joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5303c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x530546
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x357279d711a4695b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5b7f74b269641760
mov qword [rsp + 0x23], rdx
movabs rdx, 0xb65b7f74b2696417
mov qword [rsp + 0x24], rdx
movabs rdx, 0x94ab6d979666fecf
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x477d8e71349b4861
mov qword [rsp + 0x34], rdx
movabs rdx, 0xbc9967af2ca304b2
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x70911212825240c
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1710122221000317
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x7120c2717101222
mov qword [rsp + 0x50], rdx
movabs rdx, 0x21520071a230915
mov qword [rsp + 0x58], rdx
movabs rdx, 0x161b1d271b042211
mov qword [rsp + 0x60], rdx
movabs rdx, 0x8140e231d0f2811
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf12060a18110628
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1f02141a1e0a2817
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x5304d6
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x3c
jge 0x530508
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x530535
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x66]
cmp rsi, 0x29
jb 0x5304bc
jmp 0x530529
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x29
call fcn.0044a200
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x29
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x29
nop dword [rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005303c0

Function at 0x530560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x530686
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xe308a542c5eb6916
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x8aba3620e3cdc065
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6cab8aba3620e3cd
mov qword [rsp + 0x24], rdx
movabs rdx, 0x116570b7a02040a6
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x612160413020b05
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1900070f06121604
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20a0a161513060b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100b1012120d0419
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0a1005030f09
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x530620
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x28]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x28]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x53064d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x530674
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x530603
jmp 0x530668
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1a
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00530560
Function at 0x531bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x531c92
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6f30fab7b52c72fa
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x1b146eb6
movabs rdx, 0x40500050b040b03
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0002060a0a0800
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x531c2b
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x32]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x531c5d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x531c85
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x32]
cmp rsi, 0xc
jb 0x531c11
jmp 0x531c78
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00531bc0
Function at 0x539200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x539326
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x17b8741ef66915fc
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x666f25ed6b112373
mov qword [rsp + 0x24], rdx
movabs rdx, 0x74206c6f7b801673
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x72796d7ae46c626b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1e0d1d0d0f060003
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x718181f1e0d1d0d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60111110612131c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9131b040c1c0d04
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e1f1f1d0112090a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x5392c0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x24
jge 0x5392ed
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x539314
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x20
jb 0x5392a3
jmp 0x539308
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.0044a200
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x20
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00539200
Function at 0x53ac40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53ad68
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x5927f3891e09aa0e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x18220e20b7af0d0c
mov qword [rsp + 0x21], rdx
movabs rdx, 0xb2205e6ed418220e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6b252008066c6261
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x121c190114030407
mov qword [rsp + 0x36], rdx
movabs rdx, 0x60e121c19011403
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4180b18030b0a07
mov qword [rsp + 0x40], rdx
movabs rdx, 0x518080a02091207
mov qword [rsp + 0x48], rdx
movabs rdx, 0x101903000f0d1c0d
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x53ad00
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x53ad32
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x53ad5b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 0x1d
jb 0x53ace3
jmp 0x53ad4f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1d
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0053ac40
Function at 0x53c6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53c832
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x2c281475f3dd33fd
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x204827fc2d206f4e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x39204827fc2d206f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65370b4f6fe73639
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6d41e9f164e265f7
mov qword [rsp + 0x36], rdx
movabs rdx, 0x76253b3a30692bf6
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x15062113261e070b
mov qword [rsp + 0x46], rdx
movabs rdx, 0x180e190d181812
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x221300180e190d18
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d0724020c1f0b16
mov qword [rsp + 0x58], rdx
movabs rdx, 0x101b0e2108150508
mov qword [rsp + 0x60], rdx
movabs rdx, 0x102417010317110b
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x53c7ca
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 3]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x2a
jge 0x53c7fc
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x53c825
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 3]
cmp rsi, 0x29
jb 0x53c7b0
jmp 0x53c817
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x29
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x29
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x29
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0053c6e0
Function at 0x53d460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x53d5dc
sub rsp, 0xd0
mov qword [rsp + 0xc8], rbp
lea rbp, [rsp + 0xc8]
movabs rdx, 0x6c82b94ad57d261a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x20ddf964e61eff41
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc17a69e620ddf964
mov qword [rsp + 0x26], rdx
movabs rdx, 0xdf73690ba7f61228
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xbb603a7aeeb4c66c
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe0a773206d30cd95
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xec96ac9225914865
mov qword [rsp + 0x46], rdx
movabs rdx, 0x3dbf6ce6504a72bf
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1ff46f6974325b20
mov qword [rsp + 0x56], rdx
movabs rdx, 0x1af1fad26570ac9f
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x43220e302e032008
mov qword [rsp + 0x66], rdx
lea rdi, [rsp + 0x68]
lea rsi, [0x0083da62]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045fbcc
mov rbp, qword [rbp]
xor eax, eax
jmp 0x53d574
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 7]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 7]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x62
jge 0x53d5a2
movzx edx, byte [rsp + rax + 0x66]
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4c
jae 0x53d5cf
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x4c
jb 0x53d557
nop
jmp 0x53d5c3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x4c
call fcn.0044a200
mov rbp, qword [rsp + 0xc8]
add rsp, 0xd0
ret
mov eax, esi
mov ecx, 0x4c
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x4c
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.0053d460

Function at 0x53f660
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x53f6cb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x53f684
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x53f6a1
cmp rdx, 0
je 0x53f6ed
test rdx, 0xf
je 0x53f67d
test rdx, 7
jne 0x53f6a1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x53f67d
ret
Function at 0x5400a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5401e6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xc5a0a5caed94b77e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x65b270dac5a0a5ca
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6ab4796e9a20ad72
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1d75a2ce74916eb5
mov qword [rsp + 0x32], rdx
movabs rdx, 0x90f07cc56c12203d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x419021308002006
mov qword [rsp + 0x42], rdx
movabs rdx, 0x212102061c141116
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x220a220318162121
mov qword [rsp + 0x50], rdx
movabs rdx, 0x71b1c05160d11
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11207001c19181e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x190323181e030f0f
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x540180
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x2e
jge 0x5401ad
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x5401d4
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x24
jb 0x540162
jmp 0x5401c8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.0044a200
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x24
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005400a0
Function at 0x5447c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5448e8
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x8cf3d23acda9e28d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x61bc6ecd16f87329
mov qword [rsp + 0x21], rdx
movabs rdx, 0xc64acdd19461bc6e
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd8934cc3ced079c7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x40a17000e0a1a13
mov qword [rsp + 0x36], rdx
movabs rdx, 0x713040a17000e0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x81a1c1b18050206
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1010411100a0b16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14121519031a0c16
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x544880
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x5448b2
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x5448db
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
cmp rsi, 0x1d
jb 0x544863
jmp 0x5448cf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1d
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005447c0
Function at 0x5454c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5455f2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x83ae6fb4ca7972ab
mov qword [rsp + 0x18], rdx
movabs rdx, 0x8b4383ae6fb4ca79
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x746c43766eb1a9aa
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdf65baaaf16720b4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf8ad5a7270a2d5b0
mov qword [rsp + 0x32], rdx
movabs rdx, 0x191d0f090f081d21
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1a1500200b14191d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9040c1f121c1106
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70a1d1603210c17
mov qword [rsp + 0x50], rdx
movabs rdx, 0x161a1b0403170804
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x54558f
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x20]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x20]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x26
jge 0x5455bc
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x5455e5
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x22
jb 0x545572
jmp 0x5455d7
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
call fcn.0044a200
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x22
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x22
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005454c0

Function at 0x546520
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x54655f
jb 0x546574
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x5465e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x5466b0
jb 0x54670f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.005464c0
aeskeygenassist xmm1, xmm0, 1
call fcn.005464e0
aeskeygenassist xmm1, xmm2, 2
call fcn.005464c0
aeskeygenassist xmm1, xmm0, 2
call fcn.005464e0
aeskeygenassist xmm1, xmm2, 4
call fcn.005464c0
aeskeygenassist xmm1, xmm0, 4
call fcn.005464e0
aeskeygenassist xmm1, xmm2, 8
call fcn.005464c0
aeskeygenassist xmm1, xmm0, 8
call fcn.005464e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005464c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005464e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005464c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005464e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005464c0
jmp 0x54677d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00546420
aeskeygenassist xmm1, xmm2, 2
call fcn.00546480
aeskeygenassist xmm1, xmm2, 4
call fcn.00546420
aeskeygenassist xmm1, xmm2, 8
call fcn.00546480
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00546420
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00546480
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00546420
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00546480
jmp 0x54677d
aeskeygenassist xmm1, xmm0, 1
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 2
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 4
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 8
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.005463e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.005463e0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x54678a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x5496c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54979c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x2064696c7a7b7874
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6a83697a73677820
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0308000a010802
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0403090e090a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x549735
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x549768
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x54978f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xf
jb 0x549718
jmp 0x549783
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xf
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.005496c0

Function at 0x54af20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54afeb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x7d9068487508dff8
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x4f
movabs rdx, 0x3050702010601
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x50707
xor eax, eax
jmp 0x54af84
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x76]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x76]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x54afb7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x54afde
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x54af67
jmp 0x54afd2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f5c0
mov eax, edi
mov ecx, 9
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0054af20
Function at 0x54b8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54b9b2
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x67752d575b413e58
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x444f655c
movabs rdx, 0x7020b0501020308
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb000400070a0407
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x54b94b
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 3]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x54b97d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x54b9a5
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 3]
cmp rsi, 0xc
jb 0x54b931
jmp 0x54b998
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0054b8e0

Function at 0x54bee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54bfd6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x746f817d646fc93b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x126db7746f817d64
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf0750e6e656dc9f4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0b0b0411050c08
mov qword [rsp + 0x32], rdx
movabs rdx, 0x111201010a100c0b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb05050b00050b00
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54bf73
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x54bfa2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x54bfc9
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x54bf56
nop
jmp 0x54bfbd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x13
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.0054bee0