joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x5393d4
jb 0x539433
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.005391e0
aeskeygenassist xmm1, xmm0, 1
call fcn.00539200
aeskeygenassist xmm1, xmm2, 2
call fcn.005391e0
aeskeygenassist xmm1, xmm0, 2
call fcn.00539200
aeskeygenassist xmm1, xmm2, 4
call fcn.005391e0
aeskeygenassist xmm1, xmm0, 4
call fcn.00539200
aeskeygenassist xmm1, xmm2, 8
call fcn.005391e0
aeskeygenassist xmm1, xmm0, 8
call fcn.00539200
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005391e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00539200
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005391e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00539200
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005391e0
jmp 0x5394a1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00539140
aeskeygenassist xmm1, xmm2, 2
call fcn.005391a0
aeskeygenassist xmm1, xmm2, 4
call fcn.00539140
aeskeygenassist xmm1, xmm2, 8
call fcn.005391a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00539140
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005391a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00539140
aeskeygenassist xmm1, xmm2, 0x80
call fcn.005391a0
jmp 0x5394a1
aeskeygenassist xmm1, xmm0, 1
call fcn.00539100
aeskeygenassist xmm1, xmm0, 2
call fcn.00539100
aeskeygenassist xmm1, xmm0, 4
call fcn.00539100
aeskeygenassist xmm1, xmm0, 8
call fcn.00539100
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00539100
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00539100
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00539100
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00539100
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00539100
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00539100
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x5394ae
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x53e900
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x53e917
inc rax
cmp rax, 4
jge 0x53e92f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x53e914
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x53e940
inc rax
cmp rax, 4
jge 0x53e94e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x53e977
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x53e95b
jmp 0x53e93d

Function at 0x53ef80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f088
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20166920da766252
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb2be13b974025d0a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5bb6781f206ec27d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x108170013090a0f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x814041701081700
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe140613170a1610
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc06000d00000913
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0a010803110004
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x53f02b
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x31]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x31]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x24
jge 0x53f058
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x53f07b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x53f00e
jmp 0x53f06f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004610a0
mov eax, edi
mov ecx, 0x18
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0053ef80
Function at 0x540c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x540db5
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x2467c1ddc46498a5
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x61b85f2467c1ddc4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x664c66027934b9c8
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0e96f9fdd65bc85
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x51e38df093736911
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe16265646fb3d16e
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x203a6c52c425b99f
mov qword [rsp + 0x46], rdx
movabs rdx, 0x192c172a0f1b2f16
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2b2e192c172a0f1b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2c2521220713221f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x17032b2413200e0e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x211f050c090f141a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x11e110800042019
mov qword [rsp + 0x70], rdx
movabs rdx, 0x191b2b0c2f2f2d11
mov qword [rsp + 0x78], rdx
movabs rdx, 0x9220320000b
mov qword [rsp + 0x80], rdx
movabs rdx, 0xd1a130909172c12
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x540d4e
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x42
jge 0x540d82
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x33
jae 0x540da8
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0x33
jb 0x540d34
nop
jmp 0x540d9c
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x33
call fcn.0044bb80
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x33
call fcn.004610a0
mov eax, edi
mov ecx, 0x33
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00540c20
Function at 0x5413e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5414ec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x162762e27401202f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x667af014cbd12e2f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x62139c417561667a
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd8726f69766128dd
mov qword [rsp + 0x50], rdx
movabs rdx, 0x16021d02170b0203
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x10e1d0413121d1d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0c120c0609010e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30217071701140a
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x541488
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x28]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x5414bc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x5414df
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x28]
cmp rsi, 0x1e
jb 0x54146e
jmp 0x5414d3
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004610a0
mov eax, edi
mov ecx, 0x1e
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.005413e0

Function at 0x544880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5449d8
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x6369536a75736e04
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb6131b47c366557
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4d570b6131b47c36
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6f73f9655a423829
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5b15821e65c8893f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x485bb26e655a1e6c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x20281e231a141c0d
mov qword [rsp + 0x44], rdx
movabs rdx, 0xd0c131720281e23
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2924150a0c0d1312
mov qword [rsp + 0x50], rdx
movabs rdx, 0x221b0b2111000f15
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1016050817290d25
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb041b13271f2829
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf051f0910211f20
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x544976
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x34
jge 0x5449a8
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x5449cb
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax + rax]
cmp rsi, 0x2a
jb 0x544959
jmp 0x5449bf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x2a
call fcn.0044bb80
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.004610a0
mov eax, edi
mov ecx, 0x2a
call fcn.004610a0
nop
call fcn.0045ee20
nop dword [rax]
jmp fcn.00544880
Function at 0x54a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a53b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xff2075ed92068782
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x99ff2075ed9206
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xed6e0216f9ec89f8
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe02070f01080c11
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb0a03020b000509
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7080b0a03020b00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90d000201030408
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54a4d9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x54a50b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x54a52e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 0x12
jb 0x54a4bf
jmp 0x54a522
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004610a0
mov eax, edi
mov ecx, 0x12
call fcn.004610a0
nop
nop dword [rax + rax]
call fcn.0045ee20
jmp fcn.0054a440

Function at 0x54ad80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54ae38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x87903abf87668591
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x300070200040602
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3020104
xor eax, eax
jmp 0x54add6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x54ae08
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x54ae2b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 8
jb 0x54adbc
jmp 0x54ae1f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004610a0
mov eax, edi
mov ecx, 8
call fcn.004610a0
nop
call fcn.0045ee20
nop dword [rax]
jmp fcn.0054ad80
Function at 0x54b3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54b4da
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x20be69c1f05aec69
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb4b7a06fe2bb0a6e
mov qword [rsp + 0x27], rdx
movabs rdx, 0xab6672aee6ea64b4
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x78a464036909df63
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1906181b09021006
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x6091906181b0902
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11d1b190a12031d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa130f090616040b
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd1d0e0204181102
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x54b477
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x22
jge 0x54b4a9
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x54b4cd
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0x1f
jb 0x54b45d
jmp 0x54b4c1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1f
call fcn.0044bb80
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004610a0
mov eax, edi
mov ecx, 0x1f
call fcn.004610a0
nop
call fcn.0045ee20
nop
jmp fcn.0054b3c0

Function at 0x54c420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c4f8
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x146fbb741649b90b
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xb9b3540c
movabs rdx, 0x3070b0a01090205
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0903070b0a0109
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb08050b02000801
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x54c494
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x54c4c8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x54c4eb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
nop
cmp rsi, 0xc
jb 0x54c47a
jmp 0x54c4df
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.0044bb80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004610a0
mov eax, edi
mov ecx, 0xc
call fcn.004610a0
nop
call fcn.0045ee20
nop dword [rax]
jmp fcn.0054c420
Function at 0x5520a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55216c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf663cadfdad9e461
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe358dcf663cadfda
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3040a0801010908
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2050702
xor eax, eax
jmp 0x552105
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x55213c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x55215f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7a]
cmp rsi, 0xb
jb 0x5520eb
jmp 0x552153
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004610a0
mov eax, edi
mov ecx, 0xb
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.005520a0

Function at 0x5534c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x86a88e5e1e0d85
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x607070307070302
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x305
xor eax, eax
jmp 0x553514
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x1a]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x553548
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x553585
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x1a]
nop dword [rax + rax]
cmp rbx, 8
jb 0x5534fa
jmp 0x553577
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x553561
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x553555
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.004610a0
mov eax, esi
mov ecx, 8
call fcn.004610a0
nop
int3
Function at 0x555160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x4067fac4a8f03fc8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7060401020304
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7010006
xor eax, eax
jmp 0x5551b5
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
cmp rax, 0xc
jge 0x5551e8
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x555225
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x14]
nop dword [rax]
cmp rbx, 8
jb 0x55519b
jmp 0x555217
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x555201
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x5551f5
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.004610a0
mov eax, esi
mov ecx, 8
call fcn.004610a0
nop
int3

Function at 0x555720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0xd896597c30104190
mov qword [rsp + 0x18], rax
movabs rax, 0x1b6a11e1eaecc2b6
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1c]
movzx ecx, byte [rsp + 0x23]
xor eax, ecx
movzx ecx, byte [rsp + 0x26]
movzx edx, byte [rsp + 0x19]
sub ecx, edx
movzx edx, byte [rsp + 0x25]
movzx ebx, byte [rsp + 0x1b]
sub edx, ebx
movzx ebx, byte [rsp + 0x20]
movzx esi, byte [rsp + 0x1d]
sub ebx, esi
movzx esi, byte [rsp + 0x27]
movzx edi, byte [rsp + 0x22]
sub esi, edi
movzx edi, byte [rsp + 0x18]
movzx r8d, byte [rsp + 0x24]
add edi, r8d
movzx r8d, byte [rsp + 0x1a]
movzx r9d, byte [rsp + 0x21]
sub r8d, r9d
movzx r9d, byte [rsp + 0x1f]
movzx r10d, byte [rsp + 0x1e]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r10 + r9]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x555806
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5557fa
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
Function at 0x555c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x52bae6f21cfe938a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x303000700010102
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x555c4f
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x68]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x555c7a
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x555cb5
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x555c33
jmp 0x555ca9
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x555c93
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x555c87
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.004610a0
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.004610a0
nop
int3

Function at 0x556ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x9d8ec3f80160d818
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x500060100000300
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x504
xor eax, eax
jmp 0x556d34
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x556d68
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x556da5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x14]
nop dword [rax + rax]
cmp rbx, 8
jb 0x556d1a
jmp 0x556d97
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x556d81
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x556d75
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.004610a0
mov eax, esi
mov ecx, 8
call fcn.004610a0
nop
int3

Function at 0x556f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x6c7bf83ddb04e27f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7020301020407
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6030205
xor eax, eax
jmp 0x556f97
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi + 0x45]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x556fc8
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x557005
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
nop word [rax + rax]
cmp rbx, 8
jb 0x556f7b
jmp 0x556ff7
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x556fe1
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x556fd5
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.004610a0
mov eax, esi
mov ecx, 8
call fcn.004610a0
nop
int3
Function at 0x557020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xa67163ae7a8f21d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x100050406070007
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x701
xor eax, eax
jmp 0x557074
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x5570a8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5570e5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x55]
nop dword [rax + rax]
cmp rbx, 8
jb