joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3f3f
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x4a3dbf
cmp rbx, 1
je 0x4a3d86
cmp rbx, 8
jle 0x4a3dcc
movups xmmword [rsp + 0x1c], xmm15
movups xmmword [rsp + 0x2c], xmm15
xor edx, edx
jmp 0x4a3ed6
movzx edx, byte [rax]
cmp edx, 0x80
mov esi, 0xfffd
cmovge edx, esi
mov rax, rcx
mov rbx, rdi
mov ecx, edx
nop
call fcn.004a3a20
test rax, rax
jl 0x4a3db2
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 0x88], rax
cmp rdi, 1
jne 0x4a3df4
movzx ecx, byte [rcx]
cmp ecx, 0x80
mov edx, 0xfffd
cmovge ecx, edx
mov dword [rsp + 0x5c], ecx
jmp 0x4a3e81
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
jmp 0x4a3e21
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xa0]
mov rbx, rcx
mov rcx, qword [rsp + 0x98]
test rbx, rbx
jle 0x4a3e67
mov qword [rsp + 0x68], rbx
call fcn.0046a6e0
mov qword [rsp + 0x60], rbx
mov ecx, eax
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
call fcn.004a3a20
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub rcx, rdx
test rax, rax
jl 0x4a3e06
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x88]
mov rbx, rcx
mov ecx, edx
test rbx, rbx
jle 0x4a3ead
mov qword [rsp + 0x70], rbx
call fcn.0046a6e0
mov rcx, qword [rsp + 0x70]
sub rcx, rbx
mov edx, dword [rsp + 0x5c]
nop dword [rax]
cmp eax, edx
jne 0x4a3e74
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov r8d, esi
shr sil, 5
movzx esi, sil
mov r9d, dword [rsp + rsi*4 + 0x1c]
bts r9d, r8d
mov dword [rsp + rsi*4 + 0x1c], r9d
inc rdx
cmp rdi, rdx
jle 0x4a3ee9
movzx esi, byte [rcx + rdx]
nop
cmp sil, 0x80
jb 0x4a3eba
cmp rdi, rdx
movups xmm0, xmmword [rsp + 0x1c]
movups xmmword [rsp + 0x3c], xmm0
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x4c], xmm0
nop dword [rax]
jg 0x4a3dcc
lea rcx, [rbx - 1]
jmp 0x4a3f0f
dec rcx
test rcx, rcx
jl 0x4a3f32
movzx edx, byte [rax + rcx]
mov ebx, edx
shr dl, 5
movzx edx, dl
mov edx, dword [rsp + rdx*4 + 0x3c]
bt edx, ebx
jae 0x4a3f0c
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045a0c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a3d40
Function at 0x4b8d80
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8fbb
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x4b8e1a
mov qword [rsp + 0x88], rax
lea rbx, [0x006d68c0]
mov rcx, rax
lea rax, [0x00bc54e0]
call fcn.00465d80
test cl, cl
jne 0x4b8e03
mov rax, qword [rsp + 0x88]
call fcn.004b82a0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x00761fe8]
call fcn.00447b80
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.004b9f40
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4b8e40
lea rdx, [0x006cef00]
cmp rax, rdx
jne 0x4b8e2b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
nop
nop dword [rax + rax]
call fcn.00457520
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x00686680]
call fcn.00409b00
inc rdx
nop dword [rax]
cmp rbx, rdx
jle 0x4b8e84
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4b8e3a
lea rax, [0x00bc54e0]
lea rbx, [0x006d68c0]
lea rdi, [0x006cef00]
call fcn.00465f40
lea rdx, [0x006cef00]
cmp rax, rdx
jne 0x4b8fab
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
lea rcx, [0x00673280]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x0069a880]
call fcn.0040c9c0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00c4bdb0], 0
je 0x4b8edd
mov rbx, rax
lea rax, [0x0069a880]
call fcn.004129a0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
nop
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.00401400
nop
call fcn.00457620
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4b8f46
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x4b8f38
mov dword [rsi + 0x10], edx
cmp dword [0x00c4bdb0], 0
je 0x4b8f67
call fcn.0045c000
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00bc54e0]
lea rbx, [0x006d68c0]
lea rdi, [0x006cef00]
call fcn.00465f40
lea rdx, [0x006cef00]
cmp rax, rdx
