joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe2e0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x0075cbd0]
movdqu xmm14, xmmword [0x0075cbe0]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4fe3cb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4fe3cb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4fe430
ret
Function at 0x506660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5067a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x506796
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00511980
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x50677b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x506791
cmp rsi, rcx
ja 0x506789
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x506781
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00511ac0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.0046cba0
mov rax, rsi
call fcn.0046cba0
call fcn.0046cb60
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.0046cb60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00506660
Function at 0x506800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506946
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x506936
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00511a20
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x50691b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x506931
cmp rsi, rcx
ja 0x506929
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x506921
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00511b60
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.0046cba0
mov rax, rsi
call fcn.0046cba0
call fcn.0046cb60
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.0046cb60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00506800
Function at 0x50c920
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50cad2
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x50c965
jae 0x50c9de
nop
jmp 0x50cac6
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
cmp rbx, 1
jne 0x50c9a9
lea rax, [0x00684ea0]
mov ebx, 1
mov rcx, rbx
call fcn.0044f620
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x50c9de
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x00684ea0]
nop
call fcn.0044f620
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x50c9f3
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x50ca25
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x50c9e6
nop dword [rax + rax]
jmp 0x50cabb
test rsi, rsi
jle 0x50ca32
xor r8d, r8d
xor r9d, r9d
jmp 0x50ca85
jmp 0x50ca37
dec rbx
test rbx, rbx
jle 0x50ca46
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x50ca34
cmp rbx, rcx
ja 0x50ca51
add rsp, 0x28
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.0046cb60
movzx r11d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r11, cl
lea r12, [rcx + 8]
cmp rcx, 0x40
sbb r13, r13
and r11, r13
or r9, r11
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x50ca95
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x50ca5c
jmp 0x50cab0
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x50caa5
mov qword [rax + rbx*8 - 8], r9
jmp 0x50ca32
mov rax, rsi
mov rcx, rbx
call fcn.0046cae0
mov rax, r10
mov rcx, rdx
call fcn.0046cae0
mov rax, r9
mov rcx, rbx
call fcn.0046cae0
mov rdx, rcx
mov rcx, rbx
call fcn.0046cb60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0050c920
Function at 0x517500
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5176f1
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movzx ecx, byte [rbx + 0x1b]
shl rcx, 0x18
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
shl rdx, 0x10
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
shl rsi, 8
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
shl r8, 0x38
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
shl r9, 0x30
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
shl r10, 0x28
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
shl r11, 0x20
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
shl r12, 0x18
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
shl r13, 0x10
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
shl r15, 8
mov qword [rsp + 0x28], r15
movzx ecx, byte [rbx + 0x10]
mov qword [rsp + 0x20], rcx
movzx edx, byte [rbx + 0xf]
shl rdx, 0x38
mov qword [rsp + 0x18], rdx
movzx esi, byte [rbx + 0xe]
shl rsi, 0x30
mov qword [rsp + 0x10], rsi
movzx edi, byte [rbx + 0xd]
shl rdi, 0x28
mov qword [rsp + 8], rdi
movzx r8d, byte [rbx + 0xc]
shl r8, 0x20
mov qword [rsp], r8
movzx r9d, byte [rbx + 0xb]
shl r9, 0x18
movzx r10d, byte [rbx + 0xa]
shl r10, 0x10
movzx r11d, byte [rbx + 9]
shl r11, 8
movzx r12d, byte [rbx + 8]
movzx r13d, byte [rbx + 7]
shl r13, 0x38
movzx ecx, byte [rbx + 6]
shl rcx, 0x30
movzx r15d, byte [rbx + 5]
shl r15, 0x28
movzx edx, byte [rbx + 4]
shl rdx, 0x20
movzx esi, byte [rbx + 3]
shl rsi, 0x18
movzx edi, byte [rbx + 2]
shl rdi, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, rdi
add rbx, rsi
add rdx, rbx
add rdx, r15
add rcx, rdx
add rcx, r13
mov qword [rax], rcx
lea rcx, [r12 + r11]
add rcx, r10
add rcx, r9
mov rdx, qword [rsp]
add rcx, rdx
mov rdx, qword [rsp + 8]
add rcx, rdx
mov rdx, qword [rsp + 0x10]
add rcx, rdx
mov rdx, qword [rsp + 0x18]
add rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
add rcx, rdx
mov rdx, qword [rsp + 0x30]
add rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, rdx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov rdx, qword [rsp + 0x48]
add rcx, rdx
mov rdx, qword [rsp + 0x50]
add rcx, rdx
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
add rcx, rdx
mov rdx, qword [rsp + 0x70]
add rcx, rdx
mov rdx, qword [rsp + 0x78]
add rcx, rdx
mov qword [rax + 0x18], rcx
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00517500
Function at 0x524a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x524c19
push rbp
mov rbp, rsp
sub rsp, 0xa0
nop word [rax + rax]
cmp cl, 0x10
jae 0x524c05
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov byte [rsp + 0xc0], cl
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x90], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x98], rsi
mov rsi, qword [rbx]
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsi + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x524bd4
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.005249a0
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xb8]
cmp dl, 0x10
jae 0x524bee
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x524b85
jmp 0x524bf7
add rsp, 0xa0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
nop
call fcn.0046cae0
lea rax, [0x006843e0]
lea rbx, [0x0075dd80]
call fcn.00438940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.00524a80
Function at 0x52bc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x52be19
push rbp
mov rbp, rsp
sub rsp, 0xd0
nop word [rax + rax]
cmp cl, 0x10
jae 0x52be05
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rbx
mov byte [rsp + 0xf0], cl
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rsi, [rsp + 0x58]
mov qword [rsp + 0xc0], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0xc8], rsi
mov rsi, qword [rbx]
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x52bdd4
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0052bb60
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
movzx r8d, byte [rsp + 0xf0]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0xe8]
cmp dl, 0x10
jae 0x52bdee
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x52bd85
jmp 0x52bdf7
add rsp, 0xd0
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
nop
call fcn.0046cae0
lea rax, [0x006843e0]
lea rbx, [0x0075dd90]
call fcn.00438940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax + rax]
jmp fcn.0052bc40
Function at 0x52f760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x52f988
push rbp
mov rbp, rsp
sub rsp, 0x118
nop dword [rax]
cmp cl, 0x10
jae 0x52f974
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rbx
mov byte [rsp + 0x138], cl
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
nop
movabs rdx, 0x80000000000000
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x100], xmm15
mov qword [rsp + 0x110], 0
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x100], rdx
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x108], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x110], rsi
mov rsi, qword [rbx]
mov r8, qword [rdx]
mov qword [rsi], r8
movups xmm0, xmmword [rdx + 8]
movups xmmword [rsi + 8], xmm0
movups xmm0, xmmword [rdx + 0x18]
movups xmmword [rsi + 0x18], xmm0
movups xmm0, xmmword [rdx + 0x28]
movups xmmword [rsi + 0x28], xmm0
movups xmm0, xmmword [rdx + 0x38]
movups xmmword [rsi + 0x38], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x108]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x110]
mov r8, qword [rsi]
mov qword [rdx], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdx + 8], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rdx + 0x18], xmm0
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rdx + 0x28], xmm0
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rdx + 0x38], xmm0
mov edx, 1
jmp 0x52f944
mov byte [rsp + 0x27], r8b
test byte [rax], al
mov rsi, qword [rax + rsi*8]
movzx edi, dl
dec edi
shr edi, 0x1f
mov rcx, rbx
mov rbx, rsi
mov rax, rcx
call fcn.0052f680
movzx edx, byte [rsp + 0x27]
inc edx
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
movzx r8d, byte [rsp + 0x138]
mov rax, rsi
mov ecx, r8d
mov rbx, qword [rsp + 0x130]
cmp dl, 0x10
jae 0x52f95e
lea esi, [rdx - 1]
movzx esi, sil
nop
mov r8d, edx
xor edx, ecx
cmp rsi, 0xf
jb 0x52f8f5
jmp 0x52f967
add rsp, 0x118
pop rbp
ret
mov rax, rsi
mov ecx, 0xf
call fcn.0046cae0
lea rax, [0x006843e0]
lea rbx, [0x0075dda0]
call fcn.00438940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0052f760
Function at 0x532b00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x532b4d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x532be0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x532c25
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x535780
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5358b0
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.00534c20
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x535814
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x535857
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x535883
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x53580e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x53580e
nop
jb 0x53586a
mov rax, rsi
mov ecx, 0x20
call fcn.0046cae0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00535780