joyce8/EMBER2024-capa huggingface dataset:
Function at 0x142555f8c
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
lea rsp, [rsp + 0x20]
je 0x1425467ae

Function at 0x142557e6c
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
or byte [rsp + rdx - 0x44bd6f01], dh
ror ebx, 3
shr word [rsp + rdx - 0x44bd6efa], cl
movzx ebp, cx
bswap ebx
sar qword [rsp + rbp*8 - 0x37844], cl
movsx esi, cx
lea ebx, [rbx + rbp*2 - 0x6e8fdf36]
mov qword [rsp + rbp - 0x6f0a], rbp
neg ebx
movzx edi, byte [rsp + rbp - 0x6efa]
not ebx
and qword [rsp + rcx - 0x44bd6efa], rdi
inc ebx
ror word [rsp + rcx - 0x44bd6f03], 0x29
neg dl
mov qword [rsp + rcx - 0x44bd6efa], r8
push rbp
xor dword [rsp + rcx - 0x44bd6ef2], ebx
sal word [rsp + rcx - 0x44bd6efc], cl
and dword [rsp + rbp - 0x6ef6], 0x141b6c38
mov r8, qword [rsp + rbp - 0x6ef2]
ror dx, cl
movsxd rbx, ebx
jnp 0x14257fdda

Function at 0x142559346
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
xor r8b, sil
add rsi, rsp
movzx ebp, ax
or bpl, al
movzx ax, byte [rax + rsi - 0x358bd396]
movsx ecx, bp
and ebp, 0x99148229
mov word [r10 + rbp*2 - 0x10402], ax
push rcx
mov ecx, dword [r11 + rbp - 0x8205]
movsx esi, byte [rsp + rbp - 0x81fc]
movsx eax, byte [rsp + rbp - 0x81fe]
xor ecx, r8d
shr al, 0x47
neg ecx
and edx, edx
jae 0x14258c2b8
mov qword [rsp], rdi
sub r11, 4
mov ecx, dword [r11]
call fcn.142530f8e
xor ebx, 0x8aa4ba87
xchg di, bp
mov qword [rsp + rdi - 0x13088183], r8
shr rdi, cl
xor dword [rsp + rdi], ebx
sal rsi, cl
pop r8
movsxd rbx, ebx
call fcn.142577593
pop rcx
mov qword [rcx + r10 - 0x3c], rax
not byte [rsp + rcx - 0x2d]
mov qword [rsp + rsi - 0x5c06b63c], rcx
lea r11, [rsi + r11 - 0x5c06b640]
push rcx
mov esi, dword [rcx + r11 - 0x3c]
push rcx
mov qword [rsp + rcx - 0x1c], rbx
xor esi, r8d
ror byte [rsp + rcx*8 - 0x1cd], 0x67
call fcn.1425745c1
neg ebx
lea ebx, [rbx + rsi - 0x2c24cd21]
rol ebx, 1
add si, si
movsx ecx, al
bswap ebx
lea ebx, [rbx + rsi + 0x52083854]
ror sil, cl
lea rbp, [rsi + rcx*8 + 0x5d95d43e]
ror ebx, 1
call fcn.14257db58
mov eax, 0x358bd396
movzx esi, byte [r11 + rax*2 - 0x6b17a72d]
xor sil, r8b
xor sil, 0x9e
lea rbx, [rax + rax*2 + 0x5a0db701]
rol sil, 1
movsx edx, bl
add sil, 0xa3
sub rdx, 0xffffffff8f3de103
sbb dx, ax
add bx, bx
not sil
jns 0x14253e43b
Function at 0x14255df37
Capabilities:
Authenticate hmac

Disassembly:
xor r8b, dil
add dl, 0x84
shl bp, 0xc1
add rdi, rsp
and ebx, edx
mov si, word [rbp + rdi - 0x4ae080be]
push rbx
lea r10, [rdx + r10 - 0x89]
xor dword [rsp + rdx*2 - 0x10a], ebp
mov word [r10 + rdx*8 - 0x438], si
and ebp, ecx
push rcx
lea r11, [r11 + rdx*2 - 0x112]
inc dx
mov ecx, dword [r11 + rbp*4 - 0x78]
movsx edi, bp
neg qword [rsp + rbp - 0x16]
xor ecx, r8d
call fcn.14259b7f6
mov ecx, 0x21b8a24
jmp 0x142587910
movsxd rsi, esi
sal rdi, cl
shl bp, 0x4e
adc r9, rsi
neg ecx
add edx, eax
add di, word [r10 + rdi*2 + 2]
mov esi, ecx
mov qword [rsp + rbp], rcx
xchg cx, si
movzx edx, byte [r11 + rbp - 5]
add dword [rsp + rbp], 0x4583961a
neg dword [rsp + rbp + 4]
lea rax, [rax + rsi*8 - 0x41552273]
xor dl, r8b
ror si, 0xc5
push rax
shr rax, 0xd1
rol dl, cl
shr rbp, cl
sar word [rsp + rbp + 0xe], cl
not dl
jb 0x142532ab5
sub sil, sil
xor dl, 0xad
push rsi
lea rax, [rbx*4 + 0x9924b88]
neg dl
sub word [rsp + rbp + 1], si
shr al, cl
xor byte [rsp + rbp*4 + 0x14], ch
sbb dl, 0xaa
pop rax
ror cl, 0x46
xor r8b, dl
jmp 0x1425952ca

Function at 0x14255e00c
Capabilities:
Encode data using base64

Disassembly:
setae dl
mov rbp, qword [rdx + r10 - 0x1200]
mov qword [rsi + rdx*2 - 0x2400], rbp
xadd word [rsp + rdx*8 - 0x8ff6], dx
mov eax, dword [rdx + r11 - 0x6438]
pop rcx
movsx esi, bl
xor eax, r8d
xchg dword [rsp + rdx - 0x642f], esi
call fcn.14259b8f1
shl rcx, 0x3f
mov ax, word [r10 + rcx]
shr rcx, 0x19
or cl, byte [r10 + rcx + 2]
lea r10, [r10 + rbx - 0xfc]
jmp 0x14258881c

Function at 0x14255ecb4
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
jmp 0x14259fc2d
mov eax, dword [r10]
movzx edx, cl
shl edx, cl
xor dx, dx
mov cl, byte [r10 + 4]
movzx ebx, dl
movzx edi, bl
add edx, 0x1b3b4c32
lea r10, [r10 + rbx + 2]
sets sil
pop r9
call fcn.14253881b
mov ecx, 0xd799bf3c
jmp 0x14258b460
lea rsp, [rsp + 8]
call rax
mov ecx, 0xab00da36
movsx esi, cx
mov rsp, qword [rbp + riz - 0x10]
mov rbp, qword [rbp + riz - 8]
mov edi, esi
mov qword [rbp + riz], rax
mov r10, rbp
rol ecx, cl
shl rsi, 0x16
movzx r11d, dil
pop r8
movzx ebp, cx
jae 0x142591b2f
Function at 0x1425604ef
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
mov ecx, esi
mov cx, word [rbp + r10 - 0x64b9dd85]
mov eax, esi
movzx esi, byte [r11 + rbp - 0x64b9dd8c]
mov edi, eax
jae 0x14259a9b7
adc r9, rdx
xor di, ax
movzx ecx, byte [r11 + rax*2 - 0x9609]
xor dword [rsp + rax*2 - 0x9602], ebp
ror dword [rsp + rax*2 - 0x9602], 0x26
shr word [rsp + rax*4 - 0x12c02], 0xef
lea r11, [r11 + rax - 0x4b07]
xor cl, r8b
neg dword [rsp + rax*2 - 0x9603]
mov edx, 0xcdb06c87
and word [rsp + rax - 0x4afe], 0xf426
xor cl, 0x1d
rol cl, 1
lea rdi, [rbp + rax - 0x214e1d4a]
jmp 0x1425422c6
sar bl, 0x21
pop r8
movsxd rcx, ecx
sar bx, 0x2d
adc r9, rcx
xor dil, bl
xor rbp, rdi
sal rbx, 0xb2
movzx edi, byte [r11 + rbx - 9]
not ebp
xor dil, r8b
sal ebx, 0xc4
jae 0x1425a12ac
mov ecx, dword [rbp + r11 - 0x2a9e25a7]
mov qword [rsp + rbp*2 - 0x553c4b3e], 0xffffffff932a098c
not edi
sal qword [rsp + rdi - 0x4edfd9fa], 0x7d
xor ecx, r8d
bswap ecx
sub ecx, 0x85315ab5
rol ecx, 2
not byte [rsp + rdi - 0x4edfd9f4]
dec ecx
mov qword [rsp + rbp - 0x2a9e259f], r8
shl di, 0x4d
shl rdi, 0xc6
movsx ebx, di
xor dword [rsp + rbx], ecx
dec al
jno 0x142556b78
mov ebp, dword [rdx + rdi - 0x8700000]
push rdx
add ebx, ebp
pop rsi
movzx esi, byte [r11 + rsi - 0x870000a]
neg rax
movsx ebp, cl
lea r11, [r11 + rdx*2 - 0x10e0000a]
call fcn.14254a3e7
mov esi, 0x10ff386
shrd ebx, edi, cl
mov dword [rbp + r10 - 0x64b9dd85], ebx
rol esi, 0x7a
jae 0x142532cda
inc sil
rol dil, 1
inc dx
rol bp, 0x2e
adc ax, bx
dec dil
sal edx, 0xd4
add ebp, edx
xor dil, 0x13
lea rbp, [rbx + 0x65213f09]
and bx, bx
adc bp, bp
xor r8b, dil
lea rcx, [rbx + rbp*4 - 0x68414f4a]
or ecx, 0x7d19268d
adc rdi, rsp
jmp 0x14256adc6
mov ebx, ebp
xor sil, r8b
dec sil
add al, dl
rol sil, 1
and ax, dx
xor sil, 0x16
push rdx
sal dil, 0xc4
or ax, di
not sil
pop rax
shl edx, 0xf0
xor r8b, sil
and al, 0x30
adc rsi, rsp
shl rdi, 0x33
add rdx, rbx
mov word [rsi + rdx - 0x6544dd8b], cx
ror edx, 0x70
movsx ecx, dil
neg cl
add ax, word [r10 + rbp - 0x64b9dd83]
xadd rdx, rcx
inc ecx
lea r10, [r10 + rbx - 0x64b9dd81]
setp cl
movzx ebp, byte [rbx + r11 - 0x64b9dd8d]
mov esi, 0x5cb1a2bb
xor bpl, r8b
dec bpl
rol bpl, 1
ror ebx, 0x61
add dil, sil
xadd ebx, edx
xor bpl, 0x16
sal rcx, 0xa
not bpl
call fcn.14257d2f3
mov rax, qword [rax + rdi - 0x54a0]
mov rdx, rax
mov qword [rsp + rbx + 0x2d7ecc39], rsi
lea rcx, [rsi*8 + 0x139bc69e]
mov rdi, qword [r10 + rbx*2 + 0x5afd987a]
xchg qword [rsp + rbx*2 + 0x5afd9872], rcx
mov rcx, qword [rsp + 8]
add rcx, 0x2c996
jmp rcx
lea rax, [rbx*2 + 0x6a14fb06]
xor dil, 0x1d
add sil, al
js 0x14257e542

Function at 0x142561e8e
Capabilities:
Encode data using xor

Disassembly:
lea r9, [0x142572758]
lea rsp, [rsp + 8]
movzx r11d, byte [rsi]
push 0x6d19d61e
xor r11d, ebx
and r11d, 0xff
mov r11d, dword [r9 + r11*4]
neg qword [rsp]
shr ebx, 8
xor ebx, r11d
inc rsi
xor ebx, 0xf00a5814
dec rbp
lea rsp, [rsp + 8]
jne 0x142561e9a
mov r9d, 0x3c8ceb0e
pop r11
pop r9
Function at 0x142563c6d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + rcx], rax
mov word [r10 + rcx + 0xe], si
pop rbp
lea rdx, [rcx + rax + 0x6182258d]
add dl, 0x8d
lea r10, [r10 + rcx*2 + 0xe]
jns 0x14258510b
add r9, rdi
add dl, sil
call fcn.142544294
lea r11, [rax + r11 - 0xe9c1]
pop rax
mov ecx, ebp
adc rdx, rbp
xor rsi, r8
xchg bp, ax
sal bp, 0x2b
shr dx, 0xd
ror rsi, 3
push rbx
not rsi
shl bp, 8
inc rsi
sub bpl, cl
or dl, bpl
adc bx, word [rsp + rax - 0x164d]
xor rsi, 0x83929a3
xor r8, rsi
mov edi, dword [rsp + rax*4 - 0x5949]
and cl, dil
mov qword [r10 + rax - 0x1663], rsi
call fcn.142562640
xadd dl, ch
mov edx, dword [r11 + rcx*4 - 0x6805]
lea rbx, [rbp + rax - 0x2d68016c]
jne 0x1425a42a7
and ax, ax
rol edx, 2
xor rax, rbp
jno 0x142593f7d
mov rdi, qword [r10]
mov ecx, 0x5785d71d
call fcn.142571ed1
movzx edx, bl
lea r10, [r10 + rdx*4 - 0x1ae]
movsx edi, dx
xor di, bx
mov word [r10 + rdx*2 - 0xda], bp
lea rbp, [rbx + rbx*8 + 0x6ca1a8b7]
lea r11, [r11 + rdx - 0x71]
movsx eax, di
adc eax, edx
mov edx, dword [r11 + rdx*2 - 0xda]
xor al, bh
xor edx, r8d
rol edx, 2
or bpl, bpl
sar sil, 0x81
call fcn.14254691d
jno 0x142599cd5
sar edx, 0x74
pop rdi
pop rcx
pop rbx
pop rcx
pop rsi
pop rdi
pop rbx
jb fcn.142588eba
mov esi, ebp
dec edx
call fcn.142556f39
adc r9, rdi
movzx edi, dx
or ebx, 0x612f3e35
movzx di, byte [r10 + rbp*2 - 0x70]
mov cl, byte [r10 + rbp*2 - 0x6e]
sal dil, cl
sub bp, word [rsp + rbp - 0x33]
mov qword [rsp + rbp*2 - 0x68], rbx
call fcn.142587ab6
mov esi, 0xd61d9f2b
lea rcx, [rsi*2 + 0x68203112]
mov esi, dword [r11 - 4]
and rcx, rcx
mov edi, ecx
xor esi, r8d
neg esi
movzx edx, cx
call fcn.14255dc09
ror rcx, 3
mov dword [rsp + rdx*2 + 3], eax
xor rcx, rdx
sar si, 0xf
inc rcx
xor rcx, 0x83929a3
xor r8, rcx
sub ax, bp
mov qword [rdx + r10 - 7], rcx
pop rdx
movsx ebx, bp
rol esi, 0xbc
mov rsi, qword [r11 + rsi*2 - 0x1f546014]
sal word [rsp + rax - 0xe9ac], 0x41
cmova rax, rbx
jae 0x14257689b
not bx
shl ax, 0x69
seta dil
setbe cl
rol bx, cl
xor byte [rsp + rdx*2 - 0x1393b], 0x3b
pop rcx
xor r8w, bx
call fcn.142592524
lea r11, [r11 + rcx*8 - 0xd005]
jp 0x14258ca59
xadd ebp, ecx
xor edx, r8d
jmp 0x14258906e

Function at 0x142564f03
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
xor rdi, r8
not dx
ror rdi, 3
or dword [rsp + 0x18], edx
not rdi
push rdx
inc rdi
inc sil
xor rdi, 0x83929a3
xor r8, rdi
call fcn.142564501

Function at 0x142567bfe
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
adc r9, rbx
push rsi
add dl, dh
movzx eax, byte [r11 + rdi*4 - 0x20d]
lea r11, [rdi + r11 - 0x87]
je fcn.14252c5df
push rbp
xor al, r8b
not rdi
add cl, 0x84
xor al, 0xaf
and dx, si
ror al, 1
sar ebp, 0x97
dec al
or dword [rsp + rbp*2 - 0x198], ecx
mov qword [rsp + rbp*8 - 0x668], 0xffffffffbc3107b4
call fcn.142591a1d
Function at 0x142567e60
Capabilities:
Parse pe header

Disassembly:
lea rdx, [rsp + rdx + 0x10]
mov qword [rsi + rdx - 0x57206], rbx
movzx esi, byte [rsi + r11 - 0x57209]
ror word [rsp + rbp - 0x3233], 0xcf
lea rdx, [rdi*2 - 0x1370f2f7]
lea rcx, [rcx + rdi*2 - 0x1f414045]
xor sil, r8b
xor byte [rsp + rbp*2 - 0x6463], 0x1e
xadd rax, rdi
xor sil, 0xaf
sal di, 0x21
ror sil, 1
rol dword [rsp + rbp*2 - 0x6461], cl
call fcn.14253dbca
mov eax, 0xb6bf4a24
mov si, word [r10]
movsx ebp, al
lea r10, [r10 + rbp*8 - 0x11e]
movzx edx, ax
lea r11, [r11 + rbp*2 - 0x49]
movzx ecx, byte [r11 + rbp*2 - 0x48]
xor cl, r8b
neg rbp
adc dl, al
rol cl, 1
not cl
movzx edi, dx
xor cl, 0xad
sar bpl, 0xe3
neg cl
xor al, 0x2e
dec bpl
jae 0x142534670
sbb cl, 0xaa
push rdi
xor r8b, cl
neg byte [rsp + rbp + 8]
lea rcx, [rsp + rcx + 8]
mov byte [rcx + rbp*2 + 0xc], sil
call fcn.142531256
sar rsi, 0x18
adc ax, cx
not dl
inc rdi
sbb word [rsp + rsi*8 - 0x2b9027], 0xd195
xadd edi, eax
adc dl, al
mov qword [rsp + rsi*8 - 0x2b9030], 0x728ab5be
xor rbp, rax
ror dl, 1
neg byte [rsp + rsi - 0x57202]
sbb qword [rsp + rbp*8 - 0x19193], 0x58351da6
dec qword [rsp + rsi*2 - 0xae404]
xor r8b, dl
not qword [rsp + rsi - 0x571fe]
mov byte [rsp + rsi - 0x571f7], 0xbc
jmp 0x14252c533
Function at 0x142568a8f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rdi + rbp], rsi
not rbp
not bx
mov qword [rsp + rbp + 1], r9
ret 0x18
mov word [r10 + rcx*2], dx
adc dword [rsp + rcx + 0xe], edi
sal rdi, 0x73
pop rbx
pop rbp
pop rdi
pop rax
pop rdx
jbe fcn.142588eba
dec al
add edx, 0x4c02682a
sub word [rsp + rbp*2 - 0x1fdf4], dx
xor al, 0x13
xor r8b, al
xadd rbx, rbp
jae 0x142560e54
xor dword [rsp + rdi*2 - 0x128], edx
shl rdi, 0x7c
pop rdi
mov r8, qword [rsp + rdi*4 + 8]
rol word [rsp + rax - 0x64bbffff], 0x43
neg rbp
movsxd rdx, edx
add r9, rdx
pop rdi
pop rbx
jmp fcn.142588eba
call fcn.14253f275
mov r8, qword [rsp + rdi - 0x2d2ce8]
mov qword [rsp + rdi - 0x2d2d00], rcx
movsxd rsi, esi
add r9, rsi
mov rsi, qword [rdi + r10 - 0x2d2d00]
lea r10, [rdi + r10 - 0x2d2cf8]
mov qword [rsp + rdi - 0x2d2ce8], 0x4681938b
lea r11, [rdi + r11 - 0x2d2d01]
lea rdx, [rcx*2 - 0x67ee8b43]
movzx edi, byte [r11 + rdi*2 - 0x5a5a00]
movsx ebp, byte [rsp + rax + 0x15]
mov qword [rsp + rax*4 + 8], 0xffffffffc50e758c
xor dil, r8b
ror bx, 0xa4
sub word [rsp + rax*2 + 4], bx
ror rdx, 0x89
sub dil, 0x19
add eax, 0xf015b19a
adc cx, word [rsp + rbx + 0x13]
not dil
xor bx, ax
inc dil
ror dl, 0x26
jb 0x14257af1f
sub r11, 4
mov esi, 0x36a6cf24
lea rcx, [rsi + rsi*2 - 0x297605e4]
mov ebx, dword [r11 + rcx - 0x7a7e6788]
xor ebx, r8d
lea rdx, [rcx*4 + 0x10948993]
lea ebx, [rsi + rbx + 0x4f6c0d06]
and rcx, rdx
lea rbp, [rdx*4 + 0x7128f438]
movsx eax, bpl
rol ebx, 3
jmp 0x1425821d3
shl sil, 0xe1
lea ebx, [rbx + rsi*2 + 0x12c62276]
sar rbp, 0x65
or ebp, edx
ror ebx, 3
not ebx
movsx edi, ax
shr ebp, 0x1e
push r8
xadd dil, al
shl bpl, 0xa4
xor dword [rsp + rsi*2 - 0x6d4d9e94], ebx
xchg rbp, rax
call fcn.14254df31
mov edi, 0x932dcd10
mov eax, 0x243a4ea0
mov rdx, qword [rbp + rax*2 - 0x48749d40]
movzx esi, dil
movsx ecx, di
lea rbp, [rax + rcx*8 - 0x484ecb5b]
mov qword [r10 + rsi*2 - 0x20], rdx
sal rbp, 0x29
xchg rcx, rsi
mov edi, dword [r11 + rcx*8 - 0x84]
xchg rsi, rbp
xor edi, r8d
lea rbx, [rsi + rcx*8 + 0x5cb44925]
jmp 0x142585657
ror dil, 1
lea rax, [rax + rdx*8 - 0x484ccce5]
sar ebp, cl
lea rbx, [rcx + rax - 0x2247027c]
xor r8b, dil
rol word [rsp + rbp + 2], 0xc6
sar dl, 0x45
lea rdi, [rsp + rdi + 0x20]
jbe 0x14252ecea
jp 0x14252e71f
inc sil
inc dx
not ebx
jg 0x142576e0b
mov edx, 0x96af7db3
movsx edi, dx
lea r11, [rdi + r11 - 0x7db7]
mov esi, edx
lea rcx, [rdi*2 + 0x52917a83]
mov edx, dword [r11 + rdi*2 - 0xfb66]
xor edx, r8d
mov eax, edi
not edx
lea rbx, [rdi*8 + 0x7b255a27]
call fcn.14257e284
sbb esi, 0xb484c33b
call fcn.1425a22d2
call fcn.14253f7a9
bswap edi
movsx edx, cx
neg edi
not edi
lea edi, [rdi + rax - 0x2a5b09b2]
sal sil, 0x82
dec al
push r8
shr bl, 0x64
sub dl, al
inc sil
xor dword [rsp + rax*2 - 0x48749d3e], edi
call fcn.142542670
Function at 0x1425738c0
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
not esi
dec esi
jmp 0x1425638b1
jmp 0x14252c1fa
shl cl, 0xe5
sub byte [rsp + rbp*2 - 0x72053ffe], dh
xor al, 0x13
xor r8b, al
inc word [rsp + rcx*2 - 0x162]
mov qword [rsp + rbp*2 - 0x7205400a], rbp
xchg bpl, bl
lea rax, [rsp + rax + 0x20]
call fcn.142554833
mov esi, dword [r11 - 4]
xor esi, r8d
mov edi, 0xca0c6db8
bswap esi
movsx eax, di
lea esi, [rsi + rdi - 0x6e75c87f]
mov ebx, eax
jmp 0x14255103a

Function at 0x1425751da
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rsi - 0x3232], rsi
xor r8b, dl
ror rdi, cl
jae 0x142546491
mov ebp, 0xaf0372aa
mov rdx, qword [r10]
mov ecx, ebp
movzx esi, bpl
mov rbx, qword ss:[rdx + rsi*2 - 0x154]
movzx edx, sil
call fcn.142539312

Function at 0x1425768f4
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xbd1ba70c
jmp 0x14258a6d1
call fcn.142590ce1
lea rsp, [rsp + 8]
jne 0x1425733ac
push 0xffffffff92a5493f
push 0x78a0b0aa
mov r9, rax
lea rsp, [rsp + 0x10]
jmp 0x14258a6d9
xor al, ah
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
Function at 0x14257af51
Capabilities:
Authenticate hmac

Disassembly:
rol bpl, 1
mov ecx, dword [r10 + rsi - 0xaefd]
adc ebx, ecx
push rdi
rol bpl, 1
jae 0x14258709e
xor edx, r8d
bswap edx
not edx
neg edx
jmp 0x142562333
inc ebx
adc ebx, eax
movsxd rdx, edx
sar cx, cl
rol rbx, 0x78
adc r9, rdx
or rcx, rbx
jnp 0x142590afc
mov ebp, 0x1a93af01
movzx esi, bp
movzx edi, si
mov ebx, dword [rbp + r10 - 0x1a93af01]
jmp 0x142529f6b
bswap rbp
lea edx, [rax + rdx - 0xd0284c9]
pop rax
push r8
xor dword [rsp + rdi*2], edx
shr edi, 0xef
pop r8
jae 0x142552f57
mov qword [rsp + rbp*4 - 0xb4], 0x2b02d93a
jmp 0x14259b1ec
xor bpl, r8b
rol bpl, cl
not bpl
xor bpl, 0xad
neg word [rsp + rdi*4 - 0x2578]
neg bpl
sub bpl, 0xaa
add cx, bx
xor r8b, bpl
call fcn.142531215
mov dword [r10 + rbp*2 - 0x35275e04], ebx
add byte [rsp + rbp - 0x1a93af01], dil
jno 0x14258805e
mov esi, 0x7aa9d6b4
jno fcn.142588eba
call fcn.14256fafa
ror ebx, 2
ror byte [rsp + rax*2 - 0x2d4c2c56], 0xa7
xor ebx, 0x4621822d
mov qword [rsp + rax - 0x16a6162c], rdx
rol ebx, 2
mov dword [rsp + rax - 0x16a61628], eax
dec ebx
sal bpl, 0x63
adc ebp, edx
mov qword [rsp + rax - 0x16a6162c], r8
xor dword [rsp + rax*2 - 0x2d4c2c58], ebx
call fcn.14254040b
xor r8b, bpl
add rbp, rsp
xchg bx, cx
call fcn.14256ce92
ror dl, 1
movzx ecx, bx
mov eax, 0xc2316d89
dec dl
xor dl, 0xb8
inc rbx
inc byte [rsp + rbx*2 + 4]
neg dl
movzx esi, ax
xor byte [rsp + rbx + 2], bh
adc dl, bl
xor r8b, dl
or eax, ecx
lea rdx, [rsp + rdx + 8]
not ebx
ror qword [rsp + rbp], 0x16
bswap rcx
mov rsi, qword [rdx + rbp*2]
mov qword [r10 + rbp - 0xa], rsi
lea rdx, [rax*2 + 0x3791f810]
shl bx, 0x8d
lea r10, [rbp + r10 - 0xa]
mov edx, dword [r11 + rbp*2 - 6]
not rbp
xchg al, cl
lea r11, [rbp + r11 - 5]
dec rbp
jno 0x14254cc2e
xor r8b, bl
inc byte [rsp + 4]
lea rbx, [rsp + rbx + 8]
sal dx, 0xcf
sar word [rsp + 6], 0xaf
shr rdi, 0x17
mov qword [rbx + rdi*2 - 0x13ea], rax
mov edx, dword [r11 + rdi*2 - 0x13ef]
lea rax, [rsi*2 + 0x77ae68b8]
not qword [rsp + rdi - 0x9f5]
xor edx, r8d
ror dil, 0x44
lea rcx, [rdi*8 + 0x35bf9329]
bswap edx
movzx ebx, cl
push rax
push rax
lea edx, [rdx + rdi*2 + 0x5b96927b]
not edx
xor eax, 0x241bbe85
dec edx
mov qword [rsp + rdi*8 - 0x4ae8], r8
ror dword [rsp + rdi*2 - 0x12b5], 0x58
mov ebp, edi
xor dword [rsp + rdi - 0x94f], edx
mov r8, qword [rsp + rdi*2 - 0x12ae]
movsxd rdx, edx
add r9, rdx
inc bl
rol rbx, 0x14
mov si, word [rdi + r10 - 0x957]
movzx ebp, byte [r11 + rdi*2 - 0x12c4]
jns 0x142585a90
rol eax, cl
xor r8, rsi
mov qword [r10 + rcx - 2], rsi
and edx, ebx
lea r10, [r10 + rcx*8 + 0xc]
jns fcn.142588eba

Function at 0x14257e5e3
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
dec ebx
jmp 0x1425467a3
jmp 0x1425470c8

Function at 0x14257e67c
Capabilities:
Authenticate hmac

Disassembly:
push qword [rsp + 0x10]
popfq
mov qword [rsp + rbp - 0x1bafe9a3], 0xb903308
mov rdx, qword [rsp + r8*4 - 0x2b4]
push rbx
call fcn.14253ecb7
call fcn.14252d9dc
movzx di, byte [rsi + rcx - 7]
sal qword [rsp + rdx*2 - 0x3e26], cl
ja 0x14259f30b
Function at 0x14257ff04
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cmp ebx, 1
lea rsp, [rsp + 8]
jne 0x1425375d1
push 0xffffffffb7092fb3
mov ecx, 0x4b200ead
mov dword [rsp + rcx - 0x4b200eab], ecx
mov rcx, rax
lea rsp, [rsp + 8]
jmp 0x142583ee5

Function at 0x14258542a
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa

Disassembly:
add edx, eax
mov qword [rsp + rcx - 0xaa34], rcx
xchg di, cx
mov dword [r10 + rcx*4 - 0x2a8cc], edx
mov ebx, dword [r11 + rcx*2 - 0x1546c]
push rcx
mov edx, edi
xor ebx, r8d
mov eax, 0xd1ab043e
not rdi
mov esi, edx
rol ebx, 1
rol qword [rsp + rcx - 0xaa34], 0x26
bswap rdx
xchg qword [rsp + rcx*2 - 0x15460], rsi
lea ebx, [rbx + rdi + 0x4d9c488a]
and al, al
movzx ebp, cl
add di, di
ror ebx, 1
lea ebx, [rbx + rdi + 0x46bc735]
jmp 0x14254ad62
Function at 0x142588a24
Capabilities:
Authenticate hmac

Disassembly:
jnp 0x1425474e7
movzx cx, byte [rbp + r10 - 0x649c1a]
xor sil, byte [r10 + rbp*2 - 0xc93832]
mov qword [rsp + rbp*2 - 0xc93834], 0xffffffff82b0a4a4
and bpl, 0xb0
adc cl, sil
mov word [r10 + rbp - 0x649c0e], cx
mov qword [rsp + rbp - 0x649c08], 0xffffffffd5975b0e
lea rax, [rdi + rbp*2 + 0x388f1803]
mov rax, qword [r11 + rbp*4 - 0x192704c]
movzx esi, bl
shr bx, 0xcf
rol qword [rsp + rbp - 0x649c0f], 0x36
lea r11, [r11 + rbp*2 - 0xc9382c]
ror word [rsp + rbp - 0x649c03], 0x4f
xor rax, r8
add ebx, edx
sbb dword [rsp + rbp*2 - 0xc9381f], 0x8897a320
ror rax, 3
bswap ebp
ror rbp, 0xf7
not rax
lea rbp, [rdi + rdx*8 - 0x4dd33b7a]
inc rax
dec ebx
sar qword [rsp + rdx - 0x649c14], 0xb4
xor rax, 0x83929a3
ror di, 0xc5
sar bpl, 0x85
xor r8, rax
sub word [rsp + rdx - 0x649c16], 0x5a8c
mov qword [r10 + rdx*2 - 0xc9383a], rax
lea rax, [rdi + rdx*2 - 0x18481166]
neg si
neg bx
lea r10, [r10 + rdx - 0x649c20]
pop rax
pop rcx
jnp fcn.142588eba

Function at 0x142589e96
Capabilities:
Authenticate hmac

Disassembly:
sub al, bh
inc ebx
xor r8b, bpl
xchg si, dx
sar ecx, 0x88
mov qword [rsp + rbx - 0xc516], rdi
lea rbp, [rsp + rbp + 8]
mov si, word [rsi + rbp - 0x2a003145]
mov ebp, ecx
dec dil
pop rbp
mov word [r10 + rbx - 0xc518], si
xor ebp, 0x9abde398
and rdi, rcx
movzx ecx, byte [r11 + rbx - 0xc51c]
jne 0x14258e0e7
mov esi, 0xedb47c3a
call fcn.142577f66
call fcn.14259db81
mov edx, 0xe1208327
call fcn.14253a0b0
lea r11, [r11 + rbx*8 - 0x628b6]
xor cl, r8b
rol rbp, 0x81
jb 0x1425515dd
xor cl, 0xaf
ror cl, 1
call fcn.14253dc9e

Function at 0x14258d9d3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xadd dx, di
mov qword [rsp + rax + 6], r8
call fcn.142557523
lea r11, [r11 + rax*2 - 0x379f46c3]
inc bx
xor esi, r8d
xadd rax, rbx
call fcn.142578fee
Function at 0x14259bebe
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa
Parse pe header

