joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454d2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b9ae8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45e580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b98cb], 0
je 0x45e58e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45e5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b98cb], 0
je 0x45e5b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45e5c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b98cb], 0
je 0x45e5f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005b9e60]
aesenc xmm0, xmmword [0x005b9e70]
aesenc xmm0, xmmword [0x005b9e80]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45e600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005b98cb], 0
je 0x45e636
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005b9e60]
aesenc xmm0, xmmword [0x005b9e70]
aesenc xmm0, xmmword [0x005b9e80]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x45ff00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x460300
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x460334
mov rcx, 0x28
jmp 0x46033f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005b9ae8], rcx
pop rbp
ret
Function at 0x479420
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4794ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005b9ae8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4794cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004a8820]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4794be
mov edi, 1
lea rsi, [0x004a8820]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004e2e48]
lea rsi, [0x004e2668]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x49c380
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x49c398
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x49c398
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x49c3a0
xor eax, eax
ret
cmp rbx, 3
je 0x49c3ac
cmp rbx, 4
jne 0x49c3d9
cmp al, 0x2c
ja 0x49c3c6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x49c3d6
cmp al, 0x24
je 0x49c3d6
nop dword [rax]
cmp al, 0x26
jae 0x49c3d6
jmp 0x49c3d9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x49c3d6
cmp al, 0x5b
je 0x49c3d6
cmp al, 0x5d
jne 0x49c3d9
xor eax, eax
ret
cmp al, 0x2f
ja 0x49c412
nop dword [rax]
cmp al, 0x26
ja 0x49c3f1
cmp al, 0x24
je 0x49c431
cmp al, 0x26
je 0x49c431
jmp 0x49c4ab
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x49c431
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x49c4a8
cmp al, 0x2f
je 0x49c431
jmp 0x49c4ab
cmp al, 0x3d
ja 0x49c429
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x49c431
nop
cmp al, 0x3d
je 0x49c431
jmp 0x49c4ab
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x49c4a0
cmp rbx, 2
jg 0x49c467
cmp rbx, 1
je 0x49c461
nop dword [rax]
cmp rbx, 2
jne 0x49c4ab
cmp al, 0x2f
je 0x49c452
cmp al, 0x3b
je 0x49c452
cmp al, 0x2c
jne 0x49c459
mov ecx, 1
jmp 0x49c45e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x49c48a
cmp al, 0x40
je 0x49c479
cmp al, 0x2f
je 0x49c479
cmp al, 0x3f
jne 0x49c482
mov ecx, 1
nop
jmp 0x49c487
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x49c499
cmp rbx, 7
jne 0x49c4ab
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x49c4a8
cmp al, 0x7e
jne 0x49c4ab
xor eax, eax
ret
cmp rbx, 7
jne 0x49c4c1
cmp al, 0x21
je 0x49c4bd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x49c4c1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x1418724b9
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + r10 - 0x113400], rbx
lea r11, [r11 + rdx - 0x4e15c2ab]
movzx ebp, byte [rsp + rdx - 0x4e15c2ac]
or bx, 0x22b7
bt bx, 0x37
xor eax, r9d
movsx edi, word [rsp + rdx - 0x4e15c2ad]
sub eax, 0x8f28031f
rol di, 0xcb
not eax
xor eax, 0x5c2d351f
add qword [rsp + r10*2 - 0x226800], r10
bswap eax
sbb word [rsp + rdx - 0x4e15c2ac], di
dec dword [rsp + r10 - 0x1133fc]
mov qword [rsp + rdx - 0x4e15c2af], r9
jb 0x1418ca22e
xor dword [rsp + rdx - 0x4e15c2af], eax
mov ecx, ebp
movzx r9d, di
call fcn.1418a0a1c

Function at 0x1418786d5
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov word [r10 + r8 - 0x2f], bx
mov edx, dword [r11 + rcx - 0x758ae32f]
mov qword [rsp + rcx - 0x758ae32f], rdi
imul ax, bp
lea rbx, [rdi*2 + 0x3811db8e]
lea r11, [rax + r11 - 0x758a405b]
btc bx, ax
xor edx, r9d
pop rbx
bts rbp, 0xaf
lea edx, [rax + rdx + 0x749acb56]
xchg bx, di
sal rbp, 0x38
rol edx, 3
shr bpl, 0xe4
bts r10d, 0x9a
jb 0x1418c2866
xor edx, 0xe2158e26
ror edx, 1
xor r10d, ecx
sar rbp, cl
btc rbx, 0x16
not edx
mov qword [rsp + rax - 0x758a405f], r9
setae bl
movsx r9d, di
jb 0x1418bc7d5
mov ecx, 0x4481d082
jmp 0x1418a639a
mov r10, qword [r8 + rcx - 0x4481d082]
lea rbp, [rcx*4 - 0x75c4f570]
neg ebp
mov rdx, qword [r8 + rbp - 0x63bdb360]
mov ebx, ebp
adc cx, bp
call fcn.14189d0aa
neg ebp
not dx
dec ebp
xchg r10b, dl
push rdx
neg ebp
sal dx, 0xaf
not ebp
and byte [rsp + rdi*2 - 0x694fe253], r10b
mov qword [rsp + rdi*2 - 0x694fe25a], r9
sal edx, 0x6b
xor dword [rsp + rdi*2 - 0x694fe25a], ebp
mov ecx, edi
pop r9
movsxd rbp, ebp
sal rdx, 0xea
push rcx
adc rsi, rbp
jmp 0x1418a98a2
xor dword [rsp + rbp*2 + 0xbc00], edx
and r9w, bp
pop r9
xor ax, 0x6bba
sar bp, 1
movsxd rdx, edx
inc bx
sbb r10, 0x37103eac
bt edi, 0x1f
add rsi, rdx
add bpl, r10b
dec rbx
jae fcn.14189f3b7
mov ebp, 0xf2b56805
mov ebx, dword [r11 + riz]
add r11, 4
mov edi, ebp
lea rcx, [rbp + 0x5b211815]
bswap ecx
xor ebx, r9d
sar bpl, 4
ror ebx, 1
movsx edx, cx
sar rbp, 0x65
lea ebx, [rbx + rbp*2 + 0xd32d20e]
btc di, 0x27
btr rbp, rcx
lea rdi, [rdi*8 + 0x7b294c18]
neg ebx
movzx r10d, bp
jmp 0x1418a638a

Function at 0x14187929a
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc edx
neg r10d
lea rdi, [rdx - 0x5e6038e8]
inc r10d
dec dx
movsx ecx, di
ror r10d, 3
rol dil, 0x61
shr edx, 0x63
bswap r10d
mov eax, edi
sbb r10d, 0xeebb903b
push rdx
ror r10d, 1
sar qword [rsp + rdx*4 - 0x73c9fc08], cl
neg cx
sbb r10d, 0x7189a115
mov ebp, edi
shr eax, cl
cdq
mov qword [rsp + rdx + 0x10], r9
setbe bpl
xor rdx, qword [rsp + rdx*4]
xor dword [rsp + rdx*2 - 0x39e4fdfc], r10d
cbw
movsx ebx, byte [rsp + rdx*4 - 0x73c9fc17]
mov r9, qword [rsp + rdx - 0x1cf27ef6]
sub al, cl
movsxd r10, r10d
add rsi, r10
mov rcx, qword [r8 + rdx*2 - 0x39e4fe0c]
lea r10, [rax + rax*8 - 0x106657f7]
mov qword [rsp + rdx*4 - 0x73c9fc08], r10
mov ax, word [rax + r8 - 0x6b]
Function at 0x14187a616
Capabilities:
Authenticate hmac

Disassembly:
add dil, r10b
mov qword [rsp + rcx + 0x3666712a], 0x7a264708
or dword [rsp + rcx + 0x36667124], 0x2606a2b1
ror dil, 1
div ebp
cqo
div word [rsp + rax + 0x11]
xor dil, r10b
ror r10b, 0xc7
lea rdx, [rbp + rax - 0x5a52b8d9]
xor r9b, dil
xor r10d, r10d
xchg bpl, al
mov word [r10 + r8 - 4], di
inc bl
or dword [rsp + rcx + 0x3666712b], r10d
shr dl, 0x25
lea r8, [rcx + r8 + 0x36667106]
pop rcx
pop r10
pop rcx
pop rbx
pop rcx
jne fcn.14189f3b7
movzx eax, byte [r11]
mov edx, 0xb8a43fae
movsx ebx, dx
movzx ecx, bx
xor al, r9b
movsx r10d, dl
movzx ebp, bx
and ebp, 0xbf102e1e
neg al
not r10
push r10
sal qword [rsp + rbx*2 - 0x7f5c], 0xe4
sbb al, 0x39
pop rdi
bt edx, ebx
not al
jae 0x14189769f
bts di, r10w
xor cl, byte [r8 + rcx + 8]
sub r10d, edx
adc rbp, 0xffffffffd6ad6924
xchg rdx, rdi
lea r8, [r8 + rdi - 0x23ba1cfa]
bts dx, bp
shld ebx, eax, cl
neg ebp
mov dword [r8 + rdi*2 - 0x47743a00], ebx
imul r10, rdi
jmp rsi
jae 0x1418b3eb1
xor edi, 0x25a30d2c
movsxd r10, r10d
bt rcx, rcx
xadd rbp, rdx
btc rcx, rdi
adc rsi, r10
mov ebx, dword [rdx + r8 - 0x23ba1d00]
lea rax, [rdi + rdi + 0x5528e135]
movzx r10d, dl
mul dil
mov eax, dword [r8 + r10*8 + 4]
shr ecx, 0x9b
jp 0x141891f0c
xor al, 0x32
xadd edx, r10d
xor r9b, al
rol rbp, cl
call fcn.1418abd9e
mov ecx, 0x9a92f19d
lea r10, [rcx - 0x5724c63]
mov ebp, ecx
mov rdi, qword [r8 + riz]
movzx r10w, byte ss:[rdi + riz]
add r8, 6
inc ecx
call fcn.1418c451c
mov rdi, qword [r8 + rcx - 0x51ac571a]
call fcn.1418b11c8

Function at 0x14187c55e
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
setb r10b
mov rbx, r8
xadd r10d, ebp
mov qword [rsp + rax + 0x611b3314], rbp
xadd r10b, bpl
lea r8, [r8 + rax + 0x611b3310]
mov dword [r8 + rax + 0x611b3314], ebx
push r10
mul edi
sal word [rsp + rdx + 0xe], 0xc
pop rdx
pop rdi
jp fcn.14189f3b7
mov edi, 0xd2b317ba
mov edi, dword [r8 + riz]
mov cl, byte [r8 + 4]
push 0x278f8683
pop rdx
lea r10, [rdx + rdx*2 + 0x6e893294]
sal edi, cl
mov dword [rdx + r8 - 0x278f8681], edi
call fcn.14189c1ae

Function at 0x14188b3e5
Capabilities:
Authenticate hmac

Disassembly:
movsx ecx, dil
lea rdi, [rbx*2 - 0x7f648759]
mov dword [r8 + rbx - 0x33abc13b], edx
mov eax, dword [r11 + rbx*2 - 0x67578276]
lea r11, [r11 + rbx - 0x33abc137]
sub r10d, edi
lea rdx, [rcx*2 + 0x12bf3fb5]
xor eax, r9d
movsx ebp, bx
rol cl, 0xa1
neg eax
xchg r10b, bl
sal r10w, 0xc4
setp bl
not eax
ja 0x14188bcda
mov dword [rsp + 9], 0xa5862806
sal dword [rsp + 0xb], 0x74
test rbx, rbx
call fcn.1418a6814
rdtsc
mov ebx, 0x33abc13b
lea r8, [r8 + rbx - 0x33abc143]
lea r10, [rbx*4 + 0x5b256137]
lea rdi, [rbx - 0x4af0cb62]
sal r10d, 0x59
mov dword [r8 + rbx - 0x33abc137], eax
jae 0x14187a5c9
Function at 0x14188c3bb
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
call fcn.14188d8e3
mov ebx, dword [r11]
mov eax, 0xdea8bd23
mov edx, 0x37993032
push rdx
lea r11, [r11 + rdx - 0x3799302e]
movzx ecx, byte [rsp + rdx*2 - 0x6f326060]
xor ebx, r9d
mov byte [rsp + rcx*4], 0x28
not ebx
movzx r10d, cx
ror ebx, 3
neg ebx
jmp 0x1418a89aa
lea rsp, [rsp + 0x20]
jne 0x1418a3b41
mov eax, 0xcd239e12
push rax
mov rax, qword [rbp + riz]
neg dword [rsp + 4]
sbb rsp, 0x18
call fcn.14189f66b
mov eax, 0x8a905aa1
dec al
bswap rax
mov rax, qword [rbp + rbx*8]
push 0xffffffffb626021a
cmp ebx, 1
lea rsp, [rsp + 8]
jne 0x14188a613
mov ecx, 0xef205198
not cl
mov rcx, rax
jmp 0x1418c0410
xor word [rsp + rdx - 0x37993031], dx
ror byte [rsp + rdx - 0x3799302e], 0x23
xor ebx, 0x8e8ba1a5
movsx ebp, byte [rsp + rdx - 0x37993030]
cdq
mov edi, 0xc8b0461b
lea ebx, [rbx + rcx - 0x25a6d618]
not bpl
bts ebp, 0x1d
and qword [rsp + rcx*2], r10
adc qword [rsp + rcx], r9
bts bp, r10w
cmovb dx, cx
xor r10, 0xffffffff85997686
xor dword [rsp + rcx], ebx
pop r9
bswap r10
sar cl, 0x23
movsxd rbx, ebx
adc rsi, rbx
mov di, word [r8 + rcx*8]
lea rax, [rdx + rax*4 - 0x75c449fc]
call fcn.1418a7d9a
push 0xffffffff89af6ea8
not byte [rsp + 1]
lea rsp, [rsp + 8]
jmp 0x141875825
Function at 0x141890c4d
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
dec rbx
call fcn.1418aeb6a
lea rsp, [rsp + 0x10]
jne 0x141887c58
mov rdx, rax
jmp 0x141875b45
lea rdx, [rdi*8 + 0x731d869f]
push rdx
lea r8, [rdi + r8 - 0x2228]
lea r10, [rdx*4 - 0x852a344]
mov word [rdi + r8 - 0x222e], cx
pop rbp
mov r10d, dword [r11 + rdi - 0x222e]
lea r11, [r11 + rdi - 0x222a]
xor r10d, r9d
ror dl, 0x62
imul dx, di
lea rbx, [rdx*2 - 0x3d7d5775]
dec r10d
rol r10d, 1
lea r10d, [r10 + rdx + 0x78fb4129]
xchg ebp, ebx
xadd rbx, rdi
shr rbp, 0x7d
rol r10d, 1
lea rcx, [rdx*4 - 0x3863e9df]
bt ecx, 0x80
movsx eax, bp
bswap r10d
xor bpl, bl
dec r10d
dec rbp
btr rdx, 0xb8
not r10d
bt rbx, 0x36
mul dil
mul rbp
inc r10d
lea rdx, [rdi + rax*8 + 0x3c3da68d]
rol dl, 0xa6
push r9
xor dword [rsp + rdi - 0x731e980f], r10d
mov r9d, 0x943ae7ae
ror edi, 0xf5
pop r9
mul ebp
bt edi, 0xab
movsxd r10, r10d
push rbp
call fcn.1418ad84c
mov ebx, dword [r11]
mov edx, 0x29823b2b
lea r10, [rdx - 0x757c2171]
movzx edi, dl
lea r11, [rdi + r11 - 0x27]
xor ebx, r9d
movsx eax, r10b
not dil
movzx ecx, r10w
bswap ebx
rol r10d, 0x42
jae 0x14188922a
mov r10, qword [r8]
mov ecx, 0xbbbc4bb5
mov ebp, ecx
mov rdi, qword [r10 + riz]
mov ebx, ebp
inc cx
mov qword [r8 + riz], rdi
call fcn.14189a346
push 0x64038700
call fcn.1418ab0ab
movzx edi, cx
not cx
mov cx, word [rax + rcx - 0xf1dddd1]
jmp 0x14187b793
and eax, ecx
ror ebx, 1
movzx ebp, r10b
mul bp
rol rax, cl
lea ebx, [rbx + rdx*4 + 0x5789f5d4]
bt bp, 0xa8
cwd
dec rdx
bswap ebx
or edx, 0xc4251224
dec cl
dec ebx
mul ebp
cqo
sal cl, 0x42
push r9
movsx r9d, r10w
xor dword [rsp + rdx*8], ebx
sub edi, ecx
not r10
shl r9d, cl
pop r9
movsxd rbx, ebx
bswap rdi
adc rsi, rbx
not ecx
xor dl, byte [rdx + r11]
lea r10, [rdi*8 + 0x5f1a192f]
add cl, r10b
not dil
lea r11, [rbp + r11 - 0xe9]
xor dl, r9b
xor dl, dil
shr dil, 1
ror dl, 1
add dl, 0x90
lea rcx, [rcx + rdi*4 - 0x51dd076c]
neg rcx
add ax, 0x1036
rol dl, 1
xor r9b, dl
lea rbx, [r10*2 - 0x39ccce74]
xor dil, bl
lea r8, [r8 + rax - 0x1f2d8]
sub bp, cx
mov word [r8 + rax*4 - 0x7cb58], dx
dec cl
jbe fcn.14189f3b7
call fcn.141899926
mov qword [rsp], 0xfffffffff4b8b135
xor ecx, 0x8484a39b
neg word [rsp + 4]
sal qword [rsp + 0xb], 0xef
jp 0x141879e28
Function at 0x1418912a2
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [r8 + rbp*2 - 0x8300]
xor rdx, rbp
sar ebp, 0x11
mov cl, byte [rdx + r8 - 0x642afff4]
mov qword [rsp + rdx - 0x642b0000], 0xffffffffc994d523
jae 0x1418b8dc5
bts bp, r10w
shld eax, ebx, cl
movsx ecx, r10w
imul edi, dword [rsp + rdx - 0x642afffc]
mov dword [r8 + rdx - 0x642afff6], eax
movzx ebx, bpl
ror ebx, cl
lea r8, [r8 + rbp - 6]
mov ebx, dword [rdx + r11 - 0x642b0000]
xadd byte [rsp + rbp - 0xe], bpl
or rbp, r10
lea r11, [r11 + rbp*4 - 0x24c]
sub bp, word [rsp + rdx - 0x642affff]
xor ebx, r9d
or byte [rsp + rbp - 0x5bba], 0x28
bswap rdi
rol dil, cl
ror ebx, 2
sub byte [rsp + r10*8 - 0x41e], dil
shl byte [rsp + rbp*2 - 0xb77e], 0x24
sbb cx, 0x1e
inc ebx
inc word [rsp + rbp - 0x5bbd]
xchg byte [rsp + rbp - 0x5bbe], r10b
imul rbp, rbp
rol ebx, 3
shl dword [rsp + rdx - 0x642afffd], cl
xor ebx, 0x21a26202
not byte [rsp + rbp - 0x20e1587c]
neg ebx
mov qword [rsp + rbp - 0x20e15881], r9
xor dword [rsp + rdx - 0x642b0000], ebx
shr bp, 0xa9
sar edx, cl
add ecx, edx
pop r9
sbb dil, 0x33
add rcx, rdi
movsx eax, di
movsxd rbx, ebx
and r10d, ecx
adc rsi, rbx
neg al
mul cx
push rdx
mov qword [rsp + rdx*2 - 0x3200044], rsi
ret

Function at 0x1418945a2
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
ror eax, 2
xor dword [rsp + r10 - 0x6818], edx
and qword [rsp + r10*4 - 0x1a0c8], rdi
adc eax, edi
neg eax
or bp, r10w
jl 0x14187504f
xor eax, edi
mov qword [rsp + r10 - 0x683a], rdx
shl qword [rsp + r10*4 - 0x1a0e6], 0x9d
neg eax
or di, 0xb9a
push rbx
mov qword [rsp + r10 - 0x6812], r9
xor dword [rsp + r10*2 - 0xd04c], eax
jmp 0x1418b10bd
inc rbp
mov r9, qword [rsp + r10*2 - 0xd04c]
movsxd rax, eax
sal bl, 0xe7
add rsi, rax
not ebx
xor byte [rsp + r10 - 0x6815], 0x3a
mov qword [rsp + r10 - 0x683a], rsi
ret 0x28

Function at 0x14189764b
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + rax*2], rdx
mov r9, qword [rsp + rax + 0x20]
mov qword [rsp + rax + 0x20], 0x5b104981
mov dword [r8 + rax*2 - 6], ecx
lea r8, [rax + r8 - 6]
xor bpl, r10b
bswap rbx
shl r10, 0x83
pop rcx
pop rbx
pop rbp
pop rdx
pop r10
jae fcn.14189f3b7
Function at 0x141899f59
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffa38f9e2a
lea rsp, [rsp + 0x20]
jmp 0x141876703

Function at 0x14189cb1a
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
movsx r10d, bl
xor r9b, bpl
neg qword [rsp + rbx - 0x3b]
mov word [r8 + rbx - 0x45], bp
adc cl, ch
push rax
mov r10d, dword [r11 + rbx - 0x42]
lea r11, [r11 + rbx*2 - 0x81]
sub qword [rsp + rbx - 0x43], rbx
lea rdi, [rcx*2 + 0x641e6f31]
xor r10d, r9d
not byte [rsp + rbx - 0x2d]
movzx ebp, byte [rsp + rcx - 0x3f9ac6d1]
bswap r10d
shr bl, 0xc5
ror r10d, 1
mov qword [rsp + rbx*2 + 4], 0x240ad4b1
lea r10d, [r10 + rax - 0x26e0979]
call fcn.1418a42b5

Function at 0x14189cd2f
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x97
rol al, 1
xor r9b, al
pop rbx
add rax, rsp
not rbp
shr r10b, 3
add cl, cl
movzx r10w, byte [rax + rdx*2 - 0x10000]
dec dl
mov word [r8 + rbp + 0xd279], r10w
sal bp, cl
mov ebp, dword [r11 + rdx*2 - 0x101fd]
movsx r10d, dil
xor ebp, r9d
lea rdx, [rcx + rcx*8 + 0x27907997]
dec ecx
add ecx, r10d
not ebp
sal ecx, 0xbf
btc cx, di
sbb edi, 0x7e13660a
ror ebp, cl
sub ebp, 0xdb027b01
push r10
or word [rsp + rcx - 0x7ffffffc], 0xfa34
or edx, 0xac147601
not ebp
sbb r10d, edi
adc qword [rsp + rdi*2 - 0x2c2933ec], rdi
imul di, word [rsp + rdi - 0x161499f1]
mov qword [rsp + rdi*4 - 0x585207e0], r9
lea rbx, [r10 + rdi - 0x34e7b7ec]
not edx
mov eax, r10d
xor dword [rsp + rdi*2 - 0x2c2903f0], ebp
pop r9
bt edi, 0x80
jb 0x141879310
xor edx, 0x6b0c5389
movsxd rbp, ebp
bt rcx, rbx
adc rsi, rbp
or ecx, edx
btc ax, 0x14
movzx ecx, word [r11 + rdi*2 - 0x2c2903eb]
shl dl, 0x85
mov ebp, ebx
rol di, 0xaf
lea r11, [r11 + rdi*2 - 0x2c2881f1]
xor cx, r9w
dec dx
ror cx, 1
shr bp, 0xc3
xor bpl, r10b
adc cx, 0x9ab2
dec eax
sete dl
shl dl, 0x64
neg cx
lea rdx, [rdi*8 - 0x45f854c]
xadd di, bx
mul rdi
dec cx
idiv rbx
xchg ebx, eax
not dx
xor r9w, cx
shl eax, 0xcd
add r10w, r10w
call fcn.1418a21e3

