joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52938c
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x2065af141d69caf7
mov qword [rsp + 0x19], rdx
movabs rdx, 0xefb1831c7220bc7c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x4fefb1831c7220bc
mov qword [rsp + 0x22], rdx
movabs rdx, 0x206c61f217207413
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6d1572f56e2921be
mov qword [rsp + 0x32], rdx
movabs rdx, 0xfd25f53af6695982
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf04010004211d08
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1015040d150d080e
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x28100c1d1b091015
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9221a1401111303
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc1b221c26151f09
mov qword [rsp + 0x60], rdx
movabs rdx, 0x82422000526190f
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x529324
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2e
jge 0x52935c
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x29
jae 0x52937f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 0x29
jb 0x52930a
jmp 0x529373
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x29
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00461020
mov eax, edi
mov ecx, 0x29
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00529240
Function at 0x52a2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x52a3fb
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0x2e7d947b7d62706f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd37298644d65687a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x747a407fd3729864
mov qword [rsp + 0x28], rdx
movabs rdx, 0x401f696072643cb6
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7b699e497373655d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7169b55980538518
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe47eb16425ac20c3
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2bbe3345507c726f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7d6e579f948374da
mov qword [rsp + 0x58], rdx
movabs rdx, 0x721b64591ddc206c
mov qword [rsp + 0x60], rdx
lea rdi, [rsp + 0x68]
lea rsi, [0x00624b20]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046165a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x52a391
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x50
jge 0x52a3c8
movzx edx, byte [rsp + rax + 0x68]
movzx esi, byte [rsp + rax + 0x69]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4c
jae 0x52a3ee
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
nop dword [rax + rax]
cmp rsi, 0x4c
jb 0x52a377
jmp 0x52a3e2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x4c
call fcn.0044bb20
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x4c
call fcn.00461020
mov eax, edi
mov ecx, 0x4c
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0052a2a0
Function at 0x52ab00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x52ac5a
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x252093e5734d5a5d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc8f37a6538664363
mov qword [rsp + 0x27], rdx
movabs rdx, 0x646e6fc8f37a6538
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x357d69233a4c8442
mov qword [rsp + 0x32], rdx
movabs rdx, 0x697e74502c666f7c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x366b276d8520698b
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1b0e05212a0c1405
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x270b082921091b0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc1e012a13130424
mov qword [rsp + 0x58], rdx
movabs rdx, 0x14030d00291f2623
mov qword [rsp + 0x60], rdx
movabs rdx, 0x280f191f180a281b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x91a0f1b1627241a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x21021728150d0f18
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x52abf8
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x36
jge 0x52ac2a
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x52ac4d
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0x2b
jb 0x52abde
jmp 0x52ac41
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2b
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
call fcn.00461020
mov eax, edi
mov ecx, 0x2b
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.0052ab00

Function at 0x52b780
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x52b7eb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x52b7a4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x52b7c1
cmp rdx, 0
je 0x52b80d
test rdx, 0xf
je 0x52b79d
test rdx, 7
jne 0x52b7c1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x52b79d
ret
Function at 0x52c240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52c378
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xe6bde465c3f1ba52
mov qword [rsp + 0x19], rdx
movabs rdx, 0xdff7736570e6bde4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xbb6874d361fb7101
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6fdbbe4a6569ccf3
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6405afff6166ec44
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1e14191600060203
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1e14051d111b0111
mov qword [rsp + 0x46], rdx
movabs rdx, 0x220f1e14051d111b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb23061a08140c05
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe1b1918151b0d21
mov qword [rsp + 0x58], rdx
movabs rdx, 0x703190e1b141816
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x52c318
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x52c348
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x52c36b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x52c2fb
jmp 0x52c35f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0052c240
Function at 0x52dfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e0da
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x61416f74f87918c1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x75706e69efa5fceb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x75645d74a207b516
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3b3bfcd93200fc2
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1c0616150108181d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1e111e1900151c06
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13100119161d1e12
mov qword [rsp + 0x48], rdx
movabs rdx, 0x900101b03191919
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb1c1d181f100a11
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x52e077
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x26
jge 0x52e0a9
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x52e0cd
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 0x20
jb 0x52e05d
jmp 0x52e0c1
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.0052dfc0
Function at 0x52f5c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x52f5ff
jb 0x52f614
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x52f680
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x52f754
jb 0x52f7b3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0052f560
aeskeygenassist xmm1, xmm0, 1
call fcn.0052f580
aeskeygenassist xmm1, xmm2, 2
call fcn.0052f560
aeskeygenassist xmm1, xmm0, 2
call fcn.0052f580
aeskeygenassist xmm1, xmm2, 4
call fcn.0052f560
aeskeygenassist xmm1, xmm0, 4
call fcn.0052f580
aeskeygenassist xmm1, xmm2, 8
call fcn.0052f560
aeskeygenassist xmm1, xmm0, 8
call fcn.0052f580
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0052f560
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0052f580
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0052f560
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0052f580
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0052f560
jmp 0x52f821
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0052f4c0
aeskeygenassist xmm1, xmm2, 2
call fcn.0052f520
aeskeygenassist xmm1, xmm2, 4
call fcn.0052f4c0
aeskeygenassist xmm1, xmm2, 8
call fcn.0052f520
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0052f4c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0052f520
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0052f4c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0052f520
jmp 0x52f821
aeskeygenassist xmm1, xmm0, 1
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 2
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 4
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 8
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0052f480
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0052f480
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x52f82e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x52fd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x52fee8
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x4839a045aa2d422b
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd6a7284d3020fd11
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2d70c0599d75251
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2c656463fcb74459
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6e6d04f36cb75a0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xfeffda7b22e92686
mov qword [rsp + 0x40], rdx
movabs rdx, 0x33323130dc5d8d77
mov qword [rsp + 0x48], rdx
movabs rdx, 0x28293938d4cf62c1
mov qword [rsp + 0x50], rdx
movabs rdx, 0x32232d052e2c0f3e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x152d03311a063929
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a1f062f2b0a3809
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2d33092006282131
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2c191a25020d05
mov qword [rsp + 0x78], rdx
movabs rdx, 0x21160b2f220d2d0e
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2b39123e1408132b
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2021172a241b132d
mov qword [rsp + 0x90], rdx
movabs rdx, 0x33a3f2d150d3b06
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x52fe83
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x48
jge 0x52feb5
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x40
jae 0x52fedb
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 0x40
jb 0x52fe69
jmp 0x52fecf
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x40
call fcn.0044bb20
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x40
call fcn.00461020
mov eax, edi
mov ecx, 0x40
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0052fd40
Function at 0x533e80
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x533e97
inc rax
cmp rax, 4
jge 0x533eaf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x533e94
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x533ec0
inc rax
cmp rax, 4
jge 0x533ece
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x533ef7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x533edb
jmp 0x533ebd

Function at 0x534580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53468c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4064e7d82976f269
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf833832e9048f2
mov qword [rsp + 0x26], rdx
movabs rdx, 0xdea8edbf74da1673
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x150b160801070a0c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x50d150b16080107
mov qword [rsp + 0x38], rdx
movabs rdx, 0x409120c0e0b1217
mov qword [rsp + 0x40], rdx
movabs rdx, 0x31703040a080912
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf140a0b080a0d11
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x534628
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x22
jge 0x53465c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x53467f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 0x18
jb 0x53460e
jmp 0x534673
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00534580
Function at 0x534a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x534b4c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2006726574f213a8
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xcf28f3f7a6052120
mov qword [rsp + 0x26], rdx
movabs rdx, 0x208b926e1802f96f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1412100e080d0106
mov qword [rsp + 0x36], rdx
movabs rdx, 0x110c1412100e080d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9090d150a100d10
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc00120a0c140208
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20b020d0d0d1412
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x534ae8
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x54]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x22
jge 0x534b1c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x17
jae 0x534b3f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x54]
cmp rsi, 0x17
jb 0x534ace
jmp 0x534b33
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00534a40

Function at 0x534b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x534c5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8164d68761989ed6
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20876e86744d6179
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7f9ca29fad83fbb2
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1000510110c12
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1308131016121408
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8051004150e020a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2170807080e0e0d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x534bf9
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x20
jge 0x534c2b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x534c4e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3c]
cmp rsi, 0x18
jb 0x534bdf
jmp 0x534c42
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.00534b60
Function at 0x538380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53843e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa4e3e965a66fb8a1
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x9ef17386
movabs rdx, 0x7030801000a0006
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0xb00050b
xor eax, eax
jmp 0x5383e1
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 - 0x36]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 - 0x36]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x53840e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x538431
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x5383c4
jmp 0x538425
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
nop
call fcn.0045eda0
jmp fcn.00538380

Function at 0x539660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53973d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2007696c9805a182
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x72fda36eed8f8a20
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd0d0d000909030a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2080d0d0d000909
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10a0c09010c0206
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x5396e0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x53970d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x539730
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x5396c2
jmp 0x539724
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00539660
Function at 0x53a480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a57d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6ecbe1e453d7417a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x866a806ecbe1e453
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x87dfea06f4e4da48
mov qword [rsp + 0x24], rdx
movabs rdx, 0x90506010b080911
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc040306050c020d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x120e08100c040306
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf120a06110e0a12
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x53a520
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x53a54d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x53a570
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x53a4ff
jmp 0x53a564
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0053a480

Function at 0x53c200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53c347
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xe3eeac2ad661b963
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc552cd727473e051
mov qword [rsp + 0x23], rdx
movabs rdx, 0xe4378d920c552cd
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6978c43320e64a65
mov qword [rsp + 0x30], rdx
movabs rdx, 0xae6e659e0d6ad16d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4b35e332f3f0c06b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2a0826210119162c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x528262c1e0e2806
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2c25270d13010f04
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a272c1619090111
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a090703242a1425
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf2005141e171f17
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x53c2e7
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x49]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x49]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x53c317
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2d
jae 0x53c33a
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x53c2ca
jmp 0x53c32e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053c200