joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c400
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x38]
mov rsi, rdx
mov edx, dword [rcx + 0x30]
mov rbx, rcx
mov byte [rsp + 0x60], r8b
xor r8d, r8d
mov byte [rsp + 0x68], r9b
mov ecx, edx
add ecx, eax
setb r8b
add r8d, dword [rbx + 0x34]
movbe dword [rsp + 0x2c], ecx
movbe dword [rsp + 0x28], r8d
cmp eax, 0x1b8
je 0x41c5f0
cmp eax, 0x1b7
jg 0x41c5a0
test eax, eax
je 0x41c590
mov r8d, 0x1b8
sub ecx, 0x1b8
lea rdx, [0x006be800]
sub r8d, eax
mov dword [rbx + 0x30], ecx
mov rcx, rbx
movsxd r8, r8d
call fcn.0041c220
lea rdx, [rsp + 0x68]
mov r8d, 8
mov rcx, rbx
call fcn.0041c220
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
lea rdx, [rsp + 0x28]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 0x30], eax
call fcn.0041c220
mov eax, 0x18
shrx eax, dword [rbx], eax
mov byte [rsi], al
mov eax, 0x10
shrx eax, dword [rbx], eax
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rbx + 0x3c], 1
jmp 0x41c456
mov r8d, 0x200
sub ecx, 0x200
lea rdx, [0x006be800]
sub r8d, eax
mov dword [rbx + 0x30], ecx
mov rcx, rbx
movsxd r8, r8d
call fcn.0041c220
sub dword [rbx + 0x30], 0x1b8
mov r8d, 0x1b8
lea rdx, [0x006be801]
mov rcx, rbx
call fcn.0041c220
mov dword [rbx + 0x3c], 1
jmp 0x41c47a
sub edx, 8
mov r8d, 8
mov rcx, rbx
mov dword [rbx + 0x30], edx
lea rdx, [rsp + 0x60]
call fcn.0041c220
mov eax, dword [rbx + 0x30]
jmp 0x41c493
Function at 0x42cbb0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x42cc73
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x42cc49
mov byte [rsp + 0x20], dl
lea rcx, [rcx + 0x40]
mov r8d, 0xb0
xor edx, edx
mov byte [rsp + 0x21], 0
mov word [rsp + 0x22], 0x101
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x28], 0
call sub.msvcrt.dll_memset
vmovdqu xmm0, xmmword [0x006c04c0]
mov dword [rbx + 0xe4], esi
xor eax, eax
vmovdqu xmm1, xmmword [0x006c0490]
vmovdqu xmm2, xmmword [0x006c04a0]
vmovdqu xmm3, xmmword [0x006c04b0]
vpxor xmm0, xmm0, xmmword [rsp + 0x20]
vmovdqu xmmword [rbx + 0x10], xmm1
vmovdqu xmmword [rbx + 0x20], xmm2
vmovdqu xmmword [rbx + 0x30], xmm3
vmovdqu xmmword [rbx], xmm0
add rsp, 0x68
pop rbx
pop rsi
ret
mov edx, 0xf0
call fcn.0042f8c0
cmp byte [rbx + 0xe8], 0
je 0x42cc64
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x42cc42
mov eax, 0xffffffff
jmp 0x42cc42

Function at 0x42cc80
Capabilities:
Hash data using sha512

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov r12, rcx
mov rbx, rdx
mov r14, r8
mov rsi, r9
test rcx, rcx
je 0x42cdc7
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x42cd96
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x42cd96
test r8, r8
je 0x42cd96
mov byte [rsp + 0x20], dl
lea rcx, [rcx + 0x40]
mov r8d, 0xb0
xor edx, edx
mov byte [rsp + 0x21], r9b
mov word [rsp + 0x22], 0x101
lea r13, [rsp + 0x60]
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x28], 0
mov rdi, r13
call sub.msvcrt.dll_memset
