joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x447bd2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.004470f0
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x447af2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.004476b0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call fcn.0042eca0
lea rax, [0x00689651]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042f640
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.0042f640
call fcn.0042ef00
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042f4e0
call fcn.0042ef00
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042f4e0
call fcn.0042ef00
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042f4e0
call fcn.0042ef00
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.0042f470
call fcn.0042ef50
call fcn.0042ed30
mov eax, dword [rsp + 0x3c]
jmp 0x447ae1
call fcn.004555d0
jmp fcn.00447a70

Function at 0x448420
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
nop
inc dword [rax + 0x244]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
nop
nop
mov rdx, rax
mov qword [rcx + 0x138], rax
nop
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xd8], rax
mov dword [rsp], 0
lea rax, fcn.00438210
mov qword [rsp + 8], rax
call fcn.0042cf80
test eax, eax
jne 0x448543
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x2d0], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x2d8], rcx
lea rcx, [rsp + 0x40]
nop
mov qword [rax + 0x2e0], rcx
mov rcx, qword [0x0086b6c0]
mov qword [rsp], rcx
lea rcx, [rax + 0x2d0]
mov qword [rsp + 8], rcx
call fcn.00403f40
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x2e8]
mov rdx, qword [rax + 0x2f0]
mov rax, qword [rax + 0x2f8]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
nop
call fcn.0042d860
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call fcn.0042d860
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x44e500
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44e5e0
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00454e10]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455480
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.004555d0
jmp fcn.0044e500
Function at 0x469880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x469ad9
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x78]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rdx
call fcn.00469af0
mov eax, dword [rsp + 0x18]
mov ecx, dword [rsp + 0x1c]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x80]
xor edi, edi
xor r8d, r8d
jmp 0x469908
lea r9, [rdi + 1]
imul r10d, r8d, 0x1000193
movzx r11d, byte [rdx + rdi]
lea r8d, [r11 + r10]
mov rdi, r9
cmp rdi, rsi
jge 0x469917
cmp rdi, rbx
jb 0x4698f1
jmp 0x469ad2
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ecx
cmp r8d, eax
je 0x469a55
xor edi, edi
test dil, dil
jne 0x469a3f
mov rdi, rsi
cmp rsi, rbx
jge 0x469a29
imul r8d, r8d, 0x1000193
movzx r9d, byte [rdx + rsi]
add r8d, r9d
mov r9, rsi
sub rsi, rdi
cmp rsi, rbx
jae 0x469ac4
movzx esi, byte [rdx + rsi]
imul esi, ecx
sub r8d, esi
lea rsi, [r9 + 1]
cmp r8d, eax
je 0x46998d
xor r9d, r9d
test r9b, r9b
je 0x469936
sub rsi, rdi
mov qword [rsp + 0x90], rsi
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov r9, rsi
sub rsi, rdi
test r9, r9
jl 0x469abd
cmp rsi, r9
ja 0x469abd
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], r9
nop
mov rax, qword [rsp + 0x70]
sub rax, rsi
mov rbx, rax
neg rax
sar rax, 0x3f
and rax, rsi
add rax, rdx
mov qword [rsp], rax
sub r9, rsi
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rbx
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x28], rsi
call fcn.004027e0
movzx r9d, byte [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x40]
jmp 0x469973
mov qword [rsp + 0x90], 0xffffffffffffffff
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rdi, qword [rsp + 0x70]
cmp rsi, rdi
ja 0x469acb
mov dword [rsp + 0x44], r8d
nop
mov qword [rsp], rdx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rcx
call fcn.004027e0
movzx edi, byte [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x44]
jmp 0x46992a
call fcn.0042cd80
ud2
call fcn.0042cc40
ud2
call fcn.0042cd80
ud2
call fcn.0042cc40
ud2
call fcn.004555d0
jmp fcn.00469880
Function at 0x4702b0
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4703c0
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
jmp 0x47032a
mov rdx, rax
cmp rdx, 0x57
jae 0x4703b9
