joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5289c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x528c09
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x528bf4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x528a02
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x528a1c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.0051a9e0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x528b31
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.004921e0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007867c8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044fb40
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x528afb
xor eax, eax
lea rbx, [0x00786740]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x007043d3]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044fc00
jmp 0x528b28
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x007865f0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044fb40
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.004921e0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x528bbe
xor eax, eax
lea rbx, [0x00786740]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x007043d3]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044fc00
jmp 0x528beb
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x007865f0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044fb40
add rsp, 0xa8
pop rbp
ret
lea rax, [0x00704bf1]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004654a0
mov rax, qword [rsp + 8]
jmp fcn.005289c0
Function at 0x52a0c0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a1b0
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rax, qword [0x0096b860]
cmp qword [rax + 8], 1
nop
jle 0x52a139
movzx ecx, byte [rax + 1]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax]
mov byte [rsp + 0x16], al
call fcn.00438fc0
lea rax, [0x00714d31]
mov ebx, 0x21
call fcn.00439840
movzx eax, byte [rsp + 0x17]
call fcn.00439240
lea rax, [0x007076dc]
mov ebx, 0xa
nop dword [rax]
call fcn.00439840
movzx eax, byte [rsp + 0x16]
call fcn.00439240
call fcn.00439200
call fcn.00439020
mov rax, qword [0x0096b860]
cmp byte [rax], 0
jne 0x52a18c
cmp byte [rax + 1], 0
jne 0x52a151
cmp byte [rax + 0x10], 0
je 0x52a16e
call fcn.00438fc0
lea rax, [0x00717a40]
mov ebx, 0x27
call fcn.00439840
call fcn.00439020
jmp 0x52a1aa
call fcn.00438fc0
lea rax, [0x0071b5e6]
mov ebx, 0x32
nop
call fcn.00439840
call fcn.00439020
jmp 0x52a1aa
call fcn.00438fc0
lea rax, [0x0071d30b]
mov ebx, 0x3d
nop dword [rax]
call fcn.00439840
call fcn.00439020
add rsp, 0x18
pop rbp
ret
call fcn.004654a0
jmp fcn.0052a0c0
Function at 0x537a40
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537b2b
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x28], rax
lea rax, [0x006d3420]
call fcn.0040d7c0
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rax + 0x10], rdx
cmp dword [0x009d9570], 0
jne 0x537a94
mov rsi, qword [rsp + 0x58]
jmp 0x537aa1
call fcn.004673a0
mov rsi, qword [rsp + 0x58]
mov qword [r11], rsi
mov qword [rax], rsi
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0xffffffffffffffff
lea rbx, [0x0078b790]
mov rcx, rax
xor edi, edi
mov rax, qword [rsp + 0x28]
call fcn.00534940
test bl, bl
je 0x537ad8
xor eax, eax
xor ebx, ebx
add rsp, 0x40
pop rbp
ret
movups xmmword [rsp + 0x30], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.0040b020
lea rdx, [0x006a3660]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
lea rax, [0x00719c4c]
mov ebx, 0x2d
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.004ccb40
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00537a40
Function at 0x538620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5387e9
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x538759
test r9, r9
je 0x538759
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x538676
jae 0x5386d7
jmp 0x5387dd
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x006a6720]
nop
call fcn.0044bc20
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop word [rax + rax]
cmp rsi, rcx
ja 0x5387d2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.00543fe0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
nop
cmp rax, rcx
jae 0x5387cd
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x60]
mov qword [rdi + rax*8], rsi
jmp 0x5387a0
test r10, r10
jne 0x538762
xor edx, edx
jmp 0x538791
nop
test rcx, rcx
jne 0x538789
lea rax, [0x006a6720]
mov ebx, 1
mov rcx, rbx
call fcn.0044bc20
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
add rsp, 0x68
pop rbp
ret
dec rcx
nop dword [rax]
test rcx, rcx
jle 0x5387af
mov rsi, qword [rdi + rcx*8 - 8]
test rsi, rsi
je 0x53879a
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
ja 0x5387c8
mov rax, rdi
mov rbx, rcx
mov rcx, rdx
add rsp, 0x68
pop rbp
ret
call fcn.004677e0
call fcn.00467760
mov rdx, rcx
mov rcx, rsi
call fcn.004677e0
mov rdx, rcx
mov rcx, rbx
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
nop
jmp fcn.00538620
Function at 0x539060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5391a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x539196
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00543c80
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x53917b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x539191
cmp rsi, rcx
ja 0x539189
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x539181
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00543dc0
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00467820
mov rax, rsi
call fcn.00467820
call fcn.004677e0
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00539060
Function at 0x539200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x539346
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x539336
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00543d20
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x53931b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x539331
cmp rsi, rcx
ja 0x539329
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x539321
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00543e60
xorps xmm15, xmm15
mov r14, qword [0x009d9398]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00467820
mov rax, rsi
call fcn.00467820
call fcn.004677e0
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00539200
Function at 0x53ec00
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53edb2
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x53ec45
jae 0x53ecbe
nop
jmp 0x53eda6
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x53ec89
lea rax, [0x006a6720]
mov ebx, 1
mov rcx, rbx
call fcn.0044bc20
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x53ecbe
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x006a6720]
nop
call fcn.0044bc20
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x53ecd3
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x53ed05
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x53ecc6
nop dword [rax + rax]
jmp 0x53ed9b
test rsi, rsi
jle 0x53ed12
xor r8d, r8d
xor r9d, r9d
jmp 0x53ed65
jmp 0x53ed17
dec rbx
test rbx, rbx
jle 0x53ed26
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x53ed14
cmp rbx, rcx
ja 0x53ed31
add rsp, 0x28
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.004677e0
movzx r11d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r11, cl
lea r12, [rcx + 8]
cmp rcx, 0x40
sbb r13, r13
and r11, r13
or r9, r11
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x53ed75
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x53ed3c
jmp 0x53ed90
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x53ed85
mov qword [rax + rbx*8 - 8], r9
jmp 0x53ed12
mov rax, rsi
mov rcx, rbx
call fcn.00467760
mov rax, r10
mov rcx, rdx
call fcn.00467760
mov rax, r9
mov rcx, rbx
call fcn.00467760
mov rdx, rcx
mov rcx, rbx
call fcn.004677e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0053ec00
Function at 0x545d00
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x545d6b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x545d24
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x545d41
cmp rdx, 0
je 0x545d8d
test rdx, 0xf
je 0x545d1d
test rdx, 7
jne 0x545d41
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x545d1d
ret

Function at 0x545fa0
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x546059
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x18]
mov rax, rbx
call rdx
mov rcx, qword [rsp + 0x50]
cmp rax, rcx
jne 0x546045
lea rax, [0x006bd700]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.0040b1e0
test rax, rax
je 0x546017
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
call rdx
add rsp, 0x28
pop rbp
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
call fcn.00545da0
mov rbx, rax
lea rax, [0x0078b7e0]
add rsp, 0x28
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007894b0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00545fa0
Function at 0x546420
Capabilities:
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5464d9
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x18]
mov rax, rbx
call rdx
mov rcx, qword [rsp + 0x50]
cmp rax, rcx
jne 0x5464c5
lea rax, [0x006bd680]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.0040b1e0
test rax, rax
je 0x546497
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
call rdx
add rsp, 0x28
pop rbp
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
call fcn.00545da0
mov rbx, rax
lea rax, [0x0078b7b8]
add rsp, 0x28
pop rbp
ret
lea rax, [0x006a5b60]
lea rbx, [0x007894f0]
call fcn.00436ea0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004654a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00546420
Function at 0x54a580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x54a5bf
jb 0x54a5d4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x54a640
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x54a67f
jb 0x54a694
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x54a700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x54a7d4
jb 0x54a833
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0054a520
aeskeygenassist xmm1, xmm0, 1
call fcn.0054a540
aeskeygenassist xmm1, xmm2, 2
call fcn.0054a520
aeskeygenassist xmm1, xmm0, 2
call fcn.0054a540
aeskeygenassist xmm1, xmm2, 4
call fcn.0054a520
aeskeygenassist xmm1, xmm0, 4
call fcn.0054a540
aeskeygenassist xmm1, xmm2, 8
call fcn.0054a520
aeskeygenassist xmm1, xmm0, 8
call fcn.0054a540
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0054a520
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0054a540
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0054a520
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0054a540
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0054a520
jmp 0x54a8a1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0054a480
aeskeygenassist xmm1, xmm2, 2
call fcn.0054a4e0
aeskeygenassist xmm1, xmm2, 4
call fcn.0054a480
aeskeygenassist xmm1, xmm2, 8
call fcn.0054a4e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0054a480
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0054a4e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0054a480
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0054a4e0
jmp 0x54a8a1
aeskeygenassist xmm1, xmm0, 1
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 2
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 4
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 8
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0054a440
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0054a440
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x54a8ae
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x54a9e0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x007885f0]
movdqu xmm14, xmmword [0x00788600]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x54aacb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x54aacb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x54ab30
ret