joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f275d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x299777ec65655147
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x517eeb9853581029
mov qword [rsp + 0x24], rdx
movabs rdx, 0x650369a707f4068d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x61113090d0e0701
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd0c07071313090b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf04110b0d0c0707
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe11081004150112
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f2700
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x6e]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x6e]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4f272d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f2750
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x17
jb 0x4f26df
jmp 0x4f2744
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004610a0
mov eax, edi
mov ecx, 0x17
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004f2660

Function at 0x4f3a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3b68
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb274cb4291847854
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x61d2cb20a16c6661
mov qword [rsp + 0x26], rdx
movabs rdx, 0xfa8861d2cb20a16c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x65b996addb908292
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa12040101160712
mov qword [rsp + 0x38], rdx
movabs rdx, 0x518131411110212
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb181500110d0903
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd1700050e001011
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f3b0b
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x20
jge 0x4f3b38
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4f3b5b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4f3aee
jmp 0x4f3b4f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004610a0
mov eax, edi
mov ecx, 0x1a
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004f3a60
Function at 0x4f3b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3c7d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9e08b66c6574ffa0
mov qword [rsp + 0x18], rdx
movabs rdx, 0xbdd61fa53f49e08
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x65626918206cab61
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa14120d060d1412
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0a0d070a0c0a06
mov qword [rsp + 0x36], rdx
movabs rdx, 0x8100f0a0d070a0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1007001205141001
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f3c20
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x24]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x24]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4f3c4d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f3c70
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x4f3bff
jmp 0x4f3c64
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004610a0
mov eax, edi
mov ecx, 0x16
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004f3b80

Function at 0x4f52e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f53ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xa27d09cae27375fd
mov qword [rsp + 0x18], rdx
movabs rdx, 0x9569a27d09cae273
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x91c2d0ef6f5ab2cb
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe050607110f1104
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf100b09040e05
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa1004070300040e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f536d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x7d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x7d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4f539a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4f53bd
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4f5350
jmp 0x4f53b1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004610a0
mov eax, edi
mov ecx, 0x12
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004f52e0
Function at 0x4f6f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f703d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd5f3f90e69df6148
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x647053747ad9d5f3
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7479e0f720f0f061
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x31308140c120704
mov qword [rsp + 0x34], rdx
movabs rdx, 0x209020b07081413
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x151210060209020b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x131202021214050f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f6fe0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x69]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x69]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4f700d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f7030
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x16
jb 0x4f6fbf
jmp 0x4f7024
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004610a0
mov eax, edi
mov ecx, 0x16
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004f6f40

Function at 0x4fda80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0xb710ab8f66040309
mov qword [rsp + 0x18], rax
movabs rax, 0x4733994bde7c06b7
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x20]
movzx ecx, byte [rsp + 0x26]
sub eax, ecx
movzx ecx, byte [rsp + 0x1f]
movzx edx, byte [rsp + 0x1e]
sub ecx, edx
movzx edx, byte [rsp + 0x18]
movzx ebx, byte [rsp + 0x1a]
xor edx, ebx
movzx ebx, byte [rsp + 0x25]
movzx esi, byte [rsp + 0x1d]
sub ebx, esi
movzx esi, byte [rsp + 0x27]
movzx edi, byte [rsp + 0x19]
sub esi, edi
movzx edi, byte [rsp + 0x24]
movzx r8d, byte [rsp + 0x22]
sub edi, r8d
movzx r8d, byte [rsp + 0x1b]
movzx r9d, byte [rsp + 0x21]
sub r8d, r9d
movzx r9d, byte [rsp + 0x23]
movzx r10d, byte [rsp + 0x1c]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r9 + r10]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x4fdb66
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x4fdb5a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
Function at 0x4fe840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe92c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6fa3740a17f5641a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc350a365a46fa374
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9e65fcc7c0b7b7cf
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1110120d00080203
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30c0300040c020f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0d140a06120e08
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fe8ca
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x4fe8fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4fe91f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0x15
jb 0x4fe8b0
jmp 0x4fe913
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004610a0
mov eax, edi
mov ecx, 0x15
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004fe840

Function at 0x501200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5012fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x751d1e54fd3836f7
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x47631aeb30da751d
mov qword [rsp + 0x20], rdx
movabs rdx, 0xff46df6e96df1f69
mov qword [rsp + 0x28], rdx
movabs rdx, 0x300020f11020b06
mov qword [rsp + 0x30], rdx
movabs rdx, 0x113050411131304
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1510111501090a0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15090f0d140d1408
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5012a0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x5012cd
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5012f0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x50127f
jmp 0x5012e4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004610a0
mov eax, edi
mov ecx, 0x16
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00501200
Function at 0x51d260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51d37a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xeee667d8f3d8f473
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x98f88520896f7972
mov qword [rsp + 0x25], rdx
movabs rdx, 0x746e69987d98f885
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x496a65cde96f6f04
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb01101c010f050d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x107161415100b01
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6111b0101140e0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x21404190903141b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x181c01030502160d
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x51d317
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x26
jge 0x51d349
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x51d36d
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x1d
jb 0x51d2fd
jmp 0x51d361
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0044bb80
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004610a0
mov eax, edi
mov ecx, 0x1d
call fcn.004610a0
nop
call fcn.0045ee20
nop
jmp fcn.0051d260

Function at 0x51d9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51da5d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbec7540ac8849c8d
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x20
movabs rdx, 0x603060204060001
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7030300
xor eax, eax
nop
jmp 0x51da00
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x6b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x6b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x51da2d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x51da50
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x51d9e2
jmp 0x51da44
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.0051d9a0
Function at 0x525c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x525d3d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6d2fa79278878ca2
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x712961806d2fa792
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc8656482a8738876
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1040e07050a1005
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc0b0d060f000413
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x10080301000f0c0b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1002030f06061004
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x525ce0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x525d0d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x525d30
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x525cbf
jmp 0x525d24
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004610a0
mov eax, edi
mov ecx, 0x14
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00525c40
Function at 0x52dce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52de18
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x7966205330e807d1
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1e53533e20796620
mov qword [rsp + 0x20], rdx
movabs rdx, 0x286958373be35604
mov qword [rsp + 0x28], rdx
movabs rdx, 0x656220e22b6da665
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa2788135726f8afd
mov qword [rsp + 0x38], rdx
movabs rdx, 0x180a110200160a24
mov qword [rsp + 0x40], rdx
movabs rdx, 0x103050006191d0d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x120a0a2114030609
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf032219050d0c05
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb041d180316090c
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe181e000d231e22
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x52ddb8
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x4f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x4f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x52dde8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x52de0b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x52dd9b
jmp 0x52ddff
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.0044bb80
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.004610a0
mov eax, edi
mov ecx, 0x25
call fcn.004610a0
nop
call fcn.0045ee20
nop dword [rax]
jmp fcn.0052dce0

Function at 0x52e320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e44c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x20b5ab6553d44166
mov qword [rsp + 0x19], rdx
movabs rdx, 0x72c973a464df6597
mov qword [rsp + 0x21], rdx
movabs rdx, 0x11aa1b121572c973
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb8fdc35f88dfcc90
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x181b111413010e02
mov qword [rsp + 0x36], rdx
movabs rdx, 0x31a1c161006121a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1904031a1c161006
mov qword [rsp + 0x40], rdx
movabs rdx, 0x311141805060319
mov qword [rsp + 0x48], rdx
movabs rdx, 0x611150a17131a06
mov qword [rsp + 0x50], rdx
movabs rdx, 0x130115110c140817
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x52e3e6
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2a
jge 0x52e41c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1d
jae 0x52e43f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 0x1d
jb 0x52e3cc
jmp 0x52e433
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.0044bb80
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004610a0
mov eax, edi
mov ecx, 0x1d
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0052e320
Function at 0x530f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53103d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xda670c6365726e1b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3cd22215092f5f9
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe819fa1103cd2221
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x123254f3c4fc421
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd0814151312100e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x510140c0a0c0d08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7051407120d000f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b0c0c1711000918
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1700100d160b0f14
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x530fe0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x52]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x53100d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x531030
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x530fbd
jmp 0x531024
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.0044bb80
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004610a0
mov eax, edi
mov ecx, 0x1c
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00530f20
Function at 0x532420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53252c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1d0b65277bf42e73
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x3a6b371bd9c4e74f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x74e69d4164203a6b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe2726f68732033ed
mov qword [rsp + 0x50], rdx
movabs rdx, 0x16021d02170b0203
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x10e1d0413121d1d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0c120c0609010e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30217071701140a
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x5324c8
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x28]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x5324fc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x53251f
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x28]
cmp rsi, 0x1e
jb 0x5324ae
jmp 0x532513
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004610a0
mov eax, edi
mov ecx, 0x1e
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00532420

Function at 0x532540
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x5325ab
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x532564
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x532581
cmp rdx, 0
je 0x5325cd
test rdx, 0xf
je 0x53255d
test rdx, 7
jne 0x532581
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x53255d
ret
Function at 0x537d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537e4c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x61ab6f013e130b63
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa45cec5d20dae665
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc8df6869e0a45cec
mov qword [rsp + 0x28], rdx
movabs rdx, 0x42afd069cf205feb
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1215091604020e15
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4130d0c0a1b0901
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a15090f0f06091c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140910100d18030d
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x537de8
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x20
jge 0x537e1c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x537e3f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0x1d
jb 0x537dce
jmp 0x537e33
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004610a0
mov eax, edi
mov ecx, 0x1d
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00537d40
Function at 0x539240
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x53927f
jb 0x539294
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret