joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b6d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rsp + 0xb0]
mov ebp, dword [rsp + 0xb8]
cmp rdx, rcx
mov rsi, rcx
mov r12, rdx
movsxd rdi, r8d
mov qword [rsp + 0x30], r9
mov r13, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
je 0x5b7007
lea eax, [rdi + rdi]
lea r14d, [rdi - 1]
cdqe
mov edx, r14d
lea rbx, [r13 + rax*8]
lea rcx, [r13 + rax*8 + 8]
mov qword [rbx], 1
call fcn.005bc130
mov rdx, qword [rsp + 0x30]
mov r8d, edi
mov rcx, r13
call fcn.005bc186
mov edx, edi
mov rcx, rsi
call fcn.005bc130
mov eax, edi
shl eax, 6
add eax, ebp
lea rbp, [r12 + r14*8 + 8]
xor r14d, r14d
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], r14d
je 0x5b6f61
nop dword [rax]
test byte [r13], 1
je 0x5b6f80
mov r15, qword [r12]
mov r8d, edi
mov rdx, r13
mov rcx, r12
and r15d, 1
mov r9, r15
call fcn.005ba110
test rax, rax
mov r8d, edi
mov rcx, r13
setne r9b
mov rdx, r12
mov qword [rsp + 0x20], rax
movzx r9d, r9b
call fcn.005ba230
mov r11, qword [rsp + 0x20]
xor r8d, r8d
mov rax, r12
test r11d, r11d
setne r8b
mov rcx, r8
neg rcx
test edi, edi
jle 0x5b6ed7
nop
mov rdx, rcx
xor rdx, qword [rax]
add rdx, r8
setb r8b
mov qword [rax], rdx
add rax, 8
cmp rax, rbp
movzx r8d, r8b
jne 0x5b6e90
xor eax, eax
nop
mov r8, qword [rsi + rax*8]
mov r9, qword [rbx + rax*8]
mov rdx, r8
xor rdx, r9
and rdx, rcx
xor r9, rdx
xor rdx, r8
mov qword [rbx + rax*8], r9
mov qword [rsi + rax*8], rdx
add rax, 1
cmp edi, eax
jg 0x5b6eb0
mov r9, r15
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.005ba110
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
test rax, rax
setne r9b
mov r8d, edi
mov rcx, rbx
call fcn.005ba230
mov r9d, 1
mov r8d, edi
mov rdx, r12
mov rcx, r12
call fcn.005bc7c0
test rax, rax
jne 0x5b6fc0
mov r9d, 1
mov r8d, edi
mov rdx, rbx
mov rcx, rbx
call fcn.005bc7c0
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
test rax, rax
setne r9b
mov r8d, edi
mov rcx, rbx
call fcn.005ba230
test rax, rax
jne 0x5b6fa0
add r14d, 1
cmp dword [rsp + 0x2c], r14d
jne 0x5b6e30
mov rax, qword [r12 + rdi*8 - 8]
or rax, qword [r12]
jne 0x5b6fde
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.sec_modinv.c
lea rcx, str.bp_0___1
mov r8d, 0x88
call fcn.0064b2d0
jmp 0x5b6e3b
lea rdx, str.sec_modinv.c
lea rcx, [0x007acf40]
mov r8d, 0xa6
call fcn.0064b2d0
jmp 0x5b6f52
lea rdx, str.sec_modinv.c
lea rcx, [0x007acf40]
mov r8d, 0xa3
call fcn.0064b2d0
jmp 0x5b6f1f
lea rdx, str.sec_modinv.c
lea rcx, str._ap_0___ap_n_1____0
mov r8d, 0xa8
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.0064b2d0
lea rdx, str.sec_modinv.c
lea rcx, str.ap___vp
mov r8d, 0x5a
call fcn.0064b2d0
jmp 0x5b6dd3
Function at 0x5bc0b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, 1
test edx, edx
mov rbx, rcx
cmovg esi, edx
cmp esi, 0x3ffffff
ja 0x5bc108
movsxd rdx, dword [rcx]
movsxd r8, esi
mov rcx, qword [rcx + 8]
shl r8, 3
shl rdx, 3
call qword [0x0065a798]
mov ecx, dword [rbx + 4]
mov edx, dword [rbx + 4]
mov qword [rbx + 8], rax
mov dword [rbx], esi
sar ecx, 0x1f
xor edx, ecx
sub edx, ecx
cmp esi, edx
jge 0x5bc101
mov dword [rbx + 4], 0
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [0x007acfe0]
lea r9, [rax + 0x60]
mov r8d, 0x1a
mov edx, 1
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop

Function at 0x5df8f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor eax, eax
mov r8d, dword [rcx + rax]
mov edx, dword [rcx + rax + 4]
and r8d, 0x80000000
and edx, 0x7fffffff
or edx, r8d
mov r8d, edx
and edx, 1
shr r8d, 1
xor r8d, dword [rcx + rax + 0x634]
neg edx
and edx, 0x9908b0df
xor r8d, edx
mov dword [rcx + rax], r8d
add rax, 4
cmp rax, 0x38c
jne 0x5df8f2
xor ax, ax
nop dword [rax]
mov r8d, dword [rcx + rax + 0x38c]
mov edx, dword [rcx + rax + 0x390]
and r8d, 0x80000000
and edx, 0x7fffffff
or edx, r8d
mov r8d, edx
and edx, 1
shr r8d, 1
xor r8d, dword [rcx + rax]
neg edx
and edx, 0x9908b0df
xor r8d, edx
mov dword [rcx + rax + 0x38c], r8d
add rax, 4
cmp rax, 0x630
jne 0x5df940
mov edx, dword [rcx + 0x9bc]
mov eax, dword [rcx]
and edx, 0x80000000
and eax, 0x7fffffff
or eax, edx
mov edx, eax
and eax, 1
shr edx, 1
xor edx, dword [rcx + 0x630]
neg eax
and eax, 0x9908b0df
xor edx, eax
mov dword [rcx + 0x9bc], edx
ret
Function at 0x5ec190
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov rdi, rcx
push rsi
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r10, rcx

Function at 0x5ed860
Capabilities:
Hash data using sha256

Disassembly:
mov rax, qword [0x007b4960]
mov dword [rcx + 0x24], 0
mov dword [rcx + 0x20], 0
mov dword [rcx + 0x68], 0
mov qword [rcx], rax
mov rax, qword [0x007b4968]
mov qword [rcx + 8], rax
mov rax, qword [0x007b4970]
mov qword [rcx + 0x10], rax
mov rax, qword [0x007b4978]
mov qword [rcx + 0x18], rax
ret

Function at 0x5ed9b0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.005ed710
mov rax, qword [0x007b4960]
mov dword [rbx + 0x24], 0
mov dword [rbx + 0x20], 0
mov dword [rbx + 0x68], 0
mov qword [rbx], rax
mov rax, qword [0x007b4968]
mov qword [rbx + 8], rax
mov rax, qword [0x007b4970]
mov qword [rbx + 0x10], rax
mov rax, qword [0x007b4978]
mov qword [rbx + 0x18], rax
add rsp, 0x20
pop rbx
ret

Function at 0x5edd60
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rdx]
movzx r9d, byte [rcx + 0xf]
lea r8, str._.C
xor r10d, r10d
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x28], rax
mov rax, rcx
movzx r11d, byte [rax + 0x20]
add rax, 1
xor r11b, byte [rax + 0xf]
mov byte [rax + 0x2f], r11b
xor r9b, byte [rdx + r10]
add r10, 1
movzx r9d, r9b
movzx r9d, byte [r8 + r9]
xor r9b, byte [rax - 1]
mov byte [rax - 1], r9b
cmp r10, 0x10
jne 0x5edd81
xor r9d, r9d
xor eax, eax
nop word cs:[rax + rax]
xor edx, edx
movzx eax, al
movzx eax, byte [r8 + rax]
xor al, byte [rcx + rdx + 0x10]
mov byte [rcx + rdx + 0x10], al
add rdx, 1
cmp rdx, 0x30
jne 0x5eddc2
add eax, r9d
add r9d, 1
cmp r9d, 0x12
jne 0x5eddc0
repz ret

Function at 0x5ee300
Capabilities:
Hash data using sha512

Disassembly:
mov rax, qword [0x007b4cc0]
mov qword [rcx + 0x48], 0
mov qword [rcx + 0x40], 0
mov dword [rcx + 0xd0], 0
mov qword [rcx], rax
mov rax, qword [0x007b4cc8]
mov qword [rcx + 8], rax
mov rax, qword [0x007b4cd0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x007b4cd8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x007b4ce0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x007b4ce8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x007b4cf0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x007b4cf8]
mov qword [rcx + 0x38], rax
ret

Function at 0x5ee550
Capabilities:
Hash data using sha384

Disassembly:
mov rax, qword [0x007b4c80]
mov qword [rcx + 0x48], 0
mov qword [rcx + 0x40], 0
mov dword [rcx + 0xd0], 0
mov qword [rcx], rax
mov rax, qword [0x007b4c88]
mov qword [rcx + 8], rax
mov rax, qword [0x007b4c90]
mov qword [rcx + 0x10], rax
mov rax, qword [0x007b4c98]
mov qword [rcx + 0x18], rax
mov rax, qword [0x007b4ca0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x007b4ca8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x007b4cb0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x007b4cb8]
mov qword [rcx + 0x38], rax
ret
Function at 0x5ee7c0
Capabilities:
Enumerate pe sections

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp edx, 0x20
mov rsi, rcx
mov rbx, r8
sete dil
jne 0x5ee8b0
movzx r8d, byte [rbx + 3]
movzx eax, byte [rbx + 2]
shl r8d, 0x18
shl eax, 0x10
or r8d, eax
movzx eax, byte [rbx]
or r8d, eax
movzx eax, byte [rbx + 1]
shl eax, 8
or r8d, eax
mov dword [rsi + 4], r8d
movzx ecx, byte [rbx + 7]
movzx eax, byte [rbx + 6]
shl ecx, 0x18
shl eax, 0x10
or ecx, eax
movzx eax, byte [rbx + 4]
or ecx, eax
movzx eax, byte [rbx + 5]
shl eax, 8
or ecx, eax
mov dword [rsi + 8], ecx
movzx edx, byte [rbx + 0xb]
movzx eax, byte [rbx + 0xa]
shl edx, 0x18
shl eax, 0x10
or edx, eax
movzx eax, byte [rbx + 8]
or edx, eax
movzx eax, byte [rbx + 9]
shl eax, 8
or edx, eax
mov dword [rsi + 0xc], edx
movzx eax, byte [rbx + 0xf]
movzx r9d, byte [rbx + 0xe]
shl eax, 0x18
shl r9d, 0x10
or eax, r9d
movzx r9d, byte [rbx + 0xc]
or eax, r9d
movzx r9d, byte [rbx + 0xd]
shl r9d, 8
or eax, r9d
test dil, dil
mov dword [rsi + 0x10], eax
jne 0x5ee8e0
mov dword [rsi + 0x38], eax
lea rax, str.expand_16_byte_kexpand_32_byte_kcbc.c
mov dword [rsi + 0x2c], r8d
mov dword [rsi + 0x30], ecx
mov dword [rsi + 0x34], edx
mov edx, dword [rax]
mov dword [rsi], edx
mov edx, dword [rax + 4]
mov dword [rsi + 0x14], edx
mov edx, dword [rax + 8]
mov dword [rsi + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rsi + 0x3c], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp edx, 0x10
je 0x5ee7da
lea rdx, [0x007b4f80]
lea rcx, str.length__SALSA20_MIN_KEY_SIZE__length__SALSA20_MAX_KEY_SIZE
mov r8d, 0x38
call fcn.0064b2d0
jmp 0x5ee7da
movzx eax, byte [rbx + 0x13]
movzx edx, byte [rbx + 0x12]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [rbx + 0x10]
or eax, edx
movzx edx, byte [rbx + 0x11]
shl edx, 8
or eax, edx
mov dword [rsi + 0x2c], eax
movzx eax, byte [rbx + 0x17]
movzx edx, byte [rbx + 0x16]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [rbx + 0x14]
or eax, edx
movzx edx, byte [rbx + 0x15]
shl edx, 8
or eax, edx
mov dword [rsi + 0x30], eax
movzx eax, byte [rbx + 0x1b]
movzx edx, byte [rbx + 0x1a]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [rbx + 0x18]
or eax, edx
movzx edx, byte [rbx + 0x19]
shl edx, 8
or eax, edx
mov dword [rsi + 0x34], eax
movzx eax, byte [rbx + 0x1f]
movzx edx, byte [rbx + 0x1e]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [rbx + 0x1c]
or eax, edx
movzx edx, byte [rbx + 0x1d]
shl edx, 8
or eax, edx
mov dword [rsi + 0x38], eax
lea rax, [0x007b4ff0]
jmp 0x5ee888

Function at 0x5eefb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
test dl, 0xf
mov rsi, rcx
mov ebx, edx
mov rdi, r8
je 0x5eefe7
lea rdx, str.aes_encrypt.c
lea rcx, [0x007b502e]
mov r8d, 0x2a
mov qword [rsp + 0x38], r9
call fcn.0064b2d0
mov r9, qword [rsp + 0x38]
lea rdx, str.cw
mov qword [rsp + 0x20], r9
mov r8d, ebx
mov r9, rdi
mov rcx, rsi
call fcn.005f7380
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x5ef470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
test edx, edx
mov rsi, rcx
mov ebx, edx
mov rbp, r8
mov edi, r9d
je 0x5ef60e
cmp edx, 0x80
ja 0x5ef5cb
cmp edi, 0x400
ja 0x5ef5f0
test ebx, ebx
je 0x5ef638
lea edx, [rbx - 1]
lea r10, [rsp + 0x20]
xor eax, eax
mov r8d, edx
add r8, 1
nop
movzx ecx, byte [rbp + rax]
mov byte [r10 + rax], cl
add rax, 1
cmp rax, r8
jne 0x5ef4c0
cmp ebx, 0x7f
ja 0x5ef62c
mov rax, r10
lea r9, [0x007b6260]
jmp 0x5ef4f3
lea edx, [rbx - 1]
movzx edx, byte [rsp + rdx + 0x20]
mov r8d, ebx
add ebx, 1
add dl, byte [rax]
add rax, 1
cmp ebx, 0x7f
movzx edx, dl
movzx edx, byte [r9 + rdx]
mov byte [rsp + r8 + 0x20], dl
jbe 0x5ef4f0
movzx eax, byte [rsp + 0x20]
movzx ecx, byte [r9 + rax]
lea eax, [rdi - 1]
cmp eax, 0x3fe
mov byte [rsp + 0x20], cl
ja 0x5ef593
lea r8d, [rdi + 7]
mov r11d, pe_nt_image_headers64
neg edi
mov ecx, edi
mov eax, 0xff
lea rdx, [0x007b6260]
shr r8d, 3
and ecx, 7
sub r11d, r8d
sar eax, cl
