joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f8460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f8556
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x764fa3c347675357
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9a09acada0ad764f
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa08475c4655264c0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1515050b080e1405
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90e0e02080d080b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0a12040a090c12
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5f84f3
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x26]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x26]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x18
jge 0x5f8522
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5f8549
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x5f84d6
nop
jmp 0x5f853d
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.00457d20
mov eax, edi
mov ecx, 0x16
call fcn.00457d20
nop
call fcn.004556c0
nop dword [rax + rax]
jmp fcn.005f8460

Function at 0x5f8f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f8fd2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x31762bf552ac5357
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1917c031762bf552
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90a04080a050207
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x50a0208
xor eax, eax
jmp 0x5f8f6b
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x5f8f9d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x5f8fc5
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0xb
jb 0x5f8f51
jmp 0x5f8fb8
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0xb
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005f8f00
Function at 0x5f9760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f984b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x9d7407af989aebe6
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1ace616ee59d7407
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc070805010b0508
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50c070805010b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50b020402070301
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5f97e4
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x12
jge 0x5f9817
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xd
jae 0x5f983e
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x5f97c7
jmp 0x5f9832
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457d20
mov eax, edi
mov ecx, 0xd
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005f9760

Function at 0x60e480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60e552
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x32332dc917142818
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x2a22da2e
movabs rdx, 0x902020400030503
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a0b020a000902
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x60e4ee
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x60e51b
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x60e545
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x60e4d1
jmp 0x60e536
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.00457d20
mov eax, edi
mov ecx, 0xc
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0060e480
Function at 0x60e660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60e732
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x7267935123741d2b
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x6c6c641b
movabs rdx, 0x308040500050008
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x108080100080308
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x60e6cb
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x17]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x60e6fd
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x60e725
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x17]
cmp rsi, 0xc
jb 0x60e6b1
jmp 0x60e718
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0xc
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0060e660

Function at 0x60ec80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60ed49
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x65735535fbf86f32
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xdfb3
movabs rdx, 0x408030302090803
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3090002
xor eax, eax
jmp 0x60ece3
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x60ed15
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x60ed3c
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2b]
cmp rsi, 0xa
jb 0x60ecc9
jmp 0x60ed30
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457d20
mov eax, edi
mov ecx, 0xa
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0060ec80
Function at 0x60f640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60f72b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x65081f284f104a47
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe4096ef174654765
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd06010e0b050b0e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb040d06010e0b05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30605010d000201
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x60f6c4
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x38]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x38]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x12
jge 0x60f6f7
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x60f71e
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x60f6a7
jmp 0x60f712
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457d20
mov eax, edi
mov ecx, 0xf
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0060f640

Function at 0x611820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61190b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x74ac3e725b676552
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa41417795362a774
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa0a030908080905
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd0d050d090a0a0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0306090c030a05
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x6118a4
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x16
jge 0x6118d7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x6118fe
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xf
jb 0x611887
jmp 0x6118f2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xf
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457d20
mov eax, edi
mov ecx, 0xf
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00611820
Function at 0x611920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6119fc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x74658565b5c66552
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8cac8042f746585
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90305090b0b030c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5030a0203080903
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x611995
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x4f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x4f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x6119c8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x6119ef
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xd
jb 0x611978
jmp 0x6119e3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457d20
mov eax, edi
mov ecx, 0xd
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.00611920
Function at 0x624200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x6242d5
movdqa xmm0, xmmword [0x0075d740]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x624241
movdqa xmm0, xmmword [0x0075d750]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x624357
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x62432b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0075d4a0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0075d900]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x62a640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62a748
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6e7568aef564c881
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb616fbcc6e7568ae
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9275af3a68ca0ca5
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1101130c080a0003
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe0e12110c0d0709
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb070e0e12110c0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80c04040d040000
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x62a6e0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x64]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x62a712
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x62a73b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x64]
cmp rsi, 0x14
jb 0x62a6c5
jmp 0x62a72f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457d20
mov eax, edi
mov ecx, 0x14
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0062a640

Function at 0x62e620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62e716
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xea02c8657346cf6f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe01cf66fea02c865
mov qword [rsp + 0x22], rdx
movabs rdx, 0x640d2a526567e310
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50a120201061001
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd120b0c0b11050a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60c0d1109100711
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x62e6b3
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x62e6e2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x62e709
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x62e696
nop
jmp 0x62e6fd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457d20
mov eax, edi
mov ecx, 0x14
call fcn.00457d20
nop
call fcn.004556c0
nop dword [rax + rax]
jmp fcn.0062e620
Function at 0x631820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6318eb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6a2e329b8685448c
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x998d
movabs rdx, 0x807070008030702
mov qword [rsp + 0x22], rdx
movabs rdx, 0x401090304090807
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x631887
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
mov byte [rsp + rdi + 0x18], r9b
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x6318b7
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x6318de
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x631870
jmp 0x6318d2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457d20
mov eax, edi
mov ecx, 0xa
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00631820

Function at 0x631900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6319fc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xefe0de654d5bea53
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4a65d361acefe0de
mov qword [rsp + 0x22], rdx
movabs rdx, 0x574f666e5859344f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa070207010c030e
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd0f081010130a07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6030e0d050f0113
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x631990
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x6319c8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x6319ef
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
nop word [rax + rax]
cmp rsi, 0x15
jb 0x631976
jmp 0x6319e3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457d20
mov eax, edi
mov ecx, 0x15
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.00631900

Function at 0x631d40
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x631dab
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x631d64
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x631d81
cmp rdx, 0
je 0x631dcd
test rdx, 0xf
je 0x631d5d
test rdx, 7
jne 0x631d81
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x631d5d
ret
Function at 0x6338e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6339ab
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x86f6d84d009e4998
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xafd8
movabs rdx, 0x300000208090705
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5060208
xor eax, eax
jmp 0x633946
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x633977
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x63399e
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x633929
jmp 0x633992
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457d20
mov eax, edi
mov ecx, 0xa
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.006338e0
Function at 0x63ae80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63afb2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x61266ff870d35163
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xae6561266ff870d3
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x593c16d86eb8353a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7265666f1f562059
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x45806c6f254d6f4c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x11c0f0604090e15
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x10150c1d011c0f06
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1404162114090e11
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc121e20140b0202
mov qword [rsp + 0x50], rdx
movabs rdx, 0x161a1014161d0206
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x63af4f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x48]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x63af7c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x63afa5
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x22
jb 0x63af32
jmp 0x63af97
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x22
call fcn.00444d40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x22
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0x22
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0063ae80

Function at 0x63b920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x63b95f
jb 0x63b974
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x63b9e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x63bab0
jb 0x63bb0f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0063b8c0
aeskeygenassist xmm1, xmm0, 1
call fcn.0063b8e0
aeskeygenassist xmm1, xmm2, 2
call fcn.0063b8c0
aeskeygenassist xmm1, xmm0, 2
call fcn.0063b8e0
aeskeygenassist xmm1, xmm2, 4
call fcn.0063b8c0
aeskeygenassist xmm1, xmm0, 4
call fcn.0063b8e0
aeskeygenassist xmm1, xmm2, 8
call fcn.0063b8c0
aeskeygenassist xmm1, xmm0, 8
call fcn.0063b8e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0063b8c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0063b8e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0063b8c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0063b8e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0063b8c0
jmp 0x63bb7d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0063b820
aeskeygenassist xmm1, xmm2, 2
call fcn.0063b880
aeskeygenassist xmm1, xmm2, 4
call fcn.0063b820
aeskeygenassist xmm1, xmm2, 8
call fcn.0063b880
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0063b820
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0063b880
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0063b820
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0063b880
jmp 0x63bb7d
aeskeygenassist xmm1, xmm0, 1
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 2
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 4
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 8
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0063b7e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0063b7e0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x63bb8a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret