joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52b720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52b852
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x6b30cb2067f16d66
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x734dccf8c97720d9
mov qword [rsp + 0x27], rdx
movabs rdx, 0x7abadf36201ac173
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x128cb83661c9c874
mov qword [rsp + 0x36], rdx
movabs rdx, 0x9140e1b1d0d0608
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x9100b0e13050d05
mov qword [rsp + 0x46], rdx
movabs rdx, 0x141009100b0e1305
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e18111b1414051b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1418191b02181e0c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1e05151c03160808
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x52b7ec
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x2a
jge 0x52b81e
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x52b845
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x1f
jb 0x52b7d2
jmp 0x52b839
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1f
call fcn.0044a200
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x1f
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1f
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0052b720
Function at 0x530f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x531032
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xb737d56c5e743936
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x40366964
movabs rdx, 0x7060b0503000003
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5070701070a0706
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x530fcb
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x530ffd
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x531025
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0xc
jb 0x530fb1
jmp 0x531018
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00530f60

Function at 0x5312c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5313bc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xecc50e3a36266c64
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x34dac56c6176ecc5
mov qword [rsp + 0x20], rdx
movabs rdx, 0x90cf736bb565681c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30e0315070c0007
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20d05110d0d110e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x141511030c0d0b06
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x531350
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x18
jge 0x531388
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5313af
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
nop word [rax + rax]
cmp rsi, 0x16
jb 0x531336
jmp 0x5313a3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x16
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.005312c0
Function at 0x535160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5352a8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xad55b06574696cd2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6ce8618b47ad55b0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9a026cfe7720240e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80a1ae260e796fa2
mov qword [rsp + 0x32], rdx
movabs rdx, 0x659d799e9f7256c1
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1e0e121818001500
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb1d0d110b19201b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x210d1e111a060b1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a13080323142317
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c131c18000e1a07
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2005050900190305
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x535240
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x535272
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x53529b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x25
jb 0x535222
jmp 0x53528f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x25
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00535160
Function at 0x53d140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x53d287
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
movabs rdx, 0xd6f56e9269749289
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc7836591614ed1a8
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbc9d82bac7836591
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf59465ab1c28b420
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7025e56e7a51541c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8acd26f1ddd90874
mov qword [rsp + 0x40], rdx
movabs rdx, 0x617efc72881d61f3
mov qword [rsp + 0x48], rdx
movabs rdx, 0x999a8fa1fb639eb4
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x58]
lea rsi, [0x00bc61c8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045fbda
mov rbp, qword [rbp]
xor eax, eax
nop
jmp 0x53d220
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x19]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x19]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x50
jge 0x53d24d
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3c
jae 0x53d27a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x3c
jb 0x53d202
jmp 0x53d26e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x3c
call fcn.0044a200
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov eax, esi
mov ecx, 0x3c
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x3c
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0053d140
Function at 0x53e720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53e866
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x4f657642e84f1d66
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3a3761407220123e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7eff6f203233000c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6549208b6e3c6f4e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x30370f265d236d35
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x520260910101e04
mov qword [rsp + 0x42], rdx
movabs rdx, 0x91a2722231b110f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x160724032702091a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x8102425010c211a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x181c03111c270c0e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2017081e0c051a09
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x53e800
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x2e
jge 0x53e82d
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x53e854
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x28
jb 0x53e7e2
jmp 0x53e848
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x28
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x28
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0053e720

Function at 0x53f260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f392
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xf846aacfb77e6e69
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1265df695520b550
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf961c3661a781265
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8220edac2cc972ef
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70605050f12121b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20f0507190d1910
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1118020f0507190d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x191b161b0b150607
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30b160d18120402
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d09101310150d1a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x53f32c
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x2a
jge 0x53f35e
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x53f385
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x1e
jb 0x53f312
jmp 0x53f379
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.0044a200
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1e
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0053f260
Function at 0x540900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x540a48
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xb56e28cbac63c3e6
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x44a7a1b56e28cbac
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6cd60b648c351ff5
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x65f120a7d969ae7a
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd28c4eb774a59cb6
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc100a14000d0311
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1b051416140d001f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1f101f1116041b05
mov qword [rsp + 0x50], rdx
movabs rdx, 0x917130c190c1b1b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x10b08152110200d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa1c070e220e011d
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x5409e0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x540a12
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x540a3b
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x23
jb 0x5409c2
jmp 0x540a2f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x23
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x23
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x23
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00540900

Function at 0x541040
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x5410ab
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x541064
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x541081
cmp rdx, 0
je 0x5410cd
test rdx, 0xf
je 0x54105d
test rdx, 7
jne 0x541081
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x54105d
ret
Function at 0x542160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5422b2
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x632f6f74f6796013
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x65462d50632f6f74
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6455fe4d69ffee3c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5275c309064b4320
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x199063698009203d
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe0d180017191817
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x10090e0d18001719
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe231b031817100e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16111f201e1b0c0a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x17011b01161c151e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x101312161308191c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x191f131517151c22
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x54224d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x32
jge 0x54227a
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x5422a5
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x24
jb 0x542230
jmp 0x542295
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
nop dword [rax]
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x24
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00542160
Function at 0x543040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x543188
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xb256b565c17069d2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x61f873cc49b256b5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x8fb26cf3612030c9
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb6d087200fbe74a2
mov qword [rsp + 0x32], rdx
movabs rdx, 0x64986ca09f6647c8
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1e0e121818001500
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb1d0d110b19201b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x210d1e111a060b1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a13080323142317
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c131c18000e1a07
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2005050900190305
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x543120
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x543152
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x54317b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x25
jb 0x543102
jmp 0x54316f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x25
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00543040
Function at 0x548a00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x548a3f
jb 0x548a54
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x548ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x548b90
jb 0x548bef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.005489a0
aeskeygenassist xmm1, xmm0, 1
call fcn.005489c0
aeskeygenassist xmm1, xmm2, 2
call fcn.005489a0
aeskeygenassist xmm1, xmm0, 2
call fcn.005489c0
aeskeygenassist xmm1, xmm2, 4
call fcn.005489a0
aeskeygenassist xmm1, xmm0, 4
call fcn.005489c0
aeskeygenassist xmm1, xmm2, 8
call fcn.005489a0
aeskeygenassist xmm1, xmm0, 8
call fcn.005489c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005489a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005489c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005489a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005489c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005489a0
jmp 0x548c5d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00548900
aeskeygenassist xmm1, xmm2, 2
call fcn.00548960
aeskeygenassist xmm1, xmm2, 4
call fcn.00548900
aeskeygenassist xmm1, xmm2, 8
call fcn.00548960
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00548900
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00548960
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00548900
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00548960
jmp 0x548c5d
aeskeygenassist xmm1, xmm0, 1
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 2
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 4
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 8
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.005488c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.005488c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x548c6a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x549040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x54919c
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
movabs rdx, 0xc495924586777d82
mov qword [rsp + 0x18], rdx
movabs rdx, 0x129573354c4be6db
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd2c1aaeb5453fc11
mov qword [rsp + 0x28], rdx
movabs rdx, 0x661f64196861fc75
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb2c6d891aa97f6de
mov qword [rsp + 0x38], rdx
movabs rdx, 0xac8bc8afb8079897
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf132318bca9388df
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f2bae1b94d635ad
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1438202f09001626
mov qword [rsp + 0x58], rdx
lea rdi, [rsp + 0x60]
lea rsi, [0x00bc7f90]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045fbda
mov rbp, qword [rbp]
xor eax, eax
jmp 0x549134
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x58
jge 0x549162
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x40
jae 0x54918f
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x40
jb 0x549117
nop
jmp 0x549183
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x40
call fcn.0044a200
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov eax, esi
mov ecx, 0x40
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x40
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.00549040

Function at 0x54a540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a688
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x676ef6646fbbb4ae
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x33eb52516120676e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x619d0569209920ad
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x79e6a63fc420746f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb0366f33a09969a3
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1b1a1521251e0c0d
mov qword [rsp + 0x44], rdx
movabs rdx, 0x22010b1b1f150f24
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1c191f0c22010b1b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10241301020f150f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x130e191b1005200c
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa14190d10010015
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x54a620
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2c
jge 0x54a652
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x54a67b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x26
jb 0x54a602
jmp 0x54a66f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x26
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x26
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x26
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0054a540
Function at 0x54c240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c328
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x3dcfdb65a16ebacc
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xdbd86c4145506163
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb0a03010f000c0f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7010b0a0b0a0301
mov qword [rsp + 0x30], rdx
movabs rdx, 0x601070e0e050503
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x54c2c1
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x14
jge 0x54c2f3
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x54c31b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x10
jb 0x54c2a7
jmp 0x54c30f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x10
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0054c240

Function at 0x54c4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c568
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb112deb24bbc7954
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x45
movabs rdx, 0x406020503060306
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x704
xor eax, eax
jmp 0x54c500
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x54c532
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x54c55b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 9
jb 0x54c4e6
jmp 0x54c54f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f5c0
mov eax, edi
mov ecx, 9
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0054c4a0