joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53a420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a50c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe477b7b91161b968
mov qword [rsp + 0x36], rdx
movabs rdx, 0x649de477b7b91161
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13080a80a064fe0a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x40a0e0a06010005
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x50810030f1106
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0107000b100d01
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x53a4aa
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x18
jge 0x53a4dc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x53a4ff
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 0x12
jb 0x53a490
jmp 0x53a4f3
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0046c880
mov eax, edi
mov ecx, 0x12
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0053a420

Function at 0x53bb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53bc3b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc48f0a8be0aa0154
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb710f800c48f0a8b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0f5818a8ff8ee61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1120610050a0b0a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3100d11040f0607
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd05040e03100d11
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd080d130f021309
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x53bbd9
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x53]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x53bc0b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x53bc2e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x53]
cmp rsi, 0x14
jb 0x53bbbf
jmp 0x53bc22
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0046c880
mov eax, edi
mov ecx, 0x14
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.0053bb40
Function at 0x53c8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53c9aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x61fa53041d1b2310
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x896e61fa53041d1b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe250699dfe1872df
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20c0e0d01100009
mov qword [rsp + 0x18], rdx
movabs rdx, 0x30311040006020c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x611060d06010a04
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x53c94d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x16
jge 0x53c97a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x53c99d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x53c930
jmp 0x53c991
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.004669c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0046c880
mov eax, edi
mov ecx, 0x12
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0053c8c0

Function at 0x53d700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53d808
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe4c6766964206ced
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x67610607ebcb0b74
mov qword [rsp + 0x47], rdx
movabs rdx, 0x4b67610607ebcb0b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6506d62016ba2961
mov qword [rsp + 0x50], rdx
movabs rdx, 0x130f140a0f00070c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf06120b0d090b0c
mov qword [rsp + 0x27], rdx
movabs rdx, 0x16171610170b16
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1512131202160f17
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x53d7ab
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x20
jge 0x53d7d8
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x53d7fb
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x19
jb 0x53d78e
jmp 0x53d7ef
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.004669c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.0046c880
mov eax, edi
mov ecx, 0x19
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0053d700
Function at 0x53db00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53dbfd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xb5752d8763b4ee43
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb56ea2b7c320b575
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b6d1cdeb9c472ea
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10e051510070b01
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb0e121109011211
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa0d020b010d0b0e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50404110513150a
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x53dba0
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x53dbcd
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x53dbf0
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x16
jb 0x53db7f
jmp 0x53dbe4
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0046c880
mov eax, edi
mov ecx, 0x16
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.0053db00

Function at 0x53dfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53e0bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6765566673706043
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6370314060666522
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6d545c7120647775
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7101703110e0a11
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf1514170e170d0a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8040c150f151417
mov qword [rsp + 0x28], rdx
movabs rdx, 0x17100b1101161511
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x53e059
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x20]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1c
jge 0x53e08b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x53e0ae
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x20]
cmp rsi, 0x18
jb 0x53e03f
jmp 0x53e0a2
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0046c880
mov eax, edi
mov ecx, 0x18
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.0053dfc0
Function at 0x540560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54066c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x616f5e200da7cac8
mov qword [rsp + 0x41], rdx
movabs rdx, 0x7621615ad1be2c61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x256def1ed2afc2b9
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb0d12140e0a0716
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x80b0d12140e0a
mov qword [rsp + 0x21], rdx
movabs rdx, 0xa13091013160b10
mov qword [rsp + 0x29], rdx
movabs rdx, 0x10113110d07030f
mov qword [rsp + 0x31], rdx
movabs rdx, 0x20f120516160700
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x540608
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x73]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x22
jge 0x54063c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x17
jae 0x54065f
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x73]
cmp rsi, 0x17
jb 0x5405ee
jmp 0x540653
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.004669c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0046c880
mov eax, edi
mov ecx, 0x17
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00540560

Function at 0x5421a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54228a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9ff5b9c1c6423c47
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xff9ff5b9c1c6423c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc8fa69b91faacbb3
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb080d0710050108
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf040c0a0f060b08
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x106030c0b09030a
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54222d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x3d]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x3d]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x54225a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54227d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x542210
jmp 0x542271
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.004669c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0046c880
mov eax, edi
mov ecx, 0x11
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.005421a0
Function at 0x5422a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5423ba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3a6c6138744bfdf6
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x49226570fb470c16
mov qword [rsp + 0x44], rdx
movabs rdx, 0x396e197449226570
mov qword [rsp + 0x48], rdx
movabs rdx, 0x655d58390b647250
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf141819000b041a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x8190f141819000b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90f131802110917
mov qword [rsp + 0x24], rdx
movabs rdx, 0x190a011702180b0f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10b0a1a0e000f07
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x542357
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x22
jge 0x542389
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x5423ad
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
cmp rsi, 0x1c
jb 0x54233d
jmp 0x5423a1
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.004669c0
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.0046c880
mov eax, edi
mov ecx, 0x1c
call fcn.0046c880
nop
call fcn.0046a5a0
nop
jmp fcn.005422a0

Function at 0x5467c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5468cc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xd4f2ab208f6e69bd
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x3fbb97ebb2aec18e
mov qword [rsp + 0x46], rdx
movabs rdx, 0xb1e43fbb97ebb2ae
mov qword [rsp + 0x48], rdx
movabs rdx, 0x896dbd5420afb961
mov qword [rsp + 0x50], rdx
movabs rdx, 0x60f0a090e0c01
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x170d0b1103051013
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb13010a071408
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa1908110d0d0a07
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x546868
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x20
jge 0x54689c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x5468bf
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0x1a
jb 0x54684e
jmp 0x5468b3
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.004669c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0046c880
mov eax, edi
mov ecx, 0x1a
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.005467c0
Function at 0x54c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c738
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x445952206c31e95e
mov qword [rsp + 0x47], rdx
movabs rdx, 0x3e445952206c31e9
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6f206a6e7046676a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5b35112b5cea4432
mov qword [rsp + 0x58], rdx
movabs rdx, 0x466c6177521f846d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a190a10091b0a03
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc1116200c0b1315
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe100812060c11
mov qword [rsp + 0x27], rdx
movabs rdx, 0x70c141017201a06
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1101020c15091403
mov qword [rsp + 0x37], rdx
movabs rdx, 0x150c07051c111809
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x54c6d5
movzx r9d, byte [rsp + rsi + 0x47]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x47], dl
mov byte [rsp + rsi + 0x47], r8b
add rax, 2
cmp rax, 0x2e
jge 0x54c708
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x54c72b
movzx r8d, byte [rsp + rdi + 0x47]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
nop
cmp rsi, 0x21
jb 0x54c6bb
jmp 0x54c71f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.004669c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.0046c880
mov eax, edi
mov ecx, 0x21
call fcn.0046c880
nop
call fcn.0046a5a0
nop dword [rax]
jmp fcn.0054c600

Function at 0x54d620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54d6cc
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword [0x00717b90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x54d693
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.0044d180
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x54d6a6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x54d6b9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x54d6a3
mov byte [rax + rcx], dl
jmp 0x54d6a3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.004669c0
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046a5a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.0054d620
Function at 0x551260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55135b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x72705152455c5f63
mov qword [rsp + 0x34], rdx
movabs rdx, 0x74693f6972705152
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6c5f384aea540b69
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6040e12120f1203
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2090e060310030d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x30f02090e060310
mov qword [rsp + 0x24], rdx
movabs rdx, 0x201110e00050e06
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x5512f9
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1a
jge 0x55132b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x55134e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
cmp rsi, 0x14
jb 0x5512df
jmp 0x551342
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0046c880
mov eax, edi
mov ecx, 0x14
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.00551260

Function at 0x551920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5519e7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xdbd4e75272e57346
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xb06c55db
movabs rdx, 0x504000502060808
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa07070405080504
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x551988
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x69]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x69]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x5519b7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x5519da
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x55196b
jmp 0x5519ce
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046c880
mov eax, edi
mov ecx, 0xb
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00551920
Function at 0x551a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x551afb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1454744e75695bd7
mov qword [rsp + 0x33], rdx
movabs rdx, 0xd450e7fcf0145474
mov qword [rsp + 0x38], rdx
movabs rdx, 0x54fdf1f3db69ebec
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90e111214130114
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa0d080204080410
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1130a0d08020408
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1000010c07100808
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x551a99
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6d]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x551acb
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x551aee
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6d]
cmp rsi, 0x15
jb 0x551a7f
jmp 0x551ae2
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0046c880
mov eax, edi
mov ecx, 0x15
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.00551a00

Function at 0x5521e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55229e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa3fc0f536e09ed0e
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x573d03fc
movabs rdx, 0x9080705080a0206
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x1000509
xor eax, eax
jmp 0x552241
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x55226e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x552291
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x552224
jmp 0x552285
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.004669c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0046c880
mov eax, edi
mov ecx, 0xc
call fcn.0046c880
nop
nop
call fcn.0046a5a0
jmp fcn.005521e0
Function at 0x554160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x554268
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xb51bab6946c165be
mov qword [rsp + 0x37], rdx
movabs rdx, 0xb9c5bb4edd0c61a9
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xdb9c5bb4edd0c61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x57c66a7997d74879
mov qword [rsp + 0x48], rdx
movabs rdx, 0x80b14000f0a1607
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xe15080608100a0d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1707020e0e150806
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2130f170508170d
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x55420b
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1c
jge 0x554238
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x55425b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x5541ee
jmp 0x55424f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.0046c880
mov eax, edi
mov ecx, 0x19
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00554160

Function at 0x554b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x554cb8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xbed9d55756cf2314
mov qword [rsp + 0x47], rdx
movabs rdx, 0x36bed9d55756cf23
mov qword [rsp + 0x48], rdx
movabs rdx, 0x872e801090f494e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x756f0d01fc75a93a
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc0986e69a0e0fd6e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1b041c140a0e1020
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1607051a1f021a12
mov qword [rsp + 0x21], rdx
movabs rdx, 0xb0c04110b0b1607
mov qword [rsp + 0x27], rdx
movabs rdx, 0x41f0c0d1606000e
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x15101b1501141411
mov qword [rsp + 0x37], rdx
movabs rdx, 0x16081f08011a0200
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x554c58
movzx r9d, byte [rsp + rsi + 0x47]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x47], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2e
jge 0x554c88
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x554cab
movzx r8d, byte [rsp + rdi + 0x47]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x554c3b
jmp 0x554c9f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.004669c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.0046c880
mov eax, edi
mov ecx, 0x21
call fcn.0046c880
nop
call fcn.0046a5a0
nop dword [rax]
jmp fcn.00554b80