rsp + rax + 0x2fd6d8df], 0x3e
neg cl
mov ebx, 0x31a668a2
add cl, 0x81
ror dword [rsp + rax*2 + 0x5fadb1ba], 0x57
jb 0x18077a412
call fcn.1807c6da0
bswap rax
ror cl, 1
dec dword [rsp + rdx + 4]
xor dil, cl
sar dl, 0xe5
lea rcx, [rsp + rcx + 8]
jae 0x1806e5cea

Function at 0x18077345e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + rax - 0x47993bd5], rdx
mov esi, dword [rsp + rsi - 0x7d01b519]
movzx edi, ax
lea esi, [rsi + rax*4 - 0x276376cc]
jl 0x1806fb687
sub rsi, 2
mov r8d, 0x182e28a7
movzx ebx, word [rsi + r8*2 - 0x305c514e]
xor bx, di
dec bx
jmp 0x1807be8de

Function at 0x180776063
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
push 0xffffffffe017c7b6
jmp 0x18077d8f7
mov eax, 0x910fdb36
mov rax, qword [rbp + rbx*8]
jmp 0x1806f69c7
lea rsp, [rsp + 0x20]
jne 0x180774a1c
mov eax, 0xe591b52c
push rax
xchg byte [rsp + 5], al
mov rax, qword [rbp + riz]
call fcn.1807b1da6
call fcn.180704410
mov ebp, 0x1a901d8e
mov r9d, 0x378dff1f
movzx r8d, byte [rbp + rsi - 0x1a901d8f]
mov edx, 0xdd0be41b
jmp 0x180798ce9
xor r8b, dil
neg r8b
jmp 0x1806e013d

Function at 0x180777edf
Capabilities:
Authenticate hmac

Disassembly:
xor dil, r9b
add r9, rsp
mov rbx, qword [r9 + rcx - 0xe2a8]
lea r9, [rbp + rax*4 - 0xc45c96c]
mov qword [r11 + rcx*4 - 0x38aa8], rbx
movzx r8d, byte [rbp + rsi - 0x18b869d1]
lea rsi, [rsi + rcx - 0xe2ae]
call fcn.1807181ef
dec ecx
lea r9, [rbp + rbx*8 + 0x41b0f0b3]
mov eax, r9d
jmp 0x1807434c4
bswap ecx
sub ebp, 0xcc914c9c
mov qword [rsp + rdx*4 - 0xac], r8
push rdx
or byte [rsp + rdx - 0x22], r8b
xor ebp, 0xce1bdb1e
lea ebp, [rbp + rdx - 0x7b380064]
not ebp
shr dword [rsp + rdx - 0x23], 0x61
lea rcx, [rdx*8 + 0x43ba6511]
sar r9, cl
mov qword [rsp + rdx*4 - 0xa4], rdi
or rcx, r8
xor dword [rsp + r9 + 8], ebp
dec r8w
mov rdi, qword [rsp + rdx - 0x23]
mov eax, ebp
rol r8b, 0x22
btr r8w, 0xb3
movzx ebp, byte [rsi + rdx - 0x30]
call fcn.180725344
inc r8
movzx r9d, byte [rsi + rcx - 0xe2ac]
xor r9b, dil
or r8b, r8b
not r9b
mov ebx, eax
add dl, r8b
inc rcx
adc r9b, 0xb4
ror r9b, 1
add r9b, 0x9a
sub r8b, 0x96
adc bpl, 0xa8
jae 0x18072c626
Function at 0x180778ab3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
movzx ebp, word [rsi + rdx*2]
xor bp, di
mov qword [rsp + rdx + 8], 0xffffffffb028e815
sub r9, rdx
ror dl, 0x61
sbb bp, 0xa839
lea rcx, [rbx + r9*8 + 0x7f047a0c]
xadd edx, r9d
lea r8, [rcx + rcx*2 - 0x50e00864]
ror bp, 1
add bp, 0x3cb8
xor dx, 0xd30d
xadd cx, r8w
movzx eax, bx
xor bp, 0xb693
add bp, 0x6331
xchg edx, r8d
pop rbx
xor bp, 0x8d05
lea rbx, [rcx + rax - 0x3e4307c5]
rol bp, 1
add ecx, 0x8638a5b1
push rax

Function at 0x18077aa93
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + r9 - 0x58], r8d
sal edx, cl
mov rbx, qword [rsp + rax - 0x498ffda3]
push r9
jbe 0x180763ac0
sub r9, r9
mov qword [rsp + r9], rdi
xor dword [rsp + r9*8], ebp
lea rcx, [rax + r8*4 - 0x4f4e8178]
xchg rcx, rax
lea rax, [rax + rax + 0x220a2e30]
pop rdi
movsxd rbp, ebp
cdq
not rdx
add r10, rbp
shl eax, 0x26
sar r8w, 0xcf
adc eax, eax
adc r9, r10
jmp r9
movzx r8w, byte [rbp + rax - 0x7ffffd12]
dec ax
mov sil, byte [rbp + rax - 0x7ffffd0f]
mov qword [rsp + rax - 0x7ffffd13], rax
push rax
movzx r9d, al
or r8b, sil
not r8b
bt r9w, 0x82
movzx esi, r9b
mov word [rbp + r9*2 - 0x22], r8w
lea rdx, [r9 + rsi*8 + 0x498ffd00]
mov r8d, dword [r10 + rax - 0x7ffffd13]
movzx ecx, al
xor r8d, ebx
push rdx
lea r8d, [r8 + r9*2 + 0x4b273895]
ror r8d, 1
xchg r9d, ecx
sal r9b, 0xe5
dec r8d
pop rax
xor r8d, 0x402a1e89
or word [rsp + r9 - 0x53], 0x9522
jg 0x18074160b
sete byte [rsp + rax - 0x498ffd9f]
mov qword [rsp + rax - 0x498ffda3], rbx
js 0x1806e5a3b

Function at 0x18077b1e3
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
not dword [rsp + 8]
call fcn.1807966e3
lea rsp, [rsp + 8]
je 0x18079e554
push 0xfffffffff635a4a8
mov ebx, 0xb10da79d
mov qword [rsp], rsi
sal bx, 2
sar bl, 0xc1
mov esi, ebx
lea rbx, [0x180762ba8]
mov esi, 0x9f0b2303
movzx esi, byte [rcx + riz]
xor esi, eax
and esi, 0xff
call fcn.180786cb8
pop rsi
movzx edx, byte [r10 + rcx*4 - 0x1dbae1fb]
add byte [rsp + rcx*2 - 0xedd70f8], r9b
xor dl, bl
rol dl, 1
shl dword [rsp + rcx - 0x76eb87d], 0xb2
push rcx
neg dl
movzx edi, r9b
xor word [rsp + rcx*8 - 0x3b75c3f8], di
ror dl, 1
dec dl
xor bl, dl
lea r8, [rcx*4 + 0x512b8406]
sub word [rsp + rcx*2 - 0xedd70f7], r9w
lea rdx, [rsp + rdx + 0x10]
bts ecx, 0x2d
lea rsi, [rdi + rcx*2 - 0x4a6c1cf8]
shl r8b, 0x83
mov esi, dword [rdx + rcx - 0x76eb87f]
movzx edx, byte [rsp + rcx - 0x76eb873]
jne 0x180775f9b
mov edi, 0xb90bab1d
neg edx
neg rdi
not edx
cbw
add byte [rsp + rax*8 + 0x16], 0xa4
bswap edx
movzx r8d, byte [rsp + rax*2]
lea edx, [rax + rdx + 0x769cdd25]
movzx esi, al
bswap edx
and dword [rsp + rax*4 + 8], 0x351bbf87
jns 0x180715a42
push 0x629868b5
neg r9d
sar word [rsp + 6], 0x82
shr dword [rsp + 9], 0xc8
add word [rsp + 0x15], 0xb036
adc r9d, 0x2c3a74a5
push 0xffffffff943a3eb9
xor qword [rsp + 0x18], 0xffffffffe0970ea4
mov qword [rsp + 0x18], rdi
xor dword [rsp + 0x18], r9d
mov rdi, qword [rsp + 0x18]
inc word [rsp + 0x13]
movsxd r9, r9d
add r10, r9
jmp 0x180730cd7
Function at 0x18077cfd8
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea r11, [r11 + r8*2 - 0x1f210]
shr dl, 0x23
push r8
mov dword [r11 + r9 - 0x5d39d093], ecx
sar ebx, 0xdf
ror qword [rsp + r9 - 0x5d39d093], 0x25
pop rbp
pop rax
pop rax
pop rax
jp fcn.180764d25
Function at 0x18078590d
Capabilities:
Parse pe header

Disassembly:
push rdx
not r8d
jbe 0x180704832
xor dl, dh
xor dword [rsp + r9*2 + 0x1000], r8d
pop rdi
movsxd r8, r8d
push rax
add r10, r8
btc r9w, 3
shr word [rsp + r9 + 0x7fc], 0x89
pop rax
jns fcn.180764d25
or qword [rsp + r9*2 + 0x1000], rdi
sar edx, cl
jae 0x1806e67bf
xor rdi, rbx
mov qword [r9 + r11 - 0xb], rbx
xchg edx, eax
sal r9w, 0xeb
not rdx
lea r11, [r9 + r11 + 0x7f4]
sub bp, ax
movzx ebx, r8b
mov r8d, dword [rsi + r9*2 + 0xff3]
and bp, ax
lea rsi, [rsi + rdx + 0xfff2]
ror rdx, 0xa3
sub al, cl
sub bl, cl
xor r8d, edi
lea r8d, [rax + r8 - 0x204e75e0]
or rcx, rdx
rol r8d, 2
not rbp
btc edx, ecx
cqo
inc r8d
shl edx, cl
jp 0x1806e57a4
neg bpl
xor dil, bpl
or ebx, r8d
lea rbp, [rsp + rbp + 8]
mov r8d, dword [rbp + rax*2 - 0x1fffc]
movsx edx, byte [rsp + rax*2 - 0x1fffc]
seta byte [rsp + rax - 0xfffe]
mov dword [r11 + rax*2 - 0x20000], r8d
mov rbx, qword [rsi + rax*4 - 0x40001]
cmovae r9d, ecx
mov ebp, 0x4ca7eb17
rol word [rsp + rax*4 - 0x3fff7], 0x85
xor rbx, rdi
cqo
cqo
cdq
xor rbx, 0x541b9806
add rbp, rdx
lea rdx, [rdx + r9*8 + 0x5e09273f]
dec rbx
sar bpl, 0xc5
bswap rbx
not rcx
lea rbp, [rbp + rbp - 0x29f2f572]
rol rbx, 6
inc word [rsp + rax*2 - 0x1fffa]
movsx r8d, bpl
shr r9, 0x67
dec rbx
rol rbx, 1
sal edx, 0x1a
pop rbp
xor rbx, 0x3d0351ac
or dx, 0xea4
not r9
jne 0x18070cfaa
mov esi, 0xfbaada01
mov rax, qword [rbp + riz]
mov r9w, word ss:[rax + riz]
mov word [rbp + riz + 6], r9w
mov r8d, dword [r10 + riz]
mov edi, 0xc32affae
mov ecx, edi
movsx edx, dil
xor r8d, ebx
or di, dx
sal edi, 0x4f
lea r9, [rdx*4 + 0x4a272126]
sbb r8d, 0xe623db86
sar rdi, 0x9f
rol r8d, 3
rol r9b, 0xc1
lea rax, [rdi + rdi*4 + 0x601ce89d]
add edi, edi
inc r8d
xor r8d, 0xf019d596
not r9
push rdi
jmp 0x18072763f
movzx ebp, byte [rsi + riz - 1]
mov qword [rsp], 0xffffffffcd3f4187
xor bpl, dil
mov ecx, dword [rsp + 2]
inc bpl
bts r9w, 0xa0
rol dword [rsp], cl
mov r8d, 0xeba6970a
rol bpl, 1
sar qword [rsp], cl
movzx eax, word [rsp + 2]
ror qword [rsp + rax*2 - 0x1fffe], 0x29
sub bpl, r8b
movsx ebx, byte [rsp + rax*8 - 0x7fff5]
add eax, dword [rsp + rax - 0xfffb]
rol bpl, 1
or r9d, 0xbe2f1697
jnp 0x18071b672
mov r9d, 0x640af70c
mov r8w, word [r9 + rbp - 0x640af70c]
mov eax, r9d
movzx esi, ax
lea rsi, [rsi*4 + 0x62895b33]
mov cx, word [r9 + rbp - 0x640af70a]
not r9w
xor al, 0x81
mov edx, 0x8314e3be
lea rbp, [rax + rbp - 0x640af78b]
or si, si
xadd eax, edx
rol rsi, 0x85
or r8w, cx
sub dl, 0x13
not r8w
push rsi
sub byte [rsp + rdx - 0x640af776], r9b
movzx edi, ax
mov word [rbp + rdx - 0x640af77a], r8w
mov edx, dword [rdi + r10 - 0xdb4b]
lea r9, [rsi + rsi*2 + 0x4ba3fb1f]
pop rax
lea r10, [r10 + rdi*2 - 0x1b692]
cbw
movzx ecx, si
xor edx, ebx
bswap edx
neg r9d
push rdi
je 0x1806f878a
lea edx, [rdx + r9 - 0x2962348e]
cbw
dec r9d
pop r9
bswap edx
shr cx, 0xcd
rol edx, 1
add eax, eax
add rcx, 0x31ada7a5
push rbx
sal si, 0x26
bt rax, rdi
xor dword [rsp + r9 - 0xdb4b], edx
mov r8d, eax
shr cl, 0x85
pop rbx
bt edi, 0x15
movsxd rdx, edx
dec dil
adc r11, rdx
lea r9, [rdi + rsi*8 - 0x60c81a5d]
jmp r11
Function at 0x180787494
Capabilities:
Authenticate hmac

Disassembly:
dec dil
adc sil, r8b
sal r8d, 0x85
xor sil, 0x2b
shr qword [rsp + r8*4 - 0x4b9e0080], cl
xor bl, sil
lea rsi, [rsp + rsi + 8]
dec qword [rsp + rdi - 0x6490018b]
sal dword [rsp + r8 - 0x12e7801d], 0xe
bts cx, ax
mov dword [rsi + rdi - 0x6490018b], r9d
mov rcx, qword [r10 + r8*2 - 0x25cf003b]
xor qword [rsp + rdi - 0x6490018b], rdi
movsx r9d, r8b
jns 0x1806e3159
lea r10, [r10 + r8 - 0x12e78013]
call fcn.180714f16
mov qword [rsp + rcx*8 - 8], rsi
cwde
xor dl, 0x37
xor bl, dl
call fcn.180758c5e
shl edi, 0xd8
mov byte [rcx + rsi*2 - 0xef34], dl
jp 0x18079e246
lea rcx, [r8 + r8*8 + 0xea9a5bd]
xor edi, 0x1090018c
mov r9d, dword [rsi + rbp - 0x7798]
mov edx, 0xe487eca0
movsx eax, cx
push r8
movzx esi, byte [r10 + rsi*4 - 0x1de64]
xor sil, bl
shr r8b, 6
setb byte [rsp + rdi - 0x6490018c]
xor sil, 8
neg sil
sal dx, cl
jae 0x18072568b

Function at 0x1807878ba
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
call fcn.18074708a
mov esi, 0xeae3f3d
mov edx, dword [rsi + rbp - 0xeae3f3d]
mov eax, esi
push rsi
lea rax, [rsp + rsi - 0xeae3ec9]
mov dword [rax + rsi - 0xeae3f3d], edx
neg dword [rsp + rsi*2 - 0x1d5c7e77]
movzx r8d, byte [r10 + rsi*2 - 0x1d5c7e7a]
mov edi, dword [rsp + rsi*8 - 0x7571f9e7]
sbb byte [rsp + rsi - 0xeae3f3b], dil
movzx r9d, dil
xor r8b, bl
movzx ecx, r9b
add r8b, 0x86
sub qword [rsp + rsi - 0xeae3f3d], rsi
sar byte [rsp + rsi - 0xeae3f3d], 0xc6
rol r8b, 1
inc byte [rsp + rsi - 0xeae3f3d]
xor r9, 0xffffffffd1226ba1
sbb r8b, 0x80
xor ecx, r9d
mov eax, esi
rol r8b, cl
xor bl, r8b
shl sil, 0x41
xchg word [rsp + rsi - 0xeae3f7a], si
lea r8, [rsp + r8 + 8]
lea rax, [r9*4 - 0x2dc804d]
lea rdx, [rcx*8 + 0x2bad20ae]
mov rdx, qword [rsi + r8 - 0xeae0001]
not dword [rsp + rsi - 0xeadfffe]
mov qword [rbp + rsi*8 - 0x7570000c], rdx
setnp sil
lea r9, [rsp + rsi - 0xeadff81]
or rsi, rcx
mov rsi, qword [r9 + riz]
mov qword [rbp + riz - 0xc], rsi
jns 0x18079a2a8
sub byte [rsp], ch
movsx r9d, cx
lea rbp, [rbp + r9*2 - 0xd74e]
call fcn.1806fff1b
Function at 0x18078a4af
Capabilities:
Authenticate hmac

Disassembly:
add eax, r9d
or qword [rsp + r9*2 + 6], rbx
xor dword [rsp + rcx*2 + 8], eax
mov qword [rsp + rcx], 0x35385123
bt r8w, dx
mov rbx, qword [rsp + rcx + 8]
bswap esi
movsxd rax, eax
ror cl, 0x67
xadd rcx, r8
adc r11, rax
push r9
xchg dword [rsp + r8*8], ecx
not byte [rsp + r8 + 0xf]
mov cl, byte [r10 + rcx + 4]
sub r8d, esi
adc edx, 0x3ba2f73a
jb 0x180767b51
lea r10, [r10 + r8*4 + 6]
ror qword [rsp + r8 + 8], 0x91
sbb esi, 0xc09cae37
xor cl, bl
sal rdx, 0x56
neg qword [rsp + r8*2]
call fcn.1807ab08f
mov edx, 0x2c20792a
mov rax, qword [rdx + r11 - 0x2c20792a]
mov ebp, edx
or dl, bpl
mov r9, qword [rdx + r11 - 0x2c207922]
movsx ebx, bp
or rdx, rbx
lea r11, [r11 + rbp - 0x2c207922]
mov ecx, 0xc9bf2585
ror ebp, cl
not rax
setne dl
movsx r8d, bp
not r9
rol bx, cl
and rax, r9
rol cx, 0xe7
push r8
or ebp, dword [rsp + rdx - 0x2c2078ff]
mov qword [r11 + rdx*2 - 0x5840f202], rax
lea rsi, [rbp + rsi - 0x516103cd]
sub rdx, 0xffffffffc299da10
mov eax, dword [rsi + rdx - 0x69869ef1]
lea rbx, [r8 + rbp - 0x46d18f52]
lea r9, [rdx - 0x38d6525c]
xor eax, edi
inc eax
inc r9b
and dword [rsp + rdx - 0x69869eed], 0x1b8f22af
inc qword [rsp + rbp - 0x516103c9]
ror eax, 1
sal r8w, 1
dec eax
neg eax
call fcn.180760104
mov edi, 0xbb105b0b
movsx r8d, di
add edi, r8d
movzx eax, word [r10 + r8*4 - 0x16c2c]
movsx r9d, di
call fcn.180796432

Function at 0x18078ca63
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
neg edi
xor r8d, ebx
xchg cl, dil
mov edx, 0x287df8a
bt r9, 0x83
dec r8d
movsx eax, si
sub byte [rsp + rdx*8 - 0x143efc44], ah
ror r8d, 1
sal word [rsp + r9 - 0x1480d41], 0xc3
sbb r8d, 0xe0b2d60b
call fcn.1807153e6
Function at 0x1807941f1
Capabilities:
Manually build aes constants

Disassembly:
add r8d, ebp
neg r9w
bswap eax
lea eax, [rax + rdx*4 - 0x3b85710a]
sar rcx, 0xef
call fcn.18073a5c9
ror edi, 1
cdqe
inc edi
add word [rsp + rax + 0x6df1], 0xa133
jno 0x180788e35
rol bl, 0x87
ror eax, 3
jmp 0x18070e392
mov qword [rsp + rax + 0x6dee], rbx
inc r9d
lea rax, [r8 - 0xefcd7c9]
bt rsi, rsi
xor dword [rsp + rcx - 0x4d1df815], edi
dec ax
lea rbx, [r9 + rcx*8 + 0x55132132]
pop rbx
or rcx, r9
shr r9d, cl
movsxd rdi, edi
bt si, r8w
add r11, rdi
neg r8b
sal r9w, 0x6c
jmp r11
btc r8w, ax
mov qword [rsp + rax + 0x7490], rdi
xor dword [rsp + rax + 0x7490], r9d
bt rcx, rcx
pop rdi
mov dword [r11 + rax*8 + 0x3a47c], r9d
movsx r9d, al
movzx eax, byte [rsi + rax*2 + 0xe917]
rol dx, 0x84
sbb bp, r8w
lea rsi, [rbx + rsi - 0x153b0009]
adc r8b, 0x1a
xor al, dil
neg al
sub rbp, 0xfffffffff2373e94
setnp bl
rol al, 1
inc ecx
rol ebp, 0x90
sbb al, 0x16
neg al
sar ebx, 0x57
jb 0x18077c077
xor al, dl
bts dx, dx
setae cl
jb 0x18074f29b
mov r8d, 0xd93057a2
lea rbx, [r8 + r8 + 0x72178a2c]
movzx eax, r8w
mov r8w, word [r11 + rax*2 - 0xaf44]
mov edx, 0xff33d1a3
mov cl, byte [r11 + rax - 0x57a0]
lea r11, [r11 + rax - 0x57a0]
movsx r9d, bx
shr r8w, cl
mov word [r11 + rax*2 - 0xaf44], r8w
bt dx, bx
bt rbx, 0x13
lea rsi, [rax + rsi - 0x57a6]
dec rax
movzx ecx, r9w
movsx r8d, r9b
mov r8d, dword [rsi + rax*2 - 0xaf42]
sal dx, 0x66
xor r8d, edi
bswap r8d
movzx ebp, cl
not eax
not rax
xor r8d, 0xb62917
call fcn.180765ac6
mov ecx, 0x4d1df815
ror edi, 3
lea edi, [rdi + r9 + 0x7c3adab]
lea rsi, [rax*8 - 0x3ec7baf3]
jmp 0x18072ca96

Function at 0x180797ad9
Capabilities:
Authenticate hmac

Disassembly:
lea r8, [rdx + rdx*8 - 0x6f59ef78]
call fcn.1806f16b1
call fcn.18077e1cc
jmp 0x18079e3e3
jmp 0x180784187
cmp ebx, 4
jmp 0x1807abe6a
not dword [rsp + r9 + 0xb]
inc edx
xor edx, 0xc0a07013
rol ax, 0x61
dec sil
push rax
inc edx
mov qword [rsp + r9*2 + 0x10], rbx
xchg r8w, ax
push rsi
sal word [rsp + r9*2 + 3], 0x2e
xor dword [rsp + r9*4 + 0x18], edx
lea rdi, [rax + 0x1a001c39]
add r8, qword [rsp + r9 + 8]
ror rdi, 0x39
mov rbx, qword [rsp + r9*2 + 0x18]
movsxd rdx, edx
xor rdi, 0x3a2fe2be
jo 0x1806e8d88
adc r11, rdx
call fcn.18073cc48
mov ebx, 0x54a3620e
lea rsi, [rbx + rsi - 0x54a36210]
mov edx, ebx
lea rcx, [rbx + 0x6cabd812]
movzx edx, word [rsi + rdx - 0x54a3620e]
movsx eax, cl
xor dx, di
sal rcx, 0x45
ja 0x18075d1b3
jmp 0x18071657b
call fcn.1806f4c17
cmp ebx, 4
call fcn.1807c82ad

Function at 0x18079a02a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
bts edx, r8d
dec bl
ror rbp, 0xe7
adc cx, bp
neg bl
add bl, 0x81
add cl, dh
cmovg edx, ecx
ror bl, 1
xor r9d, dword [rsp + rdx*2 - 0x77]
xor dil, bl
neg bp
lea rbx, [rsp + rbx + 0x10]
sbb r9, qword [rsp + rdx - 0x38]
mov qword [rbx + rdx - 0x40], rax
call fcn.1807a7974

Function at 0x18079a5a9
Capabilities:
Parse pe header

Disassembly:
xor r8d, 0x371276af
bts rbp, 0xa1
lea rdx, [rdx - 0x7944b4ca]
mov qword [rsp + rdx + 0x7943f0bc], rdi
jae 0x1807aba94
Function at 0x18079ae32
Capabilities:
Authenticate hmac

Disassembly:
xor sil, 0x1f
ror word [rsp + r9 - 0xd119], 0x21
cbw
sbb sil, 0x9b
xor sil, dl
add sil, dl
ror byte [rsp + r9 - 0xd119], cl
xor bl, sil
bt r8d, 0xa3
lea rsi, [rsp + rsi + 8]
mov rdi, qword [rsi + r9 - 0xd11b]
mov esi, r8d
shl dword [rsp + r9*8 - 0x688d4], cl
mov qword [rbp + r9*2 - 0x1a240], rdi
jns 0x180773506
mov ebx, 0xf42a380b
sub rsi, 4
movzx eax, bl
mov r8d, 0x4a3f6098
mov ecx, dword [rax + rsi - 0xb]
movzx edx, al
btc dx, 0xb4
adc bl, 0xe
xor ecx, edi
btc eax, 0x1e
dec ecx
ror ecx, 1
neg ecx
movsx ebp, dl
movsx r9d, r8w
shl r9w, 0x62
ror ecx, 3
btr bx, 0x2f
shr ebx, 0x2d
bswap ecx
jb 0x18079e3cb
lea rcx, [r8 + r8*8 - 0x57d40ef3]
sub edi, 0x8c91e8be
xor edi, edx
ror cx, 0x61
ror edi, 1
xchg dx, cx
neg edi
mov qword [rsp + r9 - 0xd1ab], rbx
or dl, sil
inc r9
bt rsi, 0x17
xor dword [rsp + r9*2 - 0x1a358], edi
sub r9b, 0x91
pop rbx
lea rax, [rdx + r9*8 - 0x362e659]
movsxd rdi, edi
adc r11, rdi
movzx esi, byte [r10 + r9*4 - 0x34467]
movzx edi, r9w
xor cx, ax
neg edi
lea r10, [r10 + r9 - 0xd115]
cdq
push rcx
sal word [rsp + r9*8 - 0x688d5], cl
xor sil, bl
jmp 0x1806fc8bf

Function at 0x18079bd76
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
dec rax
lea rsp, [rsp + 0x40]
jne 0x18078a107
mov edx, 0xd91eab21
pop r10

Function at 0x18079c3b7
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + rcx*8 - 0x63e50], rbp
and r9w, 0x292e
mov qword [r11 + rcx - 0xc7ca], rdx
not rbx
or word [rsp + rcx*8 - 0x63e4b], cx
pop r8
jl fcn.180764d25
mov eax, 0x3e99722b
movzx bx, byte [r11 + rax*2 - 0x7d32e456]
movzx ecx, ax
sub cl, 0xbf
mov r8b, byte [rax + r11 - 0x3e997229]
dec ax
and bl, r8b
bt rcx, rax
movsx r8d, ax
not bl
setae al
btr cx, ax
mov bp, bx
movzx eax, byte [rsi + rax - 0x3e997202]
movzx r9d, cl
movzx edx, r8b
movzx ebx, r8b
xor al, dil
lea rcx, [rcx + rbx*2 + 0x6b34a4aa]
dec al
neg rcx
rol ebx, 0xf5
neg al
xor bl, 0x88
dec bx
jne 0x1807bc9a1
not al
sbb r9w, 0x409a
shr rcx, cl
adc al, 0xa8
ror al, 1
dec r9
sar bl, 0x41
lea rbx, [r8 + r9*8 + 0x2c3b4433]
xor al, 6
sal r8b, 0x63
adc dl, r9b
xchg cx, r8w
neg al
rol dx, 0x6b
sbb r9, 0x7372623
xadd cl, r9b
xor dil, al
inc dx
push rdx
lea rax, [rsp + rax + 8]
shr word [rsp + r8 - 0xfe52], 0xa1
mov byte [rax + r8*4 - 0x3f94c], bpl
movzx ebp, word [rsp + r8*2 - 0x1fca6]
mov r8d, dword [rsi + r8 - 0xfe58]
xor r8d, edi
ror bp, 0x66
dec r8d
ror ebx, cl
rol r8d, 2
pop rcx
lea r8d, [rcx + r8 - 0x3433782c]
xor r8d, 0xb0b19108
movsx eax, bp
sar eax, 0xbb
dec bx
push rdi
rol dx, 0x49
jne 0x180710382
cbw
lea r8, [rsp + r8 + 8]
jmp 0x18071131a
Function at 0x18079e2a3
Capabilities:
Authenticate hmac

Disassembly:
rol bpl, 1
xor dil, bpl
call fcn.180793a36
dec dil
add sil, 0x25
xchg qword [rsp + rdi - 0x259aeed2], r8
sal word [rsp + r9*2 - 0xc25e], 0xe
xor bl, sil
sal edx, 0xb0
add ax, 0x949e
mov word [rbp + r9*4 - 0x184c4], si
cmove eax, dword [rsp + rdi - 0x259aeed1]
jbe 0x180776014
movzx eax, byte [r10 + rdi - 0x259aeed1]
xadd dword [rsp + rdi - 0x259aeecf], edx
lea rcx, [rdx + r8*2 + 0x56170c14]
xor al, bl
call fcn.180739837
cwde
mov qword [r11 + rdx*8 - 0x80002], rbx
movzx r9d, dx
mov ebx, r8d
lea r11, [r11 + rcx - 0x5991]
mov qword [rsp + rdx*8 - 0x7ffe0], rbx
dec r8d
mov qword [rsp + rdx - 0xffff], rdx
pop rcx
pop rcx
pop rdx
pop rdx
jne fcn.180764d25
mov edx, 0xeb6aabd
lea rax, [rdx*2 - 0x1bcaa464]
movzx r9d, ax
mov r8d, dword [r11 + rdx - 0xeb6aabd]
movzx ecx, dl
lea rbx, [rcx + rdx*2 - 0x1be3d7d2]
rol bx, 0xc6
movzx ebx, byte [rsi + rdx*2 - 0x1d6d557b]
xor bl, dil
sub bl, 0x2e
bts eax, eax
neg bl
btr r9w, cx
sar al, 0x23
adc bl, 0xb
or ax, 0xb93
ror ax, 0x4d
xor bl, 0x92
bts rax, r9
inc bl
movsx ebp, cl
xor bl, 0x26
call fcn.18076e6da
mov r8d, 0x259a568c
movsx edi, r8b
movzx dx, byte [rbp + r8*2 - 0x4b34ad18]
lea rsi, [r8 + 0x4e8a3e82]
inc di
xchg edi, r8d
mov r9b, byte [rbp + rdi*2 - 0x4b34ad16]
add si, r8w
btr r8w, 0x81
not dl
lea rax, [rsi + r8 + 0x7400cd0a]
not r9b
inc sil
or dl, r9b
shr si, 0x2f
movzx r9d, ax
sub di, 0x67b9
mov word [rbp + rdi - 0x259aeed1], dx
push rax
movsx edx, sil
setbe byte [rsp + rdi - 0x259aeecd]
movzx esi, byte [r10 + r9*2 - 0xc264]
xor sil, bl
sal dword [rsp + rdi - 0x259aeed2], 0x65
neg sil
add r8, r8
sbb sil, dl
not sil
dec r9
jg 0x18079d2f4
btr r9, 0x85
xchg r8b, dl
sbb ecx, 0xa1189f99
bt rdx, 0xa7
call fcn.180784754
Function at 0x18079f6c1
Capabilities:
Parse pe header

Disassembly:
mov r8b, byte [rbp + rcx*2 - 0x215b5f18]
bt cx, 0x9b
sub si, 0xee38
mov byte ss:[rsi + rdi - 0x398bdfff], r8b
lea r9, [rdx*2 - 0x46f3bdc6]
and edx, ecx
lea rdi, [rsi + rdx - 0x13e98467]
mov eax, dword [r10 + rcx*4 - 0x42b6be40]
sar edx, 0x36
mov r8d, 0x4e06ef2b
lea r10, [r10 + rcx*4 - 0x42b6be3c]
xadd r8b, r9b
xor eax, ebx
bswap eax
shl edi, cl
adc r8d, 0xde9d4eb8
xadd sil, r8b
not eax
jg 0x18075bb5c
btr rbp, 0x3e
lea rsi, [rsi + rbp - 0x4c2ea915]
movzx ebp, byte [rsi + rax + 0xfb]
xor bpl, dil
sub bpl, 0x1d
mov qword [rsp + rax + 0xfb], rdx
cbw
sal ax, 0xca
xor bpl, 0xb6
xadd dx, ax
bt ax, dx
shl ax, 0xcc
adc bpl, 0x2e
sal qword [rsp + rax + 0x6000], cl
xor rax, rdx
shr ebx, cl
not bpl
dec bpl
xor dil, bpl
sar eax, cl
not word [rsp + rax*2 - 3]
lea rbp, [rsp + rbp + 8]
not r8b
mov r9d, 0xb114c63c
mov r9d, dword [rbp + rax - 2]
lea r11, [rax + r11 - 6]
rol rcx, cl
sub rdx, qword [rsp + rax*2 - 4]
mov dword [rax + r11 - 2], r9d
xadd byte [rsp + rax + 3], ch
call fcn.1806e9271
mov r8d, 0x599a96a5
movsx ebp, r8w
mov r9w, word [r11 + r8 - 0x599a96a5]
mov cl, byte [r11 + r8 - 0x599a96a3]
mov eax, ebp
lea r11, [r11 + r8 - 0x599a96a3]
movsx ebx, r8b
shl r9w, cl
movzx edx, ax
mov word [r8 + r11 - 0x599a96a5], r9w
lea rsi, [rsi + rdx - 0x96a9]
lea rdx, [rbx + rbx*2 - 0x12ebc3e0]
xor bpl, bpl
lea r9, [rbp + r8*4 - 0x18c98d68]
mov ecx, dword [r8 + rsi - 0x599a96a5]
shl bx, 6
xor ecx, edi
call fcn.1806f5bed
mov ecx, 0x10adaf90
movsx edx, cl
movzx edi, dl
mov rdi, qword [rdi + rbp - 0x90]
mov esi, 0x398bce37
jmp 0x180799262