vmovdqu xmm0, xmmword [0x006c04c0]
xor eax, eax
mov ecx, 0x10
vmovdqu xmm1, xmmword [0x006c0490]
vmovdqu xmm2, xmmword [0x006c04a0]
mov r8, rsi
mov rdx, r14
vmovdqu xmm3, xmmword [0x006c04b0]
vpxor xmm0, xmm0, xmmword [rsp + 0x20]
mov dword [r12 + 0xe4], ebx
rep stosq qword [rdi], rax
mov rcx, r13
vmovdqu xmmword [r12 + 0x10], xmm1
vmovdqu xmmword [r12 + 0x20], xmm2
vmovdqu xmmword [r12 + 0x30], xmm3
vmovdqu xmmword [r12], xmm0
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, r12
call fcn.0042c890
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.0042f8c0
xor eax, eax
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov edx, 0xf0
mov rcx, r12
call fcn.0042f8c0
cmp byte [r12 + 0xe8], 0
je 0x42cdb7
mov qword [r12 + 0x58], 0xffffffffffffffff
mov qword [r12 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x42cd85
mov eax, 0xffffffff
jmp 0x42cd85

Function at 0x431be0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x431c30
test rdx, rdx
je 0x431c30
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
sete al
movzx eax, al
neg eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x431c21
Function at 0x44e270
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x40
lea eax, [rdx - 1]
mov rbx, rcx
cmp al, 0x1f
ja 0x44e2d8
mov byte [rsp + 0x20], dl
lea rcx, [rcx + 0x20]
mov r8d, 0x99
xor edx, edx
mov byte [rsp + 0x21], 0
mov word [rsp + 0x22], 0x101
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x28], 0
call sub.msvcrt.dll_memset
vmovdqu xmm0, xmmword [0x006c10f0]
xor eax, eax
vmovdqu xmmword [rbx + 0x10], xmm0
vmovdqu xmm0, xmmword [0x006c10e0]
vpxor xmm0, xmm0, xmmword [rsp + 0x20]
vmovdqu xmmword [rbx], xmm0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
jmp 0x44e2d2

Function at 0x44f7d0
Capabilities:
Hash data using sha256

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea eax, [rdx - 1]
mov r12, rcx
mov rdi, r8
mov esi, r9d
cmp al, 0x1f
ja 0x44f997
lea eax, [r9 - 1]
cmp al, 0x1f
ja 0x44f997
test r8, r8
je 0x44f997
mov byte [rsp + 0x20], dl
lea rcx, [rcx + 0x20]
mov r8d, 0x99
xor edx, edx
mov byte [rsp + 0x21], r9b
mov word [rsp + 0x22], 0x101
lea rbx, [rsp + 0x40]
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x28], 0
call sub.msvcrt.dll_memset
vmovdqu xmm0, xmmword [0x006c10f0]
movzx r9d, sil
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov rcx, rbx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov rax, rdi
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
vmovdqu xmmword [r12 + 0x10], xmm0
vmovdqu xmm0, xmmword [0x006c10e0]
vpxor xmm0, xmm0, xmmword [rsp + 0x20]
vmovdqu xmmword [r12], xmm0
cmp r9d, 8
jae 0x44f970
xor edx, edx
test r9b, 4
jne 0x44f950
test r9b, 2
jne 0x44f930
and r9d, 1
jne 0x44f920
mov r8d, 0x40
mov rdx, rbx
mov rcx, r12
call fcn.0044f6d0
mov rax, rbx
nop word [rax + rax]
mov rdx, rax
lea rsi, [rsp + 0x80]
inc rax
mov byte [rdx], 0
cmp rax, rsi
jne 0x44f8f0
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
ret
movzx eax, byte [rax + rdx]
mov byte [rcx + rdx], al
jmp 0x44f8d3
movzx r8d, word [rax + rdx]
mov word [rcx + rdx], r8w
add rdx, 2
and r9d, 1
je 0x44f8d3
jmp 0x44f920
mov edx, dword [rax]
mov dword [rcx], edx
mov edx, 4
test r9b, 2
je 0x44f8cd
jmp 0x44f930
mov r8d, r9d
xor eax, eax
and r8d, 0xfffffff8
mov edx, eax
add eax, 8
mov rcx, qword [rdi + rdx]
mov qword [rbx + rdx], rcx
cmp eax, r8d
jb 0x44f979
lea rcx, [rbx + rax]
add rax, rdi
jmp 0x44f8bb
mov eax, 0xffffffff
jmp 0x44f908
Function at 0x456750
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x28
movabs rax, 0x6a09e667f3bcc908
mov r8d, 0x200
xor edx, edx
vmovq xmm0, rax
movabs rax, 0xbb67ae8584caa73b
vpbroadcastq ymm1, xmm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
movabs rax, 0x3c6ef372fe94f82b
vmovdqu ymmword [rcx + 0x220], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
movabs rax, 0xa54ff53a5f1d36f1
vmovdqu ymmword [rcx + 0x240], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
movabs rax, 0x510e527fade682d1
vmovdqu ymmword [rcx + 0x260], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
movabs rax, 0x9b05688c2b3e6c1f
vmovdqu ymmword [rcx + 0x280], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
movabs rax, 0x1f83d9abfb41bd6b
vmovdqu ymmword [rcx + 0x2a0], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
movabs rax, 0x5be0cd19137e2179
vmovdqu ymmword [rcx + 0x2c0], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
mov eax, 0x1010020
vmovdqu ymmword [rcx + 0x2e0], ymm0
vmovq xmm0, rax
vpbroadcastq ymm0, xmm0
vpxor ymm0, ymm0, ymm1
vmovdqu ymmword [rcx + 0x200], ymm0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x300], xmm0
vmovdqu xmm0, xmmword [0x006c11e0]
vmovdqu xmmword [rcx + 0x310], xmm0
vzeroupper
call sub.msvcrt.dll_memset
xor eax, eax
add rsp, 0x28
ret
Function at 0x4862c0
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
mov edx, 0x40
lea rcx, [0x0073b7c0]
call fcn.00488040
lea rcx, [0x0073b900]
add rsp, 0x28
jmp fcn.0054f020
Function at 0x4f7fa0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp fcn.004f5020
Function at 0x4fbff0
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x88
jmp fcn.004f8290

Function at 0x4fc280
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x48
jmp fcn.004f8290
Function at 0x55bb00
Capabilities:
Hash data using sha256

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
vmovdqu xmm3, xmmword [0x006fc6d0]
vmovdqu xmm2, xmmword [0x006fc6c0]
xor r8d, r8d
lea r12, [rsp + 0x20]
mov rbx, rcx
mov rsi, rdx
mov rcx, r12
vmovdqu xmmword [rsp + 0x30], xmm3
vmovdqu xmmword [rsp + 0x20], xmm2
call fcn.00559700
lea rdx, [rsi + 0x40]
xor r8d, r8d
mov rcx, r12
call fcn.00559700
vmovdqu xmm1, xmmword [0x006fc6c0]
xor r8d, r8d
mov rdx, r12
vmovdqu xmm2, xmmword [0x006fc6d0]
vmovdqu xmm4, xmmword [0x006fc6a0]
mov rcx, rbx
vmovdqu xmm5, xmmword [0x006fc6b0]
vmovdqu xmmword [rbx], xmm1
vmovdqu xmmword [rbx + 0x10], xmm2
vmovdqu xmmword [rsp + 0x40], xmm4
vmovdqu xmmword [rsp + 0x50], xmm5
call fcn.00559700
vmovdqu xmm0, xmmword [0x006fc6e0]
vmovdqu xmm3, xmmword [rbx]
vmovdqu xmm4, xmmword [rbx + 0x10]
vpshufb xmm1, xmm3, xmm0
vpshufb xmm0, xmm4, xmm0
vmovdqu xmmword [rbx], xmm1
vmovdqu xmmword [rbx + 0x10], xmm0
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
Function at 0x577be0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r9, rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
jmp fcn.00419560
Function at 0x57ee10
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, 0x7531
sub rsp, 0xe0
mov rbx, rdx
mov edx, 0x40
mov rsi, rcx
lea r12, [rsp + 0x3f]
and r12, 0xffffffffffffffe0
mov r8, r12
call fcn.00419560
mov rcx, qword [0x00725140]
call sub.libgcc_s_seh_1.dll___emutls_get_address
mov r8d, 0x80000
mov rcx, r12
mov r10d, 0x20000
mov rdx, qword [rax]
mov r11, rax
call fcn.0057e800
vmovdqu xmm4, xmmword [r12 + 0x10]
vpxor xmm1, xmm4, xmmword [r12 + 0x30]
mov rsi, qword [rsi + 0x23]
mov r9, qword [r12]
mov r8, qword [r12 + 8]
xor rsi, qword [r12 + 0xc0]
xor r9, qword [r12 + 0x20]
xor r8, qword [r12 + 0x28]
mov rcx, qword [r11]
nop word cs:[rax + rax]
nop
mov rdx, r9
vmovdqu xmm0, xmm1
vmovq xmm2, r9
vpinsrq xmm1, xmm2, r8, 1
and edx, 0x7fff0
add rdx, rcx
vmovdqu xmm3, xmmword [rdx]
vaesenc xmm1, xmm3, xmm1
vpxor xmm0, xmm0, xmm1
vmovq qword [rbp - 0x10], xmm1
vmovq qword [rdx], xmm0
vmovhlps xmm0, xmm0, xmm0
vmovq r14, xmm0
shr r14, 0x18
vmovq r13, xmm0
mov eax, r14d
and r14d, 1
shr ax, 3
and eax, 6
or eax, r14d
add eax, eax
sarx eax, edi, eax
shl eax, 0x1c
and eax, 0x30000000
xor rax, r13
vmovq r13, xmm1
and r13d, 0x7fff0
add r13, rcx
mov qword [rdx + 8], rax
mov rax, qword [rbp - 0x10]
mov r14, qword [r13]
mov r15, qword [r13 + 8]
mul r14
mov qword [rbp - 0x10], rax
add r8, qword [rbp - 0x10]
add r9, rdx
mov rax, rsi
mov qword [r13], r9
xor r9, r14
mov qword [rbp - 8], rdx
xor rax, r8
xor r8, r15
dec r10
mov qword [r13 + 8], rax
jne 0x57eeb0
mov rcx, qword [r11]
mov r8d, 0x80000
mov rdx, r12
call fcn.0057e370
mov rcx, r12
mov edx, 0x18
call fcn.00418ac0
movzx eax, byte [r12]
lea r9, [0x006fcd40]
mov r8, rbx
mov edx, 0xc8
mov rcx, r12
and eax, 3
call qword [r9 + rax*8]
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x57efc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, 0x7531
sub rsp, 0xe0
mov rbx, rdx
mov edx, 0x40
mov rsi, rcx
lea r12, [rsp + 0x3f]
and r12, 0xffffffffffffffe0
mov r8, r12
call fcn.00419560
mov rcx, qword [0x00725140]
call sub.libgcc_s_seh_1.dll___emutls_get_address
mov r8d, 0x80000
mov rcx, r12
mov r10d, 0x20000
mov rdx, qword [rax]
mov r11, rax
call fcn.0057e800
vmovdqu xmm4, xmmword [r12 + 0x10]
vpxor xmm1, xmm4, xmmword [r12 + 0x30]
mov rsi, qword [rsi + 0x23]
mov r9, qword [r12]
mov r8, qword [r12 + 8]
xor rsi, qword [r12 + 0xc0]
xor r9, qword [r12 + 0x20]
xor r8, qword [r12 + 0x28]
mov rcx, qword [r11]
nop word cs:[rax + rax]
nop
mov rdx, r9
vmovdqu xmm0, xmm1
vmovq xmm2, r9
vpinsrq xmm1, xmm2, r8, 1
and edx, 0x3fff0
add rdx, rcx
vmovdqu xmm3, xmmword [rdx]
vaesenc xmm1, xmm3, xmm1
vpxor xmm0, xmm0, xmm1
vmovq qword [rbp - 0x10], xmm1
vmovq qword [rdx], xmm0
vmovhlps xmm0, xmm0, xmm0
vmovq r14, xmm0
shr r14, 0x18
vmovq r13, xmm0
mov eax, r14d
and r14d, 1
shr ax, 3
and eax, 6
or eax, r14d
add eax, eax
sarx eax, edi, eax
shl eax, 0x1c
and eax, 0x30000000
xor rax, r13
vmovq r13, xmm1
and r13d, 0x3fff0
add r13, rcx
mov qword [rdx + 8], rax
mov rax, qword [rbp - 0x10]
mov r14, qword [r13]
mov r15, qword [r13 + 8]
mul r14
mov qword [rbp - 0x10], rax
add r8, qword [rbp - 0x10]
add r9, rdx
mov rax, rsi
mov qword [r13], r9
xor r9, r14
mov qword [rbp - 8], rdx
xor rax, r8
xor r8, r15
dec r10
mov qword [r13 + 8], rax
jne 0x57f060
mov rcx, qword [r11]
mov r8d, 0x80000
mov rdx, r12
call fcn.0057e370
mov rcx, r12
mov edx, 0x18
call fcn.00418ac0
movzx eax, byte [r12]
lea r9, [0x006fcd40]
mov r8, rbx
mov edx, 0xc8
mov rcx, r12
and eax, 3
call qword [r9 + rax*8]
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x57f170
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, 0x7531
sub rsp, 0xe0
mov rbx, rdx
mov edx, 0x40
mov rsi, rcx
lea r12, [rsp + 0x3f]
and r12, 0xffffffffffffffe0
mov r8, r12
call fcn.00419560
mov rcx, qword [0x00725140]
call sub.libgcc_s_seh_1.dll___emutls_get_address
mov r8d, 0x200000
mov rcx, r12
mov r10d, 0x40000
mov rdx, qword [rax]
mov r11, rax
call fcn.0057e800
vmovdqu xmm4, xmmword [r12 + 0x10]
vpxor xmm1, xmm4, xmmword [r12 + 0x30]
mov rsi, qword [rsi + 0x23]
mov r9, qword [r12]
mov r8, qword [r12 + 8]
xor rsi, qword [r12 + 0xc0]
xor r9, qword [r12 + 0x20]
xor r8, qword [r12 + 0x28]
mov rcx, qword [r11]
nop word cs:[rax + rax]
nop
mov rdx, r9
vmovdqu xmm0, xmm1
vmovq xmm2, r9
vpinsrq xmm1, xmm2, r8, 1
and edx, 0x1ffff0
add rdx, rcx
vmovdqu xmm3, xmmword [rdx]
vaesenc xmm1, xmm3, xmm1
vpxor xmm0, xmm0, xmm1
vmovq qword [rbp - 0x10], xmm1
vmovq qword [rdx], xmm0
vmovhlps xmm0, xmm0, xmm0
vmovq r14, xmm0
shr r14, 0x18
vmovq r13, xmm0
mov eax, r14d
and r14d, 1
shr ax, 3
and eax, 6
or eax, r14d
add eax, eax
sarx eax, edi, eax
shl eax, 0x1c
and eax, 0x30000000
xor rax, r13
vmovq r13, xmm1
and r13d, 0x1ffff0
add r13, rcx
mov qword [rdx + 8], rax
mov rax, qword [rbp - 0x10]
mov r14, qword [r13]
mov r15, qword [r13 + 8]
mul r14
mov qword [rbp - 0x10], rax
add r8, qword [rbp - 0x10]
add r9, rdx
mov rax, rsi
mov qword [r13], r9
xor r9, r14
mov qword [rbp - 8], rdx
xor rax, r8
xor r8, r15
dec r10
mov qword [r13 + 8], rax
jne 0x57f210
mov rcx, qword [r11]
mov r8d, 0x200000
mov rdx, r12
call fcn.0057e370
mov rcx, r12
mov edx, 0x18
call fcn.00418ac0
movzx eax, byte [r12]
lea r9, [0x006fcd40]
mov r8, rbx
mov edx, 0xc8
mov rcx, r12
and eax, 3
call qword [r9 + rax*8]
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x57f320
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, 0x7531
sub rsp, 0xe0
mov rbx, rdx
mov edx, 0x40
mov rsi, rcx
lea r12, [rsp + 0x3f]
and r12, 0xffffffffffffffe0
mov r8, r12
call fcn.00419560
mov rcx, qword [0x00725140]
call sub.libgcc_s_seh_1.dll___emutls_get_address
mov r8d, 0x100000
mov rcx, r12
mov r10d, 0x40000
mov rdx, qword [rax]
mov r11, rax
call fcn.0057e800
vmovdqu xmm4, xmmword [r12 + 0x10]
vpxor xmm1, xmm4, xmmword [r12 + 0x30]
mov rsi, qword [rsi + 0x23]
mov r9, qword [r12]
mov r8, qword [r12 + 8]
xor rsi, qword [r12 + 0xc0]
xor r9, qword [r12 + 0x20]
xor r8, qword [r12 + 0x28]
mov rcx, qword [r11]
nop word cs:[rax + rax]
nop
mov rdx, r9
vmovdqu xmm0, xmm1
vmovq xmm2, r9
vpinsrq xmm1, xmm2, r8, 1
and edx, 0xffff0
add rdx, rcx
vmovdqu xmm3, xmmword [rdx]
vaesenc xmm1, xmm3, xmm1
vpxor xmm0, xmm0, xmm1
vmovq qword [rbp - 0x10], xmm1
vmovq qword [rdx], xmm0
vmovhlps xmm0, xmm0, xmm0
vmovq r14, xmm0
shr r14, 0x18
vmovq r13, xmm0
mov eax, r14d
and r14d, 1
shr ax, 3
and eax, 6
or eax, r14d
add eax, eax
sarx eax, edi, eax
shl eax, 0x1c
and eax, 0x30000000
xor rax, r13
vmovq r13, xmm1
and r13d, 0xffff0
add r13, rcx
mov qword [rdx + 8], rax
mov rax, qword [rbp - 0x10]
mov r14, qword [r13]
mov r15, qword [r13 + 8]
mul r14
mov qword [rbp - 0x10], rax
add r8, qword [rbp - 0x10]
add r9, rdx
mov rax, rsi
mov qword [r13], r9
xor r9, r14
mov qword [rbp - 8], rdx
xor rax, r8
xor r8, r15
dec r10
mov qword [r13 + 8], rax
jne 0x57f3c0
mov rcx, qword [r11]
mov r8d, 0x100000
mov rdx, r12
call fcn.0057e370
mov rcx, r12
mov edx, 0x18
call fcn.00418ac0
movzx eax, byte [r12]
lea r9, [0x006fcd40]
mov r8, rbx
mov edx, 0xc8
mov rcx, r12
and eax, 3
call qword [r9 + rax*8]
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x57f4d0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, 0x7531
sub rsp, 0xe0
mov rbx, rdx
mov edx, 0x40
mov rsi, rcx
lea r12, [rsp + 0x3f]
and r12, 0xffffffffffffffe0
mov r8, r12
call fcn.00419560
mov rcx, qword [0x00725140]
call sub.libgcc_s_seh_1.dll___emutls_get_address
mov r8d, 0x40000
mov rcx, r12
mov r10d, 0x10000
mov rdx, qword [rax]
mov r11, rax
call fcn.0057e800
vmovdqu xmm4, xmmword [r12 + 0x10]
vpxor xmm1, xmm4, xmmword [r12 + 0x30]
mov rsi, qword [rsi + 0x23]
mov r9, qword [r12]
mov r8, qword [r12 + 8]
xor rsi, qword [r12 + 0xc0]
xor r9, qword [r12 + 0x20]
xor r8, qword [r12 + 0x28]
mov rcx, qword [r11]
nop word cs:[rax + rax]
nop
mov rdx, r9
vmovdqu xmm0, xmm1
vmovq xmm2, r9
vpinsrq xmm1, xmm2, r8, 1
and edx, 0x3fff0
add rdx, rcx
vmovdqu xmm3, xmmword [rdx]
vaesenc xmm1, xmm3, xmm1
vpxor xmm0, xmm0, xmm1
vmovq qword [rbp - 0x10], xmm1
vmovq qword [rdx], xmm0
vmovhlps xmm0, xmm0, xmm0
vmovq r14, xmm0
shr r14, 0x18
vmovq r13, xmm0
mov eax, r14d
and r14d, 1
shr ax, 3
and eax, 6
or eax, r14d
add eax, eax
sarx eax, edi, eax
shl eax, 0x1c
and eax, 0x30000000
xor rax, r13
vmovq r13, xmm1
and r13d, 0x3fff0
add r13, rcx
mov qword [rdx + 8], rax
mov rax, qword [rbp - 0x10]
mov r14, qword [r13]
mov r15, qword [r13 + 8]
mul r14
mov qword [rbp - 0x10], rax
add r8, qword [rbp - 0x10]
add r9, rdx
mov rax, rsi
mov qword [r13], r9
xor r9, r14
mov qword [rbp - 8], rdx
xor rax, r8
xor r8, r15
dec r10
mov qword [r13 + 8], rax
jne 0x57f570
mov rcx, qword [r11]
mov r8d, 0x40000
mov rdx, r12
call fcn.0057e370
mov rcx, r12
mov edx, 0x18
call fcn.00418ac0
movzx eax, byte [r12]
lea r9, [0x006fcd40]
mov r8, rbx
mov edx, 0xc8
mov rcx, r12
and eax, 3
call qword [r9 + rax*8]
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x57f680
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov edi, 0x7531
sub rsp, 0xe0
mov rbx, rdx
mov edx, 0x40
mov rsi, rcx
lea r12, [rsp + 0x3f]
and r12, 0xffffffffffffffe0
mov r8, r12
call fcn.00419560
mov rcx, qword [0x00725140]
call sub.libgcc_s_seh_1.dll___emutls_get_address
mov r8d, 0x40000
mov rcx, r12
mov r10d, 0x10000
mov rdx, qword [rax]
mov r11, rax
call fcn.0057e800
vmovdqu xmm4, xmmword [r12 + 0x10]
vpxor xmm1, xmm4, xmmword [r12 + 0x30]
mov rsi, qword [rsi + 0x23]
mov r9, qword [r12]
mov r8, qword [r12 + 8]
xor rsi, qword [r12 + 0xc0]
xor r9, qword [r12 + 0x20]
xor r8, qword [r12 + 0x28]
mov rcx, qword [r11]
nop word cs:[rax + rax]
nop
mov rdx, r9
vmovdqu xmm0, xmm1
vmovq xmm2, r9
vpinsrq xmm1, xmm2, r8, 1
and edx, 0x1fff0
add rdx, rcx
vmovdqu xmm3, xmmword [rdx]
vaesenc xmm1, xmm3, xmm1
vpxor xmm0, xmm0, xmm1
vmovq qword [rbp - 0x10], xmm1
vmovq qword [rdx], xmm0
vmovhlps xmm0, xmm0, xmm0
vmovq r14, xmm0
shr r14, 0x18
vmovq r13, xmm0
mov eax, r14d
and r14d, 1
shr ax, 3
and eax, 6
or eax, r14d
add eax, eax
sarx eax, edi, eax
shl eax, 0x1c
and eax, 0x30000000
xor rax, r13
vmovq r13, xmm1
and r13d, 0x1fff0
add r13, rcx
mov qword [rdx + 8], rax
mov rax, qword [rbp - 0x10]
mov r14, qword [r13]
mov r15, qword [r13 + 8]
mul r14
mov qword [rbp - 0x10], rax
add r8, qword [rbp - 0x10]
add r9, rdx
mov rax, rsi
mov qword [r13], r9
xor r9, r14
mov qword [rbp - 8], rdx
xor rax, r8
xor r8, r15
dec r10
mov qword [r13 + 8], rax
jne 0x57f720
mov rcx, qword [r11]
mov r8d, 0x40000
mov rdx, r12
call fcn.0057e370
mov rcx, r12
mov edx, 0x18
call fcn.00418ac0
movzx eax, byte [r12]
lea r9, [0x006fcd40]
mov r8, rbx
mov edx, 0xc8
mov rcx, r12
and eax, 3
call qword [r9 + rax*8]
nop
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x608750
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
lea r11, [0x0071fcb0]
lea rsi, [r11 + 0x18]
mov r9, rcx
lea rbx, [rcx + 0x5fe]
movzx r10d, word [r11]
mov r8, rbx
xor ecx, ecx
movzx eax, word [r8]
sub r8, 2
mov edx, eax
imul eax, eax, 0xaaab
shr eax, 0x19
lea eax, [rax + rax*2]
shl eax, 8
sub edx, eax
mov eax, ecx
movzx edx, dx
and eax, 0xf
shlx eax, r10d, eax
add ax, word [r9 + rdx*2]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x300
jne 0x608770
add r11, 2
cmp rsi, r11
jne 0x608767
pop rbx
pop rsi
ret