joyce8/EMBER2024-capa huggingface dataset:
Function at 0x532f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x533058
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x167fd747004ca63
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb8650167fd747004
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x696061c9d669233a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10cf66d61117ac09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x702220c17d9c95fa
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2150507121e1a06
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x14090220021c061d
mov qword [rsp + 0x46], rdx
movabs rdx, 0x21e14090220021c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x712071b09191310
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9181507070b201f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x120d0b20050e0116
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x532fe0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x2b]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x2b]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x2a
jge 0x533017
movzx edx, byte [rsp + rax + 0x3e]
lea rsi, [rax + 1]
cmp rsi, 0x2a
jae 0x53304a
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x53303e
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x22
jb 0x532fc2
jmp 0x533032
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x22
call fcn.00443880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x22
call fcn.00456360
mov eax, edi
mov ecx, 0x22
call fcn.00456360
mov rax, rsi
mov ecx, 0x2a
call fcn.00456360
nop
call fcn.00453c40
nop dword [rax]
jmp fcn.00532f00

Function at 0x534500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53463f
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x61cb0dfd090f8630
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1e136ea20cb9e065
mov qword [rsp + 0x26], rdx
movabs rdx, 0x751220746f6e2008
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xdf776f88d3ccb7d2
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1b180c09000f1c0c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1f1a1b180c09000f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x31c18050e1e1c0a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20c0c060c011b04
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb0e0910161f0b19
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x5345c0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x5345fc
movzx edx, byte [rsp + rax + 0x3e]
lea rsi, [rax + 1]
cmp rsi, 0x22
jae 0x534631
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x534625
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x20
jb 0x5345a3
jmp 0x534617
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x20
call fcn.00443880
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x20
nop
call fcn.00456360
mov eax, edi
mov ecx, 0x20
call fcn.00456360
mov rax, rsi
mov ecx, 0x22
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00534500
Function at 0x534c80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x534d50
jb 0x534daf
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00534aa0
aeskeygenassist xmm1, xmm0, 1
call fcn.00534ac0
aeskeygenassist xmm1, xmm2, 2
call fcn.00534aa0
aeskeygenassist xmm1, xmm0, 2
call fcn.00534ac0
aeskeygenassist xmm1, xmm2, 4
call fcn.00534aa0
aeskeygenassist xmm1, xmm0, 4
call fcn.00534ac0
aeskeygenassist xmm1, xmm2, 8
call fcn.00534aa0
aeskeygenassist xmm1, xmm0, 8
call fcn.00534ac0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00534aa0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00534ac0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00534aa0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00534ac0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00534aa0
jmp 0x534e1d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00534a00
aeskeygenassist xmm1, xmm2, 2
call fcn.00534a60
aeskeygenassist xmm1, xmm2, 4
call fcn.00534a00
aeskeygenassist xmm1, xmm2, 8
call fcn.00534a60
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00534a00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00534a60
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00534a00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00534a60
jmp 0x534e1d
aeskeygenassist xmm1, xmm0, 1
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 2
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 4
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 8
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.005349c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.005349c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x534e2a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x537020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53712b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x95576d619a74df3e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa7b49665b295576d
mov qword [rsp + 0x20], rdx
movabs rdx, 0xee6fb7974901a569
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10b0a0706140f12
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb12001411081214
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60b0b1403010c0e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5370b3
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x5370ea
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x53711d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x537111
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x537096
jmp 0x537105
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456360
mov eax, edi
mov ecx, 0x15
call fcn.00456360
mov rax, rsi
mov ecx, 0x18
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00537020

Function at 0x5381a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538275
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x19], 0x8d132df5
mov dword [rsp + 0x1c], 0x89f1338d
movabs rdx, 0x502000502050306
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x5381f8
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x57]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x57]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 8
jge 0x53822f
movzx edx, byte [rsp + rax + 0x20]
lea rsi, [rax + 1]
cmp rsi, 8
jae 0x538267
movzx esi, byte [rsp + rax + 0x21]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 7
jae 0x53825b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 7
jb 0x5381db
jmp 0x53824f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 7
nop dword [rax + rax]
call fcn.00443880
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 7
call fcn.00456360
mov eax, edi
mov ecx, 7
call fcn.00456360
mov rax, rsi
mov ecx, 8
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.005381a0
Function at 0x539480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53957f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x5b6e7356306a4750
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4154676f501e555b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20e080902010d02
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x90c060b020e0809
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30702090e0a0407
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x539504
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x19]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x19]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x14
jge 0x53953b
movzx edx, byte [rsp + rax + 0x2c]
lea rsi, [rax + 1]
cmp rsi, 0x14
jae 0x539571
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x539565
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xf
jb 0x5394e7
jmp 0x539556
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
call fcn.00443880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00456360
mov eax, edi
mov ecx, 0xf
call fcn.00456360
mov rax, rsi
mov ecx, 0x14
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00539480

Function at 0x53b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53b333
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x6502aaaad0d36552
mov qword [rsp + 0x19], rdx
movabs rdx, 0x52d79a6502aaaad0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x578e726ff59467c2
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50404060e030209
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30f110205040406
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90e0f05050b080d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x53b2b0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x53b2ed
movzx edx, byte [rsp + rax + 0x2c]
lea rsi, [rax + 1]
nop
cmp rsi, 0x14
jae 0x53b325
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x53b314
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
cmp rsi, 0x13
jb 0x53b296
jmp 0x53b308
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00443880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456360
mov eax, edi
mov ecx, 0x13
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x14
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0053b220
Function at 0x53b780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53b873
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x56897e8d7e938e64
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7c5e756c7956897e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10506040b03020c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x408000c060c0105
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x53b7f2
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x53b82e
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0xe
jae 0x53b865
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x53b855
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0xd
jb 0x53b7d8
jmp 0x53b849
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456360
mov eax, edi
mov ecx, 0xd
nop dword [rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0xe
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0053b780

Function at 0x53ec20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x53edc6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
lea rdx, [rsp + 0x90]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0xa0]
movups xmmword [rdx], xmm15
movabs rdx, 0x4e26a7030bea19fd
mov qword [rsp + 0x34], rdx
movabs rdx, 0xac3b461bb509111f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xa58605147d01babc
mov qword [rsp + 0x44], rdx
movabs rdx, 0x7c23ab2a4d813d3
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1818141d1b1e0616
mov qword [rsp + 0x54], rdx
movabs rdx, 0x70d1b0f001e021a
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x1602000e070d1b0f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a1d051e05121800
mov qword [rsp + 0x68], rdx
movabs rdx, 0xd131105171c0716
mov qword [rsp + 0x70], rdx
movabs rdx, 0xd1e101d0f00140b
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x53ed14
movzx r8d, byte [rsp + rbx + 0x34]
sub r8d, edx
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x34], dl
lea edx, [rdi - 0x72]
mov byte [rsp + rbx + 0x34], dl
add rax, 2
cmp rax, 0x2c
jge 0x53ed4d
movzx edx, byte [rsp + rax + 0x54]
lea rbx, [rax + 1]
cmp rbx, 0x2c
jae 0x53edb7
movzx ebx, byte [rsp + rax + 0x55]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x20
jae 0x53edab
movzx edi, byte [rsp + rsi + 0x34]
sub edi, edx
cmp rbx, 0x20
jb 0x53ecf8
jmp 0x53ed9f
lea rax, [rsp + 0x14]
movups xmmword [rax], xmm15
lea rax, [rsp + 0x24]
movups xmmword [rax], xmm15
xor eax, eax
jmp 0x53ed6f
movzx ecx, byte [rsp + rax + 0x34]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 0x20
jl 0x53ed63
movups xmm0, xmmword [rsp + 0x14]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rsp + 0x24]
movups xmmword [rsp + 0xa0], xmm0
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, ebx
mov ecx, 0x20
call fcn.00456360
mov eax, esi
mov ecx, 0x20
call fcn.00456360
mov rax, rbx
mov ecx, 0x2c
nop
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0053ec20
Function at 0x540800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54095f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x646622585d793750
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x444c646622585d79
mov qword [rsp + 0x20], rdx
movabs rdx, 0x264b0e743b69713a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2465664228725867
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10083072238e5e20
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1b061f081c1c0e15
mov qword [rsp + 0x40], rdx
movabs rdx, 0x92011140b050111
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4160f03001d0f13
mov qword [rsp + 0x50], rdx
movabs rdx, 0x106081012190014
mov qword [rsp + 0x58], rdx
movabs rdx, 0x12100e091000040f
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd100e14091f2109
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x5408e0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1a]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x30
jge 0x54091c
movzx edx, byte [rsp + rax + 0x40]
lea rsi, [rax + 1]
cmp rsi, 0x30
jae 0x540951
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x540945
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1a]
cmp rsi, 0x22
jb 0x5408c2
jmp 0x540937
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.00443880
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x22
nop
call fcn.00456360
mov eax, edi
mov ecx, 0x22
call fcn.00456360
mov rax, rsi
mov ecx, 0x30
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00540800
Function at 0x543840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x543915
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x19], 0x981efe0c
mov dword [rsp + 0x1c], 0x3613f998
movabs rdx, 0x2010504010403
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x543895
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 8
jge 0x5438d1
movzx edx, byte [rsp + rax + 0x20]
lea rsi, [rax + 1]
cmp rsi, 8
jae 0x543907
movzx esi, byte [rsp + rax + 0x21]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 7
jae 0x5438fb
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
cmp rsi, 7
jb 0x54387b
jmp 0x5438ef
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 7
nop dword [rax]
call fcn.00443880
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 7
call fcn.00456360
mov eax, edi
mov ecx, 7
call fcn.00456360
mov rax, rsi
mov ecx, 8
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00543840

Function at 0x543f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54403f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8fb0a53b38fef05
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x107030106070602
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
nop
jmp 0x543fc0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x543ffc
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0xa
jae 0x544031
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x544025
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
cmp rsi, 8
jb 0x543fa2
jmp 0x544017
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00443880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov eax, edi
mov ecx, 8
call fcn.00456360
mov rax, rsi
mov ecx, 0xa
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00543f60
Function at 0x544060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54413f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x96221886459249ab
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x3036
movabs rdx, 0x4060700050604
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x207
xor eax, eax
jmp 0x5440c2
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6e]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x5440fe
movzx edx, byte [rsp + rax + 0x1c]
lea rsi, [rax + 1]
cmp rsi, 0xa
jae 0x544131
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x544125
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6e]
cmp rsi, 0xa
jb 0x5440a8
jmp 0x544119
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00443880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456360
mov eax, edi
mov ecx, 0xa
call fcn.00456360
mov rax, rsi
mov ecx, 0xa
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00544060
Function at 0x5511a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55137d
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x5512da
test r9, r9
je 0x5512da
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x5511fc
jae 0x551260
jmp 0x551371
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x0062d6c0]
call fcn.004406e0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x551366
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.0055f760
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x55135b
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
nop
jmp 0x551324
test r10, r10
jne 0x5512e3
xor edx, edx
jmp 0x551313
nop
cmp rcx, 1
jge 0x55130b
lea rax, [0x0062d6c0]
mov ebx, 1
mov rcx, rbx
call fcn.004406e0
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
nop
ret
dec rdx
test rdx, rdx
jle 0x551333
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x551321
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x55134d
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.004563e0
mov rax, rcx
mov rcx, rdx
call fcn.00456360
mov rdx, rcx
mov rcx, rsi
call fcn.004563e0
mov rdx, rcx
mov rcx, rbx
call fcn.004563e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00453c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005511a0
Function at 0x5513e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x551573
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r9
lea r11, [r10 + rsi]
cmp rcx, r11
jb 0x551567
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov rbx, r11
call fcn.005505a0
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
xor eax, eax
jmp 0x55146a
inc rax
cmp rdx, rax
jle 0x551548
mov rbx, qword [rsi + rax*8]
test rbx, rbx
je 0x551467
mov rdi, qword [rsp + 0x80]
lea rcx, [rax + rdi]
mov r8, qword [rsp + 0x70]
cmp r8, rcx
jb 0x55155f
cmp rax, rcx
ja 0x55155a
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rcx, rax
shl rax, 3
sub r8, rcx
mov rsi, r8
neg r8
sar r8, 0x3f
and rax, r8
mov r8, qword [rsp + 0x60]
add rax, r8
mov qword [rsp], rax
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rdi
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rbx
call fcn.0055f820
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
nop
cmp rcx, rdx
jbe 0x551552
mov rbx, qword [rsp + 0x60]
mov qword [rbx + rdx*8], rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
jmp 0x551467
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
call fcn.00456360
call fcn.00456420
mov rdx, r8
call fcn.004563e0
mov rdx, rcx
mov rcx, r11
call fcn.004563e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00453c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.005513e0