lea rax, [rdx + rdx*2]
lea rbx, [0x00848fa0]
mov rdi, qword [rbx + rax*8 + 8]
lea r8, [rsi + rdi]
lea r8, [r8 + 0x40]
cmp r8, 0xffffffffffffffc4
jge 0x470358
lea rax, [rdx + 1]
jmp 0x470327
cmp r8, 0xffffffffffffffe0
jle 0x470364
lea rax, [rdx - 1]
jmp 0x470327
mov qword [rsp + 0x20], rdx
mov rdx, rax
shl rax, 3
mov rdx, qword [rbx + rdx*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
call fcn.0046fec0
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0042cc40
ud2
call fcn.004555d0
jmp fcn.004702b0
Function at 0x4996d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4997a0
jb 0x4997ff
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00499960
aeskeygenassist xmm1, xmm0, 1
call fcn.00499970
aeskeygenassist xmm1, xmm2, 2
call fcn.00499960
aeskeygenassist xmm1, xmm0, 2
call fcn.00499970
aeskeygenassist xmm1, xmm2, 4
call fcn.00499960
aeskeygenassist xmm1, xmm0, 4
call fcn.00499970
aeskeygenassist xmm1, xmm2, 8
call fcn.00499960
aeskeygenassist xmm1, xmm0, 8
call fcn.00499970
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00499960
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00499970
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00499960
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00499970
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00499960
jmp 0x49986d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004998d0
aeskeygenassist xmm1, xmm2, 2
call fcn.00499920
aeskeygenassist xmm1, xmm2, 4
call fcn.004998d0
aeskeygenassist xmm1, xmm2, 8
call fcn.00499920
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004998d0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00499920
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004998d0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00499920
jmp 0x49986d
aeskeygenassist xmm1, xmm0, 1
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004998a0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004998a0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x49987a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4ed620
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4ed82e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rdx + rax]
lea rdx, [rdx + 7]
sar rdx, 3
mov rbx, qword [rsp + 0x60]
cmp rdx, rbx
jg 0x4ed782
test rdx, rdx
jl 0x4ed827
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r8, rax
xor r9d, r9d
jmp 0x4ed6a4
bswap rax
mov qword [rcx + r9*8], rax
inc r9
mov rdi, r11
mov rax, r10
cmp rax, 8
jl 0x4ed6e4
cmp rax, rdi
ja 0x4ed820
nop
lea r10, [rax - 8]
sub rax, r10
mov r11, rdi
sub rdi, r10
neg rdi
sar rdi, 0x3f
and rdi, r10
nop
cmp rax, 7
jbe 0x4ed819
mov rax, qword [rsi + rdi]
cmp r9, rdx
jb 0x4ed694
jmp 0x4ed812
test rax, rax
jle 0x4ed73e
xor edi, edi
xor r9d, r9d
jmp 0x4ed719
cmp rdi, 0x40
sbb r11, r11
lea r12, [rdi + 8]
movzx r13d, byte [rax + rsi - 1]
mov rax, rcx
mov rcx, rdi
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rax
mov rax, r10
mov rdi, r12
test rax, rax
jle 0x4ed72c
lea r10, [rax - 1]
cmp r10, r8
jb 0x4ed6f0
jmp 0x4ed80b
lea rax, [rdx - 1]
cmp rax, rdx
jae 0x4ed804
mov qword [rcx + rdx*8 - 8], r9
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
call fcn.004e4940
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rdx, 1
jne 0x4ed7c3
lea rax, [0x00633720]
mov qword [rsp], rax
mov qword [rsp + 8], 1
mov qword [rsp + 0x10], 1
call fcn.00440560
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x70]
mov edx, 1
mov ebx, 1
jmp 0x4ed682
mov qword [rsp + 0x30], rdx
lea rax, [0x00633720]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
lea rax, [rdx + 4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x10], rax
call fcn.00440560
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
jmp 0x4ed682
call fcn.0042cc40
ud2
call fcn.0042cc40
ud2
call fcn.0042cc40
ud2
call fcn.0042cc40
ud2
call fcn.0042cd80
ud2
call fcn.0042cd80
ud2
call fcn.004555d0
jmp fcn.004ed620
Function at 0x506a90
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x506bc8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, rax
sar rax, 0x3f
shr rax, 0x3d
add rax, rcx
sar rax, 3
shl rax, 3
sub rcx, rax
lea rax, [rcx - 8]
neg rax
cmp rax, 8
je 0x506bc1
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x506b9e
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rax, [0x00633fa0]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
call fcn.00440560
mov rcx, qword [rsp + 0x20]
cmp rcx, 8
sbb eax, eax
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rbx]
shr sil, cl
and esi, eax
mov byte [rdx], sil
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x506b80
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rbx - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rdx + r8], r10b
movzx r9d, byte [rbx + r8]
mov rcx, r11
shr r9b, cl
and r9d, eax
or r10d, r9d
mov byte [rdx + r8], r10b
inc r8
cmp r8, rsi
jl 0x506b4b
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rsp + 0x48]
jmp 0x506b9e
call fcn.004555d0
jmp fcn.00506a90
Function at 0x51b840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x51ba43
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
lea rax, [0x0063a460]
mov qword [rsp], rax
call fcn.0040c140
mov rax, qword [rsp + 8]
mov qword [rsp + 0x58], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x51b8d6
movzx r8d, byte [rsi + rdx]
movzx r9d, byte [rbx + rdi]
xor r8d, r9d
mov byte [rdx + rsi], r8b
inc rdi
inc rsi
cmp rdi, rax
jge 0x51b8b2
cmp rsi, rcx
jge 0x51b8b2
jb 0x51b88a
jmp 0x51ba3c
nop
mov rax, qword [rsp + 0x58]
movzx edi, byte [rax + 3]
lea r8d, [rdi + 1]
mov byte [rax + 3], r8b
cmp dil, 0xff
je 0x51b9f9
mov rcx, rsi
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
cmp rcx, rsi
jge 0x51ba32
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0x90]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x98]
mov qword [rsp + 8], rbx
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x10], rsi
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0x18], rdi
call rcx
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0x90]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 4
mov qword [rsp + 0x18], 4
call rcx
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x90]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 0
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rbx
call rcx
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rbx + 0x20]
mov rdi, qword [rsp + 0x90]
mov qword [rsp], rdi
call rsi
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
xor edi, edi
jmp 0x51b8a1
movzx edi, byte [rax + 2]
lea r8d, [rdi + 1]
mov byte [rax + 2], r8b
cmp dil, 0xff
jne 0x51b8ce
movzx edi, byte [rax + 1]
lea r8d, [rdi + 1]
mov byte [rax + 1], r8b
cmp dil, 0xff
jne 0x51b8ce
movzx edi, byte [rax]
inc edi
mov byte [rax], dil
jmp 0x51b8ce
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.0042cc40
ud2
call fcn.004555d0
jmp fcn.0051b840
Function at 0x51da10
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x51db4c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
xor eax, eax
jmp 0x51db2c
mov rbx, qword [rsp + 0x28]
mov r8, rbx
shl rbx, 8
lea r9, [0x00888760]
add rbx, r9
mov dword [rbx + rdx*4], eax
lea rdx, [rdi + 1]
mov rax, r8
mov rcx, rsi
cmp rdx, 0x10
jge 0x51db14
mov qword [rsp + 0x30], rdx
lea rbx, [rax - 7]
neg rbx
shl rbx, 2
cmp rbx, 0x40
sbb rsi, rsi
shl rax, 6
shl rcx, 4
lea r9, [0x008407c0]
add rax, r9
add rax, rcx
movzx eax, byte [rax + rdx]
mov rcx, rbx
shl rax, cl
and rax, rsi
mov qword [rsp], rax
lea rax, [0x00839ec0]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.0051d9b0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rbx, rdx
and rdx, 2
shl rdx, 4
mov rsi, rbx
and rbx, 1
or rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
shl rbx, 1
or edx, ebx
mov rbx, rax
shl rax, 1
shr rbx, 0x1f
or rax, rbx
movzx edx, dl
cmp rdx, 0x40
jb 0x51da3f
jmp 0x51db45
inc rcx
cmp rcx, 4
jge 0x51db29
mov qword [rsp + 0x38], rcx
xor edx, edx
jmp 0x51da62
inc rax
cmp rax, 8
jge 0x51db3b
mov qword [rsp + 0x28], rax
xor ecx, ecx
jmp 0x51db17
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.0042cc40
ud2
call fcn.004555d0
jmp fcn.0051da10
Function at 0x57de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 8]
cmp rax, qword [rcx + 0x10]
jbe 0x57e02b
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov rax, qword [0x008638f8]
mov qword [rsp + 0x50], rax
lea rcx, [0x00633ee0]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rax
call fcn.00440560
mov rax, qword [rsp + 0x18]
mov rcx, qword [0x008638f8]
mov qword [rsp + 0x68], rcx
mov rdx, qword [0x008638f0]
mov qword [rsp + 0x78], rdx
movzx ebx, byte [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x50]
xor r8d, r8d
xor r9d, r9d
jmp 0x57debd
inc r8
cmp r8, rcx
jge 0x57e003
movzx r10d, word [rdx + r8*2]
test rsi, rsi
je 0x57deeb
movzx r11d, word [rsi + 0xf0]
