joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5341c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5342ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x742142e1746ca6e1
mov qword [rsp + 0x35], rdx
movabs rdx, 0x4dc565742142e174
mov qword [rsp + 0x38], rdx
movabs rdx, 0x72a83643c40fc5ea
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6110d0a000c0e04
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x40a10010911060b
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd0b040d0a011001
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x53424a
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x18
jge 0x53427c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x53429f
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x13
jb 0x534230
jmp 0x534293
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004564a0
mov eax, edi
mov ecx, 0x13
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.005341c0

Function at 0x5346c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5347bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd618fe72cc1a003d
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x65c17373d618fe72
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15686e497972d280
mov qword [rsp + 0x48], rdx
movabs rdx, 0x60c0207000706
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1313000d020713
mov qword [rsp + 0x26], rdx
movabs rdx, 0x305060d0a010013
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x70c0a0313071213
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x534759
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x53478b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5347ae
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0x14
jb 0x53473f
jmp 0x5347a2
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004564a0
mov eax, edi
mov ecx, 0x14
call fcn.004564a0
nop
nop dword [rax + rax]
call fcn.004541c0
jmp fcn.005346c0
Function at 0x535080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53516c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x45156319f3730b44
mov qword [rsp + 0x31], rdx
movabs rdx, 0x7b2f9722876df45
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1804c65a42001f0b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1013060a1404080a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5041610110e0f01
mov qword [rsp + 0x21], rdx
movabs rdx, 0x315160c040d0d04
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x53510a
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
cmp rax, 0x18
jge 0x53513c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x53515f
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
cmp rsi, 0x17
jb 0x5350f0
jmp 0x535153
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004564a0
mov eax, edi
mov ecx, 0x17
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00535080

Function at 0x535180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53527b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x690992b0e25465de
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xc44a60a6c690992
mov qword [rsp + 0x40], rdx
movabs rdx, 0x570ea46f1f01ff72
mov qword [rsp + 0x48], rdx
movabs rdx, 0x12020413050a0302
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x61000120000
mov qword [rsp + 0x25], rdx
movabs rdx, 0x13120a0309050000
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x13020f0e0c0a0613
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x535219
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x53524b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x53526e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0x15
jb 0x5351ff
jmp 0x535262
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004564a0
mov eax, edi
mov ecx, 0x15
call fcn.004564a0
nop
nop dword [rax + rax]
call fcn.004541c0
jmp fcn.00535180
Function at 0x535a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x535b4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5820666f31591d75
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x15635820666f3159
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf26c556664642f73
mov qword [rsp + 0x38], rdx
movabs rdx, 0x301080b030c0b11
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20f0301080b030c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110c07110d090807
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x535aea
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x535b1c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x535b3f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x12
jb 0x535ad0
jmp 0x535b33
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004564a0
mov eax, edi
mov ecx, 0x12
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00535a60

Function at 0x537ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x537e47
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x85903fddeb1fc2bf
mov qword [rsp + 0x62], rdx
movabs rdx, 0xc7bf72c959b58590
mov qword [rsp + 0x68], rdx
movabs rdx, 0x6ee5936c6ffd938a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x735d60206f94a467
mov qword [rsp + 0x78], rdx
movabs rdx, 0xd26574c94f8670f3
mov qword [rsp + 0x80], rdx
movabs rdx, 0xefa4ea63acd999d3
mov qword [rsp + 0x88], rdx
movabs rdx, 0xc83ebc051a0ac02f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x3321181807060f0c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x220a081b2c2b3313
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1028220a081b2c2b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x33280f2029212e31
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x25090426130d2805
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2002f2914332035
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x170e011c2c340526
mov qword [rsp + 0x42], rdx
movabs rdx, 0x341c0014012d2f1e
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x325191c282e2c35
mov qword [rsp + 0x52], rdx
movabs rdx, 0x1c32300534343127
mov qword [rsp + 0x5a], rdx
xor eax, eax
jmp 0x537de3
movzx r9d, byte [rsp + rsi + 0x62]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x62], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x62], dl
add rax, 2
cmp rax, 0x4a
jge 0x537e10
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x537e3a
movzx r8d, byte [rsp + rdi + 0x62]
sub r8d, edx
cmp rsi, 0x36
jb 0x537dc6
jmp 0x537e2e
xor eax, eax
lea rbx, [rsp + 0x62]
mov ecx, 0x36
nop dword [rax]
call fcn.00444780
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.004564a0
mov eax, edi
mov ecx, 0x36
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00537ca0
Function at 0x538c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538ce7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xff63d53da89c6eab
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x74d9
movabs rdx, 0x502020808070204
mov qword [rsp + 0x18], rdx
movabs rdx, 0x702000307080502
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x538c87
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x26]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x26]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x538cb7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x538cda
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x538c6a
jmp 0x538cce
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004564a0
mov eax, edi
mov ecx, 0xa
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00538c20

Function at 0x53cbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53cccc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x263f05703d4f731a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x4bb8636e53731e49
mov qword [rsp + 0x44], rdx
movabs rdx, 0x377933614bb8636e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3a5ef573696e5866
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb090e150d0c110f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf090b0f1a1b0815
mov qword [rsp + 0x26], rdx
movabs rdx, 0x702050b0b060f09
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x91a001a13080319
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x53cc68
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x53cc9c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x53ccbf
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x1c
jb 0x53cc4e
jmp 0x53ccb3
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004564a0
mov eax, edi
mov ecx, 0x1c
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0053cbc0
Function at 0x54c280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c36a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x37364a9f56b17b30
mov qword [rsp + 0x37], rdx
movabs rdx, 0xbf37364a9f56b17b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6b89968b63de70a6
mov qword [rsp + 0x40], rdx
movabs rdx, 0x40a040401050b0a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb08080908030403
mov qword [rsp + 0x27], rdx
movabs rdx, 0x50310020e030d0f
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x54c30d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x13]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x13]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x54c33a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54c35d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x54c2f0
jmp 0x54c351
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0054c280

Function at 0x54c620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c70a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x37f7eecc33bcf01c
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xf737f7eecc33bcf0
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1566651fbc062239
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40c020805010d0a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x800040c02080501
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc061008050b0406
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54c6ad
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x54c6da
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54c6fd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x54c690
jmp 0x54c6f1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0054c620
Function at 0x54cda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54ce8c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe3635620b6cd4d3
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x120e3635620b6cd4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6e0d9fb16311e96b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0b02100a080d03
mov qword [rsp + 0x19], rdx
movabs rdx, 0x30e0e0310070f0b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x902030004010409
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54ce2a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4b]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x54ce5c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54ce7f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4b]
cmp rsi, 0x11
jb 0x54ce10
jmp 0x54ce73
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0054cda0

Function at 0x54cea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54cf8a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2c0e2a1d39322c30
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x382c0e2a1d39322c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x581d454429423326
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc010903030f0406
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7040c010903030f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4090a090c04050a
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54cf2d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x1b]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x1b]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x54cf5a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54cf7d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x54cf10
jmp 0x54cf71
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0054cea0
Function at 0x54cfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54d08c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x373635232e583125
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x47373635232e5831
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6665e64e7152d5b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100a03080a020c10
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb090e0c100a0308
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x40a09000304030e
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54d02a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x54d05c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54d07f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x11
jb 0x54d010
jmp 0x54d073
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0054cfa0

Function at 0x54de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54defd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe2a745f2e68cf052
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xa572b76d65e2a745
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70c07040c050505
mov qword [rsp + 0x19], rdx
movabs rdx, 0x103070c07040c05
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2070a010406030c
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x54dea0
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0x2a]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0x2a]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x54decd
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x54def0
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x54de82
jmp 0x54dee4
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004564a0
mov eax, edi
mov ecx, 0xd
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.0054de20
Function at 0x54f2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54f39b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x421b3b6c613d2969
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5468da5c421b3b6c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x307a21f14e396e53
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb050a0d0d08110b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1301070702131009
mov qword [rsp + 0x20], rdx
movabs rdx, 0x90f130613010707
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0207100b05130e
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x54f339
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x54f36b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x54f38e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x14
jb 0x54f31f
jmp 0x54f382
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004564a0
mov eax, edi
mov ecx, 0x14
call fcn.004564a0
nop
nop dword [rax + rax]
call fcn.004541c0
jmp fcn.0054f2a0
Function at 0x1400316bc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140031734
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140031734
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140031734
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140031728
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140031746
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031716
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140031736

Function at 0x140033280
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400332ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400332ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400332ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400332ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400332ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400332cc
xor al, al
add rsp, 0x28
ret

Function at 0x14003c014
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bd78

Function at 0x140045f30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045f58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045f58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001adc
xor al, al
add rsp, 0x28
ret
Function at 0x140003dd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003e2d
lea rbx, [0x1400cbc80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003e14
cmp r10, 2
jb 0x140003e14
cmp byte [r9], r8b
jne 0x140003e14
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003df0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003e6f
lea rbx, [0x1400cbc80]
cmp r8b, 0x23
jne 0x140003e53
cmp byte [r9], r8b
jne 0x140003e53
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003e40
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004030
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000405f
mov r8d, 0x78f
lea rdx, str.C:UsersUSEDesktopUltra_x_CheatRIZKA_FUCKED_BY_EXTRA_XITERimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000406b
mov qword [rdi], 0
lea rdx, [0x1400cb4c8]
mov rcx, rbx
call fcn.140003e80
mov rbx, rax
test rax, rax
jne 0x14000408d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004166
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004166
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140004166
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004166
cmp rsi, 0xffffffffffffffff
je 0x140004166
mov rax, qword [0x140134460]
test rax, rax
je 0x140004103
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140004166
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140004153
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140134460]
test rax, rax
je 0x140004148
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000416f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140004161
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140004171
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret