joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509ec7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x65c6e55a344acd4e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6464da65c6e55a34
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x504030601080205
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6050806
xor eax, eax
jmp 0x509e68
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x6a]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x6a]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x509e97
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x509eba
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x509e4b
jmp 0x509eae
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00509e00

Function at 0x50a860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a926
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbbcaba6f91c25301
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xbdc1
movabs rdx, 0x909050000070703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7020608
xor eax, eax
jmp 0x50a8c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x50a8f2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x50a917
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 0xa
jb 0x50a8a3
jmp 0x50a90b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0050a860
Function at 0x511760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511887
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x4f13607070657875
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x804d4f1360707065
mov qword [rsp + 0x20], rdx
movabs rdx, 0x65595c7466616a28
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7a6c5b610d606a1a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9e3a725273436561
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120a0708151a1710
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70506070c1e161c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6130f081416050c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e1e0d0d030b0119
mov qword [rsp + 0x58], rdx
movabs rdx, 0x17101c1d0309210c
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x511829
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x28
jge 0x511857
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x51187a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x22
jb 0x51180c
jmp 0x51186e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461020
mov eax, edi
mov ecx, 0x22
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00511760

Function at 0x511de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511ea7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa9276170ea619ba0
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xa3b0
movabs rdx, 0x8090601020703
mov qword [rsp + 0x22], rdx
movabs rdx, 0x107090709010008
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x511e47
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x2d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x2d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x511e77
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x511e9a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x511e2a
jmp 0x511e8e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00511de0
Function at 0x512a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x512c52
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0xd06e61a1206fd0c4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3975e2306f1920d0
mov qword [rsp + 0x26], rdx
movabs rdx, 0xde086fa77489650a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xcc73766fb874e036
mov qword [rsp + 0x36], rdx
movabs rdx, 0x8e2480d2f2dc6e6f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x656c01394c5f6c03
mov qword [rsp + 0x46], rdx
movabs rdx, 0x6baa027368f9dee9
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x48ae5f1928837465
mov qword [rsp + 0x56], rdx
movabs rdx, 0x41a13735388a30da
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x4611254623154624
mov qword [rsp + 0x66], rdx
movabs rdx, 0x2a041e3d0a22162b
mov qword [rsp + 0x6e], rdx
movabs rdx, 0xf092a041e3d0a22
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2c2741320c2f2215
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1834073b2f293c18
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3d1a183e3f0e1629
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1220b2532353017
mov qword [rsp + 0x90], rdx
movabs rdx, 0x735243d1c2f1a30
mov qword [rsp + 0x98], rdx
movabs rdx, 0x392324310a450425
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x212613223f241800
mov qword [rsp + 0xa8], rdx
xor eax, eax
jmp 0x512be7
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x4a
jge 0x512c1c
movzx edx, byte [rsp + rax + 0x66]
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x47
jae 0x512c45
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
cmp rsi, 0x47
jb 0x512bcd
jmp 0x512c36
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x47
call fcn.0044bb20
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0x47
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00512a80

Function at 0x5165e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5166ac
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6474d52f2d65c63d
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf738f06474d52f2d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8010300010500
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x809090a
xor eax, eax
jmp 0x516645
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x31]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x51667c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x51669f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x31]
cmp rsi, 0xb
jb 0x51662b
jmp 0x516693
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005165e0
Function at 0x5166c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51678c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6411a82fd9066a74
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7972656411a82fd9
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2060201000a0506
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3000a06000a0206
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x51672f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x65]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x65]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x51675c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x51677f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x516712
jmp 0x516773
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005166c0

Function at 0x516ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x516d3b
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xceb7cd5b20e36f6f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xcdd375e6c39bdace
mov qword [rsp + 0x26], rdx
movabs rdx, 0x74a93157f5662bb6
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xcf7fdc6f205f5d65
mov qword [rsp + 0x36], rdx
movabs rdx, 0x963a70b7d8ddcb69
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x20cd74f9c27764f3
mov qword [rsp + 0x46], rdx
movabs rdx, 0xa2afaa325083aec9
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x212f072b202a1907
mov qword [rsp + 0x56], rdx
movabs rdx, 0x1e0b212f072b202a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3634351c0d081436
mov qword [rsp + 0x60], rdx
movabs rdx, 0x273001122a0f220e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x635150726090a05
mov qword [rsp + 0x70], rdx
movabs rdx, 0xb301d253505232b
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1e290b33020a010b
mov qword [rsp + 0x80], rdx
movabs rdx, 0x131142f29100434
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2022222d35180e0a
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x516cd1
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x42
jge 0x516d08
movzx edx, byte [rsp + rax + 0x56]
movzx esi, byte [rsp + rax + 0x57]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x516d2e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
nop dword [rax + rax]
cmp rsi, 0x37
jb 0x516cb7
jmp 0x516d22
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x37
call fcn.0044bb20
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.00461020
mov eax, edi
mov ecx, 0x37
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.00516ba0
Function at 0x519220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5192fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x41acc2a497baa4b5
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2fcc2c2c1720104
mov qword [rsp + 0x22], rdx
movabs rdx, 0x604070703090e02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3020b050c070604
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10d0f080c0f08
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x5192a0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x3b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x3b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x5192cd
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5192f0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x519282
jmp 0x5192e4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00519220

Function at 0x523ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x523bc8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6550789f74dd0173
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x64e2e54572e97272
mov qword [rsp + 0x25], rdx
movabs rdx, 0xecea69e5ec64e2e5
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa7ea630e7e6fbd20
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf0c160f1b021306
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa0d1c0606180e1a
mov qword [rsp + 0x42], rdx
movabs rdx, 0x101816130c0f0a0d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x119040e1411040c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x523b6b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x523b98
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x523bbb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x523b4e
jmp 0x523baf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461020
mov eax, edi
mov ecx, 0x1d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00523ac0
Function at 0x5241e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52429d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2b749b9fe01048e
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x29
movabs rdx, 0x607000403010004
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x207
xor eax, eax
nop
jmp 0x524240
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x53]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x53]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x52426d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x524290
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x524222
jmp 0x524284
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.005241e0

Function at 0x525da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x525e8a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x379435c995c72c30
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x90379435c995c72c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1f66e491b9ed9a5b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0c100e06091001
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x8030b0c100e0609
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40a060a020c010d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x525e2d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x525e5a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x525e7d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x525e10
jmp 0x525e71
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00525da0
Function at 0x525ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x525f8a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x37453634333c313b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4337453634333c31
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x54333768353c4146
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf0e0c02100d020b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0c0f0e0c02100d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50008060e0f090e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x525f2d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x525f5a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x525f7d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x525f10
jmp 0x525f71
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00525ea0

Function at 0x52cc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ccec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe86e6b1f67e60912
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x52926e60
movabs rdx, 0x10a0b0408040103
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa010007020b0a04
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x52cc85
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x52ccbc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x52ccdf
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0xc
jb 0x52cc6b
jmp 0x52ccd3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0052cc20
Function at 0x539260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5393d2
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xff750cafbcfd1748
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x94efae2019ef2064
mov qword [rsp + 0x25], rdx
movabs rdx, 0x71a3ec2ee994efae
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xdbe0028e0f0609fa
mov qword [rsp + 0x32], rdx
movabs rdx, 0x86f574d6b3086f20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf5b605d1aeb3396e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x182624210a100e1c
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x12141c0713062c0f
mov qword [rsp + 0x52], rdx
movabs rdx, 0xd12001518131214
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2c2b07290b210128
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2b11192c021a0129
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2c0104172720232a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x131b17111505032c
mov qword [rsp + 0x78], rdx
movabs rdx, 0x5030112132c161f
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x539370
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x64]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x3e
jge 0x53939d
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x5393c5
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2d
jb 0x539353
jmp 0x5393b7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2d
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
nop
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00539260

Function at 0x53a7a0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x53a80b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x53a7c4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x53a7e1
cmp rdx, 0
je 0x53a82d
test rdx, 0xf
je 0x53a7bd
test rdx, 7
jne 0x53a7e1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x53a7bd
ret
Function at 0x53dea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x48
movups xmmword [rsp + 0x58], xmm15
movabs rdx, 0x59403b3b801c1eb1
mov qword [rsp + 0x26], rdx
movabs rdx, 0xbd184d9826095248
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc07030a0e00040b
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc0f0c07030a0e00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1020b0308050809
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x53df19
movzx r8d, byte [rsp + rbx + 0x26]
sub r8d, edx
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x26], dl
lea edx, [rdi - 7]
mov byte [rsp + rbx + 0x26], dl
add rax, 2
cmp rax, 0x12
jge 0x53df48
movzx edx, byte [rsp + rax + 0x36]
movzx ebx, byte [rsp + rax + 0x37]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x10
jae 0x53df85
movzx edi, byte [rsp + rsi + 0x26]
sub edi, edx
nop dword [rax]
cmp rbx, 0x10
jb 0x53defd
jmp 0x53df76
movups xmmword [rsp + 0x16], xmm15
xor eax, eax
jmp 0x53df60
movzx ecx, byte [rsp + rax + 0x26]
mov byte [rsp + rax + 0x16], cl
inc rax
nop
cmp rax, 0x10
jl 0x53df52
movups xmm0, xmmword [rsp + 0x16]
movups xmmword [rsp + 0x58], xmm0
add rsp, 0x48
pop rbp
ret
mov eax, ebx
mov ecx, 0x10
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 0x10
call fcn.00461020
nop
int3
Function at 0x5461a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x5461df
jb 0x5461f4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x546260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x546334
jb 0x546393
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00546140
aeskeygenassist xmm1, xmm0, 1
call fcn.00546160
aeskeygenassist xmm1, xmm2, 2
call fcn.00546140
aeskeygenassist xmm1, xmm0, 2
call fcn.00546160
aeskeygenassist xmm1, xmm2, 4
call fcn.00546140
aeskeygenassist xmm1, xmm0, 4
call fcn.00546160
aeskeygenassist xmm1, xmm2, 8
call fcn.00546140
aeskeygenassist xmm1, xmm0, 8
call fcn.00546160
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00546140
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00546160
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00546140
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00546160
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00546140
jmp 0x546401
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.005460a0
aeskeygenassist xmm1, xmm2, 2
call fcn.00546100
aeskeygenassist xmm1, xmm2, 4
call fcn.005460a0
aeskeygenassist xmm1, xmm2, 8
call fcn.00546100
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005460a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00546100
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005460a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00546100
jmp 0x546401
aeskeygenassist xmm1, xmm0, 1
call fcn.00546060
aeskeygenassist xmm1, xmm0, 2
call fcn.00546060
aeskeygenassist xmm1, xmm0, 4
call fcn.00546060
aeskeygenassist xmm1, xmm0, 8
call fcn.00546060
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00546060
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00546060
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00546060
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00546060
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00546060
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00546060
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x54640e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret