joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5326e0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x532875
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x1244652b71734c75
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4220674c1244652b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4649755d2041592d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x653769746e027320
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6c7b658874474c20
mov qword [rsp + 0x34], rdx
movabs rdx, 0x436c524f3d6955f1
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x7263615766713b4a
mov qword [rsp + 0x44], rdx
movabs rdx, 0x9331b211b2d0e23
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2300c3309331b21
mov qword [rsp + 0x50], rdx
movabs rdx, 0x303211302f2b3028
mov qword [rsp + 0x58], rdx
movabs rdx, 0x30c2c2d2913092c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x321e202202251621
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2b1124320b171704
mov qword [rsp + 0x70], rdx
movabs rdx, 0x32070b0b08270917
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2306301a07332c0b
mov qword [rsp + 0x80], rdx
movabs rdx, 0x101d12320d012c2e
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x53280e
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x44
jge 0x532842
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x34
jae 0x532868
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x34
jb 0x5327f4
nop
jmp 0x53285c
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x34
call fcn.0044bb20
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x34
call fcn.00461020
mov eax, edi
mov ecx, 0x34
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005326e0
Function at 0x5364e0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x5364f7
inc rax
cmp rax, 4
jge 0x53650f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x5364f4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x536520
inc rax
cmp rax, 4
jge 0x53652e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x536557
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x53653b
jmp 0x53651d
Function at 0x537140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53723b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x87648e8993766d69
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7cd6359a9e838e70
mov qword [rsp + 0x24], rdx
movabs rdx, 0x753a787d746e7992
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x903031517090e0b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x30f0c100a100c0b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x40a0514030f0c10
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171414090d070114
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5371d9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x53720b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x53722e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x18
jb 0x5371bf
jmp 0x537222
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.00537140

Function at 0x537de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537f18
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xdb3069b00a768369
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x74746170db3069b0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64c8de730cbb728e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x666120aa80b032ac
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x4fb91bb520ada274
mov qword [rsp + 0x36], rdx
movabs rdx, 0x8210f23070e0106
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x220c070803230f07
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1118220c07080323
mov qword [rsp + 0x48], rdx
movabs rdx, 0x170f18132317151e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d140e1e04080320
mov qword [rsp + 0x58], rdx
movabs rdx, 0x161d0e1203070e01
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x537eb8
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2a
jge 0x537ee8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x537f0b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x537e9b
jmp 0x537eff
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461020
mov eax, edi
mov ecx, 0x24
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00537de0
Function at 0x537f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53803b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x356ed1e9d8740270
mov qword [rsp + 0x19], rdx
movabs rdx, 0xdfa1d73adc78435
mov qword [rsp + 0x20], rdx
movabs rdx, 0x821467cf146cfc88
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100e01070f0e080d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10030a0e1605160d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70e0f051208130c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x41503030d101609
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x537fd9
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x22]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x53800b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x53802e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x22]
cmp rsi, 0x17
jb 0x537fbf
jmp 0x538022
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.00537f40

Function at 0x539140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x5392c7
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x3a48493f33642c87
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6156203a48493f33
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6e820c375b658b37
mov qword [rsp + 0x28], rdx
movabs rdx, 0x205c238736016d14
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6960641c7a8e4651
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3b28016d6f4620f2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x72625d562a1c7367
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1521001e291b050e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6270c01311f1832
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1628191731161105
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1030230e171d2f03
mov qword [rsp + 0x68], rdx
movabs rdx, 0x17171d2d2a13210e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2a1c042e0b05050b
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2e231d2f0c2d2504
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1b29280b0f273029
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x539260
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x40
jge 0x539292
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x33
jae 0x5392ba
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x33
jb 0x539245
jmp 0x5392ae
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x33
nop
call fcn.0044bb20
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x33
call fcn.00461020
mov eax, edi
mov ecx, 0x33
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00539140
Function at 0x53a5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a686
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x46ef494877777954
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x18
movabs rdx, 0x306060308030808
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x602
xor eax, eax
nop
jmp 0x53a620
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x53a652
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x53a677
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 9
jb 0x53a602
jmp 0x53a66b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053a5c0

Function at 0x53a780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a838
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4f6858252a303734
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x304020200060601
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x20703
xor eax, eax
jmp 0x53a7d6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xa]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x53a808
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x53a82b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xa]
cmp rsi, 8
jb 0x53a7bc
jmp 0x53a81f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0053a780

Function at 0x53a860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a91d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbdf6fb73c0f86cf3
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xdc
movabs rdx, 0x207080805060307
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8030000
xor eax, eax
nop
jmp 0x53a8c0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x53a8ed
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x53a910
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x53a8a2
jmp 0x53a904
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0053a860
Function at 0x53b4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53b598
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8e627f65b2e094a3
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xdeb0b584
movabs rdx, 0x809030b07020106
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3070809030b0702
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5000a000708030b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x53b537
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x12
jge 0x53b568
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x53b58b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x53b51a
jmp 0x53b57f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0053b4c0

Function at 0x53cd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53ce48
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb974ab65e66703ac
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6920a88faea7728b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20996920a88faea7
mov qword [rsp + 0x28], rdx
movabs rdx, 0x64e8e60924d99572
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc01100a0d17180c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x714150707070113
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80305050d141605
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8050b0703070c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x53cdeb
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x20
jge 0x53ce18
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x53ce3b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x53cdce
jmp 0x53ce2f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053cd40
Function at 0x53d440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53d526
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1b76d1961026ed1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xabbcfd0afdb60bc1
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40b00020c070804
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4080908040d040b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0a07050f00060c
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x53d4c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x53d4f2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x53d517
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
cmp rsi, 0x10
jb 0x53d4a2
jmp 0x53d50b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053d440
Function at 0x53ec80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x53ee15
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x21730a64656db36e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x957571748f532173
mov qword [rsp + 0x24], rdx
movabs rdx, 0x63285ea1712034a0
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x616d566fa5206c4b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x69881f697a6f1274
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x946b647c98c5746c
mov qword [rsp + 0x44], rdx
movabs rdx, 0x8a2e203664617469
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x260d301007232932
mov qword [rsp + 0x54], rdx
movabs rdx, 0xc250813260d3010
mov qword [rsp + 0x58], rdx
movabs rdx, 0x300e0f2022072c05
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2207242c07240e1f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x192816121b140b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x16262a232c243001
mov qword [rsp + 0x78], rdx
movabs rdx, 0x101213161b322d00
mov qword [rsp + 0x80], rdx
movabs rdx, 0x232a322211112130
mov qword [rsp + 0x88], rdx
movabs rdx, 0x4312421091b2935
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x53edb4
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x33]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x33]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x44
jge 0x53ede2
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x53ee08
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x36
jb 0x53ed97
nop
jmp 0x53edfc
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x36
call fcn.0044bb20
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.00461020
mov eax, edi
mov ecx, 0x36
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0053ec80

Function at 0x541e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
movups xmmword [rsp + 0x50], xmm15
movabs rdx, 0x1c73a90021
mov qword [rsp + 0x14], rdx
mov dword [rsp + 0x1c], 0x2c427800
movabs rdx, 0x90303090b09020b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x30300040a04000b
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x541e61
movzx r8d, byte [rsp + rbx + 0x14]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rsi + 0x14], dl
mov byte [rsp + rbx + 0x14], dil
add rax, 2
cmp rax, 0x10
jge 0x541e90
movzx edx, byte [rsp + rax + 0x20]
movzx ebx, byte [rsp + rax + 0x21]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0xc
jae 0x541ec8
movzx edi, byte [rsp + rsi + 0x14]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x35]
cmp rbx, 0xc
jb 0x541e47
jmp 0x541ebc
movups xmmword [rsp + 0x30], xmm15
xor eax, eax
jmp 0x541ea6
movzx ecx, byte [rsp + rax + 0x14]
mov byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0xc
jl 0x541e9a
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x50], xmm0
add rsp, 0x40
pop rbp
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461020
mov eax, esi
mov ecx, 0xc
call fcn.00461020
nop
int3
Function at 0x541ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541fb8
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa70ad08c74d2959d
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xa9dba707
movabs rdx, 0xa0109070a050805
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4060a0109070a05
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80000020804050b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x541f57
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x12
jge 0x541f88
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x541fab
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x541f3a
jmp 0x541f9f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00541ee0

Function at 0x5431e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5432cc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xabe0a49baee765a5
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa369abe0a49baee7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x67cd69ae9ca56562
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30e06060206100d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40d030e06060206
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x606090507000c02
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x54326a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x54329c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5432bf
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x12
jb 0x543250
jmp 0x5432b3
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005431e0
Function at 0x544160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544298
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x206827dbe7fa726e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6ccec9206827dbe7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6ed00b73c6ed694b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x71206b156f7786cc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd787610772bf74e4
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb03010d020b0d04
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x805020d14020122
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1110805020d1402
mov qword [rsp + 0x48], rdx
movabs rdx, 0x313091f0e17031a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe0d081b08101309
mov qword [rsp + 0x58], rdx
movabs rdx, 0x220821021a1d1f21
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x544235
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7f]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x2a
jge 0x544268
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x54428b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7f]
nop
cmp rsi, 0x23
jb 0x54421b
jmp 0x54427f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x23
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00461020
mov eax, edi
mov ecx, 0x23
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00544160
Function at 0x54a960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54aa5d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xfdeefd9cde0f4531
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd431bbc9312e00fd
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc3314fd130dc9dc
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60108100b0c130f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x60b0e0406040c13
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x110b080e060b0e04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x705021416031204
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x54aa00
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x4d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x4d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x54aa2d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x54aa50
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x17
jb 0x54a9df
jmp 0x54aa44
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0054a960

Function at 0x54ba40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x447c669ff81401d8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x704010004030207
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4070700
xor eax, eax
jmp 0x54ba97
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi + 0x3a]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x54bac8
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x54bb05
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
nop word [rax + rax]
cmp rbx, 8
jb 0x54ba7b
jmp 0x54baf7
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x54bae1
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x54bad5
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3