mov ebx, r11d
and al, byte [rsp + rbx + 0x20]
test r11d, r11d
movzx eax, al
movzx edx, byte [rdx + rax]
lea eax, [r11 - 1]
mov byte [rsp + rbx + 0x20], dl
je 0x5ef58e
nop
lea ecx, [rax + r8]
xor dl, byte [rsp + rcx + 0x20]
mov ecx, eax
sub eax, 1
cmp eax, 0xffffffff
movzx edx, dl
movzx edx, byte [r9 + rdx]
mov byte [rsp + rcx + 0x20], dl
jne 0x5ef570
movzx ecx, byte [rsp + 0x20]
xor eax, eax
lea r8, [r10 + 1]
jmp 0x5ef5a5
movzx ecx, byte [r10 + rax]
movzx edx, byte [r8 + rax]
shl edx, 8
or edx, ecx
mov word [rsi + rax], dx
add rax, 2
cmp rax, 0x80
jne 0x5ef5a0
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.arctwo.c
lea rcx, str.length___ARCTWO_MAX_KEY_SIZE
mov r8d, 0xbb
call fcn.0064b2d0
cmp edi, 0x400
jbe 0x5ef4a6
lea rdx, str.arctwo.c
lea rcx, str.ekb___1024
mov r8d, 0xbc
call fcn.0064b2d0
jmp 0x5ef4a6
lea rdx, str.arctwo.c
lea rcx, str.length___ARCTWO_MIN_KEY_SIZE
mov r8d, 0xba
call fcn.0064b2d0
jmp 0x5ef49a
lea r9, [0x007b6260]
jmp 0x5ef516
lea r10, [rsp + 0x20]
mov edx, 0xffffffff
jmp 0x5ef4db
lea r9d, [rdx*8]
jmp 0x5ef470
Function at 0x5ef650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
test edx, edx
mov rsi, rcx
mov ebx, edx
mov rbp, r8
mov edi, r9d
je 0x5ef60e
cmp edx, 0x80
ja 0x5ef5cb
cmp edi, 0x400
ja 0x5ef5f0
test ebx, ebx
je 0x5ef638
lea edx, [rbx - 1]
lea r10, [rsp + 0x20]
xor eax, eax
mov r8d, edx
add r8, 1
nop
movzx ecx, byte [rbp + rax]
mov byte [r10 + rax], cl
add rax, 1
cmp rax, r8
jne 0x5ef4c0
cmp ebx, 0x7f
ja 0x5ef62c
mov rax, r10
lea r9, [0x007b6260]
jmp 0x5ef4f3
lea edx, [rbx - 1]
movzx edx, byte [rsp + rdx + 0x20]
mov r8d, ebx
add ebx, 1
add dl, byte [rax]
add rax, 1
cmp ebx, 0x7f
movzx edx, dl
movzx edx, byte [r9 + rdx]
mov byte [rsp + r8 + 0x20], dl
jbe 0x5ef4f0
movzx eax, byte [rsp + 0x20]
movzx ecx, byte [r9 + rax]
lea eax, [rdi - 1]
cmp eax, 0x3fe
mov byte [rsp + 0x20], cl
ja 0x5ef593
lea r8d, [rdi + 7]
mov r11d, pe_nt_image_headers64
neg edi
mov ecx, edi
mov eax, 0xff
lea rdx, [0x007b6260]
shr r8d, 3
and ecx, 7
sub r11d, r8d
sar eax, cl
mov ebx, r11d
and al, byte [rsp + rbx + 0x20]
test r11d, r11d
movzx eax, al
movzx edx, byte [rdx + rax]
lea eax, [r11 - 1]
mov byte [rsp + rbx + 0x20], dl
je 0x5ef58e
nop
lea ecx, [rax + r8]
xor dl, byte [rsp + rcx + 0x20]
mov ecx, eax
sub eax, 1
cmp eax, 0xffffffff
movzx edx, dl
movzx edx, byte [r9 + rdx]
mov byte [rsp + rcx + 0x20], dl
jne 0x5ef570
movzx ecx, byte [rsp + 0x20]
xor eax, eax
lea r8, [r10 + 1]
jmp 0x5ef5a5
movzx ecx, byte [r10 + rax]
movzx edx, byte [r8 + rax]
shl edx, 8
or edx, ecx
mov word [rsi + rax], dx
add rax, 2
cmp rax, 0x80
jne 0x5ef5a0
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.arctwo.c
lea rcx, str.length___ARCTWO_MAX_KEY_SIZE
mov r8d, 0xbb
call fcn.0064b2d0
cmp edi, 0x400
jbe 0x5ef4a6
lea rdx, str.arctwo.c
lea rcx, str.ekb___1024
mov r8d, 0xbc
call fcn.0064b2d0
jmp 0x5ef4a6
lea rdx, str.arctwo.c
lea rcx, str.length___ARCTWO_MIN_KEY_SIZE
mov r8d, 0xba
call fcn.0064b2d0
jmp 0x5ef49a
lea r9, [0x007b6260]
jmp 0x5ef516
lea r10, [rsp + 0x20]
mov edx, 0xffffffff
jmp 0x5ef4db
lea r9d, [rdx*8]
jmp 0x5ef470

Function at 0x5ef6e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r9d, r9d
lea r11, [0x007b64c0]
test ecx, ecx
je 0x5ef71e
nop
movzx r10d, byte [r8 + r9]
mov rbx, r10
mov eax, r10d
shr r10b, 4
and ebx, 0xf
xor eax, 1
and r10d, 0xf
xor al, byte [r11 + rbx*4]
xor al, byte [r11 + r10*4]
mov byte [rdx + r9], al
add r9, 1
cmp ecx, r9d
ja 0x5ef6f0
pop rbx
ret
Function at 0x5f15b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test edx, edx
mov rbx, rcx
mov esi, edx
mov rdi, r8
je 0x5f1659
cmp edx, 0x100
ja 0x5f163b
xor eax, eax
mov byte [rbx + rax], al
add rax, 1
cmp rax, 0x100
jne 0x5f15d1
lea r8, [rbx + 0x100]
mov r9, rbx
xor edx, edx
xor ecx, ecx
nop
movzx r10d, byte [r9]
mov eax, edx
add r9, 1
movzx eax, byte [rdi + rax]
movzx r11d, r10b
add eax, r11d
add ecx, eax
movzx ecx, cl
mov eax, ecx
movzx r11d, byte [rbx + rax]
mov byte [r9 - 1], r11b
mov byte [rbx + rax], r10b
lea eax, [rdx + 1]
xor edx, edx
div esi
cmp r9, r8
jne 0x5f15f0
mov byte [rbx + 0x101], 0
mov byte [rbx + 0x100], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rdx, [0x007b7000]
lea rcx, str.length___ARCFOUR_MAX_KEY_SIZE
mov r8d, 0x2b
call fcn.0064b2d0
jmp 0x5f15cf
lea rdx, [0x007b7000]
lea rcx, str.length___ARCFOUR_MIN_KEY_SIZE
mov r8d, 0x2a
call fcn.0064b2d0
jmp 0x5f15cf

Function at 0x5f1680
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp edx, 0xf
mov rsi, rcx
mov edi, edx
mov rbx, r8
jbe 0x5f180b
cmp edx, 0x20
ja 0x5f17bd
jne 0x5f17d6
mov r10d, 0x3c
mov eax, 0xe
mov r9d, 8
mov dword [rsi + 0xf0], eax
xor edx, edx
movzx eax, byte [rbx + rdx*4 + 3]
movzx r8d, byte [rbx + rdx*4 + 2]
movzx ecx, byte [rbx + rdx*4]
shl r8d, 0x10
shl eax, 0x18
or eax, r8d
movzx r8d, byte [rbx + rdx*4 + 1]
or eax, ecx
shl r8d, 8
or eax, r8d
mov dword [rsi + rdx*4], eax
add rdx, 1
cmp r9d, edx
ja 0x5f16c1
mov rcx, rsi
mov r8d, r9d
lea r11, [0x007b709e]
jmp 0x5f1764
mov edx, ebx
lea rax, str.cw
add r11, 1
ror edx, 8
mov ebx, edx
movzx edi, dl
shr ebx, 0x18
movzx edi, byte [rax + rdi]
movzx ebx, byte [rax + rbx]
shl ebx, 0x18
or ebx, edi
movzx edi, dh
shr edx, 0x10
movzx edi, byte [rax + rdi]
movzx edx, dl
movzx eax, byte [rax + rdx]
shl edi, 8
shl eax, 0x10
or ebx, edi
or ebx, eax
movzx eax, byte [r11 - 1]
xor ebx, eax
xor ebx, dword [rcx]
mov eax, r8d
add r8d, 1
add rcx, 4
cmp r8d, r10d
mov dword [rsi + rax*4], ebx
jae 0x5f1802
lea eax, [r8 - 1]
xor edx, edx
mov ebx, dword [rsi + rax*4]
mov eax, r8d
div r9d
test edx, edx
je 0x5f1704
cmp r9d, 6
jbe 0x5f174b
cmp edx, 4
jne 0x5f174b
mov eax, ebx
lea rdx, str.cw
movzx ebp, bl
shr eax, 0x10
movzx eax, al
movzx ebp, byte [rdx + rbp]
movzx edi, byte [rdx + rax]
mov eax, ebx
movzx ebx, bh
shr eax, 0x18
movzx ebx, byte [rdx + rbx]
movzx eax, byte [rdx + rax]
shl edi, 0x10
shl ebx, 8
shl eax, 0x18
or eax, ebp
or ebx, eax
or ebx, edi
jmp 0x5f174b
lea rdx, str.aes_set_encrypt_key.c
lea rcx, str.keysize___AES_MAX_KEY_SIZE
mov r8d, 0x31
call fcn.0064b2d0
cmp edi, 0x18
sbb r10d, r10d
and r10d, 0xfffffff8
add r10d, 0x34
cmp edi, 0x18
sbb eax, eax
and eax, 0xfffffffe
add eax, 0xc
cmp edi, 0x18
sbb r9d, r9d
and r9d, 0xfffffffe
add r9d, 6
jmp 0x5f16b9
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.aes_set_encrypt_key.c
lea rcx, str.keysize___AES_MIN_KEY_SIZE
mov r8d, 0x30
call fcn.0064b2d0
jmp 0x5f17d6
Function at 0x5f2940
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
mov ebx, dword [rdx + 0xf0]
cmp rdx, rcx
je 0x5f28e9
mov dword [rcx + 0xf0], ebx
xor r8d, r8d
shl ebx, 2
nop
mov r11d, ebx
xor eax, eax
sub r11d, r8d
lea r9d, [r11 + rax]
mov r10d, dword [rdx + r9*4]
lea r9d, [r8 + rax]
add rax, 1
cmp rax, 4
mov dword [rcx + r9*4], r10d
jne 0x5f2868
add r8d, 4
cmp r8d, ebx
jbe 0x5f2860
cmp ebx, 4
jbe 0x5f28e5
sub ebx, 5
lea rdx, [rcx + 0x10]
lea r8, [0x007b70e0]
lea r10, [rcx + rbx*4 + 0x14]
mov ecx, dword [rdx]
add rdx, 4
movzx eax, ch
movzx r9d, cl
mov eax, dword [r8 + rax*4]
ror eax, 0x18
xor eax, dword [r8 + r9*4]
mov r9d, ecx
shr r9d, 0x10
shr ecx, 0x18
movzx r9d, r9b
mov ecx, dword [r8 + rcx*4]
mov r9d, dword [r8 + r9*4]
ror ecx, 8
ror r9d, 0x10
xor eax, r9d
xor eax, ecx
mov dword [rdx - 4], eax
cmp rdx, r10
jne 0x5f28a3
pop rbx
pop rsi
pop rdi
ret
lea edi, [rbx*4]
xor ebx, ebx
test edi, edi
mov esi, edi
je 0x5f28e5
nop dword [rax + rax]
xor eax, eax
lea r8d, [rbx + rax]
lea r9, [rdx + r8*4]
lea r8d, [rsi + rax]
add rax, 1
cmp rax, 4
lea r8, [rdx + r8*4]
mov r10d, dword [r9]
mov r11d, dword [r8]
mov dword [r9], r11d
mov dword [r8], r10d
jne 0x5f2902
add ebx, 4
sub esi, 4
cmp ebx, esi
jb 0x5f2900
mov ebx, edi
jmp 0x5f288b
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.005f1680
mov rdx, rbx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x5f2840
Function at 0x5f2bc0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movzx eax, byte [rcx + 0xf]
xor ebx, ebx
mov rdi, rdx
lea rbp, [rsp + 0x20]
mov rsi, rcx
shl rax, 4
mov rdx, qword [rdx + rax + 8]
mov rax, qword [rdi + rax]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov rcx, rbp
call fcn.005f2b60
movzx eax, byte [rsi + rbx + 0xe]
sub rbx, 1
shl rax, 4
add rax, rdi
mov edx, dword [rax]
xor dword [rsp + 0x20], edx
mov edx, dword [rax + 4]
xor dword [rsp + 0x24], edx
mov edx, dword [rax + 8]
xor dword [rsp + 0x28], edx
mov eax, dword [rax + 0xc]
xor dword [rsp + 0x2c], eax
cmp rbx, 0xfffffffffffffff2
jne 0x5f2bf0
mov rcx, rbp
call fcn.005f2b60
movzx eax, byte [rsi]
shl rax, 4
add rdi, rax
mov eax, dword [rdi]
xor eax, dword [rsp + 0x20]
mov dword [rsi], eax
mov eax, dword [rdi + 4]
xor eax, dword [rsp + 0x24]
mov dword [rsi + 4], eax
mov eax, dword [rdi + 8]
xor eax, dword [rsp + 0x28]
mov dword [rsi + 8], eax
mov eax, dword [rdi + 0xc]
xor eax, dword [rsp + 0x2c]
mov dword [rsi + 0xc], eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12d, r8d
mov rbp, rcx
mov rdi, rdx
cmp r12d, 0xf
mov r13, r9
mov r8d, r8d
jbe 0x5f2ce2
mov rsi, r9
mov ebx, r12d
nop word [rax + rax]
mov rdx, rsi
mov r8d, 0x10
mov rcx, rdi
call fcn.005ec170
sub ebx, 0x10
mov rdx, rbp
mov rcx, rdi
call 0x5f2bc0
add rsi, 0x10
cmp ebx, 0xf
ja 0x5f2ca0
mov r8d, r12d
sub r12d, 0x10
shr r12d, 4
and r8d, 0xf
add r12, 1
shl r12, 4
add r13, r12
test r8d, r8d
jne 0x5f2cf4
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, r13
mov rcx, rdi
call fcn.005ec170
mov rdx, rbp
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x5f2bc0
Function at 0x5f2c70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movzx eax, byte [rcx + 0xf]
xor ebx, ebx
mov rdi, rdx
lea rbp, [rsp + 0x20]
mov rsi, rcx
shl rax, 4
mov rdx, qword [rdx + rax + 8]
mov rax, qword [rdi + rax]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov rcx, rbp
call fcn.005f2b60
movzx eax, byte [rsi + rbx + 0xe]
sub rbx, 1
shl rax, 4
add rax, rdi
mov edx, dword [rax]
xor dword [rsp + 0x20], edx
mov edx, dword [rax + 4]
xor dword [rsp + 0x24], edx
mov edx, dword [rax + 8]
xor dword [rsp + 0x28], edx
mov eax, dword [rax + 0xc]
xor dword [rsp + 0x2c], eax
cmp rbx, 0xfffffffffffffff2
jne 0x5f2bf0
mov rcx, rbp
call fcn.005f2b60
movzx eax, byte [rsi]
shl rax, 4
add rdi, rax
mov eax, dword [rdi]
xor eax, dword [rsp + 0x20]
mov dword [rsi], eax
mov eax, dword [rdi + 4]
xor eax, dword [rsp + 0x24]
mov dword [rsi + 4], eax
mov eax, dword [rdi + 8]
xor eax, dword [rsp + 0x28]
mov dword [rsi + 8], eax
mov eax, dword [rdi + 0xc]
xor eax, dword [rsp + 0x2c]
mov dword [rsi + 0xc], eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12d, r8d
mov rbp, rcx
mov rdi, rdx
cmp r12d, 0xf
mov r13, r9
mov r8d, r8d
jbe 0x5f2ce2
mov rsi, r9
mov ebx, r12d
nop word [rax + rax]
mov rdx, rsi
mov r8d, 0x10
mov rcx, rdi
call fcn.005ec170
sub ebx, 0x10
mov rdx, rbp
mov rcx, rdi
call 0x5f2bc0
add rsi, 0x10
cmp ebx, 0xf
ja 0x5f2ca0
mov r8d, r12d
sub r12d, 0x10
shr r12d, 4
and r8d, 0xf
add r12, 1
shl r12, 4
add r13, r12
test r8d, r8d
jne 0x5f2cf4
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, r13
mov rcx, rdi
call fcn.005ec170
mov rdx, rbp
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x5f2bc0