joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x503906
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb602337027d1fd61
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x316c3a2e
movabs rdx, 0x70602070b05010b
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x9030902
xor eax, eax
jmp 0x5038a0
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x5038d2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x5038f7
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x29]
cmp rsi, 0xc
jb 0x503884
jmp 0x5038eb
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
nop
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461b40
mov eax, edi
mov ecx, 0xc
nop
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00503840

Function at 0x5055c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5056ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x184699067464797e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6118469906746479
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5e1030fd17a21299
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0009100510080b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0a0f0b05070b00
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40d071000080702
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50564a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x50567c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50569f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4b]
cmp rsi, 0x11
jb 0x505630
jmp 0x505693
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461b40
mov eax, edi
mov ecx, 0x11
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005055c0
Function at 0x5060e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5061c6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6572d0e26074bf61
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6429deb6dd544c4a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1000c090408030c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x50e01000c090408
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0b050d04010500
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x506160
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7e]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x506192
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5061b7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7e]
cmp rsi, 0x10
jb 0x506142
jmp 0x5061ab
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461b40
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005060e0

Function at 0x5065c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5066da
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6a6112644752655a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x726d406a37444b50
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1a726d406a37444b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4d303e433d815f63
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x13111718070f100b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x171813111718070f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0b15120917000d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1614020c0a0f0d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x309090516130402
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x506677
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x10]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x22
jge 0x5066a9
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x5066cd
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x10]
cmp rsi, 0x19
jb 0x50665d
jmp 0x5066c1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.0044c140
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461b40
mov eax, edi
mov ecx, 0x19
call fcn.00461b40
nop
call fcn.0045f8c0
nop
jmp fcn.005065c0
Function at 0x506a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506b47
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x656ce112b20e13e8
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x7845
movabs rdx, 0x402030405020000
mov qword [rsp + 0x22], rdx
movabs rdx, 0x404040401010402
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x506ae7
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x64]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x64]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x506b17
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x506b3a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x506aca
jmp 0x506b2e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461b40
mov eax, edi
mov ecx, 0xa
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00506a80

Function at 0x507f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507fcc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x65725e68645b6480
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x51754b65725e6864
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa00020801050209
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa02020803050905
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x507f6f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x507f9c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x507fbf
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x507f52
jmp 0x507fb3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0044c140
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461b40
mov eax, edi
mov ecx, 0xb
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00507f00
Function at 0x508400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5084fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8ad09faf74fdee44
mov qword [rsp + 0x19], rdx
movabs rdx, 0x30d893cf675a18a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6b0e8c6c0afa6e65
mov qword [rsp + 0x28], rdx
movabs rdx, 0x120604040809090b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1102020c05061415
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0e0604070b0d0e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80a090b15050e01
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x508499
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x58]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x5084cb
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5084ee
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x58]
cmp rsi, 0x17
jb 0x50847f
jmp 0x5084e2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044c140
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461b40
mov eax, edi
mov ecx, 0x17
call fcn.00461b40
nop
nop dword [rax + rax]
call fcn.0045f8c0
jmp fcn.00508400

Function at 0x510240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51038c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x6c6123fbee913169
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xddb7277846c6123
mov qword [rsp + 0x24], rdx
movabs rdx, 0x41e1eee175209e72
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6fdd0d0a8af1e777
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa87bc5d65b97166c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x16010e050218160b
mov qword [rsp + 0x44], rdx
movabs rdx, 0x2403080b16010e05
mov qword [rsp + 0x48], rdx
movabs rdx, 0x917010c11230103
mov qword [rsp + 0x50], rdx
movabs rdx, 0x41116241a1e1419
mov qword [rsp + 0x58], rdx
movabs rdx, 0x21130c160e0b1805
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1d2217191d162002
mov qword [rsp + 0x68], rdx
movabs rdx, 0x212160b1f081b03
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x510324
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x34
jge 0x51035c
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x51037f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
cmp rsi, 0x25
jb 0x51030a
jmp 0x510373
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.0044c140
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461b40
mov eax, edi
mov ecx, 0x25
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00510240
Function at 0x5213e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5214ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2e8242b919e731ab
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x82e8242b919e731
mov qword [rsp + 0x20], rdx
movabs rdx, 0xedd802850638dfe2
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf0c0e0b000f060d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80a090d04091007
mov qword [rsp + 0x38], rdx
movabs rdx, 0x602030605030e03
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x52146d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x52149a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5214bd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x521450
jmp 0x5214b1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461b40
mov eax, edi
mov ecx, 0x11
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005213e0
Function at 0x535520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x5356fb
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0xb8d46e5069747082
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6872f3723a647320
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa9ad6872f3723a64
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8fe320642597af75
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x39dec73876cd953
mov qword [rsp + 0x34], rdx
movabs rdx, 0xcfb6d4ad6dbb6e41
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x81c825aa33e37a69
mov qword [rsp + 0x44], rdx
movabs rdx, 0xde3345af02736f20
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xcbf96f4811706351
mov qword [rsp + 0x54], rdx
movabs rdx, 0x72d8acfe0568518e
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x4130451312092c26
mov qword [rsp + 0x64], rdx
movabs rdx, 0xb4847390a210a0d
mov qword [rsp + 0x6c], rdx
movabs rdx, 0x12113e340b484739
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2c1a403d2d201221
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2d22313429130618
mov qword [rsp + 0x80], rdx
movabs rdx, 0x364314042648131d
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3a3534174240190b
mov qword [rsp + 0x90], rdx
movabs rdx, 0x2c06003a3b2e3612
mov qword [rsp + 0x98], rdx
movabs rdx, 0x461f1b270c280724
mov qword [rsp + 0xa0], rdx
movabs rdx, 0xa34111806100f1b
mov qword [rsp + 0xa8], rdx
xor eax, eax
jmp 0x535699
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x4c
jge 0x5356c8
movzx edx, byte [rsp + rax + 0x64]
movzx esi, byte [rsp + rax + 0x65]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4a
jae 0x5356ee
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop
cmp rsi, 0x4a
jb 0x53567c
jmp 0x5356e2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x4a
call fcn.0044c140
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x4a
call fcn.00461b40
mov eax, edi
mov ecx, 0x4a
call fcn.00461b40
nop
nop dword [rax + rax]
call fcn.0045f8c0
jmp fcn.00535520
Function at 0x535720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53586c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x9c65b2a26c9e6a9b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb6f4617172a9ee30
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7067abb69287b0
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd8122088617f54c8
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc1bf204fed65d361
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1e130e0901140f15
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1f0a1e130e090114
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c11112117000423
mov qword [rsp + 0x50], rdx
movabs rdx, 0x13270a07170218
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5261a092605190a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x26080e020c101124
mov qword [rsp + 0x68], rdx
movabs rdx, 0x171212040c001309
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x535804
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x32
jge 0x53583c
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x28
jae 0x53585f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
cmp rsi, 0x28
jb 0x5357ea
jmp 0x535853
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x28
call fcn.0044c140
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00461b40
mov eax, edi
mov ecx, 0x28
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00535720
Function at 0x538560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5386bd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x3af88651e8a666f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x79c037a1d0dc20ad
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1a6ec879c037a1d0
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf97a65843899f905
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8572a173a294f020
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb8232f8574c667f7
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1d171d0d08100b1a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x17220b1408162725
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10170c1e1d232310
mov qword [rsp + 0x58], rdx
movabs rdx, 0x502151707220a0d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xc2016291d192a02
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d1c08060a0c130e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x328120508290214
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x538660
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x38
jge 0x53868d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x5386b0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2b
jb 0x53863e
jmp 0x5386a4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2b
call fcn.0044c140
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
call fcn.00461b40
mov eax, edi
mov ecx, 0x2b
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00538560

Function at 0x53bde0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x53be4b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x53be04
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x53be21
cmp rdx, 0
je 0x53be6d
test rdx, 0xf
je 0x53bdfd
test rdx, 7
jne 0x53be21
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x53bdfd
ret
Function at 0x53cea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53cfec
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xbd746d74be827263
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x92757066bd746d74
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb9926732704c3a79
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7b75b76e3a888420
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7353696f74622b6c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x161903121b151319
mov qword [rsp + 0x42], rdx
movabs rdx, 0x17211b0e070a1619
mov qword [rsp + 0x48], rdx
movabs rdx, 0x81b15080c0b1312
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f080a0e101d1d02
mov qword [rsp + 0x58], rdx
movabs rdx, 0x211b0e020b220608
mov qword [rsp + 0x60], rdx
movabs rdx, 0x50f181607151105
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1f121507181f0a06
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x53cf84
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x36
jge 0x53cfbc
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x24
jae 0x53cfdf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0x24
jb 0x53cf6a
jmp 0x53cfd3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.0044c140
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461b40
mov eax, edi
mov ecx, 0x24
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.0053cea0
Function at 0x540e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x540fa7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xf4b56f7413d6ef79
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5b70d01c4c2fdfe2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x75f308f16f8f0ddc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6b63896c105dba6c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x190116100b0b010f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xa1d071914151a11
mov qword [rsp + 0x46], rdx
movabs rdx, 0x100c0a1d07191415
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16160306090f1b19
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a07021d1a0f0015
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1408190d10071206
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x540f49
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x2a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x2a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2a
jge 0x540f77
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x540f9a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x20
jb 0x540f2c
jmp 0x540f8e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x20
call fcn.0044c140
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461b40
mov eax, edi
mov ecx, 0x20
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00540e80

Function at 0x541340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541478
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x49957baa6c8672b3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xad8149957baa6c86
mov qword [rsp + 0x20], rdx
movabs rdx, 0x697396b06e7e85c5
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8fc762793d79c682
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb6af6c8b73b682ad
mov qword [rsp + 0x38], rdx
movabs rdx, 0x190c0c020f0a001d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x18131c031a09141b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50c1016061c1208
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe21141719180a17
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf1e13151d032009
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e151a07070b0419
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x541418
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x30
jge 0x541448
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x54146b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x5413fb
jmp 0x54145f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.0044c140
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461b40
mov eax, edi
mov ecx, 0x22
call fcn.00461b40
nop
call fcn.0045f8c0
nop dword [rax]
jmp fcn.00541340
Function at 0x541fc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x541fff
jb 0x542014
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret