joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486e00
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48704b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x486eac
mov qword [rsp + 0x88], rax
lea rbx, [0x006fb640]
mov rcx, rax
lea rax, [0x00992f00]
call fcn.0046d2c0
test cl, cl
jne 0x486e91
mov rax, qword [rsp + 0x88]
call fcn.00485c60
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x007dcda0]
call fcn.0044e760
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.00488240
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x486ecd
lea rdx, [0x006fb380]
cmp rax, rdx
jne 0x486ebb
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.00460ca0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006b38c0]
call fcn.0040ab80
inc rdx
cmp rbx, rdx
jle 0x486f18
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x486eca
lea rax, [0x00992f00]
lea rbx, [0x006fb640]
lea rdi, [0x006fb380]
call fcn.0046d480
lea rdx, [0x006fb380]
nop dword [rax]
cmp rax, rdx
jne 0x48703b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x006a6500]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x006d05e0]
nop
call fcn.0040d960
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x009e7a70], 0
jne 0x486f7a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x486f89
mov rbx, rax
lea rax, [0x006d05e0]
call fcn.00413e40
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.00485720
call fcn.00460d60
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x486fd6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x486fc8
mov dword [rsi + 0x10], edx
cmp dword [0x009e7a70], 0
jne 0x486fee
mov qword [rsi + 0x30], rcx
jmp 0x486ff7
lea rdi, [rsi + 0x30]
call fcn.00465940
lea rax, [0x00992f00]
lea rbx, [0x006fb640]
lea rdi, [0x006fb380]
call fcn.0046d480
lea rdx, [0x006fb380]
cmp rax, rdx
jne 0x48702c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006b38c0]
call fcn.0040ab80
mov rbx, rdx
lea rcx, [0x006b38c0]
call fcn.0040ab80
nop
mov qword [rsp + 8], rax
call fcn.00463680
mov rax, qword [rsp + 8]
jmp fcn.00486e00
Function at 0x4ee520
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4ee58b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4ee544
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4ee561
cmp rdx, 0
je 0x4ee5ad
test rdx, 0xf
je 0x4ee53d
test rdx, 7
jne 0x4ee561
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4ee53d
ret
Function at 0x4f3120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4f315f
jb 0x4f3174
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4f31e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4f321f
jb 0x4f3234
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4f32a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4f3370
jb 0x4f33cf
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004f30c0
aeskeygenassist xmm1, xmm0, 1
call fcn.004f30e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004f30c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004f30e0
aeskeygenassist xmm1, xmm2, 4
call fcn.004f30c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004f30e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004f30c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004f30e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004f30c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004f30e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004f30c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004f30e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004f30c0
jmp 0x4f343d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004f3020
aeskeygenassist xmm1, xmm2, 2
call fcn.004f3080
aeskeygenassist xmm1, xmm2, 4
call fcn.004f3020
aeskeygenassist xmm1, xmm2, 8
call fcn.004f3080
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004f3020
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004f3080
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004f3020
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004f3080
jmp 0x4f343d
aeskeygenassist xmm1, xmm0, 1
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 2
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 4
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 8
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004f2fe0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004f2fe0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4f344a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4f87a0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4f89ac
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f87a0
Function at 0x50f900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x50faad
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
cmp cl, 0x10
jae 0x50fa99
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xc0], cl
mov qword [rsp + 0xb8], rbx
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x90], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x50fa60
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0050f800
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
nop dword [rax + rax]
cmp dl, 0x10
jae 0x50fa7c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x50fa0e
jmp 0x50fa8c
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465ce0
lea rax, [0x006aba60]
lea rbx, [0x007dea70]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00463680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0050f900
Function at 0x511d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511e4f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rcx, rax
lea rax, [rsp + 0x38]
mov rbx, rcx
call fcn.00511b60
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rcx, [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 1
call fcn.0051d880
xorps xmm15, xmm15
mov r14, qword [0x009e77f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x58]
xor eax, eax
xor edx, edx
jmp 0x511dc0
test byte [rcx], al
lea rsi, [rax + 1]
mov rdi, qword [rsp + rax*8 + 0x18]
xor rdi, qword [rcx + rax*8]
or rdx, rdi
mov rax, rsi
nop dword [rax]
cmp rax, 4
jl 0x511da8
nop
not rdx
mov rcx, rdx
shr rdx, 0x20
and rcx, rdx
mov rdx, rcx
shr rcx, 0x10
and rcx, rdx
mov rdx, rcx
shr rcx, 8
and rcx, rdx
mov rdx, rcx
shr rcx, 4
and rcx, rdx
mov rdx, rcx
shr rcx, 2
and rcx, rdx
mov rdx, rcx
shr rcx, 1
and rcx, rdx
and ecx, 1
cmp rcx, 1
je 0x511e41
lea rax, [0x006c5ca0]
call fcn.0040d960
mov qword [rax + 8], 0x17
lea rcx, [0x0070aa9c]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x007dfba0]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00511d20
Function at 0x516ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x516ed3
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
cmp cl, 0x10
jae 0x516ebf
mov qword [rsp + 0xe0], rax
mov byte [rsp + 0xf0], cl
mov qword [rsp + 0xe8], rbx
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc0], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0xc8], rdx
mov rdx, qword [rbx]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x516e85
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.00516be0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x516ea2
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x516e38
nop
jmp 0x516eb2
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465ce0
lea rax, [0x006aba60]
lea rbx, [0x007dea80]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00463680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00516ce0
Function at 0x51a920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x51ab6d
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
cmp cl, 0x10
jae 0x51ab59
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x138], cl
mov qword [rsp + 0x130], rbx
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0xb8]
mov qword [rdx], rsi
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x51ab20
mov byte [rsp + 0x27], r8b
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0051a820
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x51ab3c
test byte [rax], al
nop
lea esi, [rdx - 1]
movzx esi, sil
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x51aad3
jmp 0x51ab4c
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov rax, rsi
mov ecx, 0xf
call fcn.00465ce0
lea rax, [0x006aba60]
lea rbx, [0x007dea90]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
nop dword [rax + rax]
call fcn.00463680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0051a920
Function at 0x51ddc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x51de0d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x51dea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x51dee5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x520c20
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x520d66
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.00520060
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x520cc0
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x520d03
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x520d2c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x520cb5
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x520cb5
test byte [rbx], al
cmp rdi, 0x20
jb 0x520d1a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00465ce0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00520c20