joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407f06ea
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdx*2 - 0xb00], 0xffffffffb1a36bac
mov dword [r9 + rdx*8 - 0x2bfc], esi
not dword [rsp + rcx*4 - 0x1f0]
movzx ebp, byte [rdi + rdx - 0x580]
ror word [rsp + rdx - 0x57e], 0x44
mov qword [rsp + rdx*2 - 0xaf8], rdx
neg cl
xor bpl, r10b
movzx esi, word [rsp + rdx*2 - 0xaf8]
shl byte [rsp + rdx*4 - 0x15fe], 0x61
sbb bpl, 0xb
movsx r11d, si
inc r11b
neg bpl
mov eax, r11d
btr dx, si
push r11
ror bpl, 1
sub bpl, 0x94
imul rcx
cqo
dec ecx
ror bpl, 1
xadd dword [rsp + rdx*2 + 0x19], ebx
cwde
div word [rsp + rdx*2 + 0x1b]
sub bpl, 0x84
shl dl, 0xc6
shl rax, cl
xor r10b, bpl
lea rbp, [rsp + rbp + 0x20]
dec cl
or eax, dword [rbp + rdx - 0xc0]
shl rcx, cl
push rcx
shr qword [rsp + rdx*2 - 0x160], 0x9c
mov dword [r9 + rdx - 0xc0], eax
jns 0x1407f5ae3
sar bp, 0xe3
ja 0x140805a5f
mov ebx, 0x5422ec12
btc rbx, rbx
movzx ecx, byte [rdi + rbx - 0x5426ec12]
lea rdx, [rbx*4 - 0x59508d55]
neg rdx
lea rdi, [rbx + rdi - 0x5426ec11]
movzx ebp, bx
sal bp, 0x41
xor cl, r10b
sub cl, 0x3f
rol dl, 0x64
ror rbp, 0xf8
xchg rdx, rbx
ror cl, 1
btr edx, ebp
not rbp
adc ebp, 0x78217390
not cl
call fcn.14085b433
rol dword [rsp + rdx - 0xa6], 0xe
adc ecx, dword [rdi + rdx*4 - 0x2ff]
xor ecx, r10d
not ecx
lea rbp, [rsi + r11*8 + 0x4fb03012]
inc ecx
xor ebx, 0x24969317
call fcn.1407fbb6e
jmp 0x140808862
push 0xffffffffb22b5f13
lea rsp, [rsp + 8]
jmp 0x14080113c
Function at 0x1407f0aee
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal ecx, 0xb6
mov qword [r9 + rbp - 0x59a4], r11
mov eax, esi
lea r11, [rax + rcx - 0x1670a9e9]
mov ebx, dword [rcx + rdi + 1]
cdq
pop rsi
xor ebx, r10d
and r11w, bp
movsx esi, ax
xor ebx, edx
sub ebx, edx
xor ebx, edx
bswap ebx
mov qword [rsp + rbp*2 - 0xb338], r10
xor dword [rsp + rbp - 0x599c], ebx
pop r10
bt bp, si
imul rbp, r11
movsxd rbx, ebx
adc r8, rbx
or dl, bpl
bt ebp, 0x80
movzx eax, byte [rdi + rcx*2 + 5]
lea rdi, [rdi + rcx + 6]
xor al, r10b
sub al, 0xb
sar edx, 0xd8
adc cl, 0x2c
dec r11d
neg al
sal bp, cl
xor bpl, 0xa8
jge 0x1407f6379
ror al, 1
ror r11, cl
sbb al, 0x94
ror al, 1
ror cl, 0xc6
bswap ebp
neg dx
sbb al, 0x83
xor r10b, al
jmp 0x1408020ad
adc ecx, edx
mov ebp, edx
neg r11w
bts rbp, 0xb
ror ecx, 1
mov qword [rsp + rdx], r10
bt bp, 0x90
xor dword [rsp + rdx], ecx
pop r10
cdqe
cdqe
movsxd rcx, ecx
rol ebp, 0x8c
adc r8, rcx
add rdx, r8
jmp rdx
imul bp, si
add rax, rsp
add r11, r11
rol rsi, 0xb1
lea rbp, [rdx + rdx*4 + 0x158044b8]
mov r11d, dword [rcx + rax - 0xb4]
rol dx, 0x45
movzx eax, bpl
mov dword [r9 + rcx*2 - 0x174], r11d
shl si, 0xeb
lea r9, [r9 + rcx - 0xc0]
jbe 0x140838993
mov r11d, 0xd6048728
movsx ebp, r11b
movzx edx, bpl
mov ebp, dword [rdi + rbp - 0x28]
xor ebp, r10d
sar r11, 0xe1
mov ebx, 0x94b88e2a
sub bl, bh
bswap ebp
push rdx
sbb ebp, 0x9617b18d
movsx eax, byte [rsp + rdx*8 - 0x140]
mov ecx, dword [rsp + r11*4 + 4]
rol ebp, 1
pop rsi
xchg sil, bl
xor ebx, 0x7bad8a26
bswap ebp
dec cl
or dl, sil
push rcx
rol ebp, 3
sub r11b, byte [rsp + r11*2 + 2]
shl word [rsp + r11*2 + 6], 0x22
mov qword [rsp + r11], r10
jnp 0x1407f3474
sar ebx, cl
movzx r10d, ax
xor dword [rsp + r11*4], ebp
neg sil
idiv bl
pop r10
jmp 0x1408112e4
add edx, r11d
setbe sil
movsxd rbp, ebp
btc rdx, r11
rol cl, 0x46
lea rdx, [rcx + rax*4 - 0x6a6b07c1]
add r8, rbp
xchg rbx, r11
mov r11d, dword [rdx + r9 + 0x6a6b0362]
bts si, bx
movzx ebp, si
lea rax, [rsp + rbx + 0x4c]
bt bx, si
dec bx
call fcn.14082f610
xchg esi, ebp
js fcn.1408404ab
Function at 0x1407faa9a
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
inc dl
mov dword [rsp + rax - 0x5b09efe], ebp
not rbx
neg dl
inc esi
sub dl, 4
mov qword [rsp + rsi - 0x5b09f0e], rax
xor r10b, dl
lea rdx, [rsp + rdx + 0x18]
bts rbp, rbx
mov qword [rdx + rsi - 0x5b09f0e], rcx
or dword [rsp + rsi - 0x5b09efe], esi
shr ebp, 0x8c
mov ebx, dword [r9 + rbp - 0xea9bd]
cdqe
xor word [rsp + rbp - 0xea9b3], bp
lea r9, [r9 + rbp - 0xea9b9]
movsx ecx, si
pop rbp
movzx esi, byte [rbp + rdi - 0x5b09f08]
lea r11, [rcx*2 + 0x50916c2b]
lea rdi, [rdi + rbp - 0x5b09f07]
dec rax
shl byte [rsp + rbp*2 - 0xb613e12], 0x26
ror word [rsp + rbp - 0x5b09f0a], cl
xor sil, r10b
inc rcx
call fcn.14083bcff

Function at 0x1407fbd19
Capabilities:
Authenticate hmac

Disassembly:
ror al, 1
xadd qword [rsp + 8], rsi
not al
add r11d, dword [rsp + 0xc]
add rsi, 0x4f9a6d80
xor byte [rsp + 8], r11b
xor r10b, al
call fcn.1408016d2

Function at 0x1407ff711
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 8]
sub rsp, rcx
jmp 0x1408338bb
xor rdx, rcx
adc r8, rbp
mov r11, qword [r9 + rsi*2 - 0x3a624a34]
mov rcx, qword [r9 + rsi*4 - 0x74c4946c]
add r11, rcx
mov ebx, esi
mov qword [r9 + rsi - 0x1d31250c], r11
movzx r11d, dl
imul rsi
shl ax, 0x66
lea r9, [rdx + r9 - 0x2366fd7]
jae 0x1407f2f42
movsxd rdx, edx
adc ebp, ecx
add ebp, r11d
adc r8, rdx
btc rbx, 0x10
btc bx, 0xbc
btc cx, 0x9e
jae fcn.1408404ab
and rsp, 0xfffffffffffffff0
call fcn.140828d0a
setl al
jne 0x140812fe0
mov qword [rsp + rbx - 0x4da63753], r11
mov dword [r11 + r9 - 0x7ff7], eax
mov ebp, dword [r9 + rbx - 0x4da63751]
mov esi, ebx
or dword [rsp + r11*4 - 0x1fff0], esi
lea r9, [r9 + rbx - 0x4da6374d]
movsx eax, bx
not dword [rsp + r11 - 0x7ffc]
idiv rax
movzx ebx, byte [rbx + rdi - 0x4da63756]
xor qword [rsp + r11*2 - 0x10002], rsi
xor word [rsp + r11*2 - 0xffed], 0xde87
mov ecx, edx
lea rdi, [rdi + r11*2 - 0xfffc]
xor bl, r10b
inc rsi
jno 0x140857d7f
sal dx, 0xe9
pop r10
adc ecx, 0x9806e810
movsxd rbp, ebp
rol esi, 0x3b
js 0x140811bab
inc r11d
neg bl
rol bl, 1
not bl
rol bl, 1
jmp 0x14081250b
Function at 0x1408001e3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp], 0xffffffff8b17db06
mov qword [rsp + 0x10], rdx
mov edx, 0x23a1ec90
not rdx
mov qword [rsp + rdx + 0x23a1ec99], rsi
mov dword [rsp + rdx*2 + 0x4743d922], edx
movzx esi, dl
sal dx, 0x2b
mov qword [rsp + rdx*2 + 0x47431000], r14
push r11
lea r11, [rdx + rdx - 0x3650a7ea]
lea r11, [r11*8 + 0x1b25e8ae]
push r12
shr r11b, 0x65
lea esi, [rdx + 0x23c18800]
xor r11, r11
neg r11b
sal rsi, 0xb
sub r11b, dl
sal rdx, 0xeb
push r15
sub r11w, dx
adc r11d, edx
mov qword [rsp + r11 + 0x38], r8
neg edx
push rax
ror r11d, 0xac
sal r11d, 0x47
push rbx
movzx r8d, dx
push r10
lea rbx, [rdx + r11 + 0x4aa6ea04]
xchg dx, r11w
imul dx, r11w
push r13
lea r10, [rdx*2 + 0x410a0ea3]
xchg r10, r11
movzx eax, bl
push rdi
neg r8w
movzx edi, bl
jle 0x1408088c0
push rcx
movabs r10, 0
ror r8, 0x52
push r10
lea rdx, [r11*4 - 0x316b48d7]
movsx ecx, r8b
push rbp
btc r8d, r8d
cmovae r8, rax
btr ecx, ebx
mov edi, dword [rsp + r11 - 0x410a0e23]
dec edi
add r8w, 0xd306
or r11w, 0xc38
rol edi, 3
movzx ebp, r8w
btc r11, rdx
inc rbp
neg edi
call fcn.140803b2c
Function at 0x140800d26
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
lea rdi, [rsi + rdi - 0x31]
not ax
xor edx, r10d
mov ebp, esi
shl rbp, 0x9e
inc edx
movsx ecx, sil
lea rbx, [rax*8 - 0x1940fef4]
inc esi
xor edx, 0xb599341c
ror rcx, 0x79
or bx, 0x9a34
ror cl, 0xa7
dec edx
rol edx, cl
inc edx
jmp 0x140839fca
lea rdi, [rdi + r11 - 0x9a4b944]
setae bl
movsx ebp, byte [rsp + r11*2 - 0x13497297]
mov qword [rsp + r11 - 0x9a4b941], 0x69b82619
xor rcx, r10
rol rcx, 1
not rcx
bt ebx, 0x97
jb 0x140821ce1
sal ebp, 0x51
lea rcx, [rcx + r11 - 0x314fbf83]
not rcx
xor r10, rcx
cdqe
call fcn.140842486
mov eax, 0x84955f2e
mov r11d, 0xc582c835
mov edx, dword [rdi + riz]
movsx esi, r11b
jmp 0x1407fa7ca
call fcn.14080923e
mov eax, 0xa900afb0
lea rbx, [rsp + 0x18]
lea rbp, [rax*8 + 0x3180c91]
lea r11, [rax*2 + 0x559451b3]
movzx dx, byte [rbx + riz]
push rbp
mov r11w, dx
movzx r11w, r11b
pop rbp
mov esi, 0xab887f07
mov ecx, ebp
mov al, byte [r9 + rcx - 0x4b1d8a11]
imul ecx, ecx
lea rbx, [rcx + rsi*4 - 0x4fac579]
sub rbp, rsi
and r11b, al
bts rbx, rsi
lea rdx, [rcx*8 - 0x5ed76e5]
call fcn.140848836
ror rcx, 0xa2
push r10
jae 0x14084ea2c
mov edx, 0xb72284b6
mov ebx, edx
lea rcx, [rbx + rbx + 0x3399d731]
mov ecx, dword [rdi + riz]
mov ebp, edx
push rbp
add rdi, 4
or word [rsp + 6], dx
jo 0x140848d35
xor ecx, r10d
xor ecx, 0xe81ff88c
and bpl, byte [rsp + 4]
btc bx, dx
adc word [rsp + 2], 0xa5ad
neg ecx
movsx esi, bl
rol ecx, 2
sub rdx, 0x4914cb2c
mov word [rsp + rdx - 0x6e0db989], si
neg ecx
rol ecx, 1
dec ecx
pop rax
add ebx, 0xbd82fa88
not ecx
shr eax, 0x7d
div dl
xchg ebp, edx
lea ecx, [rcx + rax*2 - 0x6835cf37]
push rdx
mov qword [rsp + rbp - 0x6e0db98a], r10
mul ax
mov r10d, 0xb334cd29
xor dword [rsp + rbx - 0x74a57f7e], ecx
movsx r11d, dx
imul ebp, ebp
xadd bl, bpl
pop r10
mul al
sub rbx, rbx
movsxd rcx, ecx
adc r8, rcx
inc ebp
cdq
xchg bpl, bl
or dx, word [rdi + rdx*2]
shr r11d, 0xf8
inc rbp
lea rdi, [rdi + rbx*4 - 0x1fa]
xor dx, r10w
rol r11d, 0x22
btc bx, bx
sal r11b, 0x82
inc dx
jmp 0x140837d56
xor dword [rsp + rsi*8 - 0x1b0], edx
ror rbx, 0x42
not r11b
push rax
mov r10, qword [rsp + rsi*8 - 0x1a8]
push rax
inc eax
movsxd rdx, edx
adc r8, rdx
cqo
sal ebx, 3
movzx ebp, byte [rdi + rsi - 0x36]
mul ebx
lea rdi, [rdi + rax*2 - 0x1abe069f]
mov qword [rsp + rax*4 - 0x357c0d30], rdx
xor bpl, r10b
sub bpl, 0x8b
not bpl
inc bpl
ror bpl, 1
mul dword [rsp + rax*2 - 0x1abe0696]
not bpl
rol rax, 0x36
xor r10b, bpl
pop rsi
jmp 0x140831082

Function at 0x140801a02
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov edi, dword [r8 + rdi*4]
sub qword [rsp + 8], 0x7c2efcb0
dec word [rsp + 0xc]
shr ecx, 8
xor ecx, edi
inc rbp
mov qword [rsp], 0xffffffffa036ad94
xor ecx, 0x99956a9b
call fcn.140827757
Function at 0x14080aa4b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add al, 0xa3
pop r11
movzx r11d, word [rsp + rdx*8 - 6]
xor al, 0x9c
inc r11d
neg dword [rsp + rcx*4 + 3]
adc al, sil
or word [rsp + rbp - 0xfff8], 0x202e
sar dx, 0xe
xor r10b, al
not word [rsp + rcx*2 + 4]
lea rax, [rsp + rax + 8]
ror word [rsp + rcx*4 + 1], 6
bswap rcx
mov dword [rax + rcx], ebx
rol dx, 0x47
shr dword [rsp + rdx*8 + 4], 0xfd
jae 0x14081217f
mov qword [rsp + rcx*2], r8
ret
cqo
imul r11, rdx
lea rbp, [rdx + rax*4 + 0x7bb04418]
add r11b, byte [rdx + rbx]
lea r9, [r9 + rdx - 2]
mov word [rdx + r9], r11w
mov r11d, ecx
mov esi, dword [rdx + rdi]
sal bp, 0x4f
xor eax, 0x8d30b718
imul r11d, edx
lea rdi, [rdi + rdx*2 + 4]
mov ebx, ebp
jno 0x14085b298
btc rax, rbp
adc esi, edx
sal bpl, 0x85
shl eax, 0xb8
mul edx
rol esi, 1
push rdx
inc esi
mov qword [rsp + rdx - 0x4cfffffe], 0x49834d9e
xor r11, 0x48bd989f
mov qword [rsp + rdx - 0x4cfffff7], r10
cwde
xor dword [rsp + rcx*2 - 0x10f6a], esi
movzx r10d, bx
push rbp
mov r10, qword [rsp + rdx - 0x4cffffef]
idiv cx
ror ax, 0x66
mov qword [rsp + rcx*2 - 0x10f62], rcx
movsxd rsi, esi
xchg r11b, al
adc r8, rsi
and byte [rsp + rcx - 0x87a6], ch
pop r11
pop rsi
pop r11
jbe fcn.1408404ab
xor esi, r10d
inc esi
imul dx, word [rsp + rdx + 1]
xor esi, 0xb599341c
dec rdx
jne 0x14081a51f

Function at 0x14080ab58
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
cmp ebx, 4
jmp fcn.14084426a
lea rsp, [rsp + 8]
jne 0x140843b9a
mov r8d, 0xe9300286
jmp 0x14084a028
movsx eax, bp
and edx, 0x46be9b23
jnp fcn.1408404ab
jmp 0x1408016fc
mov r8, rax
call fcn.14080926e
sar bx, 0x23
xor si, r10w
shr rbx, 0x57
lea rbp, [rdx + rax*2 + 0x49b283ba]
neg si
not si
bt bx, 0xa
xor si, 0xf23f
xor r11d, ecx
not si
or cl, 0x35
inc bpl
adc si, 0xa18b
lea rbx, [rcx + 0x493e968d]
xor r10w, si
shr al, 0xe2
add rsi, rsp
div rbx
neg ecx
mov eax, dword [rsi + riz]
sal bl, 0x65
jns 0x1408177e0
sbb r9, 4
shr rbp, cl
mov dword [r9 + rbp - 0xa4d919], eax
ja 0x14083d0b5

Function at 0x14080b30e
Capabilities:
Authenticate hmac

Disassembly:
not word [rsp + r11*2 - 0x35]
lea rbx, [r9 + r11*2 - 0x38]
call fcn.140813cf3
pop rdx
mov qword [rsp + r11*2 - 0x32], r10
movsx edx, r11b
rol qword [rsp + r11*2 - 0x3a], 0x90
movzx esi, dx
xor dword [rsp + r11 - 0x15], ecx
mov r10, qword [rsp + r11*2 - 0x32]
or dl, bpl
movsxd rcx, ecx
cwde
cwde
movsx ebx, byte [rsp + r11*2 - 0x39]
adc r8, rcx
ror bl, 0x64
mov rbp, qword [r11 + r9 - 0x1d]
sal word [rsp + r11*2 - 0x35], 0x4b
mov cl, byte [r9 + r11*2 - 0x32]
je 0x140828f0c
neg edx
xor edx, 0x239839a0
add word [rsp + r11 + 1], si
lea rbx, [r11 + r11*4 - 0x6c550652]
adc qword [rsp + r11*2], r11
mov qword [rsp + r11], r10
xadd rcx, rsi
or r11w, ax
or r11w, si
xor dword [rsp + r11*2], edx
sub al, 0x2f
bts rcx, 0x28
pop r10
add r11w, cx
movsxd rdx, edx
call fcn.14083b124
shr rbp, cl
movzx ecx, sil
neg eax
cwd
mov qword [r9 + r11 - 0x1b], rbp
movzx ebp, r11b
jbe 0x1407f63cc
Function at 0x140812769
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x20]
je 0x1408156b3
push r9
push 0xffffffffb32e32b1
mov qword [rsp], r10
mov r9d, 0x8b127100
rol r9w, 0xc3
lea r10, [r9 + r9*2 - 0x2d4134fb]
lea r9, [0x140849898]
mov ebp, 0xf99f6118
jmp 0x14085d193
lea rcx, [rbp*4 - 0x6af9e980]
not edx
shl ebp, 0x96
mov dword [r9 + rbp - 0x46000000], edx
mov ebp, dword [rbp + rdi - 0x46000000]
adc rdi, 4
movzx esi, cx
movzx ebx, cx
movzx eax, bx
xor ebp, r10d
btc cx, 6
mov r11d, ebx
rol ebp, 2
rol al, 0xc7
inc ebp
or ebx, 0x342b0235
rol ebp, 3
push rcx
add al, byte [rsp + rsi*2 - 0x135bd]
lea ebp, [rsi + rbp - 0x2d929e9a]
call fcn.1407fc6ab
call fcn.140811528

Function at 0x140813e95
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movsxd r11, r11d
ror ebx, 0x29
and rbx, rcx
adc r8, r11
shl esi, cl
shr ebx, cl
mov r9d, dword [r9 + rdx - 0x4f0fba87]
jnp fcn.1408404ab
pop rbx
mov r10d, edx
xor dword [rsp + rdx*4 - 0x1ccc4], r11d
xadd ebp, edx
pop r10
lea rbx, [rbp + rcx + 0x5ab85136]
shr bl, 0xa1
jg 0x1407f0a46

Function at 0x140813eb7
Capabilities:
Encode data using base64

Disassembly:
dec byte [rsp]
bswap ebp
jge 0x140829175
mov qword [rsp], 0x2d2cb186
shr dword [rsp + 2], 1
adc rdi, 4
shr qword [rsp], 0x17
xor ebp, r10d
jmp 0x140806a09
call fcn.14081ffbe
mov bx, word [r9]
mov ecx, 0x563f4710
mov cl, byte [rcx + r9 - 0x563f470e]
mov r11d, 0x4305ab1d
mov esi, r11d
lea r9, [r9 + r11 - 0x4305ab1b]
mov edx, r11d
shl bx, cl
push rsi
jmp 0x140845fc7
movzx ebp, byte [rsp + r11 - 0x4305ab1a]
mov word [r9 + rbp*8 - 0x218], bx
mov eax, dword [rbp + rdi - 0x43]
mov ecx, esi
shr esi, 0x64
lea rdi, [rsi + rdi - 0x4305aad]
call fcn.1408548cd
bswap eax
rol esi, 0x78
rol eax, 3
push rsi
ror word [rsp + rsi*8 - 0x4bc58563], 0x6d
call fcn.14085de37
adc ebp, 0x9007f3f
call fcn.14081b88b

Function at 0x1408142c7
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xffffffffca389891
xor edx, esi
and qword [rsp], 0xffffffffda09ccad
shl byte [rsp + 2], 0x87
jnp 0x1408454e4
and edx, 0xff
shr dword [rsp + 2], 0xf4
jbe 0x140828303
movzx edx, word [rdi]
mov ecx, 0x5429a035
movsx eax, cx
sar cx, 0x2f
lea rdi, [rcx + rdi - 0x5429fffd]
mov esi, eax
rol ecx, cl
xor dx, r10w
movzx ebp, sil
mov ebx, ecx
btr eax, eax
xor dx, bx
bts ecx, eax
adc dx, 0xc700
dec ebx
xor dx, 0x9e0f
add dx, cx
add sil, al
xor r10w, dx
add rdx, rsp
xor rbp, rbx
not eax
mov rsi, qword [rdx + rax*2 - 0x40bf94]
bts ecx, eax
sar ecx, cl
lea r9, [rax + r9 - 0x205fd2]
call fcn.140836622
mov edx, dword [rdi + rdx*4]
not word [rsp + 3]
push 0xffffffffa112d833
shr esi, 8
push 0xfffffffff13b3198
jmp 0x140829c01
xor esi, edx
call fcn.14082838e
xor dword [rsp + rdx*4 + 0x28], ebp
mov r10, qword [rsp + rdx*4 + 0x28]
inc r11w
neg word [rsp + rdx*2 + 0x11]
mov r11, qword [rsp + 8]
add r11, 0x44f06
jmp r11
bt cx, dx
dec ebp
bt eax, eax
movsx r11d, dx
ror ebp, cl
btr rsi, rsi
bt ebx, 0x33
xor ebp, 0xeba8c69d
call fcn.14083d39a
pop r10
dec al
sal sil, 0x87
movsxd rbx, ebx
lea rcx, [r11 + 0x27a28888]
movsx edx, al
xchg rsi, r11
adc r8, rbx
add rax, 0xffffffff91166fa7
xor r11, r8
jmp r11
Function at 0x140815575
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
cwde
shl bp, 0x6e
mov r10, qword [rsp + rsi - 0xff6e]
lea r11, [rbx*8 - 0x32edc2d0]
ja 0x14082f2a4
mov qword [rsp + rbx - 0x76ff4849], 0x620bc69f
movsxd rcx, ecx
mov qword [rsp + rbx - 0x76ff4851], rbx
add r8, rcx
ror dx, 0xa1
not dword [rsp + rbx - 0x76ff4851]
idiv r11
mov rbx, qword [r9 + rsi*2 - 0x1feec]
mov rdx, qword [r9 + rsi - 0xff6e]
and rbx, rdx
sub r11w, r11w
not rbx
btc esi, eax
jae 0x140820f92
mov ecx, dword [r9]
mov esi, 0x9ba3ac9e
mov eax, dword [r9 + riz + 4]
mul ecx
dec si
mov ebp, esi
mov dword [r9 + riz], edx
mov dword [r9 + riz + 4], eax
lea rcx, [rbp - 0x10f61270]
mov edx, dword [rdi + riz]
jnp 0x1408275e6
xor cl, 0x9c
btc rax, rdx
movzx esi, bx
inc cl
imul dx, dx
not edx
xor r10b, cl
add rcx, rsp
cqo
mov dword [rbx + rcx], ebp
movzx ecx, dx
mov eax, dword [rdi + rbx]
or rdx, rbx
adc bl, ch
lea rdi, [rdi + rbx + 4]
bts rbx, rcx
lea rbp, [rsi + rdx*2 + 0x6f336d0c]
rol dl, 0x27
xor eax, r10d
bswap eax
lea r11, [rbx*2 + 0x48983786]
sub eax, 0x9617b18e
push rdx
and r11d, dword [rsp + rbx + 2]
rol eax, 1
bswap eax
rol eax, 3
add qword [rsp + rbx - 1], r10
add bpl, 0xa3
xor dword [rsp + rbx - 1], eax
pop r10
inc r11d
movsxd rax, eax
add r8, rax
inc rsi
add rdx, r8
jmp rdx
add rdi, 4
xor edx, r10d
movsx r11d, cx
xadd r11, rsi
dec edx
bswap edx
xor ebp, r11d
lea rbx, [rcx + rbp*2 - 0x4ce884f4]
add si, 0x31a2
neg edx
xor bp, 0xa893
sal r11, 8
inc edx
push r10
xor dword [rsp + rbp - 0x42c4], edx
movzx eax, sil
pop r10
jmp 0x140834803

Function at 0x1408180ff
Capabilities:
Encode data using base64

Disassembly:
add sil, bpl
neg ecx
inc ecx
not ecx
lea ecx, [rbx + rcx - 0x6f17933e]
mov eax, 0x6ae891a
mov qword [rsp + rbp - 0x17b6db01], rbx
neg si
ror ecx, 3
ror qword [rsp + rbp - 0x17b6db01], 0x7d
and eax, eax
mul esi
bswap ecx
inc esi
push rbp
add qword [rsp + rbp - 0x17b6daf9], r10
div qword [rsp + rbp*2 - 0x2f6db602]
mov r10d, 0x7b1ad19c
imul byte [rsp + rbp - 0x17b6dafd]
xor dword [rsp + rbp - 0x17b6daf9], ecx
div r10d
mov r10, qword [rsp + r11 - 0x400407f9]
jmp 0x140846b17

Function at 0x14081923d
Capabilities:
Encode data using base64

Disassembly:
pop rsi
pop r11
jp fcn.1408404ab

Function at 0x14081a258
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
je 0x14084cb8f
jmp 0x140833efa
push r9
mov r9d, 0x3e0d42a1
sub r9, r9
push r10
lea r9, [r9 - 0x44e939f9]
lea r10, [r9*2 + 0x3ea8750a]
jge 0x14084d4e5
Function at 0x14081bd87
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor ebp, 0x11352f19
sal ecx, 0x4a
xor esi, r11d
dec ebp
bt ecx, eax
sar esi, 0x38
not edx
mov qword [rsp + rax*8 - 0x757e8], r10
ror word [rsp + rax - 0xeafc], 0x68
sub word [rsp + rax*2 - 0x1d5fe], bx
cwd
not ebp
movzx edx, word [rsp + rax*2 - 0x1d5f5]
lea ebp, [rbp + rcx*2 + 0x9d7a540]
sar byte [rsp + rax*2 - 0x1d5ea], 0x85
xchg qword [rsp + rax - 0xeaff], r11
not ebp
ror byte [rsp + rax*4 - 0x3abf8], 0x43
cwd
ja 0x1407f75c9
mov qword [rsp + rdx - 0x1c0ad08e], rdx
lea rdi, [rdi + rdx*4 - 0x702b4234]
and word [rsp + rdx - 0x1c0ad088], 0x6f00
movsx esi, dl
xor ecx, r10d
xor ecx, 0x3b32563e
lea ecx, [rcx + rsi - 0x554163ff]
not ecx
sal sil, 0xc6
movsx ebp, si
mov r11d, 0xec8965a0
sbb ecx, 0xa79c732d
or bp, dx
jge 0x1408019cf
ror word [rsp + rdx - 0x1c0ad089], 0x8e
not ecx
inc dword [rsp + rdx - 0x1c0ad08c]
mov qword [rsp + rdx - 0x1c0ad08e], r10
xor dword [rsp + rdx*4 - 0x702b4238], ecx
mov eax, r11d
call fcn.14081888e

Function at 0x1408202a8
Capabilities:
Authenticate hmac

Disassembly:
rol dl, 1
shl r11w, 0x25
inc sil
ror r11w, 0xa8
sbb dl, 0xa9
neg dl
pop r11
bt ebp, 0x17
sbb dl, 0x93
btr r11, 0x31
call fcn.140820abb
shl si, 0x88
mov edx, dword [rsi + r9 - 0x3fffa]
call fcn.14080928b
xor bl, 5
rol bl, 1
sub bl, 0x39
mov eax, ecx
btr rax, rcx
bswap ecx
xor r10b, bl
btr eax, edx
adc dl, sil
inc dword [rsp + rsi*4 - 0x3903ce8]
mov word [r9 + rsi - 0xe40f32], bx
ror word [rsp + rsi - 0xe40f36], cl
mov eax, dword [rsi + rdi - 0xe40f39]
xchg rdx, rsi
xor eax, r10d
sar edx, 0x96
movsx ebx, si
push rbp
dec eax
or bl, 0xe
ror bl, cl
ror eax, 2
and dword [rsp + rcx - 0x15a56b9e], esi
btr ebx, edx
movsx r11d, cl
bswap eax
or r11w, cx
lea eax, [rax + rsi - 0x3b392abb]
inc word [rsp + rsi - 0x4439a9ee]
rol eax, 3
push r11
mov qword [rsp + rcx - 0x15a56b94], r10
and byte [rsp + rcx - 0x15a56ba2], ch
push r11
xor dword [rsp + rsi - 0x4439a9e2], eax
push rbx
sub dl, byte [rsp + rcx - 0x15a56b92]
add dword [rsp + rsi - 0x4439a9de], r11d
mov r10, qword [rsp + rcx - 0x15a56b84]
movsxd rax, eax
adc r8, rax
lea rbx, [rsi + r11*4 + 0xf1c7eae]
mov dl, byte [rdi + rcx*2 - 0x2b4ad743]
lea rsi, [rbx + rcx*4 + 0x311e6994]
lea rdi, [rdi + rcx*2 - 0x2b4ad742]
inc bp
add word [rsp + rcx - 0x15a56b98], 0xa2b1
xor dl, r10b
xor dword [rsp + rcx*4 - 0x5695ae77], ecx
rol rbp, cl
inc dl
and r11d, ebp
jp 0x140804e9d

Function at 0x1408203aa
Capabilities:
Authenticate hmac

Disassembly:
sbb rbp, rdx
call fcn.14082c6f3
xor bpl, byte [rsp + rsi*2 - 0x1e606d0d]
mov r10, qword [rsp + rsi - 0xf303672]
xor eax, edx
push rbx
movsxd rcx, ecx
cbw
adc r8, rcx
sub ebp, dword [rsp + rsi - 0xf303677]
xor r11w, ax
mov ecx, 0xee889f1f
pop rsi
pop rdx
pop r11
pop rcx
pop r11
jle fcn.1408404ab
Function at 0x140820b06
Capabilities:
Encode data using base64
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
bswap ecx
lea ecx, [rbx + rcx + 0x2e1cf3c]
mov qword [rsp + rbx - 0x61eb003], 0x441e983d
shr dl, 0x41
xadd word [rsp + rbx*2 - 0xc3d6002], bx
rol ecx, 3
inc rdx
xadd word [rsp + rbx*4 - 0x1877fffd], bp
ror bpl, 4
mov qword [rsp + rbx - 0x61e0000], r10
mov r10d, r11d
jp 0x14084232c
mov esi, dword [r9]
mov ebp, 0x1b9f6a87
mov eax, dword [rbp + r9 - 0x1b9f6a83]
mul esi
movsx ebx, bpl
call fcn.1408555a3

Function at 0x140820e53
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x723b1a9a], rax
add bp, 0xa18b
bt esi, edx
adc byte [rsp + rbx - 0x723b1a8c], r11b
xor r10w, bp
or qword [rsp + r11 - 0x2885f44f], r11
lea rbp, [rsp + rbp + 0x18]
movsx ecx, r11b
mov esi, dword [rbp + rbx - 0x723b1aa2]
inc word [rsp + rbx - 0x723b1a90]
add rcx, qword [rsp + rbx - 0x723b1a92]
mov qword [rsp + rbx - 0x723b1aa2], rbx
lea r9, [r9 + rbx - 0x723b1aa6]
mov dword [rbx + r9 - 0x723b1aa2], esi
cbw
mov esi, dword [rbx + rdi - 0x723b1aa2]
movzx ebp, cx
lea rdi, [rbx + rdi - 0x723b1a9e]
imul qword [rsp + rbx - 0x723b1a9a]
xor esi, r10d
xchg r11, rcx
lea rbx, [r11*2 + 0x2b105e36]
bswap esi
not dword [rsp + rdx - 0x581feb]
and rdx, 0xffffffffec920784
ror esi, 2
xadd dword [rsp + rdx*4 - 0x401ded], ebx
lea esi, [rsi + rbx + 0x20bb73c8]

Function at 0x140823c98
Capabilities:
Encode data using base64

Disassembly:
movzx r11d, byte [rsp + rcx - 0xcc8094]
mov qword [rsp + rcx*2 - 0x199013c], rbx
add dx, 0x8583
lea rcx, [rbp + 0x71374c23]
pop rbp
mov word [rsp + rcx - 0x71374c85], cx
not dx
mov esi, dword [rsp + rcx - 0x71374c82]
or ebp, dword [rsp + rcx - 0x71374c86]
inc rcx
inc dx
not ecx
xadd byte [rsp + rax*2 - 0x77b6], r11b
sub sil, bl
xor r10w, dx
sal cl, 0xc7
not r11b
lea rdx, [rsp + rdx + 0x10]
mov byte [rsp + rax - 0x3bd8], 0x3f
sbb dword [rsp + rax - 0x3bdd], eax
movzx cx, byte [rdx + rax*4 - 0xef78]
sbb rsi, qword [rsp + rax - 0x3bd6]
neg dword [rsp + rax*2 - 0x77bc]
lea r9, [rax + r9 - 0x3be0]
rol r11d, 0x5f
not ebx
jae 0x14080175d
mov word [rax + r9 - 0x3bde], cx
dec dword [rsp + rax - 0x3bd2]
pop rdx
pop rdx
jnp fcn.1408404ab
mov edx, 0x241641a9
movsx eax, dl
mov esi, 0x42abe119
mov dx, word [r9 + rdx*2 - 0x482c8352]
lea rcx, [rax + rax*8 - 0x396fb456]
lea r11, [rsi + rcx*2 - 0xe58e5d5]
movzx ebx, byte [rsi + rdi - 0x42abe119]
sar rsi, cl
ror r11, 0xe3
inc r11
xor bl, r10b
neg r11d
lea r11, [rsi - 0x1af44c5d]
mov ebp, esi
neg bl
and al, 0xa7
sar rbp, cl
btc rcx, 0xb2
xor bl, 0x93
call fcn.1408379fa
lea ebp, [rsi + rbp - 0x11999a49]
sub cx, cx
ror rcx, 0x4d
push r10
add cl, sil
cqo
dec bl
xor dword [rsp + rcx - 0xf0], ebp
xchg rsi, rdx
pop r10
bt ecx, ecx
imul rdx
movsxd rbp, ebp
mov r11d, edx
adc r8, rbp
bt dx, si
xor sil, byte [rdi + rcx*2 - 0x1e0]
sar r11b, 5
lea rbp, [r11*4 - 0xcd202cd]
and ax, dx
lea rdi, [rdi + rcx*4 - 0x3bf]
setle dl
xchg bp, ax
shr bl, 0xa4
xor sil, r10b
sub ebp, 0xa0104684
setbe bpl
sub ax, r11w
xor sil, 0x92
imul rax
sbb sil, bl
neg sil
xadd rcx, rbp
ror edx, 0xcb
sbb dl, bpl
not sil
call fcn.1407fc962