joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5323a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532526
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov dword [rsp + 0x2c], 0
bswap ebx
mov dword [rsp + 0x2c], ebx
cmp qword [rax], 0
jne 0x532505
cmp qword [rax + 0x30], 0
jne 0x53250f
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp rdx, 4
jge 0x53243f
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x1b
lea rcx, [0x006acb04]
mov qword [rax], rcx
lea rcx, [0x007191c0]
mov rdi, qword [rsp + 0x48]
mov qword [rdi], rcx
cmp dword [0x008f2cf0], 0
jne 0x53242a
mov qword [rdi + 8], rax
jmp 0x53243c
lea rdx, [rdi + 8]
mov rbx, rdi
mov rdi, rdx
call fcn.004654a0
mov rdi, rbx
mov rax, rdi
cmp byte [rax + 0x28], 0
je 0x53249a
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp qword [rax + 0x20], rdx
jge 0x53249a
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x36
lea rcx, [0x006b5e63]
mov qword [rax], rcx
lea rcx, [0x007191c0]
mov rdi, qword [rsp + 0x48]
mov qword [rdi], rcx
cmp dword [0x008f2cf0], 0
jne 0x53248f
mov qword [rdi + 8], rax
jmp 0x532505
add rdi, 8
call fcn.004654a0
jmp 0x532505
mov rbx, qword [rax + 0x18]
lea rdx, [rbx + 4]
mov rcx, qword [rax + 0x20]
mov r8, qword [rax + 0x10]
cmp rcx, rdx
jae 0x5324db
mov qword [rsp + 0x30], rbx
mov rax, r8
mov rbx, rdx
mov edi, 4
lea rsi, [0x006578a0]
call fcn.0044a920
mov r8, rax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x2c]
mov dword [r8 + rbx], esi
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
cmp dword [0x008f2cf0], 0
jne 0x5324fa
mov qword [rax + 0x10], r8
jmp 0x532505
lea rdi, [rax + 0x10]
nop
call fcn.00465620
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006576e0]
lea rbx, [0x007185a0]
nop dword [rax]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.005323a0
Function at 0x535400
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5354dc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rdx + 0x30]
call rdx
mov rcx, qword [rax + 0x30]
cmp qword [rax + 0x38], 5
nop
jne 0x53549a
cmp dword [rcx], 0x35322d50
jne 0x53549a
cmp byte [rcx + 4], 0x36
jne 0x53549a
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x38]
nop
call fcn.0051cf40
call fcn.004d8820
test rdi, rdi
jne 0x53549a
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x18]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.0051d0c0
test rbx, rbx
jne 0x5354c8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x20]
mov rdi, qword [rdx + 0x28]
mov rsi, qword [rdx + 0x30]
mov r8, qword [rdx + 0x18]
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
call fcn.0051e640
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x006576e0]
lea rbx, [0x007183b0]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00535400
Function at 0x535520
Capabilities:
Encode data using base64
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5356fc
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x80], rdi
mov r9, qword [rbx + 0x18]
mov r10, qword [r9]
mov r10, qword [r10 + 8]
mov r11, r10
shl r10, 6
sub r10, r11
sub r10, qword [r9 + 8]
lea r9, [r10 + 7]
sar r9, 0x3f
shr r9, 0x3d
lea r9, [r9 + r10]
lea r9, [r9 + 7]
sar r9, 3
cmp rsi, r9
jl 0x535649
nop word [rax + rax]
cmp r8, r9
jb 0x5356f0
mov rdx, r9
shl r9, 3
sub r9, r10
test r9, r9
jle 0x535687
nop dword [rax]
test rdi, rdi
jne 0x5355b0
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x535643
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], rcx
nop
test rdx, rdx
ja 0x5355d1
lea rax, [rsp + 0x28]
xor esi, esi
xor r8d, r8d
jmp 0x53560a
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x28]
mov rbx, rdx
xor ecx, ecx
mov rdi, rbx
lea rsi, [0x006578a0]
call fcn.0044a920
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x80]
mov rsi, rcx
mov r8, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x48], rax
mov rbx, rdi
mov rcx, rdx
nop
call fcn.004662e0
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
lea r8, [rdx - 1]
jmp 0x535692
mov rdx, qword [rbx + 0x18]
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r8
mov rsi, rdx
nop dword [rax]
call fcn.0051d200
test rbx, rbx
jne 0x535674
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x006576e0]
lea rbx, [0x007183c0]
call fcn.00436420
mov rsi, rdx
jmp 0x535649
dec r8
mov rcx, rdi
test r8, r8
jl 0x5356e3
cmp r9, 8
sbb r10d, r10d
movzx r11d, byte [rax + r8]
mov rdi, rcx
mov rcx, r9
shr r11b, cl
and r10d, r11d
mov byte [rax + r8], r10b
test r8, r8
jle 0x53568c
movzx r11d, byte [r8 + rax - 1]
lea r12, [rcx - 8]
neg r12
test r12, r12
jl 0x5356eb
cmp r12, 0x20
sbb r13d, r13d
mov rcx, r12
shl r11d, cl
and r11d, r13d
or r10d, r11d
mov byte [rax + r8], r10b
jmp 0x53568c
mov r8, rsi
mov rdi, rax
jmp 0x535687
call fcn.00435080
mov rcx, r9
mov rdx, r8
call fcn.004659c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.00535520
Function at 0x535f40
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x5361cf
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x128], rax
xor ecx, ecx
jmp 0x535fa6
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
mov ecx, 1
cmp rcx, 1
jge 0x536039
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x120], rax
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x110], xmm15
test byte [rax], al
lea rbx, [rsp + 0xf8]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x535f91
movups xmmword [rsp + 0xd0], xmm15
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe8], xmm15
mov rax, qword [rsp + 0x120]
add rax, 0x28
lea rbx, [rsp + 0xd0]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x535f91
jmp 0x5361bb
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
test byte [rax], al
lea rbx, [rax + 0x50]
lea rax, [rsp + 0x58]
call fcn.004e4420
lea rcx, [rsp + 0xa8]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x140]
mov qword [rsp + 8], rdx
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x10], rsi
call fcn.004e5ee0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rcx, [rsp + 0x80]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x140]
add rdx, 0x28
mov qword [rsp + 8], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x10], rdx
call fcn.004e5ee0
xorps xmm15, xmm15
mov r14, qword [0x008f2a80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x148]
test byte [rcx], al
nop
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rax, [rsp + 0x80]
lea rbx, [rsp + 0x38]
call fcn.004e4d80
cmp rbx, 0x20
mov ecx, 0x20
cmovl rcx, rbx
mov rdx, qword [rsp + 0x148]
cmp rax, rdx
je 0x536157
mov rbx, rax
mov rax, rdx
call fcn.004662e0
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rax, [rsp + 0xa8]
lea rbx, [rsp + 0x18]
call fcn.004e4d80
test rbx, rbx
jbe 0x5361b1
mov rdx, qword [rsp + 0x148]
movzx esi, byte [rdx + 0x1f]
movzx edi, byte [rax]
and edi, 1
shl rdi, 7
or esi, edi
mov byte [rdx + 0x1f], sil
mov rax, rdx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
xor eax, eax
mov rcx, rax
call fcn.00465940
lea rax, [0x006576e0]
lea rbx, [0x00718470]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00535f40
Function at 0x536bc0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x158]
cmp r12, qword [r14 + 0x10]
jbe 0x536d5c
sub rsp, 0x1d8
mov qword [rsp + 0x1d0], rbp
lea rbp, [rsp + 0x1d0]
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], rcx
movups xmmword [rsp + 0x1c0], xmm15
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rcx
xor edx, edx
jmp 0x536c40
mov rdx, qword [rsp + 0x18]
inc rdx
mov rax, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1e8]
nop
cmp rdx, 2
jge 0x536cbe
mov qword [rsp + 0x18], rdx
mov rax, qword [rsp + rdx*8 + 0x1c0]
mov qword [rsp + 0x1b0], rax
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
test byte [rax], al
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.00402d80
nop
test al, al
je 0x536c1e
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rax, qword [rsp + 0x1b0]
add rax, 0x28
lea rbx, [rsp + 0x20]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x536c1e
jmp 0x536d48
lea rdi, [rsp + 0x110]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465bf4
mov rbp, qword [rbp]
lea rax, [rsp + 0x110]
mov rbx, rcx
call fcn.00536940
lea rdi, [rsp + 0x70]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465bf4
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x1e8]
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.00536da0
mov rbx, rax
mov rax, qword [rsp + 0x1b8]
call fcn.005366c0
mov rbp, qword [rsp + 0x1d0]
add rsp, 0x1d8
ret
lea rax, [0x006576e0]
lea rbx, [0x00718470]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00536bc0
Function at 0x537b20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537c71
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x70], rbx
xor ecx, ecx
jmp 0x537b6f
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov ecx, 1
cmp rcx, 1
jge 0x537bdc
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
test byte [rax], al
lea rbx, [rsp + 0x40]
mov ecx, 0x28
nop dword [rax]
call fcn.00402d80
test al, al
je 0x537b5a
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov rax, qword [rsp + 0x68]
add rax, 0x28
lea rbx, [rsp + 0x18]
mov ecx, 0x28
call fcn.00402d80
test al, al
je 0x537b5a
jmp 0x537c5d
test byte [rax], al
test byte [rbx], al
mov rdx, qword [0x00892260]
mov rcx, rbx
mov rbx, rdx
call fcn.004e4360
nop
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rcx + 0x28]
mov rax, qword [rsp + 0x88]
mov qword [rax + 0x28], rdx
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
nop
mov rdx, qword [rcx + 0x50]
mov qword [rax + 0x50], rdx
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rax + 0x58], xmm0
movups xmm0, xmmword [rcx + 0x68]
movups xmmword [rax + 0x68], xmm0
lea rdx, [rax + 0x78]
add rcx, 0x78
mov rbx, qword [0x00892260]
mov rax, rdx
call fcn.004e4360
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x006576e0]
lea rbx, [0x00718470]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00537b20
Function at 0x537ca0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537dce
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
nop dword [rax]
cmp rcx, 0x40
je 0x537cfa
lea rax, [0x0066df60]
call fcn.0040d960
mov qword [rax + 8], 0x32
lea rcx, [0x006b5351]
mov qword [rax], rcx
lea rbx, [0x007191c0]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov ecx, 0x15
call fcn.00537e20
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi - 0x15]
mov rbx, qword [rsp + 0x60]
lea rsi, [rbx + 0x15]
lea rax, [rsp + 0x20]
mov ecx, 0x15
mov rbx, rsi
mov rdi, rdx
call fcn.00537e20
mov qword [rsp + 0x40], rax
test byte [rax], al
mov rcx, qword [0x00892248]
test byte [rcx], al
mov rbx, rax
call fcn.00538380
mov rbx, qword [rsp + 0x58]
test byte [rbx], al
mov rax, rbx
mov rcx, qword [rsp + 0x40]
call fcn.00538d60
mov rdi, qword [rsp + 0x70]
add rdi, 0xffffffffffffffd6
mov rbx, qword [rsp + 0x60]
add rbx, 0x2a
mov rax, qword [rsp + 0x40]
mov ecx, 0x16
call fcn.00537e20
mov rcx, qword [0x00892250]
test byte [rcx], al
mov rax, qword [rsp + 0x40]
mov rbx, rax
call fcn.00538380
mov rax, qword [rsp + 0x58]
mov rbx, rax
mov rcx, qword [rsp + 0x40]
call fcn.00538d60
mov rax, qword [rsp + 0x58]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.00537ca0

Function at 0x537e20
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537eb5
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
nop dword [rax]
cmp rcx, 0x20
jge 0x537ea1
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
lea rdx, [rsp + 0x18]
nop dword [rax]
cmp rbx, rdx
je 0x537e77
mov rax, rdx
call fcn.004662e0
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x18]
test byte [rax], al
mov rbx, rdx
nop dword [rax]
call fcn.00539c80
mov rax, qword [rsp + 0x48]
mov rbx, rax
call fcn.005392c0
mov rax, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x006576e0]
lea rbx, [0x00718480]
call fcn.00436420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00537e20
Function at 0x5380a0
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0xe0]
cmp r12, qword [r14 + 0x10]
jbe 0x53834c
sub rsp, 0x160
mov qword [rsp + 0x158], rbp
lea rbp, [rsp + 0x158]
mov qword [rsp + 0x270], rbx
lea rdi, [rsp + 0x168]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465bd4
mov rbp, qword [rbp]
nop
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
lea rbx, [rsp + 0x10]
call fcn.00538020
cmp rbx, 0x1f
jbe 0x53833e
cmp byte [rax + 0x1f], 0x7f
ja 0x53832b
mov rdx, qword [rsp + 0x270]
cmp rdx, 2
jb 0x538318
cmp rdx, 8
ja 0x538305
lea rdi, [rsp + 0x58]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465bd4
mov rbp, qword [rbp]
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
xor esi, esi
jmp 0x538179
mov r10, qword [rax + r10]
mov qword [rsp + r8*8 + 0x30], r10
lea rsi, [r8 + 1]
mov rbx, r9
cmp rsi, 4
jge 0x5381ad
mov r8, rsi
shl rsi, 3
cmp rbx, rsi
jb 0x5382f6
mov r9, rbx
sub rbx, rsi
mov r10, rsi
sub rsi, rcx
sar rsi, 0x3f
and r10, rsi
cmp rbx, 7
ja 0x538169
jmp 0x5382e9
mov rcx, rdx
mov ebx, 1
shl rbx, cl
lea r8, [rbx - 1]
xor eax, eax
xor esi, esi
jmp 0x5381ce
mov rcx, rdx
mov rbx, r11
mov rsi, rax
mov rax, r9
cmp rax, 0x100
jae 0x538298
mov r9, rax
shr rax, 6
mov r10, r9
and r9d, 0x3f
lea r11, [rcx - 0x40]
neg r11
cmp r11, r9
jbe 0x53820b
cmp rax, 5
jae 0x5382df
mov r9, qword [rsp + rax*8 + 0x30]
mov rcx, r10
shr r9, cl
jmp 0x538250
cmp rax, 5
jae 0x5382d5
mov r11, qword [rsp + rax*8 + 0x30]
mov rcx, r10
shr r11, cl
lea r12, [rax + 1]
cmp r12, 5
jae 0x5382c8
lea r12, [r9 - 0x40]
neg r12
cmp r12, 0x40
sbb r9, r9
mov r12, qword [rsp + rax*8 + 0x38]
neg rcx
shl r12, cl
and r9, r12
or r9, r11
mov rcx, r10
and r9, r8
add r9, rsi
bt r9d, 0
jb 0x53826c
lea r9, [rcx + 1]
mov r11, rbx
mov rax, rsi
jmp 0x5381c2
mov r11, rbx
shr rbx, 1
cmp rbx, r9
jbe 0x538282
mov byte [rsp + rcx + 0x58], r9b
xor eax, eax
nop
jmp 0x53828f
sub r9d, r11d
mov byte [rsp + rcx + 0x58], r9b
mov eax, 1
lea r9, [rcx + rdx]
jmp 0x5381c2
lea rdi, [rsp + 0x168]
lea rsi, [rsp + 0x58]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465ee0
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0x158]
add rsp, 0x160
ret
mov rax, r12
mov ecx, 5
call fcn.00465960
mov ecx, 5
call fcn.00465960
mov ecx, 5
call fcn.00465960
mov eax, 7
mov rcx, rbx
call fcn.00465940
mov rax, rsi
mov rcx, rbx
nop dword [rax]
call fcn.00465a00
lea rax, [0x006576e0]
lea rbx, [0x00718460]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718450]
call fcn.00436420
lea rax, [0x006576e0]
lea rbx, [0x00718490]
call fcn.00436420
mov eax, 0x1f
mov rcx, rbx
call fcn.00465940
nop
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
nop dword [rax]
call fcn.004632e0
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
jmp fcn.005380a0
Function at 0x539c80
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x539efc
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00539c80
Function at 0x53c9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53cba0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x00659880]
call fcn.0040d960
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x53ca2b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x53cb59
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x53cb80
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x53ca1d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x53ca1d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x53ca1d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x53ca1d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x53cae8
cmp r9, r10
jle 0x53cae8
ja 0x53cb63
mov rax, r10
mov rcx, r9
call fcn.00465940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004632e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0053c9c0