Function at 0x14189f66b
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 8]
call rax
mov rsp, qword [rbp + riz - 0x10]
mov r11d, 0xce952f87
movzx edx, r11w
lea rbx, [r11 + 0x542e93ae]
mov rbp, qword [rdx + rbp - 0x2f8f]
dec edx
movzx r8d, dx
js 0x1418cbd09
mov qword [rbp + rdx*8 - 0x17c30], rax
movzx r10d, dl
mov r8, rbp
js 0x1418c669a
jnp 0x1418a714d
movzx dx, byte [r8]
mov ebp, 0x212c1616
movsx ecx, bpl
mov dil, byte [r8 + rbp*2 - 0x42582c2a]
movzx r10d, bp
mov eax, 0x76375105
lea r8, [r8 + rbp - 0x212c1614]
and dl, dil
shr cl, 0x42
not eax
not dl
mov word [rcx + r8 - 5], dx
movzx edi, ax
cdqe
shl rdi, 0x65
adc edi, dword [r11 + rbp - 0x212c1616]
add rbp, rbp
movzx ebx, bp
movsx edx, bl
lea r11, [rbp + r11 - 0x42582c28]
call fcn.1418c55e3
jmp 0x1418727b0
jmp 0x1418963a2
Function at 0x14189fba3
Capabilities:
Encode data using base64

Disassembly:
sub r10d, 0xdb027b01
mov qword [rsp + rdx - 0xffff], rdx
not r10d
rol word [rsp + rdx - 0xfff5], 0x48
dec word [rsp + rdx*2 - 0x1fffe]
mov qword [rsp + rdx*2 - 0x1fff6], r9
neg al
xor dword [rsp + rdx - 0xfff7], r10d
add bx, ax
mov r9, qword [rsp + rdx - 0xfff7]
shl dword [rsp + rdx - 0xfffd], 0x8c
movzx ecx, dil
not dil
movsxd r10, r10d
sbb dil, cl
jb 0x1418bf1bf
mov edx, 0xf9370080
bt edx, 0x19
mov ebx, dword [r11 + riz]
movzx r10d, dl
add rdx, r10
adc r10, 0x3926658c
lea r11, [r11 + r10 - 0x39266608]
xor ebx, r9d
inc ebx
btc r10d, 0xb6
rol ebx, 1
lea ebx, [rbx + rdx - 0x2b7f5fdc]
bt r10, 0x10
and r10, 0x7694e506
bswap ebx
not dl
lea rdx, [rdx + rdx*4 + 0x10b4728f]
dec ebx
or dl, r10b
btr r10d, r10d
xor r10w, dx
bswap ebx
or dl, dh
sar edx, 0xb8
push r9
call fcn.1418a3417
add rsi, r10
imul ebp, edi
mov qword [rsp + rdx*4 - 0x3fff4], rbp
call fcn.14189994c

Function at 0x1418a1745
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
xor r10d, r9d
movzx edi, bx
movsx ebp, bl
lea r10d, [r10 + rbx*2 + 0xc9171f3]
mov qword [rsp + rbx*2 - 0x7177b33a], rbp
ror dword [rsp + rdi*8 - 0x6cce5], 0x52
xor r10d, 0x2b207625
call fcn.14188b42a

Function at 0x1418a2cfe
Capabilities:
Check for software breakpoints
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
neg dword [rsp + rbx - 0x3fffd]
jg 0x14187a38b
ror dil, 1
sub bl, byte [rsp + rbx - 0x3fffa]
neg dil
cwde
mov ebp, dword [rsp + rbx - 0x3fff3]
shr dword [rsp + rbx - 0x3fff6], 0xf3
xor r9b, dil
btr bx, 0xad
mov word [r8 + rbx*2 - 0x7bffc], di
cdq
btr ecx, r10d
xor ebp, 0xd9a1e81a
lea r8, [r8 + rbx - 0x3dffd]
ja 0x1418a424a
xor dil, r9b
sal bx, 0x81
mov qword [rsp + rbx - 0x3fffe], rax
push r10
neg dil
shr rdx, 0xeb
div rbx
ror dil, 1
xor dil, 0xab
and r10w, bx
and word [rsp + rbx - 0x3fffa], dx
inc dil
jmp 0x141887b74
inc qword [rsp + rbx*2 - 0x7bff9]
push rax
mov qword [rsp + rbx - 0x3dfff], rsi
ret 0x10