jne 0x4b8f9c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x00686680]
call fcn.00409b00
mov rbx, rdx
lea rcx, [0x00686680]
call fcn.00409b00
nop
mov qword [rsp + 8], rax
call fcn.0045a0c0
mov rax, qword [rsp + 8]
jmp fcn.004b8d80
Function at 0x4d0e60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d0f82
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x00bad7c8]
call fcn.004a0340
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004d0fa0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x00c4bbb8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x4d0f57
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
sub rbx, rsi
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
inc rsi
and rsi, rdi
mov rdi, qword [rsp + 0x48]
lea rax, [rdi + rsi]
lea rdx, [rsp + 0x50]
nop
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
call fcn.0045a0c0
jmp fcn.004d0e60
Function at 0x4f0070
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4f00ea
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4f00a0
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4f00c0
cmp rdx, 0
je 0x4f010c
test rdx, 0xf
je 0x4f008d
test rdx, 7
jne 0x4f00c0
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4f008d
ret
Function at 0x4f3460
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x40], r9
shr rbx, 2
xor edx, edx
jmp 0x4f34a1
mov r8, rdx
shl r8, 2
mov r10, r8
sub r8, rcx
sar r8, 0x3f
and r10, r8
mov r8d, dword [rax + r10]
bswap r8d
lea r10, [rdx + 1]
mov dword [rdi + rdx*4], r8d
mov rdx, r10
cmp rdx, rbx
jl 0x4f347b
jmp 0x4f34c0
mov rdx, r8
sub r8, rbx
xor ecx, dword [rdi + r8*4]
mov dword [rdi + rdx*4], ecx
inc rdx
nop dword [rax + rax]
cmp rsi, rdx
jle 0x4f35d2
mov ecx, dword [rdi + rdx*4 - 4]
test rbx, rbx
je 0x4f36b4
mov rax, rdx
mov r8, rdx
nop dword [rax]
cmp rbx, 0xffffffffffffffff
jne 0x4f34ed
neg rax
xor edx, edx
jmp 0x4f34f2
cqo
idiv rbx
test rdx, rdx
jne 0x4f356d
lea rdx, [0x008ab560]
movzx r10d, byte [rax + rdx - 1]
shl r10d, 0x18
rol ecx, 8
mov r11d, ecx
shr ecx, 0x18
lea r12, str.cw
movzx ecx, byte [rcx + r12]
shl ecx, 0x18
mov r13d, r11d
shr r11d, 0x10
movzx r11d, r11b
movzx r11d, byte [r11 + r12]
shl r11d, 0x10
or r11d, ecx
mov ecx, r13d
shr r13d, 8
movzx r13d, r13b
movzx r13d, byte [r13 + r12]
shl r13d, 8
or r13d, r11d
movzx ecx, cl
movzx ecx, byte [rcx + r12]
or r13d, ecx
nop
xor r10d, r13d
mov ecx, r10d
lea r10, str.cw
jmp 0x4f34a8
cmp rbx, 6
jle 0x4f35c6
cmp rdx, 4
jne 0x4f35c6
mov edx, ecx
shr ecx, 0x18
lea r10, str.cw
movzx ecx, byte [rcx + r10]
shl ecx, 0x18
mov r11d, edx
shr edx, 0x10
movzx edx, dl
movzx edx, byte [rdx + r10]
shl edx, 0x10
or ecx, edx
mov edx, r11d
shr r11d, 8
movzx r11d, r11b
movzx r11d, byte [r11 + r10]
shl r11d, 8
or ecx, r11d
movzx edx, dl
movzx edx, byte [rdx + r10]
or ecx, edx
jmp 0x4f34a8
lea r10, str.cw
jmp 0x4f34a8
test r9, r9
je 0x4f35db
xor eax, eax
jmp 0x4f35e4
pop rbp
ret
add rax, 4
mov rsi, rcx
cmp rsi, rax
jle 0x4f35f3
mov rcx, rsi
sub rsi, rax
xor edx, edx
jmp 0x4f3600
pop rbp
ret
lea r8, [rdx + rax]
mov dword [r9 + r8*4], ebx
inc rdx
cmp rdx, 4
jge 0x4f35dd
lea rbx, [rdx + rsi]
lea rbx, [rbx - 4]
mov ebx, dword [rdi + rbx*4]
test rax, rax
jle 0x4f368c
lea r8, [rax + 4]
cmp rcx, r8
jle 0x4f368c
mov r8d, ebx
shr ebx, 0x18
lea r10, str.cw
movzx r11d, byte [r10 + rbx]
lea r12, [0x008b2180]
mov ebx, dword [r12 + r11*4]
mov r11d, r8d
shr r8d, 0x10
movzx r8d, r8b
movzx r8d, byte [r10 + r8]
lea r13, [0x008b2580]
xor ebx, dword [r13 + r8*4]
mov r8d, r11d
shr r11d, 8
movzx r11d, r11b
movzx r11d, byte [r11 + r10]
lea r15, [0x008b2980]
xor ebx, dword [r15 + r11*4]
movzx r8d, r8b
movzx r8d, byte [r8 + r10]
lea r11, [0x008b2d80]
xor ebx, dword [r11 + r8*4]
jmp 0x4f35f5
lea r10, str.cw
lea r11, [0x008b2d80]
lea r12, [0x008b2180]
lea r13, [0x008b2580]
lea r15, [0x008b2980]
jmp 0x4f35f5
call fcn.004308a0
nop
int3
Function at 0x4f4220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4f425f
jb 0x4f4274
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4f42e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4f431f
jb 0x4f4334
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4f43a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4f4474
jb 0x4f44d3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004f41c0
aeskeygenassist xmm1, xmm0, 1
call fcn.004f41e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004f41c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004f41e0
aeskeygenassist xmm1, xmm2, 4
call fcn.004f41c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004f41e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004f41c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004f41e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004f41c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004f41e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004f41c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004f41e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004f41c0
jmp 0x4f4541
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004f4120
aeskeygenassist xmm1, xmm2, 2
call fcn.004f4180
aeskeygenassist xmm1, xmm2, 4
call fcn.004f4120
aeskeygenassist xmm1, xmm2, 8
call fcn.004f4180
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004f4120
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004f4180
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004f4120
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004f4180
jmp 0x4f4541
aeskeygenassist xmm1, xmm0, 1
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 2
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 4
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 8
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004f40e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004f40e0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4f454e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4f4680
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x00764010]
movdqu xmm14, xmmword [0x00764020]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4f476b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4f476b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4f47d0
ret
Function at 0x4f8800
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4f89f1
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movzx ecx, byte [rbx + 0x1b]
shl rcx, 0x18
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
shl rdx, 0x10
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
shl rsi, 8
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
shl r8, 0x38
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
shl r9, 0x30
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
shl r10, 0x28
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
shl r11, 0x20
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
shl r12, 0x18
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
shl r13, 0x10
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
shl r15, 8
mov qword [rsp + 0x28], r15
movzx ecx, byte [rbx + 0x10]
mov qword [rsp + 0x20], rcx
movzx edx, byte [rbx + 0xf]
shl rdx, 0x38
mov qword [rsp + 0x18], rdx
movzx esi, byte [rbx + 0xe]
shl rsi, 0x30
mov qword [rsp + 0x10], rsi
movzx edi, byte [rbx + 0xd]
shl rdi, 0x28
mov qword [rsp + 8], rdi
movzx r8d, byte [rbx + 0xc]
shl r8, 0x20
mov qword [rsp], r8
movzx r9d, byte [rbx + 0xb]
shl r9, 0x18
movzx r10d, byte [rbx + 0xa]
shl r10, 0x10
movzx r11d, byte [rbx + 9]
shl r11, 8
movzx r12d, byte [rbx + 8]
movzx r13d, byte [rbx + 7]
shl r13, 0x38
movzx ecx, byte [rbx + 6]
shl rcx, 0x30
movzx r15d, byte [rbx + 5]
shl r15, 0x28
movzx edx, byte [rbx + 4]
shl rdx, 0x20
movzx esi, byte [rbx + 3]
shl rsi, 0x18
movzx edi, byte [rbx + 2]
shl rdi, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, rdi
add rbx, rsi
add rdx, rbx
add rdx, r15
add rcx, rdx
add rcx, r13
mov qword [rax], rcx