test r11w, r11w
je 0x57dffb
cmp r10w, r11w
jb 0x57deba
test rsi, rsi
je 0x57df01
movzx r11d, word [rsi + 0xf2]
test r11w, r11w
je 0x57df01
cmp r10w, r11w
ja 0x57deba
test bl, bl
je 0x57df0d
cmp r10w, 0x301
jb 0x57deba
mov qword [rsp + 0x60], r8
mov word [rsp + 0x46], r10w
mov qword [rsp + 0x48], r9
cmp r10w, 0x304
je 0x57dfaa
xor r11d, r11d
test r11b, r11b
jne 0x57deba
lea r11, [r9 + 1]
cmp r11, rdi
ja 0x57df47
mov word [rax + r9*2], r10w
mov r9, r11
jmp 0x57deba
lea rcx, [0x00633ee0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], r9
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r11
call fcn.00440670
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
lea r11, [rcx + 1]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
movzx ebx, byte [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
movzx r10d, word [rsp + 0x46]
jmp 0x57df3a
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x70], rax
call fcn.0057e040
movzx r11d, byte [rsp]
xor r11d, 1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
movzx ebx, byte [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
movzx r10d, word [rsp + 0x46]
jmp 0x57df2c
test rsi, rsi
jmp 0x57deeb
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xb0], rdi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
call fcn.004555d0
jmp fcn.0057de20
Function at 0x140002a40
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x140
mov r9d, r8d
mov rdi, rcx
sub r9d, 0x80
je 0x140002a82
sub r9d, 0x40
je 0x140002a7a
cmp r9d, 0x40
je 0x140002a72
mov eax, 0xfffff800
add rsp, 0x140
pop rdi
ret
mov dword [rcx], 0xe
jmp 0x140002a88
mov dword [rcx], 0xc
jmp 0x140002a88
mov dword [rcx], 0xa
mov qword [rsp + 0x150], rbx
lea rbx, [rcx + 0x10]
mov qword [rcx + 8], rbx
lea rcx, [rsp + 0x20]
call fcn.140002ce0
test eax, eax
jne 0x140002cca
mov eax, dword [rsp + 0x20]
lea eax, [rax*4]
movsxd rcx, eax
mov rax, qword [rsp + 0x28]
lea r9, [rax + rcx*4]
mov eax, dword [rax + rcx*4]
mov dword [rbx], eax
mov eax, dword [r9 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r9 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r9 + 0xc]
sub r9, 0x10
mov dword [rbx + 0xc], eax
add rbx, 0x10
mov r10d, dword [rdi]
dec r10d
test r10d, r10d
jle 0x140002cae
lea r11, [0x140000000]
nop dword [rax]
mov r8d, dword [r9]
dec r10d
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
mov eax, r8d
shr rax, 0x18
mov edx, dword [r11 + rcx*4 + 0x63e0]
movzx eax, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6fe0]
mov eax, r8d
shr eax, 0x10
movzx ecx, al
shr r8d, 8
movzx eax, byte [rcx + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6be0]
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rcx*4 + 0x67e0]
mov dword [rbx], edx
mov r8d, dword [r9 + 4]
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
mov eax, r8d
shr rax, 0x18
mov edx, dword [r11 + rcx*4 + 0x63e0]
movzx eax, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6fe0]
mov eax, r8d
shr eax, 0x10
movzx ecx, al
shr r8d, 8
movzx eax, byte [rcx + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6be0]
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rcx*4 + 0x67e0]
mov dword [rbx + 4], edx
mov r8d, dword [r9 + 8]
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
mov eax, r8d
shr rax, 0x18
mov edx, dword [r11 + rcx*4 + 0x63e0]
movzx eax, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6fe0]
mov eax, r8d
shr eax, 0x10
movzx ecx, al
shr r8d, 8
movzx eax, byte [rcx + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6be0]
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rcx*4 + 0x67e0]
mov dword [rbx + 8], edx
mov r8d, dword [r9 + 0xc]
sub r9, 0x10
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
mov eax, r8d
shr rax, 0x18
mov edx, dword [r11 + rcx*4 + 0x63e0]
movzx eax, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6fe0]
mov eax, r8d
shr eax, 0x10
movzx ecx, al
shr r8d, 8
movzx eax, byte [rcx + r11 + 0x51e0]
xor edx, dword [r11 + rax*4 + 0x6be0]
movzx eax, r8b
movzx ecx, byte [rax + r11 + 0x51e0]
xor edx, dword [r11 + rcx*4 + 0x67e0]
mov dword [rbx + 0xc], edx
add rbx, 0x10
test r10d, r10d
jg 0x140002b00
mov eax, dword [r9]
mov dword [rbx], eax
mov eax, dword [r9 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r9 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r9 + 0xc]
mov dword [rbx + 0xc], eax
xor eax, eax
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret