joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5174e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x5176d3
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
cmp cl, 0x10
jae 0x5176bf
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x517685
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.005173e0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x5176a2
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x517638
nop
jmp 0x5176b2
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465060
lea rax, [0x00663a00]
lea rbx, [0x00728370]
call fcn.00436220
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.005174e0
Function at 0x51b120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x51b36d
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
cmp cl, 0x10
jae 0x51b359
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x51b320
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0051b020
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x51b33c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x51b2d3
jmp 0x51b34c
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465060
lea rax, [0x00663a00]
lea rbx, [0x00728380]
call fcn.00436220
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0051b120
Function at 0x51e5c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x51e60d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x51e6a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x51e6e5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x521420
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x521566
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.00520860
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x5214c0
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x521503
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x52152c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x5214b5
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x5214b5
test byte [rbx], al
cmp rdi, 0x20
jb 0x52151a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00465060
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00521420
Function at 0x529c40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529e1c
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x529d77
test r9, r9
je 0x529d77
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x529c9c
jae 0x529cfb
jmp 0x529e10
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x00663480]
call fcn.0044a640
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x529e05
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.00535ac0
xorps xmm15, xmm15
mov r14, qword [0x00907580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x529df9
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
jmp 0x529dc2
test r10, r10
jne 0x529d82
xor edx, edx
nop
jmp 0x529db2
nop
cmp rcx, 1
jge 0x529daa
lea rax, [0x00663480]
mov ebx, 1
mov rcx, rbx
call fcn.0044a640
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
dec rdx
test rdx, rdx
jle 0x529dd1
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x529dbf
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x529deb
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.004650e0
mov rax, rcx
mov rcx, rdx
nop
call fcn.00465060
mov rdx, rcx
mov rcx, rsi
call fcn.004650e0
mov rdx, rcx
mov rcx, rbx
call fcn.004650e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00529c40
Function at 0x52a6a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a7f1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x52a7e5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00535760
xorps xmm15, xmm15
mov r14, qword [0x00907580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x52a7c1
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x52a7e0
cmp rsi, rcx
ja 0x52a7d3
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x52a7cb
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.005358a0
xorps xmm15, xmm15
mov r14, qword [0x00907580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465120
mov rax, rsi
call fcn.00465120
nop dword [rax + rax]
call fcn.004650e0
mov rdx, rcx
mov rcx, r9
call fcn.004650e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.0052a6a0
Function at 0x52a860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a9b1
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x52a9a5
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00535800
xorps xmm15, xmm15
mov r14, qword [0x00907580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x52a981
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x52a9a0
cmp rsi, rcx
ja 0x52a993
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x52a98b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00535940
xorps xmm15, xmm15
mov r14, qword [0x00907580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00465120
mov rax, rsi
call fcn.00465120
nop dword [rax + rax]
call fcn.004650e0
mov rdx, rcx
mov rcx, r9
call fcn.004650e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.0052a860
Function at 0x5303c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53057c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x530407
nop
jae 0x53047e
jmp 0x530570
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x53044b
lea rax, [0x00663480]
mov ebx, 1
mov rcx, rbx
call fcn.0044a640
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x53047e
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x00663480]
call fcn.0044a640
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x530493
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x5304c5
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x530486
nop dword [rax + rax]
jmp 0x530565
test rsi, rsi
jle 0x5304d2
xor r8d, r8d
xor r9d, r9d
jmp 0x53052e
jmp 0x5304d7
dec rbx
test rbx, rbx
jle 0x5304e6
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x5304d4
cmp rbx, rcx
ja 0x5304f5
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.004650e0
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x53053e
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x530505
jmp 0x530559
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x53054e
mov qword [rax + rbx*8 - 8], r9
jmp 0x5304d2
mov rax, rsi
mov rcx, rbx
call fcn.00465060
mov rax, r10
mov rcx, rdx
nop
call fcn.00465060
mov rax, r9
mov rcx, rbx
call fcn.00465060
mov rdx, rcx
mov rcx, rbx
call fcn.004650e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.005303c0
Function at 0x53b600
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53b746
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, qword [rbx]
mov rdx, qword [rdx + 8]
mov rsi, rdx
shl rdx, 6
sub rdx, rsi
sub rdx, qword [rbx + 8]
lea rsi, [rdx + 7]
sar rsi, 0x3f
shr rsi, 0x3d
lea rcx, [rsi + rdx]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x18], rcx
mov rbx, rcx
lea rax, [0x00663bc0]
call fcn.0044a640
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx - 1]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsi]
mov rsi, qword [rsi + 8]
xor ebx, ebx
xor r8d, r8d
jmp 0x53b684
mov byte [rax + rdx], r9b
inc rbx
mov r8, r10
cmp rbx, rsi
jge 0x53b69f
mov r9, qword [rdi + rbx*8]
mov r10d, 0x3f
jmp 0x53b6b8
cmp rdx, rcx
jb 0x53b67a
jmp 0x53b728
mov rbx, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, r13
mov r10, r8
mov r9, r15
xor r8d, r8d
cmp r10, 8
jl 0x53b695
nop
cmp rdx, rcx
jae 0x53b73a
movzx r11d, byte [rax + rdx]
test r8, r8
jl 0x53b735
cmp r8, 0x20
sbb r12d, r12d
mov r13, rcx
mov rcx, r8
mov r15, r9
shl r9d, cl
and r9d, r12d
or r11d, r9d
mov byte [rax + rdx], r11b
lea r9, [rcx - 8]
neg r9
test r9, r9
jl 0x53b730
cmp r9, 0x40
sbb r11, r11
mov rcx, r9
shr r15, cl
and r15, r11
lea r8, [r10 + r8]
lea r8, [r8 - 8]
dec rdx
test rdx, rdx
jge 0x53b6ac
mov rbx, r13
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rdx
call fcn.00465060
call fcn.00434e80
call fcn.00434e80
mov rax, rdx
nop dword [rax]
call fcn.00465060
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0053b600
Function at 0x53c8c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53cb06
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x88], rax
mov rsi, qword [rdi]
nop
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x70], rsi
mov r8, qword [rax + 8]
mov r9, qword [rax]
cmp qword [rax + 0x10], rsi
jl 0x53c95e
test r8, r8
je 0x53c94b
shl r8, 3
mov rax, r9
mov rbx, r8
call fcn.00465720
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rax + 0x10]
cmp rdx, rsi
jb 0x53cafa
mov qword [rax + 8], rsi
jmp 0x53c9b3
lea rax, [0x00663ac0]
mov rbx, rsi
mov rcx, rbx
call fcn.0044a640
mov rdx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
cmp dword [0x009077f0], 0
jne 0x53c993
mov qword [rdi], rax
jmp 0x53c998
call fcn.00464bc0
mov rax, rdi
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rdi]
mov rsi, qword [rbx + 8]
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
mov r10, qword [rdx + 8]
mov r11, qword [rdx]
mov rdx, qword [rdx + 0x10]
cmp r10, rsi
jne 0x53cae7
mov r12, qword [rcx + 8]
mov r13, qword [rcx]
mov rcx, qword [rcx + 0x10]
cmp r10, r12
jne 0x53cae7
mov rbx, qword [rax]
mov r15, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov rdi, qword [rdi + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], r15
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdi
call fcn.0053dc00
xorps xmm15, xmm15
mov r14, qword [0x00907580]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx]
mov rdi, qword [rcx + 0x10]
mov r8, qword [rcx]
cmp rdi, rbx
jb 0x53cadc
xor edi, edi
xor r9d, r9d
nop
jmp 0x53caa0
lea r10, [rdi + 1]
mov r11, qword [rsi + rdi*8]
sub r11, qword [r8 + rdi*8]
sub r11, r9
shr r11, 0x3f
mov rdi, r10
mov r9, r11
nop dword [rax + rax]
cmp rdi, rbx
jl 0x53ca82
mov rsi, rax
sub rax, r9
sbb rbx, rbx
sub r9, rsi
sbb rsi, rsi
nop
neg rbx
neg rsi
or rbx, rsi
xor rbx, 1
mov rax, rdx
call fcn.0053bd00
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, rbx
mov rdx, rdi
call fcn.004650e0
lea rax, [0x00663a00]
lea rbx, [0x00728300]
call fcn.00436220
mov rcx, rsi
nop dword [rax]
call fcn.004650e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462a00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0053c8c0