joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x680fc8bf6daeb2f9
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x40603050400
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
jmp 0x554fd6
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x53]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x555002
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x555045
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x554fba
nop
jmp 0x555036
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x555020
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55500f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x556b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x67ae32c387d699a6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x103020100030307
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x556baf
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x2b]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x556bda
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x556c15
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x556b93
jmp 0x556c09
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x556bf3
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x556be7
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.00461020
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
nop
int3
Function at 0x5575a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0xfe52aa59a0df4ba2
mov qword [rsp + 0x18], rax
movabs rax, 0x599c9e876efedfc6
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1c]
movzx ecx, byte [rsp + 0x18]
sub eax, ecx
movzx ecx, byte [rsp + 0x22]
movzx edx, byte [rsp + 0x1f]
sub ecx, edx
movzx edx, byte [rsp + 0x26]
movzx ebx, byte [rsp + 0x25]
xor edx, ebx
movzx ebx, byte [rsp + 0x27]
movzx esi, byte [rsp + 0x1e]
sub ebx, esi
movzx esi, byte [rsp + 0x19]
movzx edi, byte [rsp + 0x23]
add esi, edi
movzx edi, byte [rsp + 0x24]
movzx r8d, byte [rsp + 0x1a]
add edi, r8d
movzx r8d, byte [rsp + 0x21]
movzx r9d, byte [rsp + 0x20]
sub r8d, r9d
movzx r9d, byte [rsp + 0x1b]
movzx r10d, byte [rsp + 0x1d]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r10 + r9]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x557686
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x55767a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret

Function at 0x557d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x76bcfb5331e11427
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x200030401020402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x706
xor eax, eax
jmp 0x557d56
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x4b]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x4b]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x557d82
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x557dc5
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x557d3a
nop
jmp 0x557db6
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x557da0
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x557d8f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x55d200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d2fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8a08998d7c642fa8
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xae7c7a76658a0899
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe17594ac36535fd0
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa010d140c100203
mov qword [rsp + 0x34], rdx
movabs rdx, 0x607040406111414
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb000d0506070404
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120c0c0c0a121112
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x55d2a0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x55d2cd
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x55d2f0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x55d27f
jmp 0x55d2e4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0055d200

Function at 0x55e060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55e16c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x765b61ebe2976c8c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7e71a47749192d77
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7de8fb0af1dcf77e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x614110d0d02090a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x131515020614110d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0a070008140e07
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14031410040f1704
mov qword [rsp + 0x48], rdx
movabs rdx, 0x160e1304120a0c07
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x55e108
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x55e13c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x55e15f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
cmp rsi, 0x18
jb 0x55e0ee
jmp 0x55e153
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0055e060
Function at 0x55e180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55e26a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x911853646cc775ef
mov qword [rsp + 0x30], rdx
movabs rdx, 0x730e639fd60f7275
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1172c4a570b77263
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb12121206140a0c
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd0006060d070a02
mov qword [rsp + 0x20], rdx
movabs rdx, 0x120a170e0e071715
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x55e20d
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x70]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x70]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x55e23a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x55e25d
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x55e1f0
jmp 0x55e251
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0055e180

Function at 0x55e580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55e66c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7a8c65fa7ffc687f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xdaf876727a8c65fa
mov qword [rsp + 0x30], rdx
movabs rdx, 0x570869d66e6f86ed
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3060b0d0a041212
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb07061003060b0d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2030c0b00030703
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x55e60a
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x14
jge 0x55e63c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x55e65f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x14
jb 0x55e5f0
jmp 0x55e653
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0055e580
Function at 0x55fb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55fc1b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa8a2b67487f37219
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x14546a6fa8a2b674
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5707fb73dc732473
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7120a050b0900
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa1100000f0d0d0b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf02120603120a11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x21207031211110d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x55fbb9
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x41]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x55fbeb
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x55fc0e
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x41]
cmp rsi, 0x14
jb 0x55fb9f
jmp 0x55fc02
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0055fb20

Function at 0x560800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5608fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x61755e7036736d5b
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3a7a4f726061755e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x666372755c745d6e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5080c00030a1001
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x60e030706100e0e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x140b060e03070610
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40705030b0f0402
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5608a0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x1a]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x1a]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x5608cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5608f0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x56087f
jmp 0x5608e4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00560800
Function at 0x560bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x560cac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x170d690fef1e445
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6774fb0464dc0170
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3579876c69f57265
mov qword [rsp + 0x28], rdx
movabs rdx, 0x140d121315120104
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0b0d1403100113
mov qword [rsp + 0x38], rdx
movabs rdx, 0x515020708120d15
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x560c4a
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x18
jge 0x560c7c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x560c9f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5b]
cmp rsi, 0x16
jb 0x560c30
jmp 0x560c93
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00560bc0

Function at 0x564a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x564acc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8a7bd17e8490a699
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9c536574756c8a7b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x506000601070403
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10d0d0602070400
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x564a6f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x12]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x12]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x564a9c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x564abf
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x564a52
jmp 0x564ab3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00564a00
Function at 0x565460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x565527
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x76d40a186ec8ca26
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x26c5d2c1
movabs rdx, 0x600010b020a0a08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5000a08040b0a09
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5654c8
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x5654f7
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x56551a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x5654ab
jmp 0x56550e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00565460

Function at 0x5663c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5664bb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4aba4179d36df251
mov qword [rsp + 0x18], rdx
movabs rdx, 0xccbc69da4aba4179
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xcd94ab75a5bddee1
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5050f080708010c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3130d0202080d02
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb0b110e03130d02
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc1202050a060805
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x566459
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x56648b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5664ae
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x14
jb 0x56643f
jmp 0x5664a2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.005663c0
Function at 0x567460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56754c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9ca394be69c4bc09
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6ea176a39ca394be
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf56563b08be55392
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1304000110040208
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf100c010a040008
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0a06050c07070e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5674ea
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x46]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x56751c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x56753f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x46]
cmp rsi, 0x14
jb 0x5674d0
jmp 0x567533
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00567460

Function at 0x5680a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56818a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x64656db2bcdd2100
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x72f6630f5364656d
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb26ffb33e97974bc
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x110d000909021410
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd100b001104110d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10b0b1012110312
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x56812d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x56815a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x56817d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x568110
jmp 0x568171
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005680a0
Function at 0x5685a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5686bd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xf883636515151cde
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3226731c4407d3ee
mov qword [rsp + 0x22], rdx
movabs rdx, 0x341b3226731c4407
mov qword [rsp + 0x24], rdx
movabs rdx, 0x14cb443947721af2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x70002060e130309
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1910090107000206
mov qword [rsp + 0x38], rdx
movabs rdx, 0x808180812120f11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3010103170a0312
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30c171807160203
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x568660
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x56868d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x5686b0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x56863d
jmp 0x5686a4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.005685a0
Function at 0x569020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5690ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x72950a05c010fff8
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6fbfce491f746972
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa060d0501010306
mov qword [rsp + 0x28], rdx
movabs rdx, 0x205050c00030404
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x56908f
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x5690bc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5690df
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x569072
jmp 0x5690d3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00569020

Function at 0x569c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x569d46
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc4f2eef4e3f46574
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x343ee84a5c65c4f2
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb060a02060c0a00
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50504070b060a02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30d0b0309000d09
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x569ce0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x74]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x569d12
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x569d37
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x74]
cmp rsi, 0xe
jb 0x569cc2
jmp 0x569d2b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00569c60