joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52d9e0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x52db87
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xd461d0e1b6a470a6
mov qword [rsp + 0x18], rdx
movabs rdx, 0x59dce1bb91a531d8
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbbc657359dce1bb
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7331cc22ed7303a6
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf7dfdb6e61417481
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf00827b414d76951
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc6d420726564d9d5
mov qword [rsp + 0x44], rdx
movabs rdx, 0x537a69532063db67
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x32040d2629171a17
mov qword [rsp + 0x54], rdx
movabs rdx, 0x2a1c0e2232040d26
mov qword [rsp + 0x58], rdx
movabs rdx, 0x15092b3513272329
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e02193b0f182124
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3517181915331e07
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1a070a0227130b05
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2132080902052d2c
mov qword [rsp + 0x80], rdx
movabs rdx, 0x22307231c242800
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3814030c110f0512
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x52db20
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x44
jge 0x52db52
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3c
jae 0x52db7a
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x3c
jb 0x52db06
jmp 0x52db6e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x3c
nop
call fcn.0044bb20
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x3c
call fcn.00461020
mov eax, edi
mov ecx, 0x3c
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0052d9e0
Function at 0x530620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x530728
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6e67a5a4658ee698
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20dfb0e0a397c869
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa728a36d20dfb0e0
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd17ebfa8dea26e5f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe1a0012160b170a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x131b1a170c000113
mov qword [rsp + 0x40], rdx
movabs rdx, 0x91918140a04020d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc191713110005
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5306cb
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x20
jge 0x5306f8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x53071b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x5306ae
jmp 0x53070f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00530620

Function at 0x531bc0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x531c2b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x531be4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x531c01
cmp rdx, 0
je 0x531c4d
test rdx, 0xf
je 0x531bdd
test rdx, 7
jne 0x531c01
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x531bdd
ret
Function at 0x533840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x533978
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xd2fa9741d6f0fb5
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6f203a8065688e69
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7e033100cc8a075
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1c272bf45e376c1b
mov qword [rsp + 0x32], rdx
movabs rdx, 0xfc8a1dcc879e6e20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x14262001021d2503
mov qword [rsp + 0x42], rdx
movabs rdx, 0x922180018051a1c
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1e1a1b0015160922
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d12270700181f0c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b13142411220917
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1412231f13181423
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x533915
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2e
jge 0x533948
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x53396b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
nop
cmp rsi, 0x28
jb 0x5338fb
jmp 0x53395f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00461020
mov eax, edi
mov ecx, 0x28
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00533840
Function at 0x539180
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x5391bf
jb 0x5391d4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x539240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x539314
jb 0x539373
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00539120
aeskeygenassist xmm1, xmm0, 1
call fcn.00539140
aeskeygenassist xmm1, xmm2, 2
call fcn.00539120
aeskeygenassist xmm1, xmm0, 2
call fcn.00539140
aeskeygenassist xmm1, xmm2, 4
call fcn.00539120
aeskeygenassist xmm1, xmm0, 4
call fcn.00539140
aeskeygenassist xmm1, xmm2, 8
call fcn.00539120
aeskeygenassist xmm1, xmm0, 8
call fcn.00539140
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00539120
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00539140
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00539120
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00539140
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00539120
jmp 0x5393e1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00539080
aeskeygenassist xmm1, xmm2, 2
call fcn.005390e0
aeskeygenassist xmm1, xmm2, 4
call fcn.00539080
aeskeygenassist xmm1, xmm2, 8
call fcn.005390e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00539080
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005390e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00539080
aeskeygenassist xmm1, xmm2, 0x80
call fcn.005390e0
jmp 0x5393e1
aeskeygenassist xmm1, xmm0, 1
call fcn.00539040
aeskeygenassist xmm1, xmm0, 2
call fcn.00539040
aeskeygenassist xmm1, xmm0, 4
call fcn.00539040
aeskeygenassist xmm1, xmm0, 8
call fcn.00539040
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00539040
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00539040
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00539040
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00539040
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00539040
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00539040
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x5393ee
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x53c060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53c12c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1e642d7461766e69
mov qword [rsp + 0x19], rdx
movabs rdx, 0x67f469ed3ffb021e
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb0a0d0d09090904
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80b080b08050b07
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x53c0cf
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x7e]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x7e]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x53c0fc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x53c11f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x53c0b2
jmp 0x53c113
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053c060
Function at 0x53ec40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x53ec57
inc rax
cmp rax, 4
jge 0x53ec6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x53ec54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x53ec80
inc rax
cmp rax, 4
jge 0x53ec8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x53ecb7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x53ec9b
jmp 0x53ec7d
Function at 0x53f5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f68c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xdc6469c561d6dad8
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe5d3724c8889eb70
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc842dc61c86ee42a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x160f0902130c0f04
mov qword [rsp + 0x18], rdx
movabs rdx, 0x15010e0016101010
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf0a170113110b07
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x53f62a
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
cmp rax, 0x18
jge 0x53f65c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x53f67f
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0x18
jb 0x53f610
jmp 0x53f673
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053f5a0

Function at 0x5406c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5407bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3a8e809192906e69
mov qword [rsp + 0x18], rdx
movabs rdx, 0x81f9728c89744606
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3aa999616f6ec796
mov qword [rsp + 0x28], rdx
movabs rdx, 0x15021109080e1316
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb040c100c090e08
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc050f11060e1707
mov qword [rsp + 0x40], rdx
movabs rdx, 0x203100615080803
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x540759
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3a]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x20
jge 0x54078b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x5407ae
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3a]
cmp rsi, 0x18
jb 0x54073f
jmp 0x5407a2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.005406c0
Function at 0x543720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x543806
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1d6f1a656420d240
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf31f393727482042
mov qword [rsp + 0x24], rdx
movabs rdx, 0x205070909010f05
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0e0b0e02050709
mov qword [rsp + 0x30], rdx
movabs rdx, 0x700080f0d020c09
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x5437a0
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x19]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x5437d2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5437f7
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x19]
cmp rsi, 0x10
jb 0x543782
jmp 0x5437eb
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00543720

Function at 0x544220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x544392
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xe6ae6e24d81ee5e4
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7e86ed69610c15b2
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa6e22171f620429b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0b69e97d9d7bfb
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4284ef0e61651127
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf665f020026c9241
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2d0e0d252f040f0b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x171e1c1601160014
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10001b2224081a17
mov qword [rsp + 0x58], rdx
movabs rdx, 0x706031f24152d09
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa181b0f13132100
mov qword [rsp + 0x68], rdx
movabs rdx, 0x262f292f1902221c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2221a1c0d1a112f
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2b291f270b111e28
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x544330
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x40
jge 0x54435d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x544385
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x30
jb 0x544313
jmp 0x544377
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x30
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x30
nop
call fcn.00461020
mov eax, edi
mov ecx, 0x30
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00544220
Function at 0x545400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x545567
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x63699da43fab0869
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfdd5c685076ed948
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf43afdd5c685076e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe0a1869ce42c989d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xdc6fedbb3fbe1f19
mov qword [rsp + 0x32], rdx
movabs rdx, 0x68add26ef6d8cb8b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1f0d1a21021f0c10
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c281403081e030c
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x801191916091c28
mov qword [rsp + 0x50], rdx
movabs rdx, 0x191a1a1b12052504
mov qword [rsp + 0x58], rdx
movabs rdx, 0x24191a18031d1f08
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1522231711031613
mov qword [rsp + 0x68], rdx
movabs rdx, 0x41d02270f040b03
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1f1f210e14031116
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x54550a
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x3e
jge 0x545537
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x54555a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x2a
jb 0x5454ed
jmp 0x54554e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2a
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00461020
mov eax, edi
mov ecx, 0x2a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00545400

Function at 0x5456a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545772
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1cba34483c3d336e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x673c39ffe61cba34
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4060b0209030407
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10308040a050406
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x54570c
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x54573e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x545765
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0xd
jb 0x5456f2
jmp 0x545755
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005456a0
Function at 0x547140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x54729a
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x476c09229b6a6833
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3f0704591c732072
mov qword [rsp + 0x25], rdx
movabs rdx, 0x5c4d38e7203f0704
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x396b61ea20f71f71
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6725462c2cc4356d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1e354b4031204776
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c22170322162a04
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xb29212506151c22
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b170c0217261e0e
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd2c151213052603
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf151e0b2011141f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x26130e2a0e142319
mov qword [rsp + 0x70], rdx
movabs rdx, 0x250b23070d0328
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x547238
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x18]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x36
jge 0x54726a
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x54728d
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x18]
cmp rsi, 0x2d
jb 0x54721e
jmp 0x547281
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2d
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.00547140

Function at 0x547840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5478f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x83a395afd5db75a0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x205070004040203
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
jmp 0x547895
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3d]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x5478c8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5478eb
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3d]
nop
cmp rsi, 8
jb 0x54787b
jmp 0x5478df
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00547840
Function at 0x549dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x549eda
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x1571685c6c5e127a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5c757a6059610c6e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x535e391c5c757a60
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7267ff7351655020
mov qword [rsp + 0x32], rdx
movabs rdx, 0x20f0b1b0d0d0600
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x19120f010710020f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50317150c0e150c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x706151b09040505
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf11040211040612
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x549e77
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x26
jge 0x549ea9
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x549ecd
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x14]
cmp rsi, 0x1c
jb 0x549e5d
jmp 0x549ec1
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.00549dc0

Function at 0x549f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a00c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6d20cae3ca6eaa63
mov qword [rsp + 0x18], rdx
movabs rdx, 0xec90d7df92d28a61
mov qword [rsp + 0x20], rdx
movabs rdx, 0x374eec90d7df92d2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65676187734eb491
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5040d010f090512
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1309090a09040c0c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc030b16010e1309
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90c14120e11050a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x549fa8
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4e]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1e
jge 0x549fdc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x549fff
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4e]
cmp rsi, 0x1a
jb 0x549f8e
jmp 0x549ff3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00549f00