joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b18a4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400b18ba
mov al, 1
jmp 0x1400b191a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400b18cb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400b1918
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400b2360
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b1918
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400b1918
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400b1918
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400b191a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400b2470
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400aaf30
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400aaf30
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400b25c0
cmp rax, 0xffffffffffffffff
je 0x1400b25c0
xor edi, edi
test rbp, rbp
jle 0x1400b256b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400af214
mov rbx, rax
test rax, rax
jne 0x1400b24f8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400b2561
mov edx, 0x8000
mov ecx, r14d
call fcn.1400ac4d4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400adc54
cmp eax, 0xffffffff
je 0x1400b2541
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400b2508
mov edx, r15d
mov ecx, r14d
call fcn.1400ac4d4
jmp 0x1400b2561
cmp byte [rsi + 0x38], dil
je 0x1400b2558
cmp dword [rsi + 0x34], 5
jne 0x1400b2558
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x1400b2561
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400af28c
jmp 0x1400b25d4
jns 0x1400b25d4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400aaf30
cmp rax, 0xffffffffffffffff
jne 0x1400b258c
cmp byte [rsi + 0x30], dil
je 0x1400b25d4
mov edi, dword [rsi + 0x2c]
jmp 0x1400b25d4
mov ecx, r14d
call fcn.1400b2360
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400b25d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x1400b25d4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400b25cd
mov eax, dword [rsi + 0x2c]
jmp 0x1400b25d2
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400aaf30
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400b5e50
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400b5e80
xor eax, eax
jmp 0x1400b5f43
mov rbp, rbx
cmp word [rax], si
je 0x1400b5ea5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400b5e8c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400b5e88
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400b2e0c
movsxd r14, eax
test eax, eax
jne 0x1400b5ee3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400b5e79
mov rcx, r14
call fcn.1400afe70
mov rdi, rax
test rax, rax
jne 0x1400b5efc
xor ecx, ecx
call fcn.1400af28c
jmp 0x1400b5ed8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400b2e0c
test eax, eax
jne 0x1400b5f2d
mov rcx, rdi
call fcn.1400af28c
jmp 0x1400b5f37
xor ecx, ecx
call fcn.1400af28c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400b5f60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400b5fe7
mov rsi, rbx
cmp word [rax], bp
je 0x1400b5fa6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400b5f90
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400b5f8c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400afe70
mov rdi, rax
test rax, rax
je 0x1400b5fd4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400bc500
mov rbp, rdi
xor ecx, ecx
call fcn.1400af28c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b72a0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400b72c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400a00e4
or eax, 0xffffffff
jmp 0x1400b72c2
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400b9170
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400e7700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400b91ba
call fcn.1400a0150
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.1400a0170
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14009d420
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140094cd0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400b91c5
lea eax, [rbx + 1]
jmp 0x1400b91a7
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400b91a5
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400b91a7

Function at 0x1400bc130
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400bc158
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400bc158
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14140776d
Capabilities:
Authenticate hmac

Disassembly:
push rdx
lea rbx, [rdx + rdx*4 + 0x1a0fb823]
mov edi, dword [rsi + rbx - 0x7793bd91]
xor edi, ebp
xor word [rsp + rdx*2 - 0x2568022c], 0xb326
sal word [rsp + rdx*2 - 0x25680228], 0xe4
dec edi
mov r8d, dword [rsp + rdx*2 - 0x2568022c]
mov eax, 0x261266a4
rol edi, 1
dec dword [rsp + rdx*2 - 0x25680228]
not rbx
neg edi
pop rbx
lea edi, [rdi + rdx*2 - 0x6d27a95d]
xchg r8b, dl
dec rax
shr rbx, 0x22
xor edi, 0x2fab5cb2
dec edx
bswap edi
mov qword [rsp + rdx*2 - 0x2568025e], rbp
xor dword [rsp + rdx - 0x12b4012f], edi
pop rbp
movsx ecx, r8w
lea r11, [rcx*8 + 0x79892f9a]
mul r11b
lea r10, [r10 + rdx - 0x12b40137]
jb 0x141439a5c

Function at 0x14140895c
Capabilities:
Authenticate hmac

Disassembly:
mov rbp, qword [rsp + rax*4 + 0x10]
mov qword [rsp + rax*2 + 0x10], r11
movsxd rdx, edx
and word [rsp + rax + 0xb], 0x363e
adc r9, rdx
mov rcx, qword [r10 + rax*2]
mov edx, dword ss:[rcx + rax*8]
lea r10, [r10 + rax + 4]
call fcn.141417a31

