joyce8/EMBER2024-capa huggingface dataset:
Function at 0x563a45
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x563b2f
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x563afd
mov r14, qword [rsi + 0x58]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
not r12d
lea r15, [r14 + 0x10]
test r12w, r12w
jne 0x563aa9
movdqa xmm0, xmmword [r15]
pmovmskb r12d, xmm0
add r14, 0xfffffffffffff580
add r15, 0x10
cmp r12w, 0xffff
je 0x563a8a
not r12d
bsf eax, r12d
neg rax
imul rdi, rax, 0xa8
lea eax, [r12 - 1]
mov ecx, r12d
not ecx
or ecx, eax
add r12d, ecx
inc r12d
lea rcx, [r14 + rdi]
add rcx, 0xffffffffffffff58
call fcn.00561cb9
add rdi, r14
add rdi, 0xffffffffffffffe0
mov rcx, rdi
call fcn.0056399e
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
call fcn.00563a06
dec rbx
jne 0x563a84
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
mov edx, 0xa8
mul rdx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rcx, rax
cmp rcx, 0xffffffffffffffef
je 0x563b2f
mov r8, qword [rsi + 0x58]
sub r8, rax
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x563bdc
mov rax, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
xor edx, edx
cmp rax, rcx
mov r8, rcx
cmovb r8, rdx
sub rax, r8
mov r8, rcx
sub r8, rax
lea r14, [rax + rdi]
sub rdi, r8
cmova r14, rcx
cmovbe rdi, rdx
sub r14, rax
je 0x563ba8
mov rcx, rax
shl rcx, 7
lea r15, [rcx + rax*8]
add r15, rbx
xor r12d, r12d
mov rax, r12
shl rax, 7
lea rcx, [rax + r12*8]
add rcx, r15
mov eax, r12d
and eax, 1
xor r12, 1
lea r12, [r12 + rax*2]
call fcn.00561cb9
cmp r12, r14
jne 0x563b82
lea r14, [rsi + 0x28]
test rdi, rdi
je 0x563be0
xor r15d, r15d
mov rax, r15
shl rax, 7
lea rcx, [rax + r15*8]
add rcx, rbx
mov eax, r15d
and eax, 1
xor r15, 1
lea r15, [r15 + rax*2]
call fcn.00561cb9
cmp r15, rdi
jne 0x563bb4
jmp 0x563be0
lea r14, [rsi + 0x28]
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x563c22
mov ecx, 0x88
mov rdx, rax
and rdx, rcx
mov r8, rax
or rax, rcx
imul rax, rdx
xor rdx, rcx
and r8, 0xffffffffffffff77
imul r8, rdx
add rax, r8
je 0x563c22
mov r8, qword [r14]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
mov rax, qword [rsi + 0x80]
lock dec qword [rax]
jne 0x563c42
mov rcx, qword [rsi + 0x80]
mov rdx, qword [rsi + 0x88]
call fcn.00563ca2
mov rcx, qword [rsi + 0x98]
mov rdx, qword [rsi + 0xa0]
call fcn.00563d2a
mov rcx, qword [rsi + 0x90]
mov rdx, qword [rsi + 0x98]
call fcn.00563d7f
cmp rsi, 0xffffffffffffffff
je 0x563c93
lock dec qword [rsi + 8]
jne 0x563c93
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.005ab9d4
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x564ea2
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
mov rcx, qword [rcx + 0x30]
mov r11, qword [rax + 0x40]
mov r9, rcx
and r9, r8
xor rcx, r8
lea rcx, [rcx + r9*2]
mov qword [rax + 0x30], rcx
test r11, r11
je 0x564ee9
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x564ef1
mov esi, dword [rdx]
mov r9d, 4
jmp 0x564ef6
xor r10d, r10d
jmp 0x564fde
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x564f19
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x564f42
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
mov rcx, rdi
not rcx
and rcx, rsi
xor rdi, rsi
add rdi, rsi
sub rdi, rcx
mov rsi, rdi
mov r9d, r11d
and r9d, 8
mov ecx, r11d
or ecx, 8
imul ecx, r9d
xor r9d, 8
mov edi, r11d
and edi, 0x37
imul edi, r9d
add ecx, edi
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x564f7b
add r11, r8
jmp 0x5650d2
mov rcx, qword [rax + 0x10]
mov r11, qword [rax + 0x18]
mov r9, r11
and r9, rsi
add r9, r9
mov rdi, rsi
sub rdi, r9
mov r9, qword [rax]
add r9, rcx
rol rcx, 0xd
add rdi, r11
xor rcx, r9
rol r9, 0x20
mov r11, qword [rax + 8]
add r11, rdi
rol rdi, 0x10
xor rdi, r11
add r9, rdi
rol rdi, 0x15
xor rdi, r9
add r11, rcx
rol rcx, 0x11
mov qword [rax + 0x18], rdi
xor rcx, r11
rol r11, 0x20
mov qword [rax + 0x10], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
mov r9, r10
xor r9, r8
mov rcx, r10
not rcx
and rcx, r8
add rcx, rcx
sub rcx, r9
mov r11d, ecx
and r11d, 7
and rcx, 0xfffffffffffffff8
cmp r10, rcx
jae 0x565064
mov r8, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add r8, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, r8
rol r8, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add r8, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, r8
xor r8, rbx
add r10, 8
cmp r10, rcx
jb 0x565012
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], r8
cmp r11d, 3
jbe 0x565076
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x56507c
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x5650a2
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x5650ce
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
mov rcx, rdx
not rcx
and rcx, r9
xor rdx, r9
add rdx, r9
sub rdx, rcx
mov r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x57e974
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov rdx, qword [rcx]
mov r9, qword [rcx + 8]
cmp r9, rdx
je 0x57ea62
mov r8d, 0x2600
lea r10, [r9 + 1]
mov qword [rcx + 8], r10
movzx eax, byte [r9]
test al, al
js 0x57e9a5
mov r9, r10
jmp 0x57ea4e
mov r10d, eax
not r10b
or r10b, 0x1f
add r10b, al
inc r10b
movzx r10d, r10b
lea r11, [r9 + 2]
mov qword [rcx + 8], r11
movzx esi, byte [r9 + 1]
cmp al, 0xdf
jbe 0x57ea30
lea rdi, [r9 + 3]
mov qword [rcx + 8], rdi
movzx r11d, byte [r9 + 2]
mov ebx, esi
xor ebx, 0xc0
or esi, 0x3f
and esi, ebx
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp al, 0xf0
jb 0x57ea41
lea rsi, [r9 + 4]
mov qword [rcx + 8], rsi
movzx eax, byte [r9 + 3]
mov r9d, r10d
not r9d
or r9d, 7
add r9d, r10d
shl r9d, 0x12
add r9d, 0x40000
shl r11d, 6
and eax, 0x3f
or eax, r11d
or eax, r9d
mov r9, rsi
cmp eax, 0x110000
jne 0x57ea4e
jmp 0x57ea62
shl r10d, 6
and esi, 0x3f
or esi, r10d
mov r9, r11
mov eax, esi
jmp 0x57ea4e
shl r10d, 0xc
or r11d, r10d
mov r9, rdi
mov eax, r11d
cmp eax, 0xd
ja 0x57ea67
bt r8d, eax
jae 0x57ea67
cmp r9, rdx
jne 0x57e98d
mov eax, 0x110000
pop rbx
pop rdi
pop rsi
ret

Function at 0x580848
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
add rdi, rcx
mov al, 1
cmp rbx, rdi
je 0x580925
movzx ebp, byte [rbx]
test bpl, bpl
js 0x580877
inc rbx
jmp 0x580909
mov ecx, ebp
not cl
or cl, 0x1f
add cl, bpl
inc cl
movzx ecx, cl
movzx r8d, byte [rbx + 1]
cmp bpl, 0xdf
jbe 0x5808eb
movzx edx, byte [rbx + 2]
mov r9d, r8d
xor r9d, 0xc0
or r8d, 0x3f
and r8d, r9d
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp bpl, 0xf0
jb 0x5808fe
movzx ebp, byte [rbx + 3]
mov r8d, ecx
not r8d
or r8d, 7
add r8d, ecx
shl r8d, 0x12
add r8d, 0x40000
shl edx, 6
and ebp, 0x3f
or ebp, edx
or ebp, r8d
cmp ebp, 0x110000
je 0x580925
add rbx, 4
jmp 0x580909
add rbx, 2
shl ecx, 6
and r8d, 0x3f
or r8d, ecx
mov ebp, r8d
jmp 0x580909
add rbx, 3
shl ecx, 0xc
or edx, ecx
mov ebp, edx
mov rcx, rsi
call fcn.0057e974
mov ecx, eax
xor eax, eax
cmp ecx, 0x110000
je 0x580925
cmp ecx, ebp
je 0x58085c
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x58c44a
Capabilities:
Get hostname

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
lea r8, [rsp + 0x20]
mov dword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.KERNEL32.dll_GetComputerNameExW
test eax, eax
jne 0x58c529
call sub.KERNEL32.dll_GetLastError
mov edi, eax
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
call fcn.0058c3af
cmp edi, 0xea
jne 0x58c4d6
mov ecx, dword [rsp + 0x20]
call fcn.0058c214
mov rbx, rax
mov rdi, rdx
lea r8, [rsp + 0x24]
mov dword [r8], ebx
xor ecx, ecx
call sub.KERNEL32.dll_GetComputerNameExW
test eax, eax
je 0x58c4f0
mov r8d, dword [rsp + 0x24]
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rdi
call fcn.00527300
mov rcx, rsi
mov rdx, r14
call fcn.0058c259
jmp 0x58c508
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov qword [rsi + 8], 0
jmp 0x58c51e
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov qword [rsi + 8], 0
test rbx, rbx
je 0x58c51e
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rdi
call fcn.005ab9d4
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x0062df41]
lea r8, [0x0062dfc0]
mov edx, 0x16
call fcn.00426370
ud2
Function at 0x58c8c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rax
mov rbx, qword [rdx]
mov r14, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rcx, r14
not rcx
and rcx, rbx
add rcx, rcx
mov r8, r14
xor r8, rbx
movzx r13d, word [rdx + 0x12]
test edi, edi
je 0x58c92d
mov edx, r13d
and edx, 0xf800
mov eax, 1
cmp edx, 0xd800
jne 0x58c92d
xor eax, eax
cmp rcx, r8
sete al
sub rcx, r8
mov r8, rcx
shr r8, 2
bt ecx, 1
adc r8, rax
jne 0x58cb11
shl r13d, 0x10
or r13d, edi
mov ebp, 0xfffd
lea rdi, [rsp + 0x24]
mov r12d, 0x3ff
test r13w, r13w
je 0x58c967
shr r13d, 0x10
jmp 0x58c974
cmp r14, rbx
je 0x58c9e3
movzx r13d, word [r14]
add r14, 2
mov eax, r13d
and eax, 0xf800
movzx r15d, r13w
cmp eax, 0xd800
jne 0x58c99a
mov eax, 1
cmp r15d, 0xdbff
jbe 0x58c9a5
xor r13d, r13d
jmp 0x58c9fb
shl r15, 0x20
xor r13d, r13d
xor eax, eax
jmp 0x58c9fe
cmp r14, rbx
je 0x58c9e8
movzx r15d, word [r14]
add r14, 2
mov ecx, r15d
and ecx, 0xfc00
cmp ecx, 0xdc00
jne 0x58c9f0
and r13d, r12d
and r15d, r12d
shl r13, 0x2a
shl r15, 0x20
or r15, r13
movabs rax, 0x1000000000000
add r15, rax
jmp 0x58c99e
mov eax, 2
xor r13d, r13d
mov r14, rbx
jmp 0x58c9fb
shl r15d, 0x10
or r15d, 1
mov r13d, r15d
xor r15d, r15d
movzx ecx, r15w
or rcx, rax
cmp rcx, 2
je 0x58cb00
shr r15, 0x20
test rcx, rcx
cmovne r15d, ebp
cmp r15d, 0x80
jae 0x58ca4c
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rsi]
jne 0x58ca38
mov rcx, rsi
call fcn.0058c561
mov rdx, qword [rsi + 0x10]
mov rax, qword [rsi + 8]
mov byte [rax + rdx], r15b
inc rdx
mov qword [rsi + 0x10], rdx
jmp 0x58c95b
mov dword [rsp + 0x24], 0
mov eax, r15d
cmp r15d, 0x800
jae 0x58ca7d
shr eax, 6
or al, 0xc0
mov byte [rsp + 0x24], al
and r15b, 0x3f
or r15b, 0x80
mov byte [rsp + 0x25], r15b
mov eax, 2
jmp 0x58cae8
cmp r15d, 0x10000
jae 0x58cab1
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x24], al
mov eax, r15d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x25], al
and r15b, 0x3f
or r15b, 0x80
mov byte [rsp + 0x26], r15b
mov eax, 3
jmp 0x58cae8
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0x24], al
mov eax, r15d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x25], al
mov eax, r15d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x26], al
and r15b, 0x3f
or r15b, 0x80
mov byte [rsp + 0x27], r15b
mov eax, 4
lea rdx, [rsp + rax]
add rdx, 0x24
mov rcx, rsi
mov r8, rdi
call fcn.0058c59a
jmp 0x58c95b
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
xor edx, edx
call fcn.0058c61b
jmp 0x58c944
Function at 0x58f150
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.0058f150
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x58f25a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x58f230
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret
Function at 0x590a7d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x590bf1
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x006301a0]
sub rsi, rdi
call fcn.00590c00
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x00630190]
test rcx, 1
je 0x590b3a
movdqu xmm7, xmmword [rdi]
call fcn.00590280
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x590ba6
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x00630190]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.005903e0
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x006301b0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x590b49
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x599e00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x599f20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x599e60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x599e60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x599e60
Function at 0x59dd80
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r8, 0xd
jne 0x59de2e
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12d, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
cmp r8, 0x10
jb 0x59ded9
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
lea rcx, [rcx + 0x10]
sub r8, 0x10
jmp 0x59de2e
cmp r8, 0
je 0x59df9f
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r8
shld r14, r13, 8
shl r13, 8
movzx r15, byte [rcx - 1]
xor r13, r15
dec rcx
dec r8
jne 0x59deef
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
Function at 0x5ac800
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.005ad520
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.005ad520
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x5ac870
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x00677534]
mov r12, rcx
test ebx, ebx
jle 0x5ac9a0
mov rax, qword [0x00677538]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x5ac8bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x5ac943
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x5ac8a0
mov rcx, r12
call fcn.005ad220
mov rsi, rax
test rax, rax
je 0x5ac9c2
mov rax, qword [0x00677538]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.005ad350
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00677538]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x5ac9a7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x5ac93c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x5ac950
add dword [0x00677534], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x00677538]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5ac93c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.005ac800
nop dword [rax]
xor ebx, ebx
jmp 0x5ac8c7
mov rax, qword [0x00677538]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.005ac800
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.005ac800
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x5ace90
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x006775a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00677580]
test rbx, rbx
je 0x5acee4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x5acedb
test r12, r12
je 0x5acedb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x5acec0
lea rcx, [0x006775a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x5ad220
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00631240]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x5ad240
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x5ad248
ret
cmp word [r8 + 0x18], 0x20b
jne 0x5ad240
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x5ad295
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x5ad28c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x5ad240
add rax, 0x28
cmp rax, r9
jne 0x5ad278
xor eax, eax
ret

Function at 0x5ad2a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00631240]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x5ad2c0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x5ad2c8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x5ad2c0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x5ad350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00631240]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x5ad370
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x5ad378
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret