joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110b9
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140012200
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400250f3]
call fcn.140011433
xor edx, edx
mov ecx, 2
call fcn.140011208
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001228a
lea rdx, str.Failed_to_create_process_snapshot
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140012314
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011299
test eax, eax
jne 0x1400122d3
lea rdx, str.Failed_to_get_first_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001108c
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140012314
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400122f7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
jmp 0x140012314
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400113d9
test eax, eax
jne 0x1400122d3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bd00]
call fcn.1400113b6
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x140011262
Capabilities:
Terminate process

Disassembly:
jmp 0x140013f10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001130c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015260
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015280
xor al, al
jmp 0x140015301
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015293
xor al, al
jmp 0x140015301
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400152bd
xor al, al
jmp 0x140015301
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400152d1
xor al, al
jmp 0x140015301
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400152e3
xor al, al
jmp 0x140015301
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400152ff
xor al, al
jmp 0x140015301
mov al, 1
add rsp, 0x38
ret
Function at 0x180006950
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [0x18002de30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800069e4
mov rax, rbx
shr rax, 0x10
test ax, ax
jne 0x1800069a9
mov r8, rbx
lea rdx, [0x180023e5c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rbx, [rsp + 0x20]
mov r8, rbx
lea rdx, [0x180023e60]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x10
lea r8, str.AheadLibEx
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180008720
add rsp, 0x180
pop rbx
ret
Function at 0x180006a00
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x358
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x340], rax
cmp edx, 1
jne 0x180006c64
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [0x180023e18]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002de30], rax
test rax, rax
jne 0x180006aa8
lea r8, [rsp + 0x20]
lea rdx, [0x180023e28]
lea rcx, [rsp + 0x130]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x10
lea r8, str.AheadLibEx
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword [0x18002de30]
test rax, rax
je 0x180006c7a
lea rcx, [0x180023e88]
call fcn.180006950
lea rcx, [0x180023ea0]
mov qword [0x18002ddf8], rax
call fcn.180006950
lea rcx, [0x180023ec0]
mov qword [0x18002de08], rax
call fcn.180006950
lea rcx, [0x180023ed8]
mov qword [0x18002de18], rax
call fcn.180006950
lea rcx, [0x180023ef0]
mov qword [0x18002dd78], rax
call fcn.180006950
lea rcx, [0x180023f00]
mov qword [0x18002dd70], rax
call fcn.180006950
lea rcx, [0x180023f18]
mov qword [0x18002de00], rax
call fcn.180006950
lea rcx, [0x180023f28]
mov qword [0x18002de20], rax
call fcn.180006950
lea rcx, [0x180023f38]
mov qword [0x18002ddd0], rax
call fcn.180006950
lea rcx, [0x180023f50]
mov qword [0x18002dd90], rax
call fcn.180006950
lea rcx, [0x180023f68]
mov qword [0x18002dd88], rax
call fcn.180006950
lea rcx, [0x180023f80]
mov qword [0x18002ddd8], rax
call fcn.180006950
lea rcx, [0x180023f98]
mov qword [0x18002dda0], rax
call fcn.180006950
lea rcx, [0x180023fb0]
mov qword [0x18002dd60], rax
call fcn.180006950
lea rcx, [0x180023fc0]
mov qword [0x18002ddb8], rax
call fcn.180006950
lea rcx, [0x180023fd8]
mov qword [0x18002dd98], rax
call fcn.180006950
lea rcx, [0x180023ff0]
mov qword [0x18002dd80], rax
call fcn.180006950
lea rcx, [0x180024000]
mov qword [0x18002dda8], rax
call fcn.180006950
lea rcx, [0x180024010]
mov qword [0x18002ddc8], rax
call fcn.180006950
lea rcx, [0x180024028]
mov qword [0x18002de10], rax
call fcn.180006950
lea rcx, [0x180024040]
mov qword [0x18002de28], rax
call fcn.180006950
lea rcx, [0x180024058]
mov qword [0x18002ddc0], rax
call fcn.180006950
lea rcx, [0x180024070]
mov qword [0x18002dde0], rax
call fcn.180006950
mov qword [0x18002dd68], rax
call fcn.180004f10
jmp 0x180006c7a
test edx, edx
jne 0x180006c7a
mov rcx, qword [0x18002de30]
test rcx, rcx
je 0x180006c7a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.180008720
add rsp, 0x358
ret
Function at 0x180018bb0
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x180018be7
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x180018bd0
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x180018cd8
sub rcx, r10
cmp r9, 8
jb 0x180018cb9
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x180018c40
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x180018cd8
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x180018cc0
test r8d, r8d
sete al
ret

Function at 0x18009273d
Capabilities:
Encode data using base64

Disassembly:
movzx esi, word [r8 + rbp - 0x303a0515]
xor si, r9w
mov qword [rsp + rbp - 0x303a0513], rbp
lea rdi, [rbp*4 - 0x7357f970]
dec di
inc si
mov edx, 0xfb9ea71c
rol si, 1
sal rdx, 0x69
shl dl, 0x42
rol bp, 0x24
sbb si, 0xb335
push rdx
rol si, 1
dec si
jmp 0x1800bf74d
sub byte [rsp + rbp - 0x303a5130], dh
shr rdi, 0x46
xor r9w, si
rol dx, 0xcf
mov word [r10 + rdi*2 - 0x26c80d8], si
movzx esi, bpl
ror ebp, 0x63
bts rdi, rdi
mov esi, dword [r8 + rbp*2 - 0xc0e9452]
xor esi, r9d
mov ecx, edi
neg esi
rol esi, 1
mov r11d, 0x602276bf
xor edx, 0x1988a62c
mov byte [rsp + rbp*8 - 0x303a512d], r11b
sbb esi, 0x8813e4b6
push rcx
not esi
mov qword [rsp + rbp - 0x6074a16], r9
jmp 0x1800d3b1a
Function at 0x180093678
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbp*4 - 0x3022c014], 0xffffffffe8aad8ab
lea edx, [rdx + rbp*8 + 0x63594062]
bswap edx
mov qword [rsp + rbp - 0xc08b009], rbp
or qword [rsp + rbp*4 - 0x3022c014], rbp
movzx ecx, word [rsp + rbp - 0xc08aff6]
rol edx, 2
bswap edx
movzx r11d, cl
neg r11
mov qword [rsp + rbp - 0xc08aff9], r9
xor dword [rsp + rbp*2 - 0x18116002], edx
mov r9, qword [rsp + rcx*2 - 0x1ffc8]
imul ecx, r11d
pop r11
xchg ch, cl
movsxd rdx, edx
adc rbx, rdx
movzx edi, bpl
mov rsi, qword [r8 + rbp*2 - 0x1811601e]
xor bpl, 0x32
xor rsi, r9
not rsi
call fcn.1800aa4d0
mov esi, 0x4bae94b0
lea r8, [r8 + rsi - 0x4bae94b4]
mov eax, esi
lea rdx, [rsi*8 - 0x4df2b146]
movsx edi, ax
mov edx, dword [r8 + rsi - 0x4bae94b0]
mov ebp, eax
shr si, 0x8a
or esi, 0x6a1dd5ab
xor edx, r9d
lea edx, [rsi + rdx - 0x7c5605bc]
bts rax, rbp
bswap edx
rol edx, 2
movzx ecx, bp
neg edx
sar eax, cl
cmovb rbp, rcx
not rax
sbb edx, 0xc7060b18
not edx
lea r11, [rax*4 - 0x7fedd5f2]
shr rcx, 0x5a
rol edx, 3
inc r11d
shr ax, 0x81
bt ax, ax
push r9
bts r11w, 0x15
inc al
xor dword [rsp + rax*4 + 0x2975c], edx
inc bp
pop r9
push rbp
xchg byte [rsp + rax*4 + 0x2975d], r11b
or byte [rsp + rsi - 0x6bbfd5a9], al
movsxd rdx, edx
lea rcx, [rax + rdi*2 - 0x20f67b47]

Function at 0x180094341
Capabilities:
Encode data using base64

Disassembly:
bt edi, ebp
xor dword [rsp + rdx*2 - 0x1ce], r11d
xor rdi, 0xffffffffa40b6a18
jle 0x1800c9560
mov rdx, r10
sub r10, 4
mov ebp, 0x3cbd03b9
lea rbp, [rbp + rbp*8 - 0x15d28747]
mov dword [r10 + riz], edx
sub r8, 4
movzx r11d, bp
mov eax, dword [r8 + r11*8 - 0x4d1d0]
jmp 0x1800a9e5f
push r9
lea r9, [r11*4 - 0x76b794c]
jge 0x1800c8c10
jb fcn.1800a827d
mov ebp, 0x32097114
lea rax, [rbp*2 - 0x6a412c6e]
lea r8, [r8 + rax*2 + 0xc5c9488]
mov esi, dword [rbp + r8 - 0x32097114]
cqo
push rax
xadd dl, ah
xor esi, r9d
bswap esi
neg dword [rsp + rbp - 0x32097112]
movsx r11d, word [rsp + rax + 0x62e0047]
not esi
xor esi, 0x4d14d404
cbw
add word [rsp + rbp*2 - 0x6412e225], ax
rol esi, 3
xchg qword [rsp + rbp - 0x32097114], rbp
pop rdx
movzx ecx, dx
not esi
jmp 0x1800a5b39
xor ax, bp
ja 0x18009ecd7
xor eax, r9d
movsx esi, r11b
bts ebp, esi
inc eax
rol eax, 1
xor r11b, 0xb7
lea eax, [rax + rbp*8 + 0xc1ccfec]
rol eax, 2
add bpl, r11b
not sil
push r9
xor dword [rsp + rbp*2 - 0x19a5358e], eax
neg rsi
bt ebp, 0xac
pop r9
movzx edi, r11b
mov edx, edi
xchg edx, ebp
movsxd rax, eax
add rbx, rax
bt r11w, si
btr si, di
jb 0x1800a4957
lea r10, [r10 + rcx*2 - 2]
rol cx, 0x42
mov word [r10 + rcx*4], dx
lea rax, [rsi + rdi - 0x755c4844]
jp fcn.1800a827d
lea r9, [rbp + rbp*2 + 0x2936e4bf]
mov r9, qword [rsp + rdx*4 - 0x3ac]
movsxd r11, r11d
sar dil, 0x66
mov qword [rsp + rdx*8 - 0x768], 0xffffffffababec0b
or di, word [rsp + rdx - 0xda]
adc rbx, r11
div dword [rsp + rdx - 0xe6]
inc qword [rsp + rax - 0xdf]
mov r11d, edi
mov qword [rsp + rdx - 0x43893440], rbx
ret 0x10
Function at 0x180098ab2
Capabilities:
Encode data using base64

Disassembly:
dec word [rsp + 0xb]
not rax
or bp, r11w
pop rdx
mov edx, r11d
not rcx
movzx edi, dx
sar r11w, 0x41
jp 0x180096275

Function at 0x1800994e5
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rcx - 0x580f0f24], r9
mov qword [rsp + rcx - 0x580f0f34], rdx
xor dword [rsp + rcx - 0x580f0f24], ebp
mov r9, qword [rsp + rax - 0x193cbb0c]
movzx r11d, sil
movsxd rbp, ebp
xchg r11, rsi
add rbx, rbp
mov qword [rsp + rsi - 0x29], rdi
dec dword [rsp + rax - 0x193cbb15]
mov esi, dword [r10 + rcx - 0x580f0f34]
or edi, 0xac0735bc
sub r11d, eax
jns 0x1800a8aa8
lea r10, [r10 + rax - 0x193cbb18]
jae 0x1800b97d2
lea r8, [r8 + rax*2 - 0x3279763a]
call fcn.1800b3fc5

Function at 0x18009d9d6
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
inc qword [rsp + rdx*2 - 0xd226]
mov edi, dword [r10 + rdx*4 - 0x1a464]
ror si, 0xcb
adc rdx, qword [rsp + rdx*2 - 0xd226]
lea r10, [r10 + rdx + 0x1dc66436]
and r11w, 0xc903
ror cx, 0xcc
sal rsi, cl
mov dword [rax + rdx + 0x1dc6642a], edi
jne 0x1800ccbde
movzx edi, word [rsp + rdx*2 + 0x3b8cc865]
pop rbp
mov qword [rsp + rsi*2], rbx
ret 8
mov qword [rsp + rdx - 2], rdx
pop rdi
rol eax, cl
call fcn.1800ba005
sub r8, 4
push 0xffffffffc89c7915
mov eax, dword [r8]
xor eax, r9d
mov edx, 0xdaaf230
ror eax, 2
xadd dword [rsp + rdx*8 - 0x6d57917c], edx
movsx esi, dx
neg eax
movsx edi, byte [rsp + 4]
rol eax, 3
sal rsi, 0xd7
mov ebp, edx
xor eax, edx
push rdx
bswap eax
push rdi
mov ecx, ebp
xor eax, 0xeb88de21
neg edx
sar rbp, cl
or dx, 0x691b
adc eax, ecx
movzx r11d, dil
mov qword [rsp + rdx*2 - 0xd226], r9
xor r11, 0xffffffffe2393295
xor dword [rsp + rdx*2 - 0xd226], eax
mov r9, qword [rsp + rdx - 0x690b]
and rsi, 0xffffffff923200a2
mov qword [rsp + rdx*4 - 0x1a45c], r11
movsxd rax, eax
dec bpl
rol cx, 0x8d
bts edi, ebp
adc rbx, rax
ror cx, 1
sub di, dx
jle 0x1800d03f6
mov dword [r10 + rdx*8 + 0x7fa08], eax
cmovbe esi, ebp
pop rsi
jbe fcn.1800a827d
movsxd rsi, esi
sar rcx, cl
xadd rbp, rdi
adc rbx, rsi
or r11d, edx
mov esi, ecx
adc rsi, qword [r10 + rcx*2]
btc dx, 2
not r11
movzx di, byte [rsi + rcx]
movzx eax, r11w
lea r10, [rcx + r10 + 6]
mov word [r10 + rcx], di
sar al, 0xc5
neg rbp
btr dx, 0x3d
or rcx, rbx
jmp rcx
mov rax, qword [rdx + r10 - 0x691b]
js 0x180095a33
mov ecx, 0x7a1c543a
movsx edi, cl
mov ecx, dword [r8 + rdi*2 - 0x78]
lea rsi, [rdi*8 - 0x55ef4441]
movsx r11d, sil
lea r8, [r8 + rdi - 0x3e]
xor ecx, r9d
lea ecx, [r11 + rcx - 0x17e85c59]
neg ecx
movzx eax, di
xor ecx, 0xd09985b3
push r11
not ecx
cwde
ror ecx, 2
push r11
jmp 0x1800b9897

Function at 0x1800a5b77
Capabilities:
Encode data using base64

Disassembly:
mov dword [rcx + r10 - 0x69d0006d], esi
movzx r11d, dx
movzx edx, word [rcx + r8 - 0x69d0006f]
sub ax, r11w
adc bpl, al
xor dx, r9w
mov qword [rsp + rdi - 0x4eccb04b], 0xfffffffff610e104
push r11
rol dx, 1
call fcn.1800a1394
Function at 0x1800a5c97
Capabilities:
Encode data using base64

Disassembly:
bt rcx, rbp
ror eax, cl
ror dil, 1
sar rcx, cl
jnp 0x1800cc6e1
inc dil
not si
not si
cdq
neg dil
xor dil, 0x3b
shr bpl, 0x84
neg dil
pop rax
lea rax, [rsi + rdx*4 + 0x7344c8b]
rol dil, 1
btc ecx, eax
sbb dil, dl
neg ebp
btc si, 0xa4
neg rax
xor dil, dl
lea rdx, [rdx*8 - 0x17e45bc4]
mov r11d, 0x80c78f
xor r9b, dil
add rdi, rsp
mov rsi, qword [rdi + rcx - 0x8000]
not dx
mov rdi, rsi
cwde
add cl, byte [r10 + rcx*8 - 0x40000]
inc eax
rol r11w, 0xe4
push rax
shr rdi, cl
shl qword [rsp + rax*4 - 0x2348], 0xa0
or word [rsp + rbp - 0x72f355f4], r11w
mov qword [r10 + rax - 0x8d8], rdi
lea rcx, [rdx + 0x47224db5]
sbb al, 0x2c
lea r10, [r10 + rax*2 - 0x1152]
add al, ch
neg byte [rsp + rbp - 0x72f355f5]
mov eax, dword [r8 + rbp - 0x72f355fb]
xor word [rsp + rbp - 0x72f355f2], r11w
or qword [rsp + rbp - 0x72f355f6], rbp
not cl
lea r8, [rbp + r8 - 0x72f355fb]
shl rcx, cl
lea rsi, [r11 + rbp*8 - 0x2366b3cd]
xor eax, r9d
ror eax, 1
mov edi, dword [rsp + r11*8 - 0x403c7df]
sal byte [rsp + rbp - 0x72f355f1], 0x21
sbb eax, 0xba3142b7
pop rdi
rol eax, 2
not dx
dec eax
btr rdi, 0x25
lea rsi, [rdx + rdi*4 + 0x2f3c8219]
shl rdi, 0xeb
push r9
xor dword [rsp + r11 - 0x8078fc], eax
bt di, di
pop r9
adc cl, sil
movsxd rax, eax
bts cx, dx
adc rbx, rax
add dx, dx
jbe fcn.1800a827d

Function at 0x1800aae49
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rsi*2 - 0x24000000], 0x3c33edbc
rol cl, 1
btr rax, rdx
sbb cl, 0x97
add byte [rsp + rsi - 0x11fffffe], 0xa5
imul sil
ror cl, 1
neg cl
shr esi, 0xd0
xor r9b, cl
jmp 0x1800a39d7
Function at 0x1800abd23
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor eax, 0xd916f025
lea rsi, [rbp + rdi*8 - 0x4c6a5058]
mov qword [rsp + rcx*2 - 0x23227876], r9
shr edi, 0xf9
xor dword [rsp + rcx*4 - 0x4644f0ec], eax
call fcn.1800aecdd
mov edi, 0x28bf9b84
lea rdx, [rdi + rdi*2 + 0x37348a81]
movsx ebp, dl
movzx edx, byte [r8 + rdi - 0x28bf9b85]
shl edi, 0xaa
setne bpl
movsx r11d, bpl
xor dl, r9b
movzx ecx, bpl
sub rcx, 0xffffffffe19e6d30
push rbp
adc dl, 0x30
xor byte [rsp + rbp + 2], cl
push r11
neg dl
sar r11, 0xc3
sar r11d, cl
pop r11
xor dl, 0x92
add qword [rsp + rbp*2 - 2], 0xffffffffbd82070e
not dl
xadd edi, ecx
ja 0x1800b83a4
movzx eax, r11w
adc dl, 0x33
movsx esi, dil
dec qword [rsp + rbp - 1]
rol dl, 1
xor r9b, dl
lea rdx, [rsp + rdx + 8]
mov cx, word [rdx + rdi*2 - 0x399f45a2]
imul r11w, bp
neg qword [rsp + rbp - 1]
mov word [r10 + rdi*2 - 0x399f45a4], cx
lea rcx, [rax + rax*4 - 0x67d6e56d]
btc esi, 0xa2
mov edx, dword [r8 + rbp - 6]
ror dword [rsp + rbp - 1], cl
xor edx, r9d
xchg di, cx
sar r11d, 0xc1
ror edx, 1
dec qword [rsp + rdi - 0x1ccf1a98]
not edx
or rbp, qword [rsp + rdi*2 - 0x399e3530]
inc ecx
lea edx, [rdx + rdi*4 - 0x46206cdf]
sal byte [rsp + r11 + 3], 0x61
sar cx, 0x68
cbw
xor edx, 0x5da7032a
xadd dil, bpl
idiv cl
and word [rsp + rdi*4 - 0x733c6823], 0xa52f
bswap edx
jb 0x18009e49e
rol qword [rsp + r11*4], 0xc9
mov qword [rsp + rdi - 0x1ccf1a09], r9
xor dword [rsp + rdi*2 - 0x399e3412], edx
pop r9
jmp 0x1800c6402
xadd bp, cx
adc rbx, rax
btc r11d, r11d
ror r11w, 0xea
mov r11, qword [rcx + r10]
inc rdi
lea r10, [rcx + r10 + 8]
lea r8, [rcx + r8 - 1]
shl dil, 0x61
movzx edx, byte [r8 + rcx*4]
sbb rdi, rdi
movsx eax, dil
not bp
xor dl, r9b
xor dl, 0x3d
sub dl, 0x10
neg dl
add si, si
bt rdi, 0x87
xchg esi, ebp
ror dl, 1
sub rax, rsi
neg sil
ror ebp, 0x1e
adc dl, dil
rol dl, 1
shr si, 0x2f
bswap rsi
push rdi
xor r9b, dl
lea rdx, [rsp + rdx + 8]
call fcn.180093c17
call fcn.1800d7a52
shl r11, cl
add bpl, 0x2b
movsxd rdx, edx
and r11w, 0x7b3b
adc rbx, rdx
or r11b, byte [r8 + r11*2 - 6]
lea r8, [r8 + rax - 0x106]
xor r11b, r9b
mov edx, eax
or sil, dil
cbw
sbb r11b, 0x11
cdq
lea rdi, [rsi - 0x56b3656]
bt bp, dx
xor r11b, 0x16
xor dil, bpl
sar si, cl
bts edi, eax
ror r11b, 1
sub r11b, 0x23
not dil
not esi
not r11b
xor r9b, r11b
xchg ecx, esi
add r11, rsp
or ebp, 0x7015f838
mov cx, word [r11 + rax*2]
shl bp, 0xce
mov word [rbp + r10 - 0x7dfdc004], cx
mov r11d, 0xd1957fbb
xchg r11d, esi
lea r10, [r10 + rax*4 - 4]
not dx
shr sil, 0x21
movzx ecx, dil
jnp fcn.1800a827d

Function at 0x1800ae265
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea r8, [r11 + rcx*4 - 0x3360ddc8]
mov qword [rsp + r10 - 0x289c3194], rax
push r13
bswap r11
push r10
mov qword [rsp + r10 - 0x289c3194], rbx
xchg cx, r11w
push r15
push rsi
mov esi, 0x298ee485
movsx ebx, r11b
push rbp
push r10
mov qword [rsp + rsi - 0x298ee485], r9
push r8
push rsi
xchg dword [rsp + r10*2 - 0x5138631f], ecx
pushfq
pop rcx
mov qword [rsp + r10*2 - 0x51386320], rcx
and r10d, r11d
movabs rcx, 0
jne 0x1800bfbc0
Function at 0x1800aec95
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
adc rbx, rbp
sal rax, 0xbf
mov edx, dword [r10 + rdi*2]
mov esi, dword [r10 + r11*2 - 0x60]
adc al, al
shr rcx, 0x47
pop r11
mov cl, byte [rdi + r10 + 8]
sbb di, di
btr edi, edi
movsx r11d, ax
lea r10, [r10 + rdi + 6]
inc r11b
rol r11, 0x53
mov qword [rsp + rdi], 0xffffffffa78e0c20
shld edx, esi, cl
bts di, 0x86
call fcn.1800bf6e5

Function at 0x1800af053
Capabilities:
Encode data using base64

Disassembly:
mov al, byte [rdi + rdx*2 - 0x5517fffe]
sbb dl, r11b
shl si, 0x49
mov word [r10 + r11 - 0x4f2cc5b6], ax
rol ebp, cl
xor cl, ch
rol ecx, cl
mov r11d, dword [rdx + r8 - 0x2a8bff4f]
movzx edi, dx
lea r8, [r8 + rdx - 0x2a8bff4f]
movzx eax, sil
xor r11d, r9d
dec r11d
push rcx
rol edx, 4
rol r11d, 2
cdq
call fcn.1800d3724
push 0xffffffff94834627
call fcn.1800aae0e
xor dword [rsp + rdi*2 - 0x33e10], eax
movzx r11d, sil
jmp 0x1800d3a8b
rol dil, 1
ror rcx, cl
mov qword [rsp + rdx*2 - 0x55165420], 0xffffffffe805e91a
sbb dil, 0x97
sal byte [rsp + rdx - 0x2a8b2a0d], 4
jnp 0x1800b50fc
mov r11d, 0x72310787
mov esi, r11d
mov edi, 0x23045332
mov edi, dword [rdi + r8 - 0x23045336]
lea rbp, [rsi + r11 + 0x34837936]
lea r8, [r8 + r11 - 0x7231078b]
jmp 0x18009384e
shr sil, 3
ror dil, 1
add ebp, dword [rsp + rdx - 0x2a8b2a0f]
sub rbp, rbp
neg dil
xor r9b, dil
xchg word [rsp + rdx*2 - 0x5516541c], dx
btr rcx, rcx
lea rdi, [rsp + rdi + 8]
movzx eax, dl
inc esi
jne 0x1800947a6
bts bp, bp
pop r9
sal r11w, 0xf
movsxd rax, eax
sbb cx, si
adc rbx, rax
movsx edx, bp
lea r8, [r8 + rdi*2 - 0x33e11]
sal r11, cl
sal si, 0x81
movzx ecx, byte [r8 + r11*2]
cmovle edx, ebp
xor cl, r9b
add r11d, esi
imul si, si
bswap rdx
adc cl, 0x92
xadd rbp, rdi
xor cl, 0xa9
add cl, dil
neg r11
setp dil
ror cl, 1
movzx eax, sil
add cl, 0x9b
sar r11d, 0x7f
xor r9b, cl
neg ebp
ror esi, 0x6f
sal rdx, 0x73
adc rcx, rsp
bts dx, 0xa5

Function at 0x1800b4ec1
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sar dil, 0x23
mov qword [r11 + rdx - 0x5b920aa1], rax
push rdi
rol ebp, 0x64
mov qword [rsp + rbp - 0x26e3880], rbx
ret 8
mul r11d
xor esi, r9d
idiv rbp
mov qword [rsp + r11 - 0x74], 0x6e8b0738
lea esi, [rsi + rax*8 + 0x622cc528]
mov edi, eax
sar ebp, cl
dec bp
xor esi, 0x4021eb1d
add rdi, 0x3b3d1592
lea rbp, [rcx + r11*4 - 0x7876845f]
pop rax
sbb esi, 0xf2854300
rol qword [rsp + r11*2 - 0xe8], cl
jb 0x1800d2d84
mov ebp, 0x26bc1786
movsx edx, bpl
movsx esi, dl
mov ebp, dword [rbp + r10 - 0x26bc1786]
movzx eax, si
mov cl, byte [r10 + rax*2 - 0x1ff08]
movsx r11d, dx
lea r10, [r10 + rax*2 - 0x1ff0a]
neg sil
shl ebp, cl
movzx edi, ax
not r11
jmp 0x1800d9854
mov dword [rax + r10 - 0xff86], ebp
not r11d
lea r8, [rax + r8 - 0xff8a]
call fcn.18009bfb1
inc dx
btr bp, si
ror dx, 1
movzx edi, r11w
sar r11w, 3
adc dx, 0x7c10
ror dx, 1
inc rbp
xor r9w, dx
xadd edi, ebp
pop rbp
lea rdx, [rsp + rdx + 8]
add edi, edi
jno 0x1800a4930
Function at 0x1800b8f1c
Capabilities:
Encode data using base64

Disassembly:
movzx ebp, byte [rsp + rax - 0x1c]
div al
mov word [r10 + rax - 1], r11w
mul dword [rsp + rax*2]
jb 0x1800b3564
jae 0x1800c95b7
mov rsi, qword [r11 + r10 - 0x43129c1d]
mov bpl, byte [r11 + r10 - 0x43129c15]
call fcn.1800d13e1
or ax, word [rsp + rcx*2 - 0x505c55db]
add qword [rsp + rbp*2], rbx
ret 8
mov qword [rsp + rax*4 - 0x7c], rax
rol r11w, 1
lea rcx, [rax - 0x59d0a3d6]
sub word [rsp + rax - 0x1e], 0x20b5
mov esi, 0x5b0830bf
adc r11w, 0x72b0
ror r11w, 1
sub r11w, 0x3b34
ror dword [rsp + rax - 0x1f], cl
xor r9w, r11w
lea r10, [rax + r10 - 0x21]
jmp 0x180099ba3
lea r8, [r8 + rdx*2 - 4]
jo 0x1800a1e1f
add dword [rsp + rax - 0x8f80], eax
xor byte [rsp + rax - 0x8f80], sil
adc edx, dword [r8 + rax*2 - 0x11f00]
dec word [rsp + rax - 0x8f7b]
lea rdi, [rbp*4 - 0x5ef3d974]
xor edx, r9d
btc rdi, 0x38
and ecx, esi
neg edx
cwde
sub byte [rsp + rbp*4 - 0x238], dil
jne 0x1800c0db2
movsxd r11, r11d
and edx, 0x9a8b29af
adc rbx, r11
movsx ecx, si
shr edx, 0xd1
jmp rbx