joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5599e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x559afa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa6da60b8d57419ca
mov qword [rsp + 0x41], rdx
movabs rdx, 0x730962106e13e36e
mov qword [rsp + 0x49], rdx
movabs rdx, 0x123e61b8f1bfda73
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc2b618d7c8c11f8e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x51d1715061d1707
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x150a1a041203051d
mov qword [rsp + 0x21], rdx
movabs rdx, 0x121e1a0611091810
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1c1d0c0007161d1b
mov qword [rsp + 0x31], rdx
movabs rdx, 0x19121b0e12130109
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x559a97
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x26
jge 0x559ac9
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x559aed
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x1f
jb 0x559a7d
jmp 0x559ae1
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.00449780
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1f
call fcn.0045cd80
nop
call fcn.0045aaa0
nop
jmp fcn.005599e0

Function at 0x55b3a0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55bb29
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x55b3ca
lea rax, [rdx + 0x10]
dec rbx
test rbx, rbx
jle 0x55b68a
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x55b63b
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005f2c20]
jmp qword [rax + rdi*8]
movabs rsi, 0x100000001b3
lea rdi, [0x005979e0]
jmp 0x55b3c3
movabs rdx, 0xd0bb9680f8d45f7f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd6936fb0d5d0bb96
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9d9026cf4515f483
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4afeffb2d34c97ef
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6747afdc6411cced
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x55b6ad
mov rax, rcx
add rsp, 0x40
pop rbp
ret
lea rdx, [0x005c8bb9]
movzx esi, byte [rdx + rax]
movzx edi, byte [rsp + rax + 0x1b]
xor edi, esi
mov byte [rsp + rax + 0x1b], dil
inc rax
cmp rax, 0x25
jl 0x55b693
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
nop
call fcn.00449780
call fcn.0040a420
mov rbx, rax
lea rax, [0x00597960]
call fcn.004320e0
movzx r8d, sil
xor rcx, r8
inc rax
shr esi, 8
movabs r8, 0x100000001b3
imul rcx, r8
cmp rax, 4
jl 0x55b6d9
jmp 0x55b625
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045aaa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0055b3a0
Function at 0x55bcc0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x55bcd7
inc rax
cmp rax, 4
jge 0x55bcef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x55bcd4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x55bd00
inc rax
cmp rax, 4
jge 0x55bd0e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x55bd37
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x55bd1b
jmp 0x55bcfd

Function at 0x55bd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55be3b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x200acb6c612f2369
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd41b7265746b4e21
mov qword [rsp + 0x40], rdx
movabs rdx, 0xaf066b61896ee1de
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50916161002150a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1311111705110a15
mov qword [rsp + 0x22], rdx
movabs rdx, 0x801150e02051311
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf0f0a1306091311
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x55bdd9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1e
jge 0x55be0b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x55be2e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x18
jb 0x55bdbf
jmp 0x55be22
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045cd80
mov eax, edi
mov ecx, 0x18
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.0055bd40

Function at 0x55d100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d1ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x21d5d36c61ac6e7d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20c5723e74416170
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2025d668c56e2a36
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14060e0614130500
mov qword [rsp + 0x18], rdx
movabs rdx, 0x100202131516110c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7050a10000e1316
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x55d18d
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x55d1ba
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x55d1dd
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x55d170
jmp 0x55d1d1
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045cd80
mov eax, edi
mov ecx, 0x18
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0055d100
Function at 0x55f800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f938
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x8767c1d03364260f
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x78dc6e4e208767c1
mov qword [rsp + 0x50], rdx
movabs rdx, 0x492030f81eec0813
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2765447e07fb1410
mov qword [rsp + 0x60], rdx
movabs rdx, 0xcce96fe6746c1c4c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x191d150111120424
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1009030521210512
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1c19011d10090305
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x101e00180e1d0312
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1c070d01230f1216
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x1c0b0e1e0b171704
mov qword [rsp + 0x43], rdx
xor eax, eax
jmp 0x55f8d5
movzx r9d, byte [rsp + rsi + 0x4b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x4b], dl
mov byte [rsp + rsi + 0x4b], r8b
add rax, 2
cmp rax, 0x2c
jge 0x55f908
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x55f92b
movzx r8d, byte [rsp + rdi + 0x4b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
nop
cmp rsi, 0x25
jb 0x55f8bb
jmp 0x55f91f
xor eax, eax
lea rbx, [rsp + 0x4b]
mov ecx, 0x25
call fcn.00449780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.0045cd80
mov eax, edi
mov ecx, 0x25
call fcn.0045cd80
nop
call fcn.0045aaa0
nop dword [rax]
jmp fcn.0055f800

Function at 0x560260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x560346
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x20402f652f271a63
mov qword [rsp + 0x30], rdx
movabs rdx, 0xea65ea6563ade5a0
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50906060802050a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x20d050906060802
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2050301010f0d09
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x5602e0
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x560312
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x560337
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x10
jb 0x5602c2
jmp 0x56032b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045cd80
mov eax, edi
mov ecx, 0x10
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00560260
Function at 0x561ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x561d66
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x10dbfea239ba7954
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 7
movabs rdx, 0x203040704020607
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8050703
xor eax, eax
nop
jmp 0x561d00
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x561d32
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x561d57
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 9
jb 0x561ce2
jmp 0x561d4b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045cd80
mov eax, edi
mov ecx, 9
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00561ca0

Function at 0x561d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x561e38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x41699a419efd7cb8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x301000105060205
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x601
xor eax, eax
jmp 0x561dd8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x561e08
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x561e2b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x561dbb
jmp 0x561e1f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0045cd80
mov eax, edi
mov ecx, 8
call fcn.0045cd80
nop
call fcn.0045aaa0
nop dword [rax]
jmp fcn.00561d80

Function at 0x563060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56313d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x72214847544b5352
mov qword [rsp + 0x30], rdx
movabs rdx, 0xdd16480b56453122
mov qword [rsp + 0x38], rdx
movabs rdx, 0x409040e050f0d02
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x10c040a0409040e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3080b0605060108
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x5630e0
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x36]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x56310d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x563130
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x5630c2
jmp 0x563124
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045cd80
mov eax, edi
mov ecx, 0x10
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.00563060
Function at 0x565220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56531b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xdbb4615a67296fa4
mov qword [rsp + 0x39], rdx
movabs rdx, 0xb3746e0ddb5f20db
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4ee8313e28a7e7e5
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110415031603100b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf03020609150f02
mov qword [rsp + 0x25], rdx
movabs rdx, 0x70e06030f030206
mov qword [rsp + 0x29], rdx
movabs rdx, 0x90b0e0b0a1000
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x5652b9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5652eb
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x56530e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0x17
jb 0x56529f
jmp 0x565302
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.00565220

Function at 0x567540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x567612
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xebd7a42065e3966e
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x80a4c99e9aebd7a4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x807020906020c07
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb010c0b0a0b0506
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x5675ac
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x5675de
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x567605
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 0xd
jb 0x567592
jmp 0x5675f5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00449780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.0045cd80
mov eax, edi
mov ecx, 0xd
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00567540
Function at 0x567620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56770c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e5e5b206f7265f6
mov qword [rsp + 0x35], rdx
movabs rdx, 0x7d5ade6e5e5b206f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd2d2e0fb67652173
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0b0f0905000810
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6000b0c0c0a0a0b
mov qword [rsp + 0x25], rdx
movabs rdx, 0x12000a0b12060f11
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x5676aa
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6f]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x16
jge 0x5676dc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5676ff
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6f]
cmp rsi, 0x13
jb 0x567690
jmp 0x5676f3
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045cd80
mov eax, edi
mov ecx, 0x13
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00567620

Function at 0x567720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56782c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xf827da0210f865eb
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd268f98bff656c20
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61fa747b0ef9fcba
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd0313100c020d06
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x14170d0313100c02
mov qword [rsp + 0x20], rdx
movabs rdx, 0x15110403020b040d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1404030400071216
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf11031117051104
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5677c8
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x22
jge 0x5677fc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x56781f
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x18
jb 0x5677ae
jmp 0x567813
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.00449780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045cd80
mov eax, edi
mov ecx, 0x18
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00567720
Function at 0x56d5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56d6b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x66531745656d616c
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x6a474f4b57665317
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0c0b040908040b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x60a040504090806
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x56d64c
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x56d67e
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x56d6a5
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 0xd
jb 0x56d632
jmp 0x56d695
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00449780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.0045cd80
mov eax, edi
mov ecx, 0xd
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0056d5e0

Function at 0x56eea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56efba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xd3497340ccd6336e
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x4420cbd97278e7de
mov qword [rsp + 0x47], rdx
movabs rdx, 0x4e4420cbd97278e7
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc3bc475fcba69d7
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160a171703140c15
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x111160a17170314
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x70d170316020809
mov qword [rsp + 0x27], rdx
movabs rdx, 0x604130c17110604
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1311180209121813
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x56ef57
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x22
jge 0x56ef89
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x56efad
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
cmp rsi, 0x19
jb 0x56ef3d
jmp 0x56efa1
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00449780
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045cd80
mov eax, edi
mov ecx, 0x19
call fcn.0045cd80
nop
call fcn.0045aaa0
nop
jmp fcn.0056eea0
Function at 0x56f980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56fa58
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x33300dfe02989990
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x99f73a31
movabs rdx, 0x10a070a030b0503
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x104010a070a030b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x707050001020104
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x56f9f4
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x56fa28
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x56fa4b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
nop
cmp rsi, 0xc
jb 0x56f9da
jmp 0x56fa3f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00449780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045cd80
mov eax, edi
mov ecx, 0xc
call fcn.0045cd80
nop
call fcn.0045aaa0
nop dword [rax]
jmp fcn.0056f980

Function at 0x575440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57553b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7529f7d765dc2b36
mov qword [rsp + 0x39], rdx
movabs rdx, 0x542028efc3663775
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6529a16122b76f6f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf010215140c000e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x121500040c05080b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x104121500040c05
mov qword [rsp + 0x29], rdx
movabs rdx, 0x60401080a000a11
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x5754d9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x57550b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x57552e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x17
jb 0x5754bf
jmp 0x575522
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.00575440
Function at 0x575ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x575e55
push rbp
mov rbp, rsp
sub rsp, 0xc0
movabs rdx, 0x7f42655e2d1e8f66
mov qword [rsp + 0x7a], rdx
movabs rdx, 0xbc35726566617f42
mov qword [rsp + 0x80], rdx
movabs rdx, 0xf742b099bc483bdf
mov qword [rsp + 0x88], rdx
movabs rdx, 0x594872273c58a174
mov qword [rsp + 0x90], rdx
movabs rdx, 0x65703820734b7569
mov qword [rsp + 0x98], rdx
movabs rdx, 0x77206d3a19741472
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x5c11aa39515af385
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x5673656363508d20
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x535e8e179c6c4966
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x27293d0c1c193741
mov qword [rsp + 0x18], rdx
lea rdi, [rsp + 0x1a]
lea rsi, [0x005efb84]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045d3ac
mov rbp, qword [rbp]
xor eax, eax
jmp 0x575df4
movzx r9d, byte [rsp + rsi + 0x7a]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x7a], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x7a], dl
add rax, 2
cmp rax, 0x62
jge 0x575e22
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x46
jae 0x575e48
movzx r8d, byte [rsp + rdi + 0x7a]
sub r8d, edx
cmp rsi, 0x46
jb 0x575dd7
nop
jmp 0x575e3c
xor eax, eax
lea rbx, [rsp + 0x7a]
mov ecx, 0x46
call fcn.00449780
add rsp, 0xc0
pop rbp
ret
mov eax, esi
mov ecx, 0x46
call fcn.0045cd80
mov eax, edi
mov ecx, 0x46
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00575ce0