lea rcx, [r12 + r11]
add rcx, r10
add rcx, r9
mov rdx, qword [rsp]
add rcx, rdx
mov rdx, qword [rsp + 8]
add rcx, rdx
mov rdx, qword [rsp + 0x10]
add rcx, rdx
mov rdx, qword [rsp + 0x18]
add rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
add rcx, rdx
mov rdx, qword [rsp + 0x30]
add rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, rdx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov rdx, qword [rsp + 0x48]
add rcx, rdx
mov rdx, qword [rsp + 0x50]
add rcx, rdx
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
add rcx, rdx
mov rdx, qword [rsp + 0x70]
add rcx, rdx
mov rdx, qword [rsp + 0x78]
add rcx, rdx
mov qword [rax + 0x18], rcx
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.0045a0c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f8800
Function at 0x505d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x505e96
push rbp
mov rbp, rsp
sub rsp, 0xa0
nop word [rax + rax]
cmp cl, 0x10
jae 0x505e82
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov byte [rsp + 0xc0], cl
nop
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
nop
movabs rdx, 0xffffffff00000000
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0xffffffffffffffff
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x88], rdx
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x90], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0x98], rsi
mov rsi, qword [rbx]
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsi + 0x10], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x90]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x98]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov edx, 1
jmp 0x505e74
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
mov rsi, qword [rax + rsi*8]
mov r8d, edx
xor edx, ecx
movzx edi, dl
dec edi
shr edi, 0x1f
lea edx, [r8 + 1]
mov byte [rsp + 0x27], dl
nop
mov rax, rbx
mov rbx, rsi
mov rcx, rax
call fcn.00505c40
mov rax, qword [rsp + 0xb0]
movzx ecx, byte [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
movzx edx, byte [rsp + 0x27]
cmp dl, 0x10
jb 0x505e26
add rsp, 0xa0
pop rbp
ret
lea rax, [0x0067b560]
lea rbx, [0x007652d0]
call fcn.00431120
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045a0c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00505d20
Function at 0x50cd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x50cef6
push rbp
mov rbp, rsp
sub rsp, 0xd0
nop word [rax + rax]
cmp cl, 0x10
jae 0x50cee2
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rbx
mov byte [rsp + 0xf0], cl
nop
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
movabs rdx, 0xffffffff00000001
mov qword [rsp + 0x58], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], 1
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0xb8], xmm15
mov qword [rsp + 0xc8], 0
lea rdx, [rsp + 0x88]
mov qword [rsp + 0xb8], rdx
lea rsi, [rsp + 0x58]
mov qword [rsp + 0xc0], rsi
lea rsi, [rsp + 0x28]
mov qword [rsp + 0xc8], rsi
mov rsi, qword [rbx]
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0xc0]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rdx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0xc8]
movups xmm0, xmmword [rsi]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsi + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov edx, 1
jmp 0x50ced4
test byte [rax], al
lea esi, [rdx - 1]
movzx esi, sil
mov rsi, qword [rax + rsi*8]
mov r8d, edx
xor edx, ecx
movzx edi, dl
dec edi
shr edi, 0x1f
lea edx, [r8 + 1]
mov byte [rsp + 0x27], dl
nop
mov rax, rbx
mov rbx, rsi
mov rcx, rax
call fcn.0050cc60
mov rax, qword [rsp + 0xe0]
movzx ecx, byte [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
movzx edx, byte [rsp + 0x27]
cmp dl, 0x10
jb 0x50ce86
add rsp, 0xd0
pop rbp
ret
lea rax, [0x0067b560]
lea rbx, [0x007652e0]
call fcn.00431120
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045a0c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0050cd40