joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52bdc0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52bef4
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call sym.crypto_internal_edwards25519_field._Element_.reduce
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x52be54
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x52be97
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x52bec1
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x52be4e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x52be4e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x52beaa
mov rax, rsi
mov ecx, 0x20
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.crypto_internal_edwards25519_field._Element_.bytes
Function at 0x52d2a0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x52d325
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x52d486
cmp rcx, 0xe
jne 0x52d3a0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x52d486
cmp rcx, 0xf
jne 0x52d417
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x52d486
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x5346a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5348ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5347c4
cmp rdx, 0x40
ja 0x53489d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x534734
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x5347a0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0083b2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x534895
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x5347c7
mov r8, rcx
cmp r8, 0x40
jl 0x534845
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0083b2b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x534888
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x534884
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x54ff00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov r10, qword [0x007e6a20]
test byte [r10], al
movzx r9d, r9w
shl r9, 0xa
xor ecx, ecx
jmp 0x54ff31
add rcx, 0x40
cmp rbx, rcx
jle 0x54ff8f
lea r11, [rcx + 0x20]
nop word [rax + rax]
cmp r8, r11
jb 0x550025
cmp rcx, r11
ja 0x55001a
mov rdx, r8
sub rdx, rcx
mov r12, rdx
neg r12
sar r12, 0x3f
and r12, rcx
add r12, rdi
cmp rsi, r11
jb 0x55000f
add rdx, 0xffffffffffffffe0
mov r13, rdx
neg r13
sar r13, 0x3f
and r11, r13
add r11, rdi
cmp rdx, 0x20
jb 0x550005
xor edx, edx
jmp 0x54ffa6
add rsp, 0x10
pop rbp
ret
shr si, 8
mov byte [r15 + rax + 0x20], sil
inc rdx
mov rsi, qword [rsp + 0x40]
cmp rdx, 0x20
jge 0x54ff2d
movzx r13d, byte [rdx + r12]
movzx r15d, byte [rdx + r11]
lea rsi, [r10 + r9]
movzx esi, word [rsi + r13*2]
lea r13, [r10 + r9]
lea r13, [r13 + 0x200]
movzx r13d, word [r13 + r15*2]
lea r15, [rdx + rcx]
xor esi, r13d
cmp rbx, r15
jbe 0x54fff8
mov byte [rax + r15], sil
lea r13, [rdx + rcx]
lea r13, [r13 + 0x20]
cmp rbx, r13
ja 0x54ff95
mov rax, r13
mov rcx, rbx
call sym.runtime.panicIndex
mov rax, r15
mov rcx, rbx
nop
call sym.runtime.panicIndex
mov ecx, 0x20
call sym.runtime.panicSliceAcap
mov rax, r11
mov rcx, rsi
call sym.runtime.panicSliceB
mov rax, rcx
mov rcx, r11
call sym.runtime.panicSliceB
mov rcx, r11
mov rdx, r8
call sym.runtime.panicSliceAcap
nop
int3
Function at 0x5d3d40
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x40]
movups xmm2, xmmword [rax + 0x10]
movups xmm3, xmmword [rax + 0x50]
movups xmm4, xmmword [rax + 0x20]
movups xmm5, xmmword [rax + 0x60]
xorps xmm6, xmm6
mov rcx, 0xf
movq xmm7, rcx
pshufb xmm7, xmm6
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov rbx, qword [rsp + 0x20]
movups xmm6, xmmword [rdx]
movups xmm8, xmmword [rdx + 0x20]
movups xmm9, xmmword [rbx]
movups xmm10, xmmword [rbx + 0x20]
pxor xmm9, xmm6
pxor xmm10, xmm8
movups xmmword [rbx], xmm9
movups xmmword [rbx + 0x20], xmm10
movaps xmm11, xmm9
psrlq xmm11, 4
movaps xmm9, xmm9
pand xmm9, xmm7
pand xmm11, xmm7
movups xmm12, xmm0
movups xmm13, xmm1
pshufb xmm12, xmm9
pshufb xmm13, xmm9
movups xmm9, xmm2
movups xmm14, xmm3
pshufb xmm9, xmm11
pshufb xmm14, xmm11
pxor xmm12, xmm9
pxor xmm13, xmm14
movaps xmm9, xmm10
movaps xmm10, xmm10
pand xmm9, xmm7
psrlq xmm10, 4
pand xmm10, xmm7
movups xmm11, xmm4
movups xmm14, xmm5
pshufb xmm11, xmm9
pshufb xmm14, xmm9
pxor xmm12, xmm11
pxor xmm13, xmm14
movups xmm11, xmmword [rax + 0x30]
movups xmm14, xmmword [rax + 0x70]
pshufb xmm11, xmm10
pshufb xmm14, xmm10
pxor xmm12, xmm11
pxor xmm13, xmm14
pxor xmm6, xmm12
pxor xmm8, xmm13
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x20], xmm8
movups xmm6, xmmword [rdx + 0x10]
movups xmm8, xmmword [rdx + 0x30]
movups xmm9, xmmword [rbx + 0x10]
movups xmm10, xmmword [rbx + 0x30]
pxor xmm9, xmm6
pxor xmm10, xmm8
movups xmmword [rbx + 0x10], xmm9
movups xmmword [rbx + 0x30], xmm10
movaps xmm11, xmm9
psrlq xmm11, 4
movaps xmm9, xmm9
pand xmm9, xmm7
pand xmm11, xmm7
movups xmm12, xmm0
movups xmm13, xmm1
pshufb xmm12, xmm9
pshufb xmm13, xmm9
movups xmm9, xmm2
movups xmm14, xmm3
pshufb xmm9, xmm11
pshufb xmm14, xmm11
pxor xmm12, xmm9
pxor xmm13, xmm14
movaps xmm9, xmm10
movaps xmm10, xmm10
pand xmm9, xmm7
psrlq xmm10, 4
pand xmm10, xmm7
movups xmm11, xmm4
movups xmm14, xmm5
pshufb xmm11, xmm9
pshufb xmm14, xmm9
pxor xmm12, xmm11
pxor xmm13, xmm14
movups xmm11, xmmword [rax + 0x30]
movups xmm14, xmmword [rax + 0x70]
pshufb xmm11, xmm10
pshufb xmm14, xmm10
pxor xmm12, xmm11
pxor xmm13, xmm14
pxor xmm6, xmm12
pxor xmm8, xmm13
movups xmmword [rdx + 0x10], xmm6
movups xmmword [rdx + 0x30], xmm8
add rdx, 0x40
add rbx, 0x40
sub rcx, 0x40
jne 0x5d3d7f
ret
Function at 0x5d3f60
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x40]
movups xmm2, xmmword [rax + 0x10]
movups xmm3, xmmword [rax + 0x50]
movups xmm4, xmmword [rax + 0x20]
movups xmm5, xmmword [rax + 0x60]
xorps xmm6, xmm6
mov rcx, 0xf
movq xmm7, rcx
pshufb xmm7, xmm6
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov rbx, qword [rsp + 0x20]
movups xmm9, xmmword [rbx]
movups xmm10, xmmword [rbx + 0x20]
movaps xmm8, xmm9
psrlq xmm8, 4
movaps xmm6, xmm9
pand xmm6, xmm7
pand xmm8, xmm7
movups xmm11, xmm0
movups xmm12, xmm1
pshufb xmm11, xmm6
pshufb xmm12, xmm6
movups xmm6, xmm2
movups xmm13, xmm3
pshufb xmm6, xmm8
pshufb xmm13, xmm8
pxor xmm11, xmm6
pxor xmm12, xmm13
movaps xmm6, xmm10
movaps xmm8, xmm10
pand xmm6, xmm7
psrlq xmm8, 4
pand xmm8, xmm7
movups xmm13, xmm4
movups xmm14, xmm5
pshufb xmm13, xmm6
pshufb xmm14, xmm6
pxor xmm11, xmm13
pxor xmm12, xmm14
movups xmm13, xmmword [rax + 0x30]
movups xmm14, xmmword [rax + 0x70]
pshufb xmm13, xmm8
pshufb xmm14, xmm8
pxor xmm11, xmm13
pxor xmm12, xmm14
movups xmm6, xmmword [rdx]
movups xmm8, xmmword [rdx + 0x20]
pxor xmm6, xmm11
pxor xmm8, xmm12
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x20], xmm8
pxor xmm9, xmm6
pxor xmm10, xmm8
movups xmmword [rbx], xmm9
movups xmmword [rbx + 0x20], xmm10
movups xmm9, xmmword [rbx + 0x10]
movups xmm10, xmmword [rbx + 0x30]
movaps xmm8, xmm9
psrlq xmm8, 4
movaps xmm6, xmm9
pand xmm6, xmm7
pand xmm8, xmm7
movups xmm11, xmm0
movups xmm12, xmm1
pshufb xmm11, xmm6
pshufb xmm12, xmm6
movups xmm6, xmm2
movups xmm13, xmm3
pshufb xmm6, xmm8
pshufb xmm13, xmm8
pxor xmm11, xmm6
pxor xmm12, xmm13
movaps xmm6, xmm10
movaps xmm8, xmm10
pand xmm6, xmm7
psrlq xmm8, 4
pand xmm8, xmm7
movups xmm13, xmm4
movups xmm14, xmm5
pshufb xmm13, xmm6
pshufb xmm14, xmm6
pxor xmm11, xmm13
pxor xmm12, xmm14
movups xmm13, xmmword [rax + 0x30]
movups xmm14, xmmword [rax + 0x70]
pshufb xmm13, xmm8
pshufb xmm14, xmm8
pxor xmm11, xmm13
pxor xmm12, xmm14
movups xmm6, xmmword [rdx + 0x10]
movups xmm8, xmmword [rdx + 0x30]
pxor xmm6, xmm11
pxor xmm8, xmm12
movups xmmword [rdx + 0x10], xmm6
movups xmmword [rdx + 0x30], xmm8
pxor xmm9, xmm6
pxor xmm10, xmm8
movups xmmword [rbx + 0x10], xmm9
movups xmmword [rbx + 0x30], xmm10
add rdx, 0x40
add rbx, 0x40
sub rcx, 0x40
jne 0x5d3f9f
ret
Function at 0x5d4160
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x40]
movups xmm2, xmmword [rax + 0x10]
movups xmm3, xmmword [rax + 0x50]
movups xmm4, xmmword [rax + 0x20]
movups xmm5, xmmword [rax + 0x60]
movups xmm6, xmmword [rax + 0x30]
movups xmm7, xmmword [rax + 0x70]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
xorps xmm8, xmm8
mov rbx, 0xf
movq xmm9, rbx
pshufb xmm9, xmm8
movups xmm8, xmmword [rdx]
movups xmm10, xmmword [rdx + 0x20]
movaps xmm11, xmm8
psrlq xmm11, 4
movaps xmm8, xmm8
pand xmm8, xmm9
pand xmm11, xmm9
movups xmm12, xmm0
movups xmm13, xmm1
pshufb xmm12, xmm8
pshufb xmm13, xmm8
movups xmm8, xmm2
movups xmm14, xmm3
pshufb xmm8, xmm11
pshufb xmm14, xmm11
pxor xmm12, xmm8
pxor xmm13, xmm14
movaps xmm8, xmm10
movaps xmm10, xmm10
pand xmm8, xmm9
psrlq xmm10, 4
pand xmm10, xmm9
movups xmm11, xmm4
movups xmm14, xmm5
pshufb xmm11, xmm8
pshufb xmm14, xmm8
pxor xmm12, xmm11
pxor xmm13, xmm14
movups xmm11, xmm6
movups xmm14, xmm7
pshufb xmm11, xmm10
pshufb xmm14, xmm10
pxor xmm12, xmm11
pxor xmm13, xmm14
movups xmmword [rcx], xmm12
movups xmmword [rcx + 0x20], xmm13
movups xmm8, xmmword [rdx + 0x10]
movups xmm10, xmmword [rdx + 0x30]
movaps xmm11, xmm8
psrlq xmm11, 4
movaps xmm8, xmm8
pand xmm8, xmm9
pand xmm11, xmm9
movups xmm12, xmm0
movups xmm13, xmm1
pshufb xmm12, xmm8
pshufb xmm13, xmm8
movups xmm8, xmm2
movups xmm14, xmm3
pshufb xmm8, xmm11
pshufb xmm14, xmm11
pxor xmm12, xmm8
pxor xmm13, xmm14
movaps xmm8, xmm10
movaps xmm10, xmm10
pand xmm8, xmm9
psrlq xmm10, 4
pand xmm10, xmm9
movups xmm11, xmm4
movups xmm14, xmm5
pshufb xmm11, xmm8
pshufb xmm14, xmm8
pxor xmm12, xmm11
pxor xmm13, xmm14
movups xmm11, xmm6
movups xmm14, xmm7
pshufb xmm11, xmm10
pshufb xmm14, xmm10
pxor xmm12, xmm11
pxor xmm13, xmm14
movups xmmword [rcx + 0x10], xmm12
movups xmmword [rcx + 0x30], xmm13
add rcx, 0x40
add rdx, 0x40
sub rax, 0x40
jne 0x5d41a9
ret

Function at 0x5d5cc0
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
movdqu xmm6, xmmword [rsi]
movdqu xmm7, xmmword [rdx]
mov rbx, 0xf
movq xmm8, rbx
pxor xmm5, xmm5
mov rsi, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
pshufb xmm8, xmm5
shr r9, 4
mov rax, rsi
mov rbx, rdx
and rax, 0xf
and rbx, 0xf
cmp r9, 0
je 0x5d5dac
or rbx, rax
cmp rbx, 0
jne 0x5d5d65
movdqa xmm0, xmmword [rsi]
movdqa xmm4, xmmword [rdx]
movdqa xmm1, xmm0
movdqa xmm2, xmm6
movdqa xmm3, xmm7
psrlq xmm1, 4
pand xmm0, xmm8
pand xmm1, xmm8
pshufb xmm2, xmm0
pshufb xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
movdqa xmmword [rdx], xmm3
add rsi, 0x10
add rdx, 0x10
sub r9, 1
jne 0x5d5d1c
jmp 0x5d5dac
movdqu xmm0, xmmword [rsi]
movdqu xmm4, xmmword [rdx]
movdqu xmm1, xmm0
movdqu xmm2, xmm6
movdqu xmm3, xmm7
psrlq xmm1, 4
pand xmm0, xmm8
pand xmm1, xmm8
pshufb xmm2, xmm0
pshufb xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
movdqu xmmword [rdx], xmm3
add rsi, 0x10
add rdx, 0x10
sub r9, 1
jne 0x5d5d65
ret
Function at 0x5d5dc0
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
movdqu xmm6, xmmword [rsi]
movdqu xmm7, xmmword [rdx]
mov rbx, 0xf
movq xmm8, rbx
pxor xmm5, xmm5
mov rsi, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
pshufb xmm8, xmm5
mov rax, rsi
mov rbx, rdx
shr r9, 4
and rax, 0xf
and rbx, 0xf
cmp r9, 0
je 0x5d5e9c
or rbx, rax
cmp rbx, 0
jne 0x5d5e5d
movdqa xmm0, xmmword [rsi]
movdqa xmm1, xmm0
movdqa xmm2, xmm6
movdqa xmm3, xmm7
psrlq xmm1, 4
pand xmm0, xmm8
pand xmm1, xmm8
pshufb xmm2, xmm0
pshufb xmm3, xmm1
pxor xmm3, xmm2
movdqa xmmword [rdx], xmm3
add rsi, 0x10
add rdx, 0x10
sub r9, 1
jne 0x5d5e1c
jmp 0x5d5e9c
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmm0
movdqa xmm2, xmm6
movdqa xmm3, xmm7
psrlq xmm1, 4
pand xmm0, xmm8
pand xmm1, xmm8
pshufb xmm2, xmm0
pshufb xmm3, xmm1
pxor xmm3, xmm2
movdqu xmmword [rdx], xmm3
add rsi, 0x10
add rdx, 0x10
sub r9, 1
jne 0x5d5e5d
ret

Function at 0x5d5fc0
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 8]
mov r9, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
shr r9, 4
cmp r9, 0
je 0x5d5ff7
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rdx]
pxor xmm1, xmm0
movdqu xmmword [rdx], xmm1
add rsi, 0x10
add rdx, 0x10
sub r9, 1
jne 0x5d5fd9
ret

Function at 0x5d6160
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 8]
mov r9, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
shr r9, 6
cmp r9, 0
je 0x5d61d0
movdqu xmm0, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm4, xmmword [rsi + 0x20]
movdqu xmm6, xmmword [rsi + 0x30]
movdqu xmm1, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm5, xmmword [rdx + 0x20]
movdqu xmm7, xmmword [rdx + 0x30]
pxor xmm1, xmm0
pxor xmm3, xmm2
pxor xmm5, xmm4
pxor xmm7, xmm6
movdqu xmmword [rdx], xmm1
movdqu xmmword [rdx + 0x10], xmm3
movdqu xmmword [rdx + 0x20], xmm5
movdqu xmmword [rdx + 0x30], xmm7
add rsi, 0x40
add rdx, 0x40
sub r9, 1
jne 0x5d6179
ret
Function at 0x5d7440
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5d7515
movdqa xmm0, xmmword [0x00692340]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5d7481
movdqa xmm0, xmmword [0x00692350]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5d7597
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5d756b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x006920f8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00692360]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x1400054a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x1400054d4
cmp word [rcx], 0x5a4d
jne 0x1400054d4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400054d4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400054d4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400053e0
test eax, eax
jne 0x1400054f0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140005450
test rax, rax
je 0x1400054e5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140005c96
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140005ba0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005b40
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005ff4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1409b7fd8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1409b7fd4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140006042
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000603a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140006129
inc ebx
add rax, 0x28
jmp 0x14000601a
mov rcx, r12
call fcn.140006821
mov rbp, rax
test rax, rax
jne 0x140006061
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140005f90
movsxd rbx, ebx
mov rax, qword [0x1409b7fd8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1400068cf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1409b7fd8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400060c3
mov rax, qword [0x1409b7fd8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140005f90
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140006123
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140006123
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1409b7fd8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140006123
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140005f90
inc dword [0x1409b7fd4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret