joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58df60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58e0b3
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xbcd96f74ddbcc65f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6b632067bcd96f74
mov qword [rsp + 0x22], rdx
movabs rdx, 0xabc12b0a69e1a039
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x63b1c7fb24617652
mov qword [rsp + 0x32], rdx
movabs rdx, 0x17b5b963ca72618e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe06001a14142218
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb232310030c0e06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c021a1c11212303
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd221f1907210117
mov qword [rsp + 0x58], rdx
movabs rdx, 0x701101405121303
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x58e02c
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x26
jge 0x58e06d
movzx edx, byte [rsp + rax + 0x42]
lea rsi, [rax + 1]
nop dword [rax + rax]
cmp rsi, 0x26
jae 0x58e0a5
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x58e094
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x24
jb 0x58e012
jmp 0x58e088
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.00443880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x24
call fcn.00456360
mov eax, edi
mov ecx, 0x24
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x26
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0058df60

Function at 0x590a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590b3f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x533534344cff3b44
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2e49533534344cff
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x33521365666ae473
mov qword [rsp + 0x26], rdx
movabs rdx, 0x204050b0c0d0205
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x905020b11100304
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6100905020b1110
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8010205020f0007
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x590ac0
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 8]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x590afc
movzx edx, byte [rsp + rax + 0x2e]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x590b31
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x590b25
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 8]
cmp rsi, 0x12
jb 0x590aa5
jmp 0x590b17
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
nop
call fcn.00456360
mov eax, edi
mov ecx, 0x12
call fcn.00456360
mov rax, rsi
mov ecx, 0x1a
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00590a20
Function at 0x591460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5915e9
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x6eb5037a78d865a3
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa385788b2068ec90
mov qword [rsp + 0x25], rdx
movabs rdx, 0x8f948463a8a38578
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8411617720716174
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7968e252074c776
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x40b4de462e03c882
mov qword [rsp + 0x42], rdx
movabs rdx, 0x3092c0426082104
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1d100f232c0e0309
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b12230825080e1c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x271706050814021d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e13061206241c26
mov qword [rsp + 0x68], rdx
movabs rdx, 0x221724000c062a22
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2b0c1d131205031d
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x59156a
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xc]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xc]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x36
jge 0x5915a2
movzx edx, byte [rsp + rax + 0x4a]
lea rsi, [rax + 1]
cmp rsi, 0x36
jae 0x5915db
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x5915cf
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2d
jb 0x59154d
nop
jmp 0x5915c3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2d
call fcn.00443880
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00456360
mov eax, edi
mov ecx, 0x2d
call fcn.00456360
mov rax, rsi
mov ecx, 0x36
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00591460

Function at 0x591e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x591f7f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x87242206154450e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6446a71163b80872
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20a010c01050b00
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10a0800020a010c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0a010c00070105
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x591f04
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x14
jge 0x591f3b
movzx edx, byte [rsp + rax + 0x2c]
lea rsi, [rax + 1]
cmp rsi, 0x14
jae 0x591f71
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x591f65
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x591ee7
jmp 0x591f56
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.00443880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00456360
mov eax, edi
mov ecx, 0xe
call fcn.00456360
mov rax, rsi
mov ecx, 0x14
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00591e80
Function at 0x592f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x593073
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x6d60203a4a6e7378
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4b8f546266566d60
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5e5872056572646c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7574767641fa6e62
mov qword [rsp + 0x30], rdx
movabs rdx, 0x25694a4e1069207a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x250f000d080c1e1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b1c06150f211609
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc03221823001307
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb120a0a211c1e00
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb15140a190b230c
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x592fec
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x28]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x28
jge 0x59302d
movzx edx, byte [rsp + rax + 0x40]
lea rsi, [rax + 1]
nop dword [rax + rax]
cmp rsi, 0x28
jae 0x593065
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x593054
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x28]
cmp rsi, 0x26
jb 0x592fd2
jmp 0x593048
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x26
call fcn.00443880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x26
call fcn.00456360
mov eax, edi
mov ecx, 0x26
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x28
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00592f20

Function at 0x5942a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59437f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb2fb6e6fc1b6fe3b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x601030206010006
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
nop
jmp 0x594300
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x52]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x59433c
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0xa
jae 0x594371
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x594365
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x52]
cmp rsi, 8
jb 0x5942e2
jmp 0x594357
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00443880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov eax, edi
mov ecx, 8
call fcn.00456360
mov rax, rsi
mov ecx, 0xa
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.005942a0
Function at 0x5965a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5966bf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xc4c4a804011a08b5
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x61c71a6ac4c4a804
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1cb9740f250470ab
mov qword [rsp + 0x26], rdx
movabs rdx, 0x30704120f090213
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1100c0507040803
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30601100c050704
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc000e05040e0a0a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x596640
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x59667c
movzx edx, byte [rsp + rax + 0x2e]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x5966b1
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5966a5
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0x14
jb 0x596625
jmp 0x596697
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
nop
call fcn.00456360
mov eax, edi
mov ecx, 0x14
call fcn.00456360
mov rax, rsi
mov ecx, 0x1a
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.005965a0
Function at 0x597f00
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x598060
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.00597bc0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
movups xmmword [rcx], xmm15
lea rcx, [rsp + 0x60]
movups xmmword [rcx], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x597fad
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x597ffe
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x598024
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
cmp rcx, 8
jge 0x597fa7
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
nop word [rax + rax]
cmp rsi, 0x20
jge 0x597fa7
test byte [rbx], al
cmp rsi, 0x20
jb 0x598015
mov rax, rsi
mov ecx, 0x20
call fcn.00456360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00453c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00597f00
Function at 0x59a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59a166
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
lea rax, [0x0062fba0]
nop
call fcn.0040bfc0
movabs rcx, 0x200f2f3f8001200
mov qword [rax], rcx
movabs rcx, 0xe000e3e20be9f700
mov qword [rax + 8], rcx
movabs rcx, 0x2eb0c0520f100
mov qword [rax + 0x10], rcx
movabs rcx, 0xe00f8000500f40e
mov qword [rax + 0x18], rcx
movabs rcx, 0xd0c04110a110f13
mov qword [rsp + 0x16], rcx
movabs rcx, 0xc05111d1f011513
mov qword [rsp + 0x1e], rcx
movabs rcx, 0xa040c05111d1f01
mov qword [rsp + 0x20], rcx
movabs rcx, 0x19180f1207180309
mov qword [rsp + 0x28], rcx
movabs rcx, 0x1b110f010900051f
mov qword [rsp + 0x30], rcx
movabs rcx, 0x141d0b010f0a1316
mov qword [rsp + 0x38], rcx
xor ecx, ecx
jmp 0x59a0f4
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rax + rdi], dl
lea edx, [r8 + 0x25]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0x2a
jge 0x59a12a
movzx edx, byte [rsp + rcx + 0x16]
lea rsi, [rcx + 1]
cmp rsi, 0x2a
jae 0x59a154
movzx esi, byte [rsp + rcx + 0x17]
mov edi, edx
xor edx, esi
add edx, ecx
cmp rdi, 0x20
jae 0x59a148
movzx r8d, byte [rdi + rax]
sub r8d, edx
cmp rsi, 0x20
jb 0x59a0da
jmp 0x59a13c
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x20
call fcn.00456360
mov eax, edi
mov ecx, 0x20
call fcn.00456360
mov rax, rsi
mov ecx, 0x2a
nop dword [rax]
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0059a020

Function at 0x59a2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59a426
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
lea rax, [0x0062fba0]
nop
call fcn.0040bfc0
movabs rcx, 0xc9eb80036fb894a3
mov qword [rax], rcx
movabs rcx, 0x2b7749f13441c0d7
mov qword [rax + 8], rcx
movabs rcx, 0x22121276faede898
mov qword [rax + 0x10], rcx
movabs rcx, 0xe1036cac2f4afe17
mov qword [rax + 0x18], rcx
movabs rcx, 0xd13120d0c181214
mov qword [rsp + 0x14], rcx
movabs rcx, 0x1a1c08031a010405
mov qword [rsp + 0x1c], rcx
movabs rcx, 0x1a1b091c1a1c0803
mov qword [rsp + 0x20], rcx
movabs rcx, 0x91f0d1f0e15070f
mov qword [rsp + 0x28], rcx
movabs rcx, 0x1615180c1709130b
mov qword [rsp + 0x30], rcx
movabs rcx, 0x713090214130e1f
mov qword [rsp + 0x38], rcx
xor ecx, ecx
jmp 0x59a3b4
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 + 0x53]
mov byte [rax + rdi], dl
lea edx, [r8 + 0x53]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0x2c
jge 0x59a3ea
movzx edx, byte [rsp + rcx + 0x14]
lea rsi, [rcx + 1]
cmp rsi, 0x2c
jae 0x59a414
movzx esi, byte [rsp + rcx + 0x15]
mov edi, edx
xor edx, esi
add edx, ecx
cmp rdi, 0x20
jae 0x59a408
movzx r8d, byte [rdi + rax]
sub r8d, edx
cmp rsi, 0x20
jb 0x59a39a
jmp 0x59a3fc
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x20
call fcn.00456360
mov eax, edi
mov ecx, 0x20
call fcn.00456360
mov rax, rsi
mov ecx, 0x2c
nop dword [rax]
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0059a2e0
Function at 0x59a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x59a5e6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
lea rdx, [rsp + 0x90]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0xa0]
movups xmmword [rdx], xmm15
movabs rdx, 0xc40099a1b2b3b2
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9ed1ccc3efc200bb
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5df0d979dd00b57f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa500d93f00b660
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10110d1700021b17
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf04141e1103010c
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd1904110d181b0f
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa1e0d1906130f14
mov qword [rsp + 0x68], rdx
movabs rdx, 0x14081e0e1c150a0d
mov qword [rsp + 0x70], rdx
movabs rdx, 0x18130b1e14180c16
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x59a534
movzx r8d, byte [rsp + rbx + 0x30]
sub r8d, edx
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x30], dl
lea edx, [rdi + 0x52]
mov byte [rsp + rbx + 0x30], dl
add rax, 2
cmp rax, 0x30
jge 0x59a56d
movzx edx, byte [rsp + rax + 0x50]
lea rbx, [rax + 1]
cmp rbx, 0x30
jae 0x59a5d7
movzx ebx, byte [rsp + rax + 0x51]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x20
jae 0x59a5cb
movzx edi, byte [rsp + rsi + 0x30]
sub edi, edx
cmp rbx, 0x20
jb 0x59a518
jmp 0x59a5bf
lea rax, [rsp + 0x10]
movups xmmword [rax], xmm15
lea rax, [rsp + 0x20]
movups xmmword [rax], xmm15
xor eax, eax
jmp 0x59a58f
movzx ecx, byte [rsp + rax + 0x30]
mov byte [rsp + rax + 0x10], cl
inc rax
cmp rax, 0x20
jl 0x59a583
movups xmm0, xmmword [rsp + 0x10]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0xa0], xmm0
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, ebx
mov ecx, 0x20
call fcn.00456360
mov eax, esi
mov ecx, 0x20
call fcn.00456360
mov rax, rbx
mov ecx, 0x30
nop
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0059a440
Function at 0x59d3c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59d613
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x59d4f0
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x59d605
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x59d462
mov rax, rsi
mov rcx, r8
call fcn.00456cc0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x59d4cc
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0059e540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x59d5fc
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x59d500
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x59d5a0
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x59d5f4
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.0059e540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x59d5ef
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
jle 0x59d5de
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x59d5da
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.00456cc0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00456420
mov rdx, r9
call fcn.004563e0
mov rax, r8
nop
call fcn.00456420
mov rax, rsi
mov ecx, 0x40
call fcn.00456420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00453c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0059d3c0
Function at 0x5a20c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a219f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xd78f0b2d989da021
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x601070001050007
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6030200
xor eax, eax
jmp 0x5a2120
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x5a215c
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x5a2191
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5a2185
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 8
jb 0x5a2102
jmp 0x5a2177
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00443880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov eax, edi
mov ecx, 8
call fcn.00456360
mov rax, rsi
mov ecx, 0xc
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.005a20c0

Function at 0x5a5ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a5fe9
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6e6951883930356a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x5a3a4b745b6c574c
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7c5a3a4b745b6c57
mov qword [rsp + 0x26], rdx
movabs rdx, 0x73fe667564366d20
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x90805050d0c170c
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb0b050d10050008
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x10160b0b050d1005
mov qword [rsp + 0x40], rdx
movabs rdx, 0x130e0f10130d0e04
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5a5f71
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1a
jge 0x5a5fa8
movzx edx, byte [rsp + rax + 0x36]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x5a5fdb
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x5a5fcf
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x5a5f54
jmp 0x5a5fc3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00443880
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456360
mov eax, edi
mov ecx, 0x19
call fcn.00456360
mov rax, rsi
mov ecx, 0x1a
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.005a5ec0