joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a8f49
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x6d200fb2026eb561
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x446ab8056808a661
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9ee4446ab8056808
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6b65bae873652085
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5190403090e0017
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50e161018011011
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1209010a18170c0d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa180c13030900
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5a8ed1
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x20
jge 0x5a8f08
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
cmp rsi, 0x20
jae 0x5a8f3b
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x5a8f2f
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x5a8eb4
jmp 0x5a8f23
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.00446000
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457f40
mov eax, edi
mov ecx, 0x1a
call fcn.00457f40
mov rax, rsi
mov ecx, 0x20
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005a8e20
Function at 0x5ad960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ada9f
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x20cd9b6cc2766ea8
mov qword [rsp + 0x19], rdx
movabs rdx, 0xdcc19f8d779485ee
mov qword [rsp + 0x21], rdx
movabs rdx, 0x61347211748ededc
mov qword [rsp + 0x28], rdx
movabs rdx, 0x81b9a3bd8ecec950
mov qword [rsp + 0x30], rdx
movabs rdx, 0x13190f0e0806030d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1719001d1c181810
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b08100d0506110c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf150e17131a091d
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe1e0a0817050017
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x5ada20
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x28
jge 0x5ada5c
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
cmp rsi, 0x28
jae 0x5ada91
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x5ada85
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4c]
cmp rsi, 0x1f
jb 0x5ada03
jmp 0x5ada77
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x1f
call fcn.00457f40
mov rax, rsi
mov ecx, 0x28
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005ad960
Function at 0x5b4720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b483f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x7bfc6e59f27dceff
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6e69f1e3e08ee87b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7373656541d36198
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2040c0613120a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x107000307000e09
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x70f060e010b0107
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf060809110a130c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5b47c0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6c]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x5b47fc
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
cmp rsi, 0x1e
jae 0x5b4831
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5b4825
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6c]
cmp rsi, 0x17
jb 0x5b47a5
jmp 0x5b4817
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1e
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005b4720

Function at 0x5b4be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b4cff
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x4838440f73511cf9
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6ef33405726f5148
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3f7323ec64dacf48
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1140c0b02130b0d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5160d021410000f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x80b070405160d02
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110f060d02010714
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5b4c80
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x5b4cbc
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x5b4cf1
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5b4ce5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 0x17
jb 0x5b4c65
jmp 0x5b4cd7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1c
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005b4be0
Function at 0x5b4d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b4e53
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xfff7613d10ba6f84
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xac736ef16cf6ca97
mov qword [rsp + 0x26], rdx
movabs rdx, 0x86d3ac736ef16cf6
mov qword [rsp + 0x28], rdx
movabs rdx, 0x467306be6401999c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4031612101219
mov qword [rsp + 0x38], rdx
movabs rdx, 0x17000908040f130c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x402110a0614020f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1917070c09100a04
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5b4dce
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x20
jge 0x5b4e0d
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0x20
jae 0x5b4e45
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x5b4e34
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0x1a
jb 0x5b4db4
jmp 0x5b4e28
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.00446000
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457f40
mov eax, edi
mov ecx, 0x1a
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x20
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005b4d20

Function at 0x5b7b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b7c0d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6b2f6849696a6f4d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x737365722b6c135e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20a0b0909080602
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3090b00070a0500
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x5b7b95
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0x10
jge 0x5b7bcc
movzx edx, byte [rsp + rax + 0x18]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x5b7bff
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5b7bf3
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
cmp rsi, 0x10
jb 0x5b7b78
jmp 0x5b7be7
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 0x10
call fcn.00446000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457f40
mov eax, edi
mov ecx, 0x10
call fcn.00457f40
mov rax, rsi
mov ecx, 0x10
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005b7b20
Function at 0x5b88e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b8a13
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x58ebd36f6ecbf9d8
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1b745be6ed5fec82
mov qword [rsp + 0x23], rdx
movabs rdx, 0xea204df2631b745b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa6f48206696365f7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1150d11071c1b19
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1a0f0508140b0c1a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6090c05190f0612
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c02110f001a1a0a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5b898e
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x20
jge 0x5b89cd
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0x20
jae 0x5b8a05
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x5b89f4
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x1d
jb 0x5b8974
jmp 0x5b89e8
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00446000
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457f40
mov eax, edi
mov ecx, 0x1d
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x20
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005b88e0

Function at 0x5ba040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ba13f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x522020316ebb3e58
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x182c6f7774435952
mov qword [rsp + 0x22], rdx
movabs rdx, 0x902060006060e09
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9000e05080d0902
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70e0102080407
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5ba0c1
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xc]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x16
jge 0x5ba0fd
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0x16
jae 0x5ba131
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5ba125
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xc]
cmp rsi, 0xf
jb 0x5ba0a7
jmp 0x5ba118
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xf
call fcn.00446000
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0xf
call fcn.00457f40
mov rax, rsi
mov ecx, 0x16
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005ba040
Function at 0x5bebc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5becdf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x9d09c8617265dbc5
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2092d4c5aeb89d09
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64af8a9163b88c17
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1213000a05000f06
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5000114000e010b
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf0c05000114000e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6090c0510080b07
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5bec62
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1a
jge 0x5bec99
movzx edx, byte [rsp + rax + 0x2e]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x5becd1
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5becc5
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x5bec45
jmp 0x5becb4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
nop dword [rax + rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x16
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1a
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005bebc0

Function at 0x5c31a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c3289
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6f575f71706d6570
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x686d
movabs rdx, 0x403030800090605
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2020200000403
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x5c320d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x5c3248
movzx edx, byte [rsp + rax + 0x22]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0xe
jae 0x5c327b
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x5c326f
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x5c31f0
jmp 0x5c3263
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457f40
mov eax, edi
mov ecx, 0xa
call fcn.00457f40
mov rax, rsi
mov ecx, 0xe
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005c31a0
Function at 0x5c4e60
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x5c50c3
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x5c50a7
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x5c4ead
xor ebx, ebx
xor ecx, ecx
jmp 0x5c4ec0
mov rax, rdx
call fcn.005b0ba0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x5c4fdb
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0048a420
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00679399]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.00445d00
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x5c4f9e
xor eax, eax
lea rbx, [0x006c556c]
mov ecx, 1
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x50]
lea r8, [0x00679440]
mov r9d, 2
mov r10, qword [rsp + 0xa0]
mov r11, qword [rsp + 0x60]
call fcn.00445de0
jmp 0x5c4fcb
xor eax, eax
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x006793a5]
mov esi, 1
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x60]
call fcn.00445d00
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.0048a420
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5c506a
xor eax, eax
lea rbx, [0x006c556c]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00679440]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.00445de0
jmp 0x5c5097
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006793a5]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.00445d00
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006797bd]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00455860
mov rax, qword [rsp + 8]
jmp fcn.005c4e60
Function at 0x5c6b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c6bf8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8e0e72fc8a016e08
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6020207020003
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
nop
jmp 0x5c6b80
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x5c6bb7
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0xa
jae 0x5c6bea
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5c6bde
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x5c6b62
jmp 0x5c6bd2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00457f40
mov eax, edi
mov ecx, 8
call fcn.00457f40
mov rax, rsi
mov ecx, 0xa
call fcn.00457f40
nop
call fcn.00455860
nop dword [rax]
jmp fcn.005c6b20

Function at 0x5ca820
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5ca838
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5ca838
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5ca840
xor eax, eax
ret
cmp rbx, 3
je 0x5ca84c
cmp rbx, 4
jne 0x5ca879
cmp al, 0x2c
ja 0x5ca866
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5ca876
cmp al, 0x24
je 0x5ca876
nop dword [rax]
cmp al, 0x26
jae 0x5ca876
jmp 0x5ca879
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5ca876
cmp al, 0x5b
je 0x5ca876
cmp al, 0x5d
jne 0x5ca879
xor eax, eax
ret
cmp al, 0x2f
ja 0x5ca8b2
nop dword [rax]
cmp al, 0x26
ja 0x5ca891
cmp al, 0x24
je 0x5ca8d1
cmp al, 0x26
je 0x5ca8d1
jmp 0x5ca94b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5ca8d1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5ca948
cmp al, 0x2f
je 0x5ca8d1
jmp 0x5ca94b
cmp al, 0x3d
ja 0x5ca8c9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5ca8d1
nop
cmp al, 0x3d
je 0x5ca8d1
jmp 0x5ca94b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5ca940
cmp rbx, 2
jg 0x5ca907
cmp rbx, 1
je 0x5ca901
nop dword [rax]
cmp rbx, 2
jne 0x5ca94b
cmp al, 0x2f
je 0x5ca8f2
cmp al, 0x3b
je 0x5ca8f2
cmp al, 0x2c
jne 0x5ca8f9
mov ecx, 1
jmp 0x5ca8fe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5ca92a
cmp al, 0x40
je 0x5ca919
cmp al, 0x2f
je 0x5ca919
cmp al, 0x3f
jne 0x5ca922
mov ecx, 1
nop
jmp 0x5ca927
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5ca939
cmp rbx, 7
jne 0x5ca94b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5ca948
cmp al, 0x7e
jne 0x5ca94b
xor eax, eax
ret
cmp rbx, 7
jne 0x5ca961
cmp al, 0x21
je 0x5ca95d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5ca961
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5cbc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cbd3f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x20d113cd61766ed8
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x386fb520491c7a20
mov qword [rsp + 0x24], rdx
movabs rdx, 0x147365d916372a0a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x111300000c160909
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf080e0804120511
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x10100f060f080e08
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe06121216000e0e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5cbcc0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x5cbcfc
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x5cbd31
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5cbd25
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
cmp rsi, 0x17
jb 0x5cbca5
jmp 0x5cbd17
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1c
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.005cbc20
Function at 0x5cf9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5cfaa9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xcfb3a9222d494541
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb95e43cfb3a9222d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x409040205060405
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xa070204
xor eax, eax
jmp 0x5cfa2e
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x75]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x75]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x5cfa68
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0xc
jae 0x5cfa9b
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x5cfa8f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x5cfa11
jmp 0x5cfa83
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457f40
mov eax, edi
mov ecx, 0xb
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005cf9c0
Function at 0x5d4bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d4ccb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x9845a92d605db86c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x924e6c9845a92d60
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb3529cac8982ab58
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0502020a120512
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1080f030c050202
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100700030e08050d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5d4c53
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x2c]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x2c]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x5d4c8a
movzx edx, byte [rsp + rax + 0x2c]
lea rsi, [rax + 1]
cmp rsi, 0x14
jae 0x5d4cbd
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5d4cb1
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x5d4c36
jmp 0x5d4ca5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00446000
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457f40
mov eax, edi
mov ecx, 0x13
call fcn.00457f40
mov rax, rsi
mov ecx, 0x14
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005d4bc0

Function at 0x5d65c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d66ad
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6f92a8726f928f40
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9ecb836672b4986f
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe01090108010e0d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10d06000c020c05
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5d6635
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0xe]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0xe]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x5d666c
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x5d669f
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5d6693
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x5d6618
jmp 0x5d6687
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00446000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457f40
mov eax, edi
mov ecx, 0xf
call fcn.00457f40
mov rax, rsi
mov ecx, 0x10
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005d65c0