joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5397a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5398ff
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x40e19536e601363
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9774426535040e19
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6e3c3974ca6f3c14
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x36e20c8f072ce42
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe8b8fac7d170b74f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x180c020413070c24
mov qword [rsp + 0x42], rdx
movabs rdx, 0x141c130a1d182410
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x152110241515141c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20011e230e040819
mov qword [rsp + 0x58], rdx
movabs rdx, 0x12140e221c220523
mov qword [rsp + 0x60], rdx
movabs rdx, 0x62122080c01160d
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x539880
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x11]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x5398bc
movzx edx, byte [rsp + rax + 0x42]
lea rsi, [rax + 1]
cmp rsi, 0x2e
jae 0x5398f1
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x5398e5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x11]
cmp rsi, 0x25
jb 0x539862
jmp 0x5398d7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.00446000
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x25
call fcn.00457f40
mov rax, rsi
mov ecx, 0x2e
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005397a0

Function at 0x539920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x539a33
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xdffd736950bb21f5
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x806320746fdffd73
mov qword [rsp + 0x20], rdx
movabs rdx, 0x626ce8e572c4256d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x121402030f021206
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70f000f12011107
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe11000e000c1101
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5399b0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x5399ed
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
nop
cmp rsi, 0x18
jae 0x539a25
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x539a14
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0x15
jb 0x539996
jmp 0x539a08
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457f40
mov eax, edi
mov ecx, 0x15
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00539920
Function at 0x53ae40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53af33
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xc1d5d55f4be3f06d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x324b35c1d5d55f4b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x904000605020904
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x705050506010904
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x53aeb2
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x53aeee
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0xe
jae 0x53af25
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x53af15
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0xb
jb 0x53ae98
jmp 0x53af09
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00446000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457f40
mov eax, edi
mov ecx, 0xb
nop dword [rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0xe
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0053ae40
Function at 0x53d260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53d3c9
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x4c3ee11168707c49
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6a73695a394c3ee1
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4e687bf838206539
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x420d7140106a406e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5e156c222760532d
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x11041f0d052107
mov qword [rsp + 0x44], rdx
movabs rdx, 0x7101f1d0011041f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16180d0823090720
mov qword [rsp + 0x50], rdx
movabs rdx, 0x161e06001c1c1b07
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b140c2008080424
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6191e1406142412
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1b0a1a011b171e09
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x53d34d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x34
jge 0x53d388
movzx edx, byte [rsp + rax + 0x44]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0x34
jae 0x53d3bb
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x53d3af
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x25
jb 0x53d330
jmp 0x53d3a3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.00446000
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x25
call fcn.00457f40
mov eax, edi
mov ecx, 0x25
call fcn.00457f40
mov rax, rsi
mov ecx, 0x34
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0053d260
Function at 0x53eae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x53ebb0
jb 0x53ec0f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0053ea80
aeskeygenassist xmm1, xmm0, 1
call fcn.0053eaa0
aeskeygenassist xmm1, xmm2, 2
call fcn.0053ea80
aeskeygenassist xmm1, xmm0, 2
call fcn.0053eaa0
aeskeygenassist xmm1, xmm2, 4
call fcn.0053ea80
aeskeygenassist xmm1, xmm0, 4
call fcn.0053eaa0
aeskeygenassist xmm1, xmm2, 8
call fcn.0053ea80
aeskeygenassist xmm1, xmm0, 8
call fcn.0053eaa0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053ea80
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053eaa0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053ea80
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053eaa0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053ea80
jmp 0x53ec7d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0053e9e0
aeskeygenassist xmm1, xmm2, 2
call fcn.0053ea40
aeskeygenassist xmm1, xmm2, 4
call fcn.0053e9e0
aeskeygenassist xmm1, xmm2, 8
call fcn.0053ea40
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053e9e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053ea40
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053e9e0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0053ea40
jmp 0x53ec7d
aeskeygenassist xmm1, xmm0, 1
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 2
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 4
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 8
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0053e9a0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0053e9a0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x53ec8a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x546620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54672b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x68327218626d127d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xaf203eee68327218
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5574696769eef6cf
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60c0b0c06000d08
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10e09130e060b08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80e0408130c0d0c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5466b3
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x18
jge 0x5466ea
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x54671d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x546711
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x14
jb 0x546696
jmp 0x546705
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457f40
mov eax, edi
mov ecx, 0x14
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00546620

Function at 0x546740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54689f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x7473752b64765e7c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6574207473752b64
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x732052898e668b70
mov qword [rsp + 0x24], rdx
movabs rdx, 0x90697e7370646158
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6197697c97647b15
mov qword [rsp + 0x34], rdx
movabs rdx, 0x422210013100f1e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x181a1e1322020013
mov qword [rsp + 0x44], rdx
movabs rdx, 0xe0f090c181a1e13
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1f131015130c0d16
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a1c041615011000
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c101f1401031b00
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x546820
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2c
jge 0x54685c
movzx edx, byte [rsp + rax + 0x3c]
lea rsi, [rax + 1]
cmp rsi, 0x2c
jae 0x546891
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x546885
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2d]
cmp rsi, 0x23
jb 0x546802
jmp 0x546877
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x23
call fcn.00446000
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x23
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x23
call fcn.00457f40
mov rax, rsi
mov ecx, 0x2c
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00546740
Function at 0x54bc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54bdbf
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x7749727849769665
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6a654a617d217f50
mov qword [rsp + 0x24], rdx
movabs rdx, 0x38747a656a654a61
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5a82316a7a968265
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3091a150d130601
mov qword [rsp + 0x38], rdx
movabs rdx, 0x18060313161104
mov qword [rsp + 0x40], rdx
movabs rdx, 0x31b17130a16050b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x40f050516130701
mov qword [rsp + 0x50], rdx
movabs rdx, 0x190c0d0b0f0f060c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x54bd40
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x28
jge 0x54bd7c
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
cmp rsi, 0x28
jae 0x54bdb1
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x54bda5
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 0x1c
jb 0x54bd23
jmp 0x54bd97
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1c
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x1c
call fcn.00457f40
mov rax, rsi
mov ecx, 0x28
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0054bc80

Function at 0x54bde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54bf1f
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x2064694a04256ef0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6d4ba4db3632411c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1d94f4366d4ba4db
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0e945646f633ebf
mov qword [rsp + 0x32], rdx
movabs rdx, 0x91b1a1203041b0d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc00111a0811091b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc040e0c0e0d1312
mov qword [rsp + 0x48], rdx
movabs rdx, 0x40e000b08141912
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1508080910021511
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x54bea0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x26
jge 0x54bedc
movzx edx, byte [rsp + rax + 0x3a]
lea rsi, [rax + 1]
cmp rsi, 0x26
jae 0x54bf11
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x54bf05
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 0x1c
jb 0x54be83
jmp 0x54bef7
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1c
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x1c
call fcn.00457f40
mov rax, rsi
mov ecx, 0x26
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0054bde0
Function at 0x54f040
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x54f24c
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx ecx, byte [rbx + 0x10]
mov qword [rsp + 0x20], rcx
movzx edi, byte [rbx + 0xf]
movzx esi, byte [rbx + 0xe]
movzx edx, byte [rbx + 0xd]
movzx ecx, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rdi, 0x38
shl rsi, 0x30
shl rdx, 0x28
shl rcx, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rcx, rbx
add rcx, rdx
add rcx, rsi
add rcx, rdi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x70]
shl rcx, 0x10
mov rdx, qword [rsp + 0x68]
shl rdx, 8
mov rbx, qword [rsp + 0x60]
add rdx, rbx
add rcx, rdx
mov rdx, qword [rsp + 0x78]
shl rdx, 0x18
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0054f040
Function at 0x566f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56703f
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xf9f7e56ce0766e20
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x280f232031dce750
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd97462280f232031
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5b6e34f9248dd165
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x171017140b1a1217
mov qword [rsp + 0x36], rdx
movabs rdx, 0x907171017140b1a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf060d1603121700
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0e150e0a001818
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa05050b14100f00
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x566fc0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x566ffc
movzx edx, byte [rsp + rax + 0x36]
lea rsi, [rax + 1]
cmp rsi, 0x22
jae 0x567031
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x567025
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x1b
jb 0x566fa3
jmp 0x567017
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1b
call fcn.00446000
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1b
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x1b
call fcn.00457f40
mov rax, rsi
mov ecx, 0x22
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00566f00

Function at 0x567700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56781f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xb26fb55e0732a615
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4d11a3052011f7b2
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb376e8d9fe20c66f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5030704160c0e05
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd090b0b1216100e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc0c03130d090b0b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1403070e01140008
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5677a2
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x75]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x75]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1c
jge 0x5677d9
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x567811
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x567805
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x17
jb 0x567785
jmp 0x5677f4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1c
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00567700
Function at 0x569b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x569c53
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x3f6f464b4eee333c
mov qword [rsp + 0x19], rdx
movabs rdx, 0xcf76f480b05f53f
mov qword [rsp + 0x20], rdx
movabs rdx, 0xee76f77506c96ef8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3090b0508090a16
mov qword [rsp + 0x30], rdx
movabs rdx, 0x14111216040d0e11
mov qword [rsp + 0x38], rdx
movabs rdx, 0x71600080f07020e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x569bd0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x16]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x569c0d
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
nop
cmp rsi, 0x18
jae 0x569c45
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x569c34
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x16]
cmp rsi, 0x17
jb 0x569bb6
jmp 0x569c28
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00569b40
Function at 0x56d840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56d95f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x1b6f5b2031f335b4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x203fb96e2090c91b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65f5b8a9bfa22016
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd0f11050d100711
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc020c141315050d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xf120c020c141315
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50c130800091005
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x56d8e2
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x1a
jge 0x56d919
movzx edx, byte [rsp + rax + 0x36]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x56d951
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x56d945
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x56d8c5
jmp 0x56d934
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1a
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0056d840