joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59df31
Capabilities:
Manually build aes constants

Disassembly:
push rbp
sal qword [rsp + rbp - 0x85], 0xfb
mul rcx
pop rdi
mov qword [rsi + rbp - 0x85], rdx
mov ecx, edi
not r9
dec bpl
mov qword [rsi + r9 + 0x78bec28e], rax
lea rbx, [rbx + r9 + 0x78bec282]
movsx edx, r9b
js 0x5d10cc
mov edi, dword [rsp + rcx - 0x90]
lea eax, [rax + r9 - 0x55f72ab]
ror eax, 1
mov qword [rsp + rcx - 0x9b], r9
xor eax, 0x8826b99f
push rdi
dec bpl
ror eax, 3
xchg r9w, di
mov qword [rsp + rcx - 0x8b], r8
xor dword [rsp + rcx*4 - 0x25c], eax
bswap r9d
call fcn.005db7a5
ror r9, 0x46
lea eax, [rcx + rax + 0x4e9d81ac]
movsx edx, r10w
jns 0x5d2be9
mov r10d, 0x97299819
movsx r9d, r10w
mov ebp, 0x61b7ff9c
lea rbx, [rbx + rbp - 0x61b7ffa0]
lea rdi, [r9 + r10*8 - 0x3d74c3f9]
mov r9d, dword [rbp + rbx - 0x61b7ff9c]
sar bpl, 0xe4
xor r9d, r8d
neg r9d
rol r9d, 2
movzx edx, bp
inc r9d
bswap r9d
xor r9d, 0x9036c29f
neg edx
lea rcx, [r10 + rbp*2 - 0x47cf7046]
push r8
xor dword [rsp + rbp - 0x61b7fff9], r9d
jmp 0x5c52fa
rol eax, 1
push r8
mov r8d, edx
xor dword [rsp + rcx - 0x640cf882], eax
or r10, 0x501d158a
bswap r8
pop r8
dec r10w
movsxd rax, eax
adc r11, rax
neg ecx
call fcn.005d6be7
not ebp
mov ecx, 0x2299fcb9
lea r10, [rcx*2 - 0x48ce6af4]
movzx eax, cx
mov dword [rsi + rcx - 0x2299fcb9], ebp
sub ax, 0x7d00
movsx ebp, al
jmp r11
movzx ebx, r9w
lea rbx, [0x005a7fe0]
movzx r9d, byte [rdx]
call fcn.005c4cfb
movzx ebp, byte [rbx - 1]
xor bpl, r8b
mov edx, 0xdf8b898a
lea rcx, [rdx + rdx*8 + 0x22197830]
add bpl, 0x8f
and dx, cx
not bpl
lea rdi, [rcx + rdx*2 - 0x537250d6]
dec dl
mov r10d, edi
inc bpl
not bpl
dec bpl
xor r8b, bpl
not dil
mov word [rsi + r10 - 0x69a50d4a], bp
lea r9, [rsp + r10 - 0x69a50cc0]
mov edi, dword [r9 + r10 - 0x69a50d48]
mov dword [rsi + r10 - 0x69a50d4e], edi
mov edi, dword [rbx + r10 - 0x69a50d4d]
shl rcx, 0xd
lea rbx, [rbx + r10 - 0x69a50d4d]
xor edi, r8d
lea r10, [rcx + rdx*4 - 0x2b449f57]
not edi
not r10d
sal r10b, 0x63
jbe 0x5d8951
mov r9d, 0x78bec285
movzx ebp, r9b
mov rcx, qword [rbp + rsi - 0x85]
mov rax, qword [r9 + rsi - 0x78bec27d]
jmp 0x595758
jp 0x5aae72
not edi
mov qword [rsp + 0x10], r8
xor dword [rsp + 0x10], edi
mov r8, qword [rsp + 0x10]
movsxd rdi, edi
xor dword [rsp + 3], 0x8eabb2b5
adc r11, rdi
mov edi, 0x74a7b829
shr qword [rsp + rdi - 0x74a7b829], 0xe7
mov rdx, qword [rsi + rdi - 0x74a7b829]
not rdi
mov rdi, qword [rsi + rdi + 0x74a7b832]
adc rsi, 0xc
xor ebp, ebp
push 0x108a7b9e
test rdi, rdi
push 0xffffffff8a2075a0
lea rsp, [rsp + 0x28]
je 0x5b37d9
jmp 0x5d6487
push rbx
mov r9d, 0xaa23e306
jmp 0x5b852b
inc edi
not edi
jmp 0x5c7c57
Function at 0x59e6ce
Capabilities:
Authenticate hmac

Disassembly:
xor r9b, r8b
call fcn.005cbfc5
xor r10d, r8d
rol r10d, 2
rol di, 0xe1
sbb r9, 0xffffffffa11ab91a
inc r10d
neg r10d
movsx edx, dil
add edi, edi
mov eax, 0x3b1957bd
ror r10d, 3
lea rbp, [rdi + rax*8 - 0x6f7c4355]
rol r9w, 0xa
jb 0x5c440b
not r10d
push r8
jae 0x5a2b3e
neg dx
ror rdx, 0xa5
xor dword [rsp + rax*2 - 0x7632af7a], r10d
pop r8
mov dword [rax + rsi - 0x3b1957c1], r10d
call fcn.005c3e4d
mov edi, 0xc48af200
sub rbx, 4
mov edx, 0xd7850a19
mov eax, dword [rbx]
mov ebp, edi
movsx r9d, dx
xor eax, r8d
push rdx
sar byte [rsp + r9*2 - 0x142e], 0x41
lea rcx, [rbp + rdi*8 + 0x4f92e]
xor eax, 0xf0b3689b
dec dword [rsp + r9*8 - 0x50c8]
pop rcx
sub eax, 0xe08ded8e
not dl
add r9b, 0x81
sbb r9, r9
ror eax, 1
xor rcx, 0xffffffffbf2edb2c
inc eax
not eax
lea eax, [rax + rdi - 0x8da5555]
push rbp
sal byte [rsp + r9*4 + 3], 2
mov qword [rsp + r9*2], r8
xor dword [rsp + r9*2], eax
call fcn.005a1b66
jmp r9

Function at 0x59fc5a
Capabilities:
Authenticate hmac

Disassembly:
call fcn.0059cefb
mov r10d, ecx
xor r9d, r8d
call fcn.0059dab7

Function at 0x5a1c55
Capabilities:
Authenticate hmac

Disassembly:
mov r10, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
jnp 0x5d3e99
pop r13
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
push qword [rsp + 0x70]
popfq
push 0x40395fb4
lea rsp, [rsp + 0x80]
ret

Function at 0x5a2f85
Capabilities:
Authenticate hmac

Disassembly:
mov dword [rax + rsi], edx
and word [rsp + rax + 0x19], 0x3ab2
pop r9
pop rcx
pop r9
pop rax
ja fcn.005b825c

Function at 0x5a62ce
Capabilities:
Authenticate hmac

Disassembly:
lea rcx, [rsp + rcx + 0x28]
mov ebp, dword [rcx + rdx*2 - 0x100]
rol r9d, 6
lea rsi, [rsi + rdx*2 - 0x104]
jae 0x5d3e99
mov dword [rsi + rdx*2 - 0x100], ebp
mov qword [rsp + rdx - 0x68], rdi
pop rax
pop r10
pop rdi
pop rax
pop rcx
jb fcn.005b825c
mov r9d, 0xe38f0a5
movzx ecx, r9w
mov rdi, qword [rsi + r9 - 0xe38f0a5]
mov rbp, qword ss:[r9 + rdi - 0xe38f0a5]
lea r10, [rcx*8 + 0x1309de8a]
mov rax, rbp
mov r9, qword [rsi + r9*2 - 0x1c71e142]
movsx edx, r10b
sub dx, 0x9912
or rax, r9
add dl, dl
not rax
adc r10, 0x36042784
mov qword [rsi + rcx*2 - 0x1e142], rax
movsx edi, r10w
shl rdx, 0xc8
mov eax, dword [rbx + rcx - 0xf0a9]
movsx ebp, r10b
lea rbx, [rbx + rcx*4 - 0x3c298]
xor eax, r8d
sub eax, 0x93a44086
xor bpl, 0x3b
dec edx
neg eax
not dx
jmp 0x5b4033
and rbp, 0xfffffffff997151c
rol eax, 3
jmp 0x5ae2e3

Function at 0x5a6997
Capabilities:
Authenticate hmac

Disassembly:
ror r10d, 1
neg ax
mov qword [rsp + rdi - 0x2a8353ae], rbp
inc r10d
jmp 0x5c7c6c
call fcn.005a9092
mov edi, 0x131db5b0
movzx r10d, di
movzx ebp, dil
mov rdi, rsi
lea rsi, [r10 + rsi - 0xb5b2]
mov word [rsi + r10*4 - 0x2d6c0], di
lea r9, [rbp - 0x3859d171]
mov eax, 0x151cc106
sub rbp, rbp
lea rbx, [r10 + rbx - 0xb5b4]
lea rcx, [rbp*8 - 0xdf0b68]
xchg r9b, cl
mov eax, dword [rbx + r10 - 0xb5b0]
xor eax, r8d
movsx edx, r9b
push r9
ror eax, 1
inc eax
jmp 0x5cc1a7
sar rdx, cl
ror eax, 1
call fcn.005d2d8e
Function at 0x5a6de5
Capabilities:
Authenticate hmac

Disassembly:
inc edi
call fcn.005aca98
mov ecx, 0xc62f3fa5
movsx ebp, cl
mov di, word [rsi]
lea rdx, [rcx*4 + 0x3f8b5d30]
mov r9d, ecx
dec cl
mov cl, byte [rsi + 2]
jp 0x5a6f08
add rsi, 2
sal dl, 0x22
call fcn.005d9c98
mov ecx, r9d
lea rbx, [rbx + r9*2 + 0x7d0cda6c]
jb 0x5ce7e9
sub r10d, r9d
lea rbp, [rdx + r10*2 - 0x7348575d]
not eax
rol edx, cl
ror eax, 2
xchg cx, r9w
push r9
dec eax
xor byte [rsp + r9 + 0x3e866d3e], 0x9e
neg eax
xor r9b, 6
pop r10
not eax
sar edx, cl
shr ebp, cl
jae 0x5be17f
push r8
lea r8, [rbp + rdx*2 + 0x7264011]
push rdi
xor dword [rsp + r9 + 0x3e866d3a], eax
neg r9b
setge r9b
mov r8, qword [rsp + rdx - 0x30]
movsxd rax, eax
rol ebp, 0x99
rol dl, 0xe4
call fcn.005b5cf7
inc ebp
mov eax, dword [r9 + rbx + 0x3e866d38]
xor eax, r8d
rol bpl, 2
mov r10d, 0x4e0ddd08
xor eax, 0x49b28490
jmp 0x5b55ec

Function at 0x5a7131
Capabilities:
Authenticate hmac

Disassembly:
xor al, 0x97
add al, 5
neg rdx
call fcn.0059be17

Function at 0x5a8f20
Capabilities:
Authenticate hmac

Disassembly:
sar rdi, cl
pop rax
pop r10
pop r9
pop r9
pop rdx
pop rdx
pop rdx
pop rbp
pop rdx
jae fcn.005b825c

Function at 0x5a901d
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rax - 0x40e34950], 0xffffffff80ab4b8d
neg r10
xor dword [rsp + rax - 0x40e34938], edx
push rdi
pop rdi
inc rbp
mov r8, qword [rsp + rax - 0x40e34938]
xor r9, qword [rsp + rbp + 9]
movsxd rdx, edx
sal qword [rsp + rbp*8 + 8], cl
and byte [rsp + rax - 0x40e34942], ch
adc r11, rdx
sal bp, cl
mov ecx, dword [rsi + rbp - 0x2000]
lea rsi, [rsi + rbp - 0x1ffc]
bswap rbp
inc qword [rsp + rax - 0x40e34949]
lea rbx, [rbx + rax - 0x40e34951]
sar bpl, 0x84
movzx eax, byte [rbx + rdi + 0x2fc66f79]
movsx edx, bpl
jp 0x5d0166

Function at 0x5a959b
Capabilities:
Authenticate hmac

Disassembly:
lea r9, [r10 + rdx*2 + 0x21944781]
not ecx
xor ecx, 0xf1b94c37
neg ecx
not ecx
sar byte [rsp + r10*2 - 0x220f5ffb], 0x62
mov qword [rsp + r10 - 0x1107b000], r8
js 0x59751c
sal r9, 0x2c
xor dil, 0xb8
mov qword [rsp + rdx*2 - 0x632f7162], rdx
sub dil, 9
or r10w, r10w
xor r8b, dil
neg word [rsp + rdx*2 - 0x632f7160]
lea rdi, [rsp + rdi + 8]
and r10d, edx
mov qword [rdi + rdx - 0x3197b8b1], rcx
xadd qword [rsp + rdx*2 - 0x632f7162], rdx
neg byte [rsp + r10*2 - 0x220f5ffd]
dec edx
mov r9, qword [rsi + r10*4 - 0x441ebff8]
mov ebp, 0xd53a3616
je 0x5adbf7
adc dword [rsp + r10 - 0x1107afff], 0x4936eabc
lea rbp, [rsp + r10 - 0x1107afb8]
or qword [rsp + r10*2 - 0x220f6000], r10
movsx edi, byte [rsp + r10 - 0x1107b000]
mov qword [r10 + rbp - 0x1107b000], r9
mov ecx, dword [rbx + rdi*8 - 0x315]
lea rbx, [rbx + rdi*4 - 0x18d]
sal rdi, 9
xor ecx, r8d
shl qword [rsp + r10*2 - 0x220f6000], 0x5c
ja 0x5a9409
mov r8, qword [rsp + rdi - 0x1c3191bf]
movsxd rbp, ebp
pop r10
add r11, rbp
mov qword [rsp + r9*4], r11
ret 0x18

Function at 0x5a9dd1
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r9 - 0x7940284], r10
xor dil, r8b
inc dword [rsp + r9 - 0x7940284]
dec dil
rol dil, 1
xadd word [rsp + r9 - 0x7940280], r10w
dec al
neg dil
add dil, 0x13
dec rbp
movzx edx, r9w
xor r8b, dil
add rbp, r10
setl byte [rsp + r9*8 - 0x3ca0141f]
jge 0x5acbf9
Function at 0x5aabca
Capabilities:
Authenticate hmac

Disassembly:
mov cx, word [rsi + rbp*4 - 0x38246]
mov qword [rsp + rbp - 0xe094], 0x10bd708
pop rax
sub bpl, al
lea rsi, [rsi + rbp*8 - 0x70454]
shl r10d, 0xb0
movzx eax, byte [rbx + rax*2 - 0x217ae11]
lea r9, [rbp*2 + 0x104f8a3]
call fcn.005be550

Function at 0x5aaff6
Capabilities:
Authenticate hmac

Disassembly:
add r11, rdi
mov qword [rsp + rdx - 0x460d], rbp
rdtsc
lea rsi, [rsi + rcx*4 - 0x3c]
rol r10b, 0x83
sar r10d, 0xf9
mov dword [rsi + rcx*8 - 0x64], eax
movsx edi, r10b
shr cl, 1
mov dword [rsi + rcx - 6], edx
jne 0x5ce940

Function at 0x5ab6bd
Capabilities:
Authenticate hmac

Disassembly:
sub r10d, r10d
sub rdi, rdi
cpuid
mov qword [rsp + r10], r10
cmovg r10w, bp
mov r9d, 0x5503eabd
lea rsi, [rsi + r10*2 - 0xc]
jno 0x5c650c

Function at 0x5abb65
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
jmp 0x5ba34c
mov r8, rax
push 0x2eabc323
push 0xffffffff901d458e
lea rsp, [rsp + 0x10]
jmp 0x5a8f5c
lea rsp, [rsp + 8]
jne 0x5acfc2
mov r8d, 0x9735ed82
bswap r8
jmp 0x5b4548
cmp ebx, 3
jmp 0x5b4564

Function at 0x5b0b7d
Capabilities:
Authenticate hmac

Disassembly:
xor ebp, 0x4a3d0984
xchg byte [rsp + r10 - 0x716f], dil
bswap edx
mov qword [rsp + r10 - 0x7160], r8
ror r10d, 0x1e
sbb dword [rsp + r10 - 0x1c5b5], r10d
neg rdx
xor dword [rsp + r10*2 - 0x38b70], ebp
call fcn.005d810e
xadd cl, al
lea ebp, [rax + rbp + 0x94ccd3]
not cx
mov qword [rsp + r10*2 - 0xe2d8], 0xffffffffa093a586
movzx edx, al
not ebp
bswap ebp
adc ax, word [rsp + r10 - 0x7161]
xor edi, r10d
mov qword [rsp + r10 - 0x7170], r10
dec ebp
jmp 0x595a37
Function at 0x5b0f7e
Capabilities:
Authenticate hmac

Disassembly:
mov byte [rsp + rax*2 - 0x19279142], 0xc
lea edx, [rdx + rax - 0x21a2e7ca]
rol edx, 1
bswap eax
bswap edx
mov qword [rsp], rcx
movzx r9d, ax
mov qword [rsp + r9*2 - 0x12608], r8
ror byte [rsp + r9 - 0x930c], 0xc5
pop rdi
movsx ebp, r10w
xor dword [rsp + r9 - 0x9304], edx
mov r8, qword [rsp + r9 - 0x9304]
mov qword [rsp + r9*4 - 0x24c28], 0xffffffff9abd571f
bswap ecx
movsxd rdx, edx
inc r10
inc bpl
mov qword [rsp + r9 - 0x930c], rcx
add r11, rdx
ror edi, 0x6f
lea r9, [rbp*4 + 0x2a2e111]
movzx ax, byte [rsi + r9*2 - 0x54762c2]
sbb word [rsp + r9*8 - 0x151d8aff], bp
dec rbp
mov bpl, byte [rsi + rbp - 0x3411]
adc dword [rsp + r9 - 0x2a3b15c], 0xc90bbc91
not dword [rsp + r9 - 0x2a3b15d]
and al, bpl
xor al, dil
inc dword [rsp + r9 - 0x2a3b155]
setl cl
inc qword [rsp + r9*8 - 0x151d8b00]
mov di, ax
movsx ebp, cl
mov eax, 0x39ba43b4
lea r10, [rsp + r9 - 0x2a3b089]
inc ax
add qword [rsp + rbp*2 + 7], r9
lea rbp, [rax*8 - 0x5ace5d55]
mov byte [r10 + r9 - 0x2a3b161], dil
jns 0x5bba39
not dword [rsp + r9*2 - 0x54762b8]
sar eax, 0xac
mov ebp, dword [rsi + r9 - 0x2a3b15d]
lea rsi, [rsi + r9*8 - 0x151d8b00]
mov edx, 0x3ea26a26
sbb al, dl
movzx r9d, byte [r9 + rbx - 0x2a3b166]
movsx edi, byte [rsp + rax - 0x39b76]
shr dx, 0xc9
adc dx, 0xc186
lea rbx, [rbx + rax*2 - 0x73701]
xor r9b, r8b
shl al, 0x25
xchg byte [rsp + rax - 0x39bb6], dl
sar eax, 0xac
inc r9b
neg r9b
call fcn.0059f7e6
xor r10b, 0xa
xor r8b, r10b
lea r10, [rsp + r10 + 0x18]
call fcn.0059de8a
xor ecx, r8d
pop rdi
dec ecx
mov qword [rsp], r10
dec qword [rsp + 8]
neg ecx
ror ecx, 3
dec dword [rsp + 1]
sub ecx, 0x8bb30d8f
movsx ebp, r10b
neg word [rsp + rbp - 0xb]
movzx eax, bpl
mov qword [rsp + rbp - 0xd], r8
inc di
inc rax
xor dword [rsp + rbp - 0xd], ecx
movzx r8d, dl
xor edi, r10d
mov r8, qword [rsp + rbp*4 - 0x4c]
sar edi, 0xe
shl r10d, 0xb5
mov qword [rsp + rdi*4 - 0x132e8], r10
movsxd rcx, ecx
call fcn.005c769d

Function at 0x5b1a94
Capabilities:
Authenticate hmac

Disassembly:
mov rsi, rbp
mov r8, qword [rsp + rdx - 0x1b15f41d]
mov qword [rsp + rdx*2 - 0x362be842], 0x13801d38
mov qword [rsp + rdx - 0x1b15f425], r11
call fcn.005b1ff8
not r10w
mov dword [rsi + rdx + 8], ecx
lea rsi, [rsi + rdx + 8]
add rdx, 0xffffffffd9922a94
call fcn.005d4653

Function at 0x5b737e
Capabilities:
Authenticate hmac

Disassembly:
movzx r10d, bp
mov qword [rsp + rbp + 0x6462d6b9], rax
mov r8, qword [rsp + rbp + 0x6462d6c1]
mov r9d, ebp
and dx, 0xcba1
movsxd rcx, ecx
shl r9b, 0x46
add r11, rcx
shr rax, 0x30
add rax, qword [rax + rsi]
jmp 0x5ce230
pop rdx
mov rdx, qword [rsi + r10*4 - 0xa514]
sub r9w, 0x2615
mov qword [rsp + rbp + 0x6462d6b9], rdi
bswap edi
mov cl, byte [rdi + rsi - 0xc071dd]
jae 0x5cdd79
Function at 0x5b7612
Capabilities:
Encode data using base64

Disassembly:
call fcn.005d6c8a
mov qword [rdi + rsi - 0x23b1899b], rax
movzx edx, di
jmp 0x5c0dde
lea r10, [rdi + rdx*2 + 0x1d10ecb9]
mov r9d, dword [rbx + rdi*2 - 0x4763132a]
lea rcx, [rdi + rdx*8 + 0x1d8a203e]
call fcn.005cd10a
movsx r10d, dil
lea rbx, [rbx + r10*2 - 0x6a]
xchg byte [rsp + rdx - 0x7131933c], dh
not byte [rsp + r10 - 0x32]
movzx edx, word [r10 + rbx - 0x34]
not rdi
ror byte [rsp + rdi + 0x67a3613c], cl
setbe r9b
xor dx, r8w
not qword [rsp + rdi + 0x67a36135]
pop rax
sub dx, 0xbbc
dec r9
and edi, ecx
neg dx
inc dx
xchg cx, r9w
neg dx
shr rcx, 0xb2
push r10
sar dil, 2
xor r8w, dx
lea rdx, [rsp + rdx + 8]
xadd r10w, ax
mov byte [rdx + rcx*2], bpl
not r10w
neg r10
lea rbx, [r10 + rbx + 0x9be3]
seto byte [rsp + rcx*8]
lea rbp, [r9 + rax*4 - 0x75de7356]
mov edx, dword [rsp + rcx + 4]
mov eax, dword [rbx + rcx]
xor eax, r8d
sar dx, 0xee
neg rdx
rol bpl, 0x42
lea eax, [rcx + rax - 0x37210015]
shl word [rsp + r10*2 + 0x137d3], 0xc9
adc r10d, edx
not word [rsp + rcx*4 + 2]
neg eax
inc rbp
inc eax
inc byte [rsp + rcx*8 + 7]
add byte [rsp + rcx + 4], 0x3f
xor eax, 0xdc22de26
and edx, r10d
lea rdx, [r10*8 - 0x41ce736d]
mov qword [rsp + rcx*2], r8
jns 0x5da0d9
mov eax, 0x522ad3b1
lea rcx, [rax*8 - 0x3a7f98c3]
mov di, word [rax + rsi - 0x522ad3b1]
jmp 0x5c926a
push rcx
mov ax, word [rsi + rax - 0x522ad3af]
mov cl, byte [rsi + 4]
mov ebp, 0x813ae6ab
add rsi, 4
dec ebp
shrd di, ax, cl
mov word [rsi], di
sub rbx, 4
mov r10d, 0xa891ef96
movzx edi, word [rsp + 4]
add qword [rsp + rdi - 2], 0xffffffffa800399c
mov eax, dword [rdi + rbx - 2]
movsx r9d, di
lea rcx, [r9 + r10 + 0x2ea01489]
inc qword [rsp + rdi - 2]
xor eax, r8d
sar byte [rsp + rdi + 4], 0x66
or word [rsp + rdi*4 - 6], di
neg eax
movsx edx, r10b
lea eax, [rax + rbp*2 - 0x3e4eea45]
call fcn.005b9ffd
mov ebp, 0x88a5500c
xor eax, r8d
lea rcx, [rbp - 0xd483bc8]
rol eax, 1
inc eax
xor eax, 0x4630240d
shr bpl, cl
rol ebp, 0xd7
shr ecx, cl
dec eax
xor rcx, 0x10309a90
sar dil, 0x25
lea r9, [rbp + rdi + 0x24155616]
bswap eax
not di
jp 0x5aae2d
lea rdx, [rax + r9 + 0x6eaaae15]
lea rax, [rax*8 - 0x50dab458]
ror ebp, 2
xadd rax, r10
lea ebp, [rbp + rdx*2 - 0x1cc97a75]
ror ebp, 3
movzx ecx, r9b
not dl
lea ebp, [rbp + rax - 0x5bf0e719]
sal rdx, 8
not ebp
push r8
xor dword [rsp + rax + 0x248bc82], ebp
sub al, dh
call fcn.00592d6c
sub rbx, 4
mov edi, 0x4a0758d
mov edi, dword [rbx + rdi*4 - 0x1281d634]
jmp 0x5b0c6e

Function at 0x5ba367
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x5c566c
not edi
pop rax
neg dx
lea rcx, [rcx + rbp*8 - 0x61de63d9]
bswap edi
jns 0x5b595d
push r8
xor dword [rsp + rcx - 0x3311a01f], edi
pop r8
movsxd rdi, edi
movsx r9d, dx
add r11, rdi
jmp 0x591596
mov rdi, qword [rcx + rsi - 0x3311a027]
shr bpl, 0x61
sar edx, 0xb
rol r9b, 0x25
movzx cx, byte ss:[rdi + rbp*4 - 0x2c7800fc]
mov word [rbp + rsi - 0xb1e0041], cx
mov ecx, 0x40145c21
and dx, r9w
lea rsi, [rsi + rbp*4 - 0x2c7800fe]
setg bpl
lea r10, [rbp*8 - 0x595db5ee]
js fcn.005b825c
Function at 0x5ba7db
Capabilities:
Authenticate hmac

Disassembly:
lea ebp, [rcx + rbp - 0xe68636a]
ror di, 0xc1
xor ebp, 0xf49057a4
mov qword [rsp + r10 - 0x4ffffff0], r8
movzx eax, cl
xor dword [rsp + r10 - 0x4ffffff0], ebp
mov r8, qword [rsp + r10 - 0x4ffffff0]
movsxd rbp, ebp
sal dx, cl
neg rdi
add r11, rbp
not ecx
dec rax
not r9b
mov r9, qword [rcx + rsi - 0x6a7cb47b]
sar al, 0xa5
je 0x5b18ab
dec r10d
mov rbp, qword [rcx + rsi - 0x6a7cb473]
ror dil, 0x24
xadd cl, dh
pop rdx
adc rdx, 0xfffffffffffeeb69
jmp rdx

Function at 0x5bb820
Capabilities:
Authenticate hmac

Disassembly:
movsxd rax, eax
call fcn.005ca725
jmp 0x5ba95c
Function at 0x5be7b5
Capabilities:
Authenticate hmac

Disassembly:
or dil, 0x2b
mov qword [rsp + rdi - 0xfff7], r8
xor dword [rsp + rdi - 0xfff7], r10d
mov qword [rsp + rdi*4 - 0x3fffc], 0x413dc70c
mov r8, qword [rsp + rdi - 0xfff7]
and rbp, 0xffffffff919d208b
mov edx, edi
ror rbp, 0x54
movsxd r10, r10d
rol dword [rsp + rbp*4 - 0x203e], 0x96
adc r11, r10
rol ecx, cl
pop rax
mov rbp, qword [rsi + rbp*2 - 0x1020]
or r9d, edx
push rcx
mov cl, byte [r9 + rsi - 0x7ffffff7]
call fcn.005d1a03

Function at 0x5c1de8
Capabilities:
Encode data using base64

Disassembly:
mov r8, qword [rsp + rdx - 0x4c77ef0]
movsxd rax, eax
neg r9d
or ecx, edx
mov qword [rsp + r9 - 0x60000000], rcx
adc r11, rax
sal r9d, 0x67
movzx edx, byte [r9 + rbx - 5]
mov r10d, 0x3dada03f
mov qword [rsp + r9*2 + 8], rbp
mov qword [rsp + r9 + 0x10], 0x21ef26
xor dl, r8b
sar dword [rsp + r9 + 9], 0x30
sub r9d, r10d
setae byte [rsp + rcx*2 - 0x98efdfc]
neg dl
call fcn.005bf207
call fcn.005a570f

Function at 0x5c4cd5
Capabilities:
Authenticate hmac

Disassembly:
dec di
xor dword [rsp + r9 - 0x8af], ebp
pop r8
or r9, r9
shl rdx, cl
movsxd rbp, ebp
adc r11, rbp
push r9
mov rbp, qword [rsi + r9*4 - 0x22bc]
and word [rsp + r9*2 - 0x1158], cx
or al, byte [rbp + r9 - 0x8af]
lea rbp, [rdx*4 - 0x1c7b3a5f]
shr word [rsp + r9 - 0x8af], 0x4d
lea rsi, [rsi + r9 - 0x8a9]
sal word [rsp + r9*2 - 0x115b], 6
jp 0x5c1630
mov word [r9 + rsi - 0x8af], ax
adc dil, dl
add qword [rsp + r9*8 - 0x4578], r11
ret
ror ebp, 2
lea rdi, [r10*4 - 0x7f68f751]
pop r10
not ebp
lea rdx, [rax + rdi + 0x678a9fa7]
rol rax, cl
movzx r9d, di
push r8
jae 0x5baa99

Function at 0x5c9ebd
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
xchg cx, r10w
mov qword [rsp + rdi*2 - 0x617b7654], r8
xor dword [rsp + rdi - 0x30bdbb2a], ebp
pop r8
sal dil, 0x63
jbe 0x5ab54f
movsxd rbp, ebp
not r10w
js 0x5b83be
add r11, rbp
jmp r11
mov qword [rsp + rbp*2 - 0x12], 0x30bdbb2a
pop rdi
lea rdx, [rsp + rdx + 8]
mov qword [rdx + rbp*2 - 0x12], rax
sal word [rsp + rbp*4 - 0x20], 0xea
lea rbx, [rdi + rbx - 0x30bdbb2e]
mov ebp, dword [rbx + rbp - 9]
jne 0x5cdf4a
shr ecx, 0x2a
movsx edx, byte [rsp + rdi - 0x30bdbb28]
xor ebp, r8d
xor ebp, edx
neg word [rsp + rdi - 0x30bdbb25]
xor ebp, 0xf1b94c37
ror cl, 0x26
neg ebp
add ecx, r10d
xor ebp, edx
not dl
jmp 0x5a56e1

Function at 0x5ca34d
Capabilities:
Authenticate hmac

Disassembly:
xadd qword [rsp + r9*2 - 0x4c3ca660], rbp
mov word [rsi + r9 - 0x261e533e], di
xchg dword [rsp + r9 - 0x261e5327], r9d
pop r10
pop rdx
pop rdx
pop rcx
pop r9
pop r10
jno fcn.005b825c
mov dword [r10 + rsi + 0xc], eax
mov dword [rsi + r10 + 8], ebx
jbe 0x5991b9

Function at 0x5cd718
Capabilities:
Authenticate hmac

Disassembly:
mov dword [rcx + rbp - 0x52abffff], edx
movzx ebp, cx
mov qword [rsp + rcx - 0x52abffff], r11
ret
xor dword [rsp + r10*2 - 0x548598b0], edx
pop rax
pop r8
ror r10d, 0x91
jb 0x5c8fc6
lea rcx, [r10*8 - 0x5be2565c]
movsxd rdx, edx
adc r11, rdx
sal rcx, 0x90
mov rbp, qword [rsi + r10 - 0x662e1521]
ror r10, 0x1b
movzx r9d, r10w
dec ecx
mov edx, dword [rcx + rsi - 0x52abfff7]
and r9w, 0x3aa9
lea rsi, [rsi + r9*2 - 4]
push rcx
jnp 0x5a787c
Function at 0x5cdc61
Capabilities:
Authenticate hmac

Disassembly:
sub rsp, 0x18
push 0xffffffffe4bcc9ac
lea rsp, [rsp + 8]
call rax
mov r9d, 0xaf290290
mov rsp, qword [rbp + riz - 0x10]
mov rbp, qword [rbp + riz - 8]
mov qword [rbp + riz], rax
movzx ecx, r9w
movzx r10d, cl
movsx r11d, r10w
mov rsi, rbp
shr r10b, 0x85
movsx edi, r10b
movsx ebx, cx
pop r8
inc r9w
jne 0x5ce41a
pop r11
lea r9, [r10*2 - 0x60e835dc]
pop rbx
lea rbp, [rdi + rdi*4 + 0x14ae641e]
push rbp
mov qword [rsp + rcx*8 - 0x1480], r11
ret

Function at 0x5cdd2b
Capabilities:
Authenticate hmac

Disassembly:
dec r10w
mov qword [rsi + rax*2 - 0x19908], rdi
push rbp
mov r9d, dword [rbx + rax*2 - 0x19914]
sub rbp, 0xfffffffffa391097
lea rbx, [r10 + rbx - 0x4d27cc8b]
push rdx
xor r9d, r8d
rol r9d, 1
mov qword [rsp + r10 - 0x4d27cc77], r10
inc r9d
neg r9d
or rbp, qword [rsp + r10 - 0x4d27cc6f]
xchg dword [rsp + rax*4 - 0x3320c], edx
jg 0x59ed3e
neg dword [rsp + rdi - 0xc071ed]
lea rsi, [rdi + rsi - 0xc071e3]
sub r10b, bpl
call fcn.005a9c66

Function at 0x5cddcb
Capabilities:
Authenticate hmac

Disassembly:
mov rsi, rbp
mov ebp, r11d
shl ebp, 0x70
pop r8
mov ebx, 0x7e1428a7
not r11b
mov r9d, r11d
pop r11
movsx eax, bp
xor bpl, bl
pop rbx
or rdi, r11
jmp rdi
movzx edi, dl
xor dword [rsp + r9 - 0x439ceb8c], ebp
pop r8
movsxd rbp, ebp
xor dil, r9b
jp 0x5cc159
lea rax, [rdx*4 - 0x28d83949]
adc r11, rbp
mov rax, qword [r9 + rsi - 0x439ceb8c]
dec edi
lea rbp, [rdx*4 + 0x46a0ac1f]
mov edx, dword [rdx + rax - 0x78e64a60]
je 0x5da3ea
jne 0x5bee59
add rdi, qword [r9 + rsi - 0xbd]
mov qword [rsp + r10*2 - 0x624abcae], rbp
neg qword [rsp + r9 - 0xb5]
mov dx, word [r10 + rsi - 0x31255e53]
lea rsi, [rsi + r10*2 - 0x624abcac]
pop rcx
dec word [rsp + r10 - 0x31255e56]
mov word ss:[rdi + r10*2 - 0x624abcb6], dx
lea rdi, [rbp*2 - 0x207f79e9]
mov qword [rsp + r10*2 - 0x624abcb6], r11
ret
lea rsp, [rsp + 8]
call rax
mov edi, 0x9011c2b5
mov ecx, edi
and ecx, 0x13b109b3
mov rsp, qword [rbp + rcx*2 - 0x20220172]
sar rdi, cl
js 0x5b1898
mov rbp, qword [rbp + rdi*4 - 8]
movsx r11d, dil
js 0x5cff9b
mov qword [rbp + rdi], rax
je 0x5ac7d7
dec di
dec ecx
lea rbp, [rbp + rdi + 0x72cd785]
shl r9d, 0xfb
sbb r10w, r10w
rol ecx, 3
call fcn.005d4de2
sub rbx, 4
mov edx, dword [rbx]
xor edx, r8d
mov ecx, 0xc8936996
movsx r9d, cx
inc edx
mov r10d, r9d
mov eax, ecx
not edx
xor r9w, r10w
and eax, r10d
movzx ebp, ax
ror edx, 1
call fcn.005c897f
rol bp, 0x44
mov ecx, dword [rdi + rbx - 0x2e28dda6]
shr ebp, 0x5f
xor ecx, r8d
movzx r9d, dil
sal bpl, 0xc3
ror ecx, 3
movsx eax, bpl
not al
mov r10d, r9d
xor ecx, 0x513e50bd
ror bpl, 0xe7
dec r10
neg ecx
jmp 0x5d4c18