Function at 0x141409753
Capabilities:
Encode data using base64

Disassembly:
dec ebx
imul rax
pop rax
mov qword [rsp + rdx*2 + 8], rbp
xor dword [rsp + rdx + 8], ebx
mov rbp, qword [rsp + rdx + 8]
mov qword [rsp + rdx + 8], 0xffffffffb712bfad
mov eax, r8d
sar qword [rsp + rdx + 8], 0x69
movsxd rbx, ebx
add r9, rbx
imul word [rsp + rdx*2 + 3]
movzx r11w, byte [r10 + rdx*8 - 0x60]
mov bl, byte [rdx + r10 - 0xa]
sbb dword [rsp + rdx*4 - 0x29], ecx
ror rdx, 0x90
adc r10, 2
bswap ecx
add rcx, rcx
jge 0x141418847
mov ecx, 0x1da2c206
jmp 0x141410c9b

Function at 0x14140b4ee
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdi - 0x263b79a6], 0x318beb98
neg ecx
sar byte [rsp + r8 - 0x799e], 0x23
dec qword [rsp + rdi - 0x263b7996]
call fcn.14141b9d7
Function at 0x14140b886
Capabilities:
Authenticate hmac

Disassembly:
sbb bl, dl
xchg edx, eax
xor bpl, bl
xchg word [rsp + rax + 9], r8w
pop rdi
btc rcx, rax
lea rbx, [rsp + rbx + 8]
bt r11, rax
setb byte [rsp + rax + 5]
adc ax, word [rax + rbx]
shl byte [rsp + rdx - 0x6d], cl
lea r10, [r10 + rdx - 0x75]
mov word [r10 + rdx - 0x73], ax
inc qword [rsp + r11*4]
lea r11, [rcx*4 + 0x3fba81a8]
mov ebx, dword [rsp + rdx - 0x70]
pop rax
jae fcn.141426d8b
mov ecx, 0x8035869a
sub rsi, 2
movzx ebx, cx
movzx r11d, word [rsi + rbx - 0x869a]
call fcn.141408720
dec edi
not ax
lea rdx, [rbx*8 + 0x1aa4c928]
rol al, 0xc1
rol edi, 2
bswap edi
mov qword [rsp + rbx*4 - 0x9ae4cc], rbp
rol ecx, 0xc9
xor dword [rsp + rbx*2 - 0x4d7266], edi
pop rbp
push rbx
sar qword [rsp + rbx - 0x26b933], 0xe2
cqo
movsxd rdi, edi
adc r9, rdi
movzx edi, byte [rsp + rbx - 0x26b92f]
btc di, bx
jae 0x14141ec18
adc r9, rdi
shr r11b, 0xe5
jae 0x14143e108
lea rsi, [rsi + rbx*2 - 0x4d7268]
movzx ecx, word [rsi + rbx*4 - 0x9ae4cc]
xor cx, bp
xor cx, dx
neg cx
sub di, di
not bl
sbb word [rsp + r11 - 0x61a0ff1a], di
ror cx, 1
neg cx
xor bp, cx
jmp 0x14143b8e9
shl r11w, 0x41
rol word [rsp + rdx*2 + 2], 0x68
lea r10, [rbx + r10 - 0x26b9d4]
btc ebx, eax
inc dword [rsp + rbx*2 - 0x4c7397]
movsx r8d, word [rsp + rbx - 0x2639cb]
mov qword [r10 + rdx + 1], rcx
pop rcx
jb fcn.141426d8b
mov rsp, r10
pop rdx
mov eax, 0x10b6c72e
push rax
mov rbx, qword [rsp + rax - 0x10b6c726]
push rax
mov r8d, dword [rsp + rax*2 - 0x216d8e53]
mov rcx, qword [rsp + rax*4 - 0x42db1ca0]
mov r15, qword [rsp + rax - 0x10b6c70e]
mov rdi, qword [rsp + rax - 0x10b6c706]
sal r8, 0xf
push qword [rsp + 0x30]
popfq
not eax
mov r9, qword [rsp + 0x38]
push r8
push rax
mov r10, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
push rax
mov rsi, qword [rsp + 0x68]
xchg byte [rsp + 0x26], al
call fcn.14143d916
mov edi, edx
sbb rsi, r8
inc r8d
shr di, 0x61
ror edi, 0x79
movzx ebx, word [rsi + r11*2 - 0x294db20a]
xor bx, bp
jmp 0x14143a907

Function at 0x14140d4ed
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [rcx + riz]
ror r8, 0x63
adc r10, 4
mov qword [rsp], 0x62bf1435
mov dword [r10 + riz], edx
call fcn.141418dc5
mov eax, 0x8226f409
mov r11d, eax
mov rax, qword [r10 + riz]
movsx ecx, r11b
mov dx, word [rcx + rax - 9]
lea rax, [rcx*2 - 0x58ff5e65]
xor cl, al
lea r10, [r10 + rcx - 0x9e]
sal r11w, cl
js 0x1414371bc
adc cx, ax
mov word [r10 + rcx*2 - 0x144a4], dx
mov edx, ecx
adc rcx, 0x2ead732d
shl cl, 0x21
lea rsi, [rsi + rcx - 0x2eae1602]
btr rdx, r11
mov edx, dword [rsi + rcx*2 - 0x5d5c2bfc]
lea rcx, [rax + rcx*2 + 0x472bee9e]
xor edx, ebp
movzx edi, r11b
sub rcx, rdi
not edx
call fcn.141404654
inc r8
div dil
rol r11d, 1
shr r8, cl
dec r11d
xor r11d, 0xcb0ca408
sub eax, edi
cwde
ror r11d, 3
sar rcx, 1
push rbp
xor dword [rsp + rcx - 0x4192cbc1], r11d
pop rbp
sal dx, 7
and edx, ebx
movsxd r11, r11d
jp 0x141419b6d
idiv ax
add r9, r11
jmp r9
mov qword [rax + rcx - 0x7dcafcf7], r11
mov qword [rsp + rdi - 0x7ba70002], r9
ret 8

Function at 0x14141190e
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 8], rbp
jmp 0x141415c22
Function at 0x1414119b0
Capabilities:
Encode data using base64

Disassembly:
lea r10, [r10 + rax*2 - 0x65700002]
mov qword [rsp + rax*2 - 0x65700000], rbx
jb 0x141400b3e

Function at 0x14141243d
Capabilities:
Authenticate hmac

Disassembly:
neg r8d
call fcn.14142d3b5
imul rbx, rbx
sbb rsi, 4
mov r11d, ebx
movzx eax, bx
shr r11d, 0xe
mov ecx, dword [rsi + r11*2 - 0x76330]
movsx edi, r11w
add al, bh
cqo
xor ecx, ebp
shr dl, 0xa5
rol ecx, 2
sal rbx, 0xc
xadd bx, dx
neg ecx
shr rdi, 0x23
mul rbx
rol ecx, 3
push rax
lea r8, [rdi + rdi*2 + 0x2c1107b2]
lea ecx, [r11 + rcx + 0xa003920]
neg r11b
not r8
mov qword [rsp + r11*2 - 0x762d0], rbp
not bl
xor dword [rsp + r11 - 0x3b168], ecx
idiv rbx
or rdx, r11
pop rbp
cbw
cdq
movsxd rcx, ecx
jns 0x141422e92
not al
sub rdi, rdx
add r9, rcx
inc al
xor r11, r8
mov rbx, qword [r10 + r11*2 + 0x58256db6]
mov rdx, qword [r11 + r10 + 0x2c12b6e3]
mov cl, byte [rax + r10 + 0xff87]
bt r11w, di
bt r11, 0xbf
adc edi, 0x512c589e
lea r10, [r10 + r11*2 + 0x58256dc0]
shld rbx, rdx, cl
cqo
mov qword [r10 + rax*2 + 0x1feee], rbx
call fcn.141419825

Function at 0x1414124f4
Capabilities:
Authenticate hmac

Disassembly:
dec word [rsp + 9]
dec edx
inc dword [rsp + 0xa]
mov qword [rsp + 8], rbp
xor dword [rsp + 8], edx
pop rbp
mov ebp, 0xd13a048b
pop rbp
jmp 0x14140d17c

Function at 0x141414446
Capabilities:
Authenticate hmac

Disassembly:
xor ax, bp
jmp 0x141414d99
xor r8d, ebp
neg ebx
ror r8d, 2
xadd qword [rsp + r11*4 - 0x2c], rdx
inc byte [rsp + r11*8 - 0x56]
bswap r8d
call fcn.14142f133
mov r8d, 0x41be5685
movzx eax, r8b
mov ecx, r8d
mov edi, dword [r10 + rax*2 - 0x10a]
mov r11d, eax
rol r8w, cl
lea r10, [rax + r10 - 0x81]
mov ebx, 0x5f8baa11
setb bl
lea rdx, [r8*4 + 0x1324d7b0]
lea rsi, [rax + rsi - 0x87]
not eax
setae cl
movzx ebx, word [rsi + r11 - 0x85]
call fcn.1414094bc
shl r11d, 0x89
rol r8w, 1
btc rdx, 0xa1
sub dx, ax
jg 0x141401de5
xor bp, r8w
add r11d, edx
movzx ebx, dil
inc ax
movzx ecx, r11b
xor ax, 0x5e1c
ror ax, 1
not ax
xor bp, ax
xadd rcx, r11
sar bx, 0x46
adc rax, rsp
btr rdi, 0xa0
mov dword [rax + r11*4 - 0x2c], r8d
mov r8d, r11d
push rdx
lea rsi, [rsi + r11*4 - 0x30]
mov r8d, dword [r11 + rsi - 0xb]
not qword [rsp + r11*2 - 0x16]
jb 0x14140410c
push 0x478fb01e
mov rsp, r10
call fcn.14143aa5d
mov edi, dword [rdi + rsi - 0x578f2192]
push rbx
pop rcx
xor edi, ebp
call fcn.141415f8c

Function at 0x1414166e7
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x9b252d1b
mov qword [rsp + rbx*2 - 0x400000], rbp
mov ebp, eax
cdqe
xadd edx, r11d
xor dword [rsp + rbx*4 - 0x800000], ecx
shl di, 0x8b
cmovae ebp, edi
xadd r8b, dil
pop rbp
movsxd rcx, ecx
sbb dil, 0xb2
dec r11w
add r9, rcx
xchg bl, r11b
sub edi, 0xc514c708
mov rdx, qword [r10 + rbx*2 - 0x400054]
movsx ecx, dil
setnp r11b
jle 0x14143816f
mov r8, qword [rbx + r10 - 0x200022]
lea r10, [r10 + rax*8 - 0x150]
jno 0x14140e372

Function at 0x141416753
Capabilities:
Encode data using base64

Disassembly:
cmp ebx, 1
lea rsp, [rsp + 0x10]
jne 0x141425c09
mov rcx, rax
jmp 0x141432681
Function at 0x141417744
Capabilities:
Authenticate hmac

Disassembly:
mov rbp, qword [rsp + r8 - 0x1c]
shr qword [rsp + r8 - 0x24], 0x84
movsxd rax, eax
add r9, rax
and bl, byte [rsp + r8*2 - 0x4d]
not r8d
jae 0x141423e94
mov ecx, 0x6b9b9323
lea r11, [rcx*8 - 0x49e6bef3]
lea rsi, [rsi + rcx - 0x6b9b9327]
mov ebx, dword [rsi + rcx - 0x6b9b9323]
movsx edi, r11w
movsx edx, cl
xor ebx, ebp
inc ebx
movsx r8d, di
neg ebx
rol ebx, 1
neg ebx
or r11, r8
add r8b, r8b
push rbp
lea rbp, [rdi + rcx*8 - 0x244fedc9]
jp 0x141437580
shr bp, 0xa
xor dword [rsp + rdx*2 - 0x46], ebx
lea rax, [r11 + rbp*8 + 0x7004c687]
not ecx
div r8
pop rbp
shl r11w, 0x82
bt di, dx
idiv ecx
movsxd rbx, ebx
add r9, rbx
mov di, word [r10 + rax - 0x15c7d069]
mov ax, word [r10 + rax - 0x15c7d067]
dec r8
add r10, 2
lea r8, [rdx + r11*8 + 0x5a139ba3]
or di, ax
lea rbx, [rdx + rdx*8 + 0x230ab010]
movzx eax, bx
not di
ror r8, 0x86
lea rdx, [rax + r11*2 - 0x606b2680]
mov word [r10 + rax*8 - 0x401e0], di
push rax
sbb word [rsp + rax - 0x8038], ax
inc qword [rsp + rax*4 - 0x200f0]
mov qword [rsp + rax - 0x803c], r9
ret
xor rbx, qword [r10 + rbx*4]
mov qword [rsp + 0x10], r8
mov qword [rsp], r8
bts r8w, r8w
mov r8, qword [r10 + riz + 8]
jae 0x141425b1f

Function at 0x141417fae
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + r11*8 - 0x2d100100], rax
xchg r8d, eax
xor edx, 0x3aa22e2a
or al, 0x39
sbb cx, word [rsp + rax - 0x36]
jae 0x141417064
mov dword [r10 + r8*2 + 4], eax
push r11
mov dword [r8 + r10], edx
sbb r8w, r8w
rol word [rsp + r8], 0x64
add byte [rsp + r8 + 5], bl
pop rax
jns fcn.141426d8b

Function at 0x141418ef0
Capabilities:
Authenticate hmac

Disassembly:
ror word [rsp + 0x10], 0x29
call fcn.141434026
mov eax, 0xc186a102
mov di, word [r10 + riz]
cbw
mov r11w, word [r10 + riz + 2]
lea rdx, [rax*8 + 0x4c038a0b]
btc edx, eax
lea r10, [r10 + rdx - 0x58338a1d]
mov ebx, eax
shl bl, 0x84
adc di, r11w
mov r11d, 0x5a2808b
mov word [r10 + r11 - 0x5a2808b], di
lea rsi, [rsi + r11*2 - 0xb45011a]
cbw
mov edi, ebx
mov edx, dword [rsi + rdx - 0x58338a1f]
movsx r8d, bl
btc ebx, r8d
xor edx, ebp
xchg r11w, di
inc edx
shl rbx, 0x64
bt rdi, r8
bts r8, r8
ror edx, 1
lea rcx, [rbx*2 - 0x6d167c2]
neg edx
call fcn.141417fae
Function at 0x14141a20f
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [rcx + rbx + 0x5728ccff]
rol ecx, 2
movzx eax, r11w
lea ecx, [rbx + rcx - 0x28aab2a2]
movzx edi, word [rsp + rbx*4 - 0xde5b]
mov qword [rsp + rbx*4 - 0xde5c], rbp
lea rbp, [r11 + rbx*8 - 0x47ce54df]
xor dword [rsp + rbx - 0x3785], ecx
mov rbp, qword [rsp + rbx - 0x3785]
imul edi
movsxd rcx, ecx
mov qword [rsp + rdx*8 + 0x18], rdi
xor r8b, r11b
adc r9, rcx
add dl, 0xa4
call fcn.14142b07f
sal qword [rsp + rdx*4 + 0x2ab], 1
lea r11, [r8 + rcx*8 - 0x2bfd70eb]
lea rsi, [rsi + rdx*2 + 0x14e]
mov ebx, dword [rdx + rsi + 0xa9]
xor ebx, ebp
cdq
not ebx
neg rax
inc rdx
movzx edi, al
ror ebx, 2
sub ebx, edx
btc edi, 0x9f
bswap ebx
mov qword [rsp + rdx*2 + 6], rbp
sal al, 0xe2
xor dword [rsp + rdx + 7], ebx
btc r11d, 0x88
rol r8b, 0xa1
mov rbp, qword [rsp + rdx*4 + 4]
sar r8b, 0xc5
je 0x14142051b
mov rbp, qword [rsp + rcx*8 - 0x498]
neg r8
movsxd rdi, edi
mov qword [rsp + rcx - 0x94], rcx
shl r8b, 0xe6
sar r11d, 4
adc r9, rdi
btr r11, rax
mov qword [rsp + rcx - 0x8c], rcx
mov rax, qword [rcx + r10 - 0x94]
sbb dl, 0x13
mov r11w, word [rax + rcx - 0x94]
lea r10, [r10 + rcx*2 - 0x122]
movsx eax, r8w
xadd byte [rsp + rcx*2 - 0x122], ch
mov word [r10 + rcx*2 - 0x128], r11w
pop rax
mov qword [rsp + rcx*2 - 0x128], r9
ret
btc rdx, 0
movsxd rbx, ebx
jb 0x141426859

Function at 0x14141b3ef
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0x73347107
lea rsp, [rsp + 8]
add rsp, rcx
jmp 0x141428e2b
push 0xffffffff96016515
push 0xd286c87
test ebx, ebx
lea rsp, [rsp + 0x10]
je 0x141438a6d

Function at 0x14141ca05
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x141436e98
push 0x6b2b9210
call fcn.14143a9f6
lea rsp, [rsp + 0x18]
jne 0x14140203f
mov ecx, 0xb0056cb3
mov rcx, rax
jmp 0x141419e3a

Function at 0x14141cdd3
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], 0xffffffffe0370408
sub rsi, 4
add byte [rsp + 6], 0x8d
mov edi, dword [rsi]
mov ebx, 0xffb3b932
movsx ecx, word [rsp + 4]
xadd dword [rsp + 3], ecx
xor edi, ebp
lea edi, [rdi + rcx + 0x33978742]
ror edi, 1
movsx eax, word [rsp + 2]
inc edi
sub cx, cx
lea r11, [rcx - 0x2b5e00e3]
neg edi
sub ebx, dword [rsp + r11 - 0x61a0ff19]
xchg qword [rsp + rbx - 0x26b933], rax
jns 0x14140b8ec
Function at 0x14141e680
Capabilities:
Authenticate hmac

Disassembly:
sub r8d, 0xe095b800
or dl, dh
mov qword [rsp + rbx - 0xeb00004], 0x6425d427
not r8d
jl 0x141431a95
push rbx
neg r8d
mov qword [rsp + rbx - 0xeaffffc], rbp
or rax, 0x7788a68c
setns byte [rsp + rbx - 0xeafffff]
xor dword [rsp + rbx*2 - 0x1d600000], r8d
movzx ebp, byte [rsp + rdx - 0x74a101b4]
mov rbp, qword [rsp + rbx*4 - 0x3ac00008]
movsxd r8, r8d
call fcn.14140391b
mov ecx, 0xb222f2b4
mov r8, qword [r10 + riz]
lea rdi, [rcx*2 - 0x6962f278]
movsx ebx, cl
mov r11d, dword [r8 + riz]
movzx r8d, cx
lea r10, [r10 + r8*4 - 0x3cacc]
mov dword [r10 + r8*2 - 0x1e568], r11d
bswap rcx
lea rsi, [rsi + r8*4 - 0x3cad4]
xchg r8b, bl
movsx edx, cl
movsx r11d, dx
xor ecx, dword [rdx + rsi]
xor ecx, ebp
lea r8, [rdx - 0x6ce7f46e]
dec ecx
neg ecx
movzx eax, r11b
xor r8d, r8d
not ecx
cdqe
bts rax, 0x13
not dl
dec ecx
bswap rdx
btc rax, rdi
push rbp
call fcn.14141c1fe

Function at 0x14141e6cb
Capabilities:
Authenticate hmac

Disassembly:
mov r9d, 0x5b9cfcbb
movzx r9d, byte [r9 + r8 - 0x5b9cfcbb]
call fcn.141423ebf
lea rsp, [rsp + 0x40]
jne 0x141412175
mov edx, 0xccb579ab
pop r9
mov ecx, 0xa9a2280c
lea rdi, [rcx*2 + 0x4ba1360d]
not ebx
jmp 0x14141cb5c

Function at 0x14141eb5b
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rbx*2 - 0x417ab78], rbx
not edx
mov r11d, 0x581b8689
mov dword [r10 + rbx*2 - 0x417ab78], edx
lea rsi, [rsi + r11 - 0x581b868d]
mov r11d, dword [rsi + rbx*2 - 0x417ab78]
push rbx
mov edx, 0x172c9a87
lea rax, [rbx + 0x58061a2e]
xor r11d, ebp
sal dword [rsp + rbx - 0x20bd5b4], 0x5c
jne 0x14141f85e
xor dil, cl
sub dil, cl
shl r8d, 0x37
not r8d
bts rdx, 0xb1
ror dil, 1
or r8, 0xffffffff9e2f8f0b
add r8, rax
xor dil, cl
rol dil, 1
ror ax, 0x4f
xor bpl, dil
mul cl
add rdi, rsp
mul r11b
lea r8, [r8 - 0x7cea44fd]
xor r8b, bl
movzx cx, byte [rax + rdi + 0x774afa6c]
sbb rbx, 0x5833ef1e
rol bx, 0xc2
lea r10, [r10 + rbx + 0x583375f5]
dec r8d
cwd
mov edi, 0xc780f633
mov word [rax + r10 + 0x774afa6c], cx
inc r11w
jnp fcn.141426d8b
Function at 0x14141ee93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0x712460af
btr eax, 0xa0
push rdx
mov rbp, qword [rsp + rax + 0x10]
call fcn.141402b02
adc r10, 0xb
xor ecx, ecx
push 0x1f3f7221
push 0xffffffffec13e424
not word [rsp + 7]
test r11, r11
push 0xffffffffdca0ad8f
lea rsp, [rsp + 0x18]
je 0x14141a030
mov r8d, 0xddad62a8
call fcn.141439cac
mov ebx, 0xcc961aa6
movzx r11d, bx
xadd r11d, ebx
not ecx
call fcn.141402444
mov ebx, edi
inc r11d
lea rax, [rbx*2 + 0x40376405]
mov qword [rsp + rdi - 0x51e6a15], rax
btc ebx, 0x10
not r11d
xor r11d, 0x1b137796
rol r11d, 2
inc r11d
and bl, byte [rsp + rdi - 0x51e6a14]
not r11d
jl 0x14140a458
mov qword [rsp + rdi - 0x51e6a15], rbp
shl edi, 0x4e
xor dword [rsp + rcx*2 - 0x2a], r11d
inc ebx
movzx ebp, bx
xchg bl, al
pop rbp
movsxd r11, r11d
xadd bx, di
xchg bl, dil
ja 0x14142a44c
adc r9, r11
lea r8, [rcx + rcx*4 + 0x1dbed011]
bt r8w, 0xb1
call fcn.14142ec23
mov edi, 0xbe0dac1e
sub rsi, 1
call fcn.14142b333
ja 0x14143dbc0
jbe 0x14140a837
sub rsi, 4
mov r8d, 0x342b5aae
movsx ecx, r8w
mov edx, dword [rsi + r8*2 - 0x6856b55c]
movzx eax, cl
xor edx, ebp
rol edx, 2
jmp 0x141428ec9
lea rbp, [r11 + r11*8 - 0x13ed42f5]
lea rbp, [rbp*4 + 0x7f2b808b]
bts ebp, r11d
xor dword [rsp + r11*4 - 0x25f22c24], eax
shr r11, 0x12
pop rbp
movsxd rax, eax
adc r9, rax
inc r11w
mov eax, r11d
mov rax, qword [r10 + r11*2 - 0x4c0]
neg r11
lea r11, [r11 + r11*4 - 0x677f70cb]
mov r11, qword [r10 + r11 + 0x677f7cb3]
jbe 0x14142d15a
jl 0x14143b9ef
push 0x6685470f
sub rsi, 4
not qword [rsp]
mov edx, 0x82264f2b
lea r8, [rdx + rdx + 0x64089b09]
mov r8d, dword [rsi + riz]
xor r8d, ebp
mov byte [rsp + 3], dh
ror r8d, 1
movzx eax, dl
cqo
ror ax, 4
xor r8d, 0xf2919c2e
mov edi, dword [rsp + rdx + 3]
cdq
neg r8d
not eax
mov r11d, dword [rsp + rdx + 4]
lea r8d, [rdx + r8 - 0x7a92e79b]
sar qword [rsp + rdx], 0x34
jae 0x141437fe5
mov qword [rsp + rdx*4], rbp
xor dword [rsp + rdx], r8d
push r11
lea rbx, [rdx + 0x5b24de02]
mov rbp, qword [rsp + rdx + 8]
mov qword [rsp + rdx*2 + 8], 0x18b88232
imul r11b
movsxd r8, r8d
mul byte [rsp + rdx*4 + 0xc]
bswap rax
rol rdi, 0x35
add r9, r8
dec ebx
dec r11b
lea rsi, [rdx + rsi - 1]
setno r11b
or qword [rsp + rdx*4 + 1], 0x51abff20
idiv word [rsp + rdx*2 + 0xb]
movzx r11d, byte [rsi + rdx*2]
xor r11b, bpl
xchg dil, al
ror bx, 0x6f
adc r11b, 0xb
mov r8d, 0xd5a9f127
rol r11b, 1
xor r11b, 0x87
add r11b, 0xac
xor bpl, r11b
shr rbx, 0x93
neg dword [rsp + rdx + 0xa]
lea r10, [r10 + rdx - 4]
add qword [rsp + rdx + 2], 0x65041c0e
ror ebx, 3
mov dword [r10 + rdx*8], r11d
or word [rsp + rdx + 0xd], di
cdqe
pop r8
pop rdi
jp fcn.141426d8b

Function at 0x141420529
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0x5488e105
xor edx, ebp
add edx, 0x9836b536
not qword [rsp]
not edx
bswap edx
call fcn.1414124f4