joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4d8610
jb 0x4d866f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004d8360
aeskeygenassist xmm1, xmm0, 1
call fcn.004d8380
aeskeygenassist xmm1, xmm2, 2
call fcn.004d8360
aeskeygenassist xmm1, xmm0, 2
call fcn.004d8380
aeskeygenassist xmm1, xmm2, 4
call fcn.004d8360
aeskeygenassist xmm1, xmm0, 4
call fcn.004d8380
aeskeygenassist xmm1, xmm2, 8
call fcn.004d8360
aeskeygenassist xmm1, xmm0, 8
call fcn.004d8380
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d8360
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d8380
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d8360
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d8380
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d8360
jmp 0x4d86dd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004d82c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004d8320
aeskeygenassist xmm1, xmm2, 4
call fcn.004d82c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004d8320
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004d82c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004d8320
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004d82c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004d8320
jmp 0x4d86dd
aeskeygenassist xmm1, xmm0, 1
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 2
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 4
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 8
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004d8280
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004d8280
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4d86ea
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4dec40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dee5f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xb0], r9
cmp rsi, r10
jl 0x4dee35
nop dword [rax]
test rsi, rsi
je 0x4dee29
test r10, r10
je 0x4dee1a
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xa8], r8
lea rdi, [rsi + 1]
call fcn.004de9a0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp], rax
mov rdx, qword [rsp + 0xb8]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r8
mov r9, qword [rsp + 0xa8]
mov qword [rsp + 0x28], r9
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rdx
mov r10, qword [rsp + 0xc0]
mov qword [rsp + 0x40], r10
call fcn.004e7980
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb8]
nop
cmp rsi, r8
jle 0x4dedf8
mov rax, qword [rsp + 0x50]
sub rax, r8
mov rbx, r8
shl r8, 3
mov rdi, rax
neg rax
sar rax, 0x3f
and rax, r8
mov r9, qword [rsp + 0x68]
add rax, r9
mov qword [rsp], rax
sub rsi, rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov rdi, qword [rsp + 0xa8]
sub rdi, rbx
mov rbx, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
mov rdi, qword [rsp + 0x60]
add rdi, r8
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdx
call fcn.004e7ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x68]
mov qword [rax + rsi*8], rdx
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.004de980
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
call fcn.004deb60
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rdx, rdi
mov rdi, r9
mov r12, rsi
mov rsi, r10
mov r13, r8
mov r8, r11
mov r9, rdx
mov r10, r12
mov r11, r13
call fcn.004dec40
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
nop
jmp fcn.004dec40
Function at 0x4deee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df106
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xb0], r9
cmp rsi, r10
jl 0x4df0ee
nop dword [rax]
test rsi, rsi
je 0x4df0cf
test r10, r10
je 0x4df0bb
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0xa0], rsi
mov rdi, rsi
call fcn.004de9a0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp], rax
mov rdx, qword [rsp + 0xb8]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r8
mov r9, qword [rsp + 0xa8]
mov qword [rsp + 0x28], r9
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rdx
mov r10, qword [rsp + 0xc0]
mov qword [rsp + 0x40], r10
call fcn.004e7a20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb8]
nop dword [rax]
cmp rsi, r8
jle 0x4df098
mov rax, qword [rsp + 0x50]
sub rax, r8
mov rbx, r8
shl r8, 3
mov rdi, rax
neg rax
sar rax, 0x3f
and rax, r8
mov r9, qword [rsp + 0x68]
add rax, r9
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
sub rax, rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdi
mov rax, qword [rsp + 0xa8]
sub rax, rbx
mov rdi, rax
neg rax
sar rax, 0x3f
and rax, r8
mov r8, qword [rsp + 0x60]
add rax, r8
mov qword [rsp + 0x18], rax
sub rsi, rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdx
call fcn.004e7b60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x4df0db
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.004de980
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
nop dword [rax + rax]
call fcn.004deb60
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rax, [0x005fe120]
lea rbx, [0x00684a90]
call fcn.00436780
lea rax, [0x005fe120]
lea rbx, [0x00684a90]
nop dword [rax]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004deee0
Function at 0x4df200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df312
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
test rsi, rsi
je 0x4df22f
test r9, r9
jne 0x4df241
mov rdi, r10
call fcn.004dea80
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rdi, [rsi + 1]
call fcn.004de9a0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp], rax
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rsp + 0x48]
mov qword [rsp + 0x38], rsi
call fcn.004e7ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x98]
mov rax, qword [rsp + 0x60]
mov qword [rax + rsi*8], rdx
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.004de980
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.004df200
Function at 0x4df920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfa24
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004e7980
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
nop
test rax, rax
je 0x4dfa1a
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
sub rcx, rdx
mov rbx, rcx
neg rcx
sar rcx, 0x3f
mov rsi, rdx
shl rdx, 3
and rdx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rsp], rcx
mov rdx, rsi
sar rsi, 1
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
call fcn.004e7ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004df920
Function at 0x4dfa80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfb84
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004e7a20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
nop
test rax, rax
je 0x4dfb7a
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
sub rcx, rdx
mov rbx, rcx
neg rcx
sar rcx, 0x3f
mov rsi, rdx
shl rdx, 3
and rdx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rsp], rcx
mov rdx, rsi
sar rsi, 1
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
call fcn.004e7b60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004dfa80
Function at 0x4e03e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e0523
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
test rsi, rsi
je 0x4e0519
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
sub rcx, r9
mov r10, rcx
neg rcx
sar rcx, 0x3f
mov r11, r9
shl r9, 3
and rcx, r9
add rcx, rax
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], r10
mov qword [rsp + 0x18], rcx
sub rbx, r11
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004e7980
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4e0519
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
add rcx, rdx
mov rdx, qword [rsp + 0x68]
cmp rdx, rcx
jle 0x4e0519
mov rbx, qword [rsp + 0x70]
sub rbx, rcx
mov rsi, rbx
neg rbx
mov rdi, rcx
shl rcx, 3
sar rbx, 0x3f
and rbx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rbx
mov qword [rsp], rcx
sub rdx, rdi
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.004e7ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004e03e0
Function at 0x4e3f00
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e3f9b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
mov rcx, rsi
xor edx, edx
jmp 0x4e3f2c
inc rdx
cmp rbx, rdx
jle 0x4e3f3a
mov r8, qword [rax + rdx*8]
xor r9d, r9d
jmp 0x4e3f6b
test rsi, rsi
jge 0x4e3f46
xor esi, esi
jmp 0x4e3f46
inc rsi
cmp rcx, rsi
jle 0x4e3f53
movzx edx, byte [rdi + rsi]
test dl, dl
je 0x4e3f43
mov rax, rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
inc r9
shr r8, 8
mov rsi, r10
cmp r9, 8
jge 0x4e3f29
lea r10, [rsi - 1]
test r10, r10
jl 0x4e3f82
mov byte [rsi + rdi - 1], r8b
nop
jmp 0x4e3f61
test r8b, r8b
je 0x4e3f61
lea rax, [0x005fe120]
lea rbx, [0x00684ab0]
call fcn.00436780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.004e3f00

Function at 0x4e4060
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e418c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x70], rdi
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rdx + rsi]
lea rdx, [rdx + 7]
sar rdx, 3
mov rdi, rdx
call fcn.004de9a0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x78]
xor esi, esi
jmp 0x4e412d
mov qword [rsp + 0x20], rsi
mov rsi, qword [rsp + 0x80]
sub rsi, rdx
lea rcx, [rsi + 8]
mov rsi, rcx
neg rcx
sar rcx, 0x3f
add rdx, 0xfffffffffffffff8
mov qword [rsp + 0x28], rdx
and rcx, rdx
mov r8, qword [rsp + 0x70]
lea rax, [r8 + rcx]
mov ebx, 8
mov rcx, rsi
call fcn.004e4000
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov qword [rsi + rdx*8], rax
inc rdx
mov rax, rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, rdx
mov rdx, qword [rsp + 0x28]
cmp rdx, 8
jge 0x4e40c7
test rdx, rdx
jle 0x4e4144
mov rsi, qword [rsp + 0x70]
xor edi, edi
xor r8d, r8d
jmp 0x4e4180
call fcn.004de980
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp rdi, 0x40
sbb r9, r9
lea r10, [rdi + 8]
movzx r11d, byte [rdx + rsi - 1]
mov r12, rcx
mov rcx, rdi
shl r11, cl
and r11, r9
or r8, r11
dec rdx
mov rcx, r12
mov rdi, r10
nop dword [rax]
test rdx, rdx
jg 0x4e4153
mov qword [rax + rbx*8 - 8], r8
jmp 0x4e4144
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004e4060
Function at 0x4eba00
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4ebc0c
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004eba00
Function at 0x50a1c0
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x50a3b6
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xa8], rcx
mov rdx, qword [rax + 0x30]
mov rax, rbx
call rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
call fcn.004dca00
mov qword [rsp + 0x30], rax
lea rcx, [rax + 7]
sar rcx, 0x3f
shr rcx, 0x3d
lea rcx, [rcx + rax]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x28], rcx
mov rbx, rcx
lea rax, [0x005fe2e0]
call fcn.00448e60
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
xor esi, esi
jmp 0x50a272
mov rcx, rax
mov rdx, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
test rcx, rcx
jne 0x50a392
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
mov rbx, qword [rsp + 0xb0]
mov rcx, rax
mov rdi, qword [rsp + 0x28]
mov rsi, rdi
mov rax, qword [rsp + 0xa8]
call fcn.00487160
test rbx, rbx
jne 0x50a365
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x60]
movzx edx, byte [rbx]
mov rsi, qword [rsp + 0x30]
mov r8, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, r8
sar rsi, 3
shl rsi, 3
sub r8, rsi
add r8, qword [0x007d4c10]
movzx esi, byte [r8]
and edx, esi
mov byte [rbx], dl
movzx edx, byte [rbx + 1]
xor edx, 0x42
mov byte [rbx + 1], dl
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov rdi, rcx
call fcn.004dc7e0
mov rbx, qword [rsp + 0x40]
call fcn.004dc5a0
test rax, rax
jl 0x50a33b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x50a25d
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
mov rdi, rcx
call rsi
nop
jmp 0x50a25d
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov r8, rbx
mov r9, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rdi, rcx
mov r8, rbx
mov r9, rsi
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
mov rsi, rdx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0050a1c0