Disassembly:
mov word ss:[rdi + rbp - 1], ax
or rbp, rcx
jmp r9
sub ecx, ebx
adc r9, rdi
mov rsi, qword [rax + r11 - 0xe]
call fcn.142564796
shl edx, 0xbb
dec sil
movsx eax, dx
inc ebp
push rax
xor sil, bpl
not bp
push rbp
xor r8b, sil
lea r10, [r10 + rdx - 0x20000002]
and qword [rsp + rdi - 0x7b2a8e70], rdx
shl eax, cl
mov word [r10 + rdx - 0x20000000], si
jns 0x142580c9b
lea r10, [r10 + rbp*2 + 0x10]
jae 0x14252ae3c
push rbp
dec esi
bswap esi
jmp 0x142572b5e
call fcn.142599e33
sal qword [rsp + rdi - 0x7b2a8e6c], cl
lea r11, [r11 + rdi - 0x7b2a8e78]
movsx ebx, dil
dec bl
mov edx, dword [r11 + rdi - 0x7b2a8e74]
ja 0x142587393
mov edi, 0xb918ac34
mov eax, dword [r11 - 4]
lea rbp, [rdi - 0x5768edf2]
movsx esi, dil
lea r11, [r11 + rsi*8 - 0x1a4]
lea rcx, [rbp + rsi*4 + 0x3b14c207]
and sil, cl
push rbp
xor eax, r8d
sub byte [rsp + rbp - 0x61afbe3b], 0x85
neg eax
pop rcx
xor eax, 0x409075aa
not eax
rol bpl, 0xe3
sbb dil, dil
inc eax
rol eax, 1
lea rdx, [rcx*2 - 0x48cd466a]
xadd rsi, rbp
push r8
neg si
neg bpl
mov r8d, edi
xor dword [rsp + rbp*2 - 0x1e0], eax
pop r8
inc rcx
ror esi, cl
sbb dil, bpl
movsxd rax, eax
mov ebx, ebp
xadd dx, di
jno 0x14259d1b0
xor edx, r8d
lea rsi, [rbx*8 + 0x641d3aa4]
xor bp, ax
neg qword [rsp + rdi - 0x7b2a8e6e]
bswap edx
neg edx
jmp 0x142548696
movsxd rdi, edi
jns 0x142530d59
adc r9, rax
or cl, dl
and cl, 0x2d
lea rax, [rdi + 0x4ad6432]
mov rdi, qword [r10 + rbp*4 - 0x3c0]
and rcx, rsi
setnp bpl
mov rax, qword [r10 + rbp*2 + 6]
adc rdi, rax
inc bl
shl rbx, cl
mov ax, word [r10 + rbp*2 + 0xe]
jae 0x14253c5c3

Function at 0x14259d65a
Capabilities:
Authenticate hmac
Encrypt data using rc4 ksa
Hash data using murmur3

Disassembly:
xor dil, 0x36
dec dil
jmp 0x14254ee5c
call fcn.14257e6b4
xor rbx, 0x83929a3
shl dx, 0x2b
inc di
xor r8, rbx
inc rbp
jle 0x142576594
lea r10, [r10 + rdx*4 - 0x16008]
xchg dil, al
lea rax, [rdi + rdi + 0x502d9895]
call fcn.1425361a1
jmp 0x142598d48

Function at 0x14259e1cc
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
adc r9, rdi
shl ax, 0xb
xadd dword [rsp + rsi - 0x2209f0], ecx
xadd qword [rsp + rsi*8 - 0x1104ff2], rbp
pop rbx
pop rbx
pop rbp
pop rcx
jno fcn.142588eba
mov qword [rsp + rbp*2], rsi
mov qword [rsp + rcx - 0x7a3738a9], r8
xor dword [rsp + rbp*2 + 0x10], edi
push rax
neg rdx
mov r8, qword [rsp + rcx - 0x7a3738a1]
ror esi, 0x28
shr rbp, cl
movsxd rdi, edi
rol sil, 7
jbe 0x142553f96

Function at 0x1425a12c1
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
adc r9, rsi
mov qword [rsp + rdi*2 - 0xf00], r9
ret 0x10
sal ebx, 0x9c
jne 0x1425802a1
neg esi
inc ax
dec rcx
call fcn.142585f7c
mov esi, 0xb3a2292f
lea rbp, [rsi*4 - 0x29e16177]
mov ebx, 0xa19f4935
mov esi, dword [r10]
mov ecx, ebp
mov ecx, dword [r10 + 4]
add esi, ecx
mov dword [r10 + 4], esi
mov ecx, ebp
lea rbx, [rbp + rcx - 0x78d90677]
and bpl, cl
lea rdi, [r10 + 4]
mov word [r10 + 2], di
jnp 0x14257058d
not cl
xor r8b, cl
call fcn.142567fc4