joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180ebb9e5
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add r10, rbp
xor dword [rsp + rdx], ecx
xor rbp, rbp
pop r11
movsx edi, dl
shr rax, 0xf6
and r9d, ebp
mov dword [rdx + rbx - 2], ecx
or edi, ebp
lea rbx, [rax + rbx - 2]
je fcn.180eb17b9
xor dl, r11b
inc dl
add bpl, cl
lea rdi, [rcx + r9 - 0x1b71b374]
cdqe
rol dl, 1
not dl
sal byte [rsp + rax*2 - 0xa3], 0x26
dec dl
neg r10
and dword [rsp + rax - 0x55], 0x24169939
shr dword [rsp + rax - 0x53], cl
xor dl, 0xac
xchg qword [rsp + rax*4 - 0x15e], rcx
mov byte [rsp + rax*2 - 0xa9], cl
neg ax
xor r11b, dl
lea rdx, [rsp + rdx + 0x10]
xadd rbp, r9
call fcn.180eb3d7e
ror dl, 0xa1
sal r9b, cl
movsx ecx, r10w
shl ebp, 0x27
mov word [rbx + r10 - 2], r9w
bts r10, 3
lea r9, [rdx*8 - 0x55e44ec]
jae 0x180ee81c1
mov ebp, 0xa2a869d
mov edx, ebp
mov cx, word [rbp + rbx - 0xa2a869d]
lea r10, [rdx*4 - 0x5270b1e9]
mov dx, word [rbx + rbp - 0xa2a869b]
lea rbx, [rbx + rbp*2 - 0x14550d38]
btr r10d, ebp
lea r9, [r10*2 - 0x39fb5dfc]
or cx, dx
or r10, 0x1b04beb8
movzx edi, bp
xchg r10b, dil
not cx
seta r9b
jge 0x180eecf24
xor cl, r11b
neg dil
jae 0x180ed39b9
ror byte [rsp + rdx*8 + 2], 0x82
sbb ecx, 0xac18b021
or dword [rsp + rdx + 4], r10d
and r10d, 0x278348b4
pop r10
not ecx
cqo
jle 0x180e65a54
btr ax, 0x33
xor ecx, 0x86977414
movzx r9d, dx
btc ax, ax
not r9d
push r11
sal rbp, 0x16
jns 0x180e6fb65
cbw
xor r11b, cl
call fcn.180eb31c1
xor r11b, dil
mov r9d, dword [rsp + rdx - 0x4c]
cdqe
mov word [rdx + rbx - 0x5a], di
mov qword [rsp + rdx*4 - 0x160], rdx
lea rbp, [rsp + rax + 0x6be20673]
mul rcx
mov r10, qword [rbp + r9]
sub cx, 0x92aa
pop rax
sal r9, 0xdb
mov qword [rax + rbx - 0x62], r10
mov edi, dword [rsi + rax*2 - 0xb5]
push rdx
xor edi, r11d
not edi
btc edx, eax
sbb byte [rsp + rax*4 - 0x152], 0x98
mov ebp, r9d
xor edi, 0xc935cb2
add bpl, 0xbb
lea r9, [rcx + rdx*4 - 0x1878e8f8]
cwde
lea edi, [rdi + rdx - 0x3848affe]
rol edi, 2
lea r10, [rbp + rbp*2 + 0x6ab77616]
mov qword [rsp + rax - 0x50], r11
xor dword [rsp + rax - 0x50], edi
lea rcx, [r9 + r9*4 + 0x6302ce0f]
mov r11, qword [rsp + rax*4 - 0x158]
add dl, r10b
not rcx
mov qword [rsp + rax*4 - 0x158], 0xffffffffc8310592
movsxd rdi, edi
adc r8, rdi
movzx edx, byte [rsi + rax - 0x5e]
add cx, word [rsp + rax - 0x4a]
lea rsi, [rax + rsi - 0x5e]
jbe 0x180e70bfa
mov edx, dword [rbx]
mov r9d, 0x6d25748a
lea rbx, [r9 + rbx - 0x6d257486]
lea rsi, [rsi + r9 - 0x6d25748b]
movzx ebp, byte [r9 + rsi - 0x6d25748a]
mov ecx, r9d
mov edi, 0x311ae42a
movzx eax, r9w
xor bpl, r11b
lea r10, [r9*8 + 0x18a37928]
sar edi, 0x7c
imul r10, r9
not bpl
shr al, 0xa1
or cx, ax
bts r9w, ax
ror bpl, 1
and r9d, 0x7c3ad132
bt r9d, 6
lea r10, [r9 + rcx + 0x53af7082]
neg bpl
call fcn.180f080c8
ror cl, 1
dec cl
btc r9, r10
shr qword [rsp + rdi*2], 0xe
ror cl, 1
sub byte [rsp + rdx*8], 0xbb
sub cl, r9b
xor r11b, cl
or r9, rdx
neg dil
lea rcx, [rsp + rcx + 8]
xadd byte [rsp + rdi + 4], r9b
mov word [rdi + rcx], ax
mov eax, 0xd0151cb3
and word [rsp + rdx*2 + 4], r10w
adc edx, dword [rsi + rdi*8 - 6]
ror word [rsp + rdi + 4], 0x2e
push rax
xor edx, r11d
rol edx, 1
add dil, r9b
inc edx
jmp fcn.180eb600e
Function at 0x180ebf22b
Capabilities:
Manually build aes constants

Disassembly:
mov r11, qword [rsp + r10 - 0x5a08331e]
btc edx, eax
sbb dword [rsp + r10 - 0x5a08332e], ebp
mov qword [rsp + rdx - 0xa1e6], 0x5128ca35
movsxd rcx, ecx
inc ebp
adc r8, rcx
movzx r10d, byte [rsi + rbp*2 - 9]
lea rsi, [rsi + rbp - 8]
call fcn.180ec1a24
mov r10d, 0x47846122
mov ebp, r10d
mov cx, word [r10 + rbx - 0x47846122]
movzx edx, bpl
jmp 0x180ee12bf

Function at 0x180ebfa5b
Capabilities:
Authenticate hmac

Disassembly:
push 0xffffffffc0b1d62d
lea rsp, [rsp + 0x10]
jmp fcn.180ed9d2f

Function at 0x180ec11cc
Capabilities:
Authenticate hmac

Disassembly:
cdqe
push rdx
not r10d
xor r9b, cl
bswap r10d
lea rax, [rdx + 0x76b5f385]
mov qword [rsp + rdx - 0x3ebac688], 0xffffffffe805b630
movsx edi, byte [rsp + rdx*2 - 0x7d758d1d]
not r10d
pop rax
adc dx, word [rsp + rdx - 0x3ebac68e]
setp byte [rsp + rdx - 0x3ebaae91]
lea r10d, [r10 + rdx - 0x4b737fb2]
and r9d, 0x3c9a3639
cwde
push rbp
mov qword [rsp + rbp - 0x10c20af3], r11
jge 0x180ed8154
call fcn.180eb3893
xor qword [rsp + rdx - 0x3ebaae95], r9
xor dword [rsp + rdx - 0x3ebaae8d], r10d
mov r11, qword [rsp + rdx - 0x3ebaae8d]
btr edi, 0xb6
mov qword [rsp + rdx*2 - 0x7d755d22], 0x9111db3
sal byte [rsp + rdx - 0x3ebaae8d], cl
mov dword [rbp + rbx - 0x10c20af9], r10d
dec r9w
lea rdi, [rdi*2 + 0x3a16a398]
lea rbx, [rdx + rbx - 0x3ebaae93]
adc rdx, rax
mov qword [rsp + rbp - 0x10c20afb], r8
ret 8
Function at 0x180ec18db
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
shr r10d, 0x73
xor ecx, 0x50906318
bt rdx, 0x9e
lea r10, [rdx + rdi*8 + 0x341c5126]
inc rdi
inc ecx
bswap ecx
xor ecx, 0xebb3022c
movsx ebp, di
rol ecx, 1
neg r10
lea ecx, [rcx + rdi*8 + 0x1b807d51]
movzx r9d, bpl
bswap ecx
jb 0x180e9a883
mov r9d, dword [rsi - 4]
xor r9d, r11d
mov ebp, 0x43b5a28d
movzx eax, bp
neg r9d
sal rbp, 0xac
sbb r9d, ebp
rol al, 0xc7
mov r10d, ebp
rol r9d, 1
add r9d, 0xd2ae4a8b
movzx edi, bp
push r11
sub r10w, di
call fcn.180f02056
mov ebp, 0x4f9dee10
shl bpl, 0xc5
mov r9, qword [rbx + rbp - 0x4f9dee00]
movzx edi, bp
adc bpl, bpl
mov edx, dword ss:[r9 + rdi*2 - 0x1dc00]
movsx r10d, bpl
btc bp, r10w
movzx eax, r10b
add r10d, dword [rbx + rdi*8 - 0x76ff8]
not edx
bswap rdi
or ax, 0x6902
movzx r9d, ax
not r10d
mov ecx, 0x1d2e7f89
bts rax, 0x1e
or edx, r10d
movsx r10d, r9b
mov dword [rbp + rbx - 0x4f9dedf9], edx
sub cx, ax
sub ebp, ebp
mov eax, dword [rsi + rbp*2 - 4]
sal ebp, cl
xor eax, r11d
lea eax, [rbp + rax - 0x32293604]
movsx edx, r10b
xor eax, 0x7d8e2497
bt r9, 0xbb
bts edi, r9d
bts ecx, r10d
sbb eax, ebp
xchg dx, bp
xadd rbp, rdx
bswap eax
rol r10d, cl
rol cx, 0xa
jb 0x180edd526
push r11
sbb bpl, 0xbb
xor dword [rsp + rbp*4 - 0x11c], eax
pop r11
neg edi
movsxd rax, eax
and r9w, r10w
adc ebp, 0x489e9a05
adc r8, rax
shr r9b, 0x81
add r10d, ebp
mov r9d, dword [rbp + rbx - 0x489e9a44]
lea rbx, [rbx + rbp - 0x489e9a40]
movzx ecx, byte [rcx + rsi - 0x1d2e1c5f]
cmova r10, rdx
lea rsi, [r10 + rsi - 7]
movzx eax, dl
or di, ax
xor cl, r11b
bswap rdx
inc cl
bswap rbp
imul rbp, rdx
btc r10, rax
neg cl
add cl, 0x99
sar bp, 0x6b
shl bpl, 0x23
call fcn.180ebae6f
sub bpl, 1
sar cx, 0x68
jb 0x180eb0fd7
xor r11b, bpl
sar cl, 0x45
lea rbp, [rsp + rbp + 0x20]
btc di, 0xa3
mov qword [rsp + r10*4 - 0x3fc], rcx
mov word [rbp + r9*8 - 0x118000], dx
mov qword [rsp + r9 - 0x22ff8], rcx
or eax, ecx
sal word [rsp + r9 - 0x22ff7], 0xcd
mov edi, dword [rsi + r9*2 - 0x46006]
jnp 0x180e771e8
movzx edx, r10b
lea rsi, [r9 + rsi - 0x23006]
mov qword [rsp + r9*2 - 0x45fe8], 0xffffffffd8258797
add eax, dword [rsp + r9*2 - 0x45ff7]
xor edi, r11d
cdqe
inc edi
neg rdx
btc eax, 0x13
bswap r9d
neg edi
rol edi, 1
mul qword [rsp + r9 - 0x3001ff]
shr eax, 0xc5
bswap edi
xor edi, 0x4881a424
mov qword [rsp + r9 - 0x3001e8], r11
movzx ebp, word [rsp + r9 - 0x3001fe]
xor dword [rsp + r9*4 - 0xc007e8], edi
mov r11, qword [rsp + r9 - 0x3001e8]
call fcn.180e8f4c1
shl bp, cl
mul r9w
sbb r10d, edi
cwd
rol rdi, 0xdf
push r11
dec dl
setne dil
xor dword [rsp + r9 - 0xb311c0a], r10d
cbw
pop r11
movsxd r10, r10d
and ecx, 0x94307033
imul rax, rbp
neg cx
add r8, r10
lea r10, [rcx + r9*8 - 0x30ee5ce3]
bswap rbp
add rax, rbx
lea rbx, [rbx + r9*2 - 0x16623818]
or edi, edx
call fcn.180ed1c79
Function at 0x180ec1c59
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
mov edi, dword [rsp + rbp*4 - 0xa9]
mov r9d, r10d
neg eax
movzx edx, bpl
movzx ecx, word [rsp + rbp - 0x28]
ror r9d, 0x18
rol eax, 3
inc rdi
xor rcx, r9
bswap eax
cmovno r10d, dword [rsp + rbp - 0x28]
xor eax, 0x3b917b21
mov qword [rsp + r10*4], r11
xadd cl, r10b
and rdx, rdx
shr dil, 0xc2
xor dword [rsp + r10*2 - 0x114], eax
dec rcx
jno 0x180eb004c
mov eax, dword [rsi - 4]
mov r10d, 0x8a817a2b
movzx ebp, r10b
lea rsi, [rsi + rbp - 0x2f]
mov qword [rsp + rbp - 0x2b], rbp
sal r10b, 0x22
xchg word [rsp + rbp - 0x2b], bp
xor eax, r11d
jmp 0x180e77b71

Function at 0x180ec1e0a
Capabilities:
Authenticate hmac

Disassembly:
mov word [rbx + rdx*2 - 8], bp
pop rcx
jg fcn.180eb17b9
adc r8, rcx
movzx ecx, r9w
jmp fcn.180eb17b9
sal r10b, 0xe3
dec ecx
sub r10, 0x12a86708
btc r9, rdx
push r11
push rbp
add di, word [rsp + r10 + 0x12a82cd6]
not dword [rsp + rdi*2 - 0x76b883aa]
xor dword [rsp + rdi - 0x3b5c41cd], ecx
movsx eax, word [rsp + rdi - 0x3b5c41d3]
mov r11, qword [rsp + rdi - 0x3b5c41cd]
movsxd rcx, ecx
add r8, rcx
btc rdi, 0x35
mov r9, qword [rbx + r10 + 0x12a82cd0]
idiv r10
mov rbp, qword ss:[r10 + r9 + 0x12a82cd0]
push rax
sal r10, 0xa3
mov qword [rdx + rbx - 0x9bfddb0], rbp
mov qword [rsp + rdx*2 - 0x137fbb60], r8
ret 0x10
push rax
mov qword [rbx + rax*2 - 0x7839286c], rdx
bts r10d, 0xb1
mov r10, qword [rsi + rax*2 - 0x78392874]
cqo
movsx r9d, ax
xor r10, r11
lea r10, [rax + r10 - 0x16e6c5ae]
not r9w
not r10
mov qword [rsp + rdx*8 + 8], rdx
sar byte [rsp + rax*2 - 0x7839286c], 0x82
neg r10
lea rdx, [rax + rax*8 - 0x135a3e7e]
movsx ecx, byte [rsp + rax*2 - 0x78392861]
movzx edi, cx
rol r10, 6
xor r10, 0xffffffffbdac65a9
shr dil, 0xe2
dec r10
shl cx, 0xa1
sal ax, 0xcf
xor r11, r10
dec qword [rsp + rax - 0x3c1bfff8]
shl ax, 0x43
dec r9b
mov qword [rbx + rax*2 - 0x78380008], r10
jb 0x180ea4c8d
jo 0x180e99f9a
jo 0x180ee11e6
lea rbx, [rax + rbx - 0x3c1c0008]
adc edi, dword [rsi + rax*2 - 0x7838000c]
lea rsi, [rsi + rax - 0x3c1c000c]
shl byte [rsp + rax - 0x3c1bfff2], 0xa1
call fcn.180ea63d2

Function at 0x180ec2fe3
Capabilities:
Authenticate hmac

Disassembly:
lea rsi, [rsi + rdx - 0x57ca123b]
add edx, edx
neg al
sbb dl, 0xa3
movzx eax, byte [rsi + riz]
xor al, r11b
btr dx, 0x37
shl bp, 0xca
sbb al, bpl
xchg word [rsp + 0xd], bp
neg dx
xor al, 0x2f
not al
rol al, 1
xor r11b, al
and rdx, qword [rsp + 8]
mov qword [rsp + rdx*8 - 0x3c009428], rsi
mov qword [rsp + rdx - 0x7801286], rdx
mov qword [rsp + rdx - 0x7801286], r8
add rdx, 0xffffffff89997439
shr rbp, 0xbb
push r11
sbb dl, dl
lea rbp, [rdx*8 - 0x185d8ad6]
mov rbp, rbx
or rdx, rdx
movzx ebx, dl
add ebx, eax
inc edx
dec edx
mov edx, ebx
jne 0x180e8f425

Function at 0x180ec3871
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 4
call fcn.180e7c4df
mov edi, 0xc9388523
mov r10w, word [rbx + riz]
lea rdx, [rsp + 8]
mov eax, edi
movzx r9d, di
call fcn.180f04df2
Function at 0x180ec3896
Capabilities:
Authenticate hmac

Disassembly:
shr r10w, 0x46
xor eax, r11d
lea rdi, [r10 + rbp*2 + 0x33ab0a05]
dec eax
lea rdx, [rcx + r9 - 0x9c350cf]
and rbp, rdx
bswap eax
shl ebp, 0x68
lea eax, [rax + rcx - 0x1ae03644]
inc di
adc r9, 0xe23111b
rol eax, 2
sub r10, qword [rsp + rbp*8 - 0x851fe8]
mov qword [rsp + rbp*4 - 0x428fe8], r11
mov qword [rsp + rbp - 0x10a400], rcx
pop rcx
sub edx, ecx
xor dword [rsp + rbp*2 - 0x2147f0], eax
mov r11, qword [rsp + rbp*2 - 0x2147f0]
mov qword [rsp + rbp - 0x10a400], rbp
call fcn.180ea7339
mov edx, 0x7abcd0b4
movzx edi, dl
mov r10d, dword [rdi + rsi - 0xb8]
lea rcx, [rdi*2 + 0x1f8f9196]
xor r10d, r11d
lea r10d, [r10 + rcx*2 + 0x66ec5430]
not r10d
movzx r9d, dil
bswap r10d
rol r9w, 0xa2
neg r10d
push r11
movsx r11d, r9w
xchg r11b, r9b
movzx ebp, cx
xor dword [rsp + rcx - 0x1f8f92fe], r10d
pop r11
movsx eax, r9w
sal di, 0x26
movsxd r10, r10d
push rdi
adc r8, r10
jmp 0x180ee8aa6
not word [rsp + rdi*4 - 0xb3ff]
movsx r10d, bpl
mov r9, qword [rbx + rdi*2 - 0x5a00]
sal bpl, 0x61
sbb qword [rsp + rdi*2 - 0x5a00], rbp
ror byte [rsp + rdi - 0x2cfe], 0x27
mov rdi, qword [rbx + rdx - 0x7abcd0ac]
pop rcx
ja 0x180ec8350
sub al, al
or r9, rdi
mov edi, ecx
xadd rax, rbp
not r9
mul rbp
adc ebp, 0xaa0e2025
mov qword [rbx + rdx*2 + 8], r9
push rcx
movzx r10d, byte [rsi + rdx - 5]
lea rsi, [rsi + rdx - 5]
cqo
not qword [rsp + rdx]
xor r10b, r11b
sal qword [rsp + rdx*2], 0x94
sbb r10b, 0x19
lea r9, [rax + rcx - 0x5b6ae2d3]
not r10b
sub r10b, 0x2f
neg r10b
xor r11b, r10b
idiv edi
lea r10, [rsp + r10 + 8]
shl rdx, cl
cmova edi, ecx
sal r9d, cl
mov ebp, dword [r10 + rdx - 0x155c7e8]
shl qword [rsp + rdx - 0x155c7e8], cl
setns dl
mov dword [rbx + rdx*2 - 0x2ab8dfc], ebp
not dl
je 0x180e787de
movsx r10d, ax
lea rbx, [rbx + rdx*2 - 0x2ab8ffa]
inc byte [rsp + rdx - 0x155c7fa]
mov qword [rsp + rdx - 0x155c7ff], r8
ret
Function at 0x180ec3d75
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [rbx + rdi*2 + 0x3bbbb5e0]
btc edi, edx
or edi, ebp
jmp r8
lea rdx, [rsp + rdx + 8]
movsx ecx, di
neg r9w
dec cl
mov rbp, qword [rdx + rax*8 - 0x1ee83b98]
sal eax, cl
lea r9, [r9 + rax - 0x48749fdb]
not eax
mov rdi, rbp
mov qword [rsp + rcx - 0x56c], 0xffffffff8e04f93f
push r9
mov rcx, qword [rbx + rax*2 - 0x5f119ffe]
add al, byte [rsp + rax*2 - 0x5f119ff2]
add rdi, rcx
mov qword [rbx + rax - 0x2f88cffe], rdi
pop r10
mov r9d, dword [rsi + rax - 0x2f88d003]
lea rsi, [rax + rsi - 0x2f88d003]
movzx edx, byte [rsp + rax*2 - 0x5f119ff8]
shr al, 0xa2
sal word [rsp + rdx - 0xfc], 0x61
xor r9d, r11d
dec r9d
mov ebp, dword [rsp + rax - 0x2f88cf3d]
lea rdi, [rdx*2 - 0x147281f6]
rol r9d, 2
sar qword [rsp + rdx*2 - 0x1fe], 0xbf
lea r9d, [r9 + rdx*2 - 0x542c7216]
je 0x180ee38d1
movzx ecx, word [rsp + rax - 0x2f88cf3f]
rol dil, 7
bswap r9d
idiv r10
cwd
shl edx, 0x92
mov qword [rsp + rdx*8], r11
ror rcx, 0xf6
js 0x180ea5f64
xor dword [rsp + rdi + 0x14727ffc], r9d
sal bpl, 0x23
ror rdi, 0x97
movsx r11d, cx
pop r11
btc rcx, rax
movsxd r9, r9d
bt bp, 0xb0
xadd rbp, rdx
rol di, 0xe2
add r8, r9
xor ecx, ebp
ror bpl, 0xe6
movsx r9d, bp
jmp r8
xor dword [rsp + rdx + 8], eax
not word [rsp + rdx + 6]
inc byte [rsp + r10 + 5]
xor word [rsp + rdx + 5], 0x1110
mov r11, qword [rsp + rdx + 8]
mov qword [rsp + rdx*2 + 8], rcx
jne 0x180f011eb
jno 0x180ebc691
mov edi, 0x95b02c9d
mov rdx, qword [rbx + riz]
lea rbp, [rdi + rdi*2 + 0x17ba8b92]
lea r10, [rsp + 0x38]
mov ecx, 0xec902689
btr rbp, rcx
mov qword [r10 + riz], rdx
mov rbp, qword [rbx + riz + 8]
mov r10d, ecx
mov edx, dword [rbp + riz]
sub rdi, rcx
xor cl, 0x1a
neg r10
mov dword [rdi + rbx + 0x56dff9f8], edx
sub r10d, edi
movsx r9d, cl
add r9, r10
mov edx, dword [rdi + rsi + 0x56dff9e8]
push r9
lea rsi, [rdi + rsi + 0x56dff9e8]
movzx ebp, dil
dec bp
add dword [rsp + rbp*8 - 0x94], r10d
xor edx, r11d
ror r10d, cl
neg edx
xor ecx, 0xebbbdb12
ror edx, cl
rol word [rsp + rcx - 0x72bfd81], cl
inc edx
shl qword [rsp + rcx - 0x72bfd81], cl
xor edx, 0xad3c63ae
sub ebp, r10d
movsx eax, byte [rsp + rdi + 0x56dff9ec]
mov qword [rsp + rcx - 0x72bfd81], r11
xor dword [rsp + rcx*4 - 0x1caff604], edx
and edi, ebp
shr r9b, cl
bts ebp, edi
pop r11
dec rax
btc di, r10w
lea rax, [rcx*8 + 0x2090de03]
movsxd rdx, edx
or r10w, 0x4b0b
setl al
adc r8, rdx
mov ecx, dword [rbx + rdi - 0xfffff4]
mov edx, dword [rbx + rdi*4 - 0x3fffff0]
lea rbp, [rdi*2 - 0x1d5740e9]
lea rdi, [rax - 0x77cea4e8]
add ecx, edx
lea rdx, [rdi + rdi*8 - 0x4c5640d4]
mov dword [rbx + rdi + 0x1ddddaf8], ecx
bts r9, rax
jb 0x180e91fe2
Function at 0x180ec69a9
Capabilities:
Authenticate hmac

Disassembly:
mov edx, ecx
mov rbp, qword gs:[r9 + rcx*8 - 0x7f0a0]
mov r10d, edi
lea rcx, [rcx + rdx*8 - 0x29d4a055]
xadd cl, dil
mov qword [rcx + rbx + 0x29cbb181], rbp
mov ebp, edi
btc edx, edx
dec r10
lea rsi, [rsi + rcx + 0x29cbb17d]
sar bpl, 0xa2
btc edx, 0x1e
movsx eax, dil
mov ebp, dword [rsi + rdx - 0x4010fe14]
lea rax, [rdi*8 + 0x593b1d00]
xor ebp, r11d
shr ecx, 0x58
neg ebp
movzx r9d, al
not ebp
cwd
sub ebp, 0xd0b5af32
xadd di, dx
push rcx
xor cx, r10w
neg ebp
mov qword [rsp + rcx - 0x6ac9], r11
lea rdx, [rax*4 - 0x52641dc8]
not eax
not r9
xor dword [rsp + rcx - 0x6ac9], ebp
movsx r11d, dx
pop r11
movsxd rbp, ebp
not cl
call fcn.180eb8007
xor r9d, 0x7a11dc93
mov qword [rsp + rdx - 0xb7], r11
bswap rax
neg cl
sbb cx, ax
xor dword [rsp + rdx*4 - 0x2dc], r9d
cdqe
push rax
inc dil
mov r11, qword [rsp + rax + 8]
mov qword [rsp + rax*8 + 8], 0x45bd9cb2
or byte [rsp + rdx*2 - 0x162], dh
adc dl, 0x2d
movsxd r9, r9d
inc dil
shr eax, 0xb7
sbb bpl, byte [rsp + rax + 6]
adc r8, r9
and word [rsp + rax + 8], di
lea rax, [rax + rax*2 - 0x17cae2cb]
mov rbx, qword [rbx + rax*2 + 0x2f95c596]
pop r10
pop rdx
jns fcn.180eb17b9
mov qword [rsp + r9*2 - 0xc2], r11
pop rbp
mov qword [rsp + rcx*2 - 0x2000], rbp
movzx r11d, word [rsp + rbp - 0x6fc83b68]
xor dword [rsp + r9*2 - 0xca], eax
push rbp
pop r10
mov r11, qword [rsp + r10 - 0x6fc83b61]
mov dword [rbx + r9 - 0x6b], eax
mov ecx, dword [rsi + r10 - 0x6fc83b71]
mov edi, dword [rsp + r9 - 0x67]
shl bp, 0x4d
push rdi
xor ecx, r11d
mov qword [rsp + r9 - 0x59], r10
lea ecx, [r9 + rcx + 0x5e19e81a]
rol ecx, 1
inc ecx
rol ecx, 1
lea rax, [r10 + rdi*2 + 0x11295615]
lea ecx, [rcx + rbp + 0x3fbc1e9b]
mov qword [rsp + r9*2 - 0xc2], r11
dec r9d
xor dword [rsp + r9 - 0x58], ecx
cdq
mov r11, qword [rsp + r9*4 - 0x190]
mov qword [rsp + r10 - 0x6fc83b59], rdi
movsxd rcx, ecx
btr r9d, r9d
add r9b, 4
adc r8, rcx
shr r10, 0x37
rol r10, 0x28
mov rbp, qword [rsi + r10 - 0x10]
lea rsi, [rsi + r10*2 - 0x10]
rol r9w, 0xa7
xor rbp, r11
cqo
movzx ecx, r10b
rol rbp, 1
and qword [rsp + r10*2], rcx
or byte [rsp + r10 + 7], 0x8d
cdqe
dec rbp
ror rbp, 2
cwde
rol al, 0xa6
jae 0x180ef3ab6
not rbp
neg dword [rsp + r10*2 + 0x13]
add r9b, cl
adc cl, r9b
xor r11, rbp
mov qword [rbx + r10*4 - 0xa], rbp
sub r9w, 0xed14
jo 0x180ea4841
lea rbx, [r10 + rbx - 0xa]
movsx ebp, byte [rsp + r10*8 + 7]
jo 0x180f02e36
mul cl
pop rcx
pop rdi
pop rdx
jae fcn.180eb17b9
mov r9, qword [rcx + rbx - 0xfe14]
jmp 0x180ea47ac
mov r10d, dword [rsi + rbp*4 - 0x423c]
lea rcx, [rdx*4 + 0x4c933197]
and dword [rsp + rbp - 0x108f], 0x8b32bf84
mul cx
xor r10d, r11d
push rdx
sub r10d, 0x84303eb8
rol dl, 0x22
neg r10d
shl rax, 0xf
mul ebp
sal byte [rsp + rbp - 0x1082], 0x42
not r10d
div eax
and qword [rsp + rbp*4 - 0x423a], rax
or eax, edx
sbb r10d, 0xb5a8ee0c
or qword [rsp + rbp*2 - 0x2116], r11
pop rcx
bt edx, eax
xor dword [rsp + rbp - 0x108f], r10d
cdq
pop r11
rol ax, 0xee
movsxd r10, r10d
setb al
movzx edi, dl
add r8, r10
or rdx, r8
jmp rdx
Function at 0x180ec6b2b
Capabilities:
Authenticate hmac

Disassembly:
inc eax
not eax
btr rdx, 0x26
btc rdx, 0xe
mov qword [rsp + rdx - 0x12815f80], r9
xor eax, 0x7710ccbd
inc eax
or bp, cx
not eax
push rdx
dec eax
and word [rsp + rdx - 0x12815f74], 0x331
mov qword [rsp + rdx - 0x12815f78], r11
xor dword [rsp + rbp - 0xdfee], eax
mov r11d, edx
bt di, 0x9c
imul r11, qword [rsp + rdx - 0x12815f80]
mov r11, qword [rsp + rdx*4 - 0x4a057df8]
movsxd rax, eax
movsx r10d, r9w
jae 0x180ed34ea
sar edi, 0x59
mov dword ss:[r10 + rdi - 0xc], ecx
ror bp, 3
mov dil, byte [rsi + rdi*2 - 0x19]
mov eax, edx
add dl, al
sbb rax, 0xb95072e
xor dil, r11b
sub dil, 0x1a
movsx r10d, ax
not dil
btc rbp, 0x97
add r10d, 0xb1b4f03d
lea rcx, [rbp*4 - 0x12535679]
sbb dil, 0x2f
lea r9, [rdx + rcx + 0x30863133]
shl dx, cl
neg dil
or r10w, cx
xor r11b, dil
call fcn.180effceb

Function at 0x180ec6bec
Capabilities:
Authenticate hmac

Disassembly:
push rdi
ror al, cl
neg al
rol qword [rsp + rdi + 0xf0], cl
mov qword [rsp + rdi + 0xe0], r9
sal qword [rsp + rbp - 0x43b9f3de], cl
rol al, cl
or dword [rsp + rdi*4 + 0x368], r10d
rol dil, cl
sbb al, cl
mov edx, dword [rsp + rdi*4 + 0x2c1]
xor al, 0x36
not word [rsp + rdi*2 + 0x179]
rol al, cl
sar rdx, cl
sub al, cl
sal bp, 0x6a
pop rdi
sbb word [rsp + rdi + 0xec], 0x89f
ror al, cl
mov qword [rsp + rdi + 0xf0], rcx
sar word [rsp + rdi*8 + 0x6da], cl
xor al, dl
rol r9d, cl
xor r11b, al
lea rax, [rsp + rax + 0x20]
sub dl, 0x8f
shl r10, 0xa0
mov rdi, qword [rax + rdi*2 + 0x1b0]
add r10w, 0x7b2d
sbb edx, r10d
jb 0x180e8061d
mov qword [rbp + rbx - 0x43b9bbf8], rdi
xadd dl, r10b
xchg dword [rsp + rdx - 0x7fff8463], edx
lea rbp, [rbp*2 - 0x6d71ac71]
lea rbx, [rbx + rbp - 0x1a01cb87]
xchg qword [rsp + rbp - 0x1a01cb8b], r9
sbb r9d, 0xc3097b16
mov qword [rsp + rbp - 0x1a01cb8f], r8
ret 0x18

Function at 0x180ec9f5c
Capabilities:
Authenticate hmac

Disassembly:
xor edi, r11d
mov r10d, edx
sub r10, rdx
lea edi, [rdi + rdx*4 - 0x5d0f3cae]
mov qword [rsp + r9*2 - 0x68e28eea], 0xfffffffff0865ba8
not edi
mul dx
xadd rdx, r10
dec edi
cwd
ror edi, 2
bswap edi
idiv r9d
add r9w, 0x933b
dec dx
ror edi, 1
inc byte [rsp + rcx - 0x47a1668d]
cdq
mov qword [rsp + rdx*4], r11
xor dword [rsp + r9 - 0x3471dab0], edi
and ecx, ecx
ror rax, 0x3d
pop r11
lea r10, [r9*8 - 0x4951086f]
dec al
call fcn.180efd4f4

Function at 0x180ecb652
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], rbp
mov rdi, qword [rbx + riz + 0xc]
mov byte [rsp], bpl
and r10, rdi
add rbp, rbp
movsx eax, bp
not r10
mov qword [rbx + riz + 0xc], r10
mov ebp, dword [rsi + riz - 4]
jo 0x180e8f1c7
mul byte [rsp]
pop rdx
xor ebp, r11d
xor eax, edx
mov r9d, eax
jno 0x180f08eb0
Function at 0x180ecbe32
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
rol rax, cl
and rax, r9
mov r11, qword [rsp + rax - 0x5dc11d]
dec rdx
mov qword [rsp + rax - 0x5dc11d], rcx
dec r10w
mov dword [rbx + rax*8 - 0x2ee092a], ebp
shr ecx, cl
lea rbp, [r9 + 0x469b53ab]
shl bp, 1
mov edi, dword [rsi + rax*8 - 0x2ee0930]
xor edi, r11d
pop rbp
shl qword [rsp + rax*2 - 0xbb824a], 0xa2
dec edi
cwd
xor cl, r9b
or ax, r10w
bswap edi
js 0x180efd757
sub r10b, al
lea edi, [r10 + rdi - 0x477b3a48]
seta r9b
rol edi, 2
ror r10d, cl
mov qword [rsp + rax - 0x5dffff], r11
xor dword [rsp + rax*2 - 0xbbfffe], edi
lea r11, [rax + r10 - 0x75c09d55]
not r10
pop r11
inc r10
cdq
movsxd rdi, edi
push r10
add r8, rdi
mov ebp, eax
inc r10w
xor r10, r10
mov rbp, qword [rsi + rax*8 - 0x2f00008]
cqo
imul rax, r9
lea rsi, [r10 + rsi - 0x10]
xor rbp, r11
rol qword [rsp + r10], 0x33
dec edx
jne 0x180e9ddde

Function at 0x180ecbf47
Capabilities:
Authenticate hmac

Disassembly:
pop rbp
pop r11
bt edx, ecx
movsxd rax, eax
adc cx, cx
adc r8, rax
movsx ebp, cl
xchg r10b, dl
shr dx, 0x86
mov r9, qword [rdx + rbx + 1]
jp 0x180e6e883
mov eax, 0xb4ab9101
movzx ecx, ax
lea r9, [rcx + rcx*8 + 0x58163428]
mov r9d, dword [rcx + rbx - 0x9101]
rol rax, cl
call fcn.180ee62c2

Function at 0x180ecf6bc
Capabilities:
Authenticate hmac

Disassembly:
dec word [rsp + rbp - 0x69272910]
adc r8, r10
mov qword [rsp + rdx*8 - 0x200c20b0], r8
ret 0x18
inc edi
rol edi, 1
neg al
neg r9d
bswap edi
xor edi, 0xe11dcd03
movsx ebp, ax
not edi
bts eax, r10d
cwd
ror edi, 1
mov qword [rsp + r10 - 0x22bb6ac5], r11
neg rcx
xor dword [rsp + rdx*2 - 0x1ffee], edi
shr rdx, cl
mov r11, qword [rsp + r10*2 - 0x4576d59a]
pop rcx
movsxd rdi, edi
cbw
pop rcx
adc r8, rdi
movzx edi, r10b
movzx eax, byte [rsi + rdx*2 - 6]
mov qword [rsp + r10*2 - 0x4576d5aa], 0x46a5e43a
inc r10
xor al, r11b
btr ecx, 0xa
sub r10, 0xffffffff8c294831
mov word [rsp + rdx + 1], r9w
rol al, 1
shr edx, cl
dec al
rol al, 1
sar dword [rsp + rdx + 2], cl
not rdx
xor al, dl
inc di
xor r11b, al
shl rdx, cl
xor byte [rsp + rdx + 0x1000006], r9b
mov word [rbx + rdi - 0xd6], ax
movzx eax, bpl
movzx edx, byte [rsi + rdx*2 + 0x1fffff9]
push r10
neg word [rsp + rdi*2 - 0x1aa]
lea rsi, [rsi + rdi*4 - 0x35f]
sbb r9, r10
xor dl, r11b
xor word [rsp + r9 - 0x28125d56], di
shr ax, 0x4c
adc dl, 0xa4
shl qword [rsp + r9 - 0x28125d54], cl
ja 0x180efa1b6
add edx, dword [rsp + rdx*2 + 0x65ede26f]
xor dword [rsp + rbp - 0x69272908], r10d
dec qword [rsp + rbp - 0x69272914]
mov r11, qword [rsp + rbp - 0x69272908]
push rcx
and edx, 0x1403e417
movsxd r10, r10d
sbb cl, 0xb1
jno 0x180e93e0c
Function at 0x180ed3206
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rbp - 0x20f8e0a], rbp
mov edi, dword [rsi + rbp*2 - 0x41f1c18]
movsx eax, word [rsp + rbp*4 - 0x83e3827]
jmp 0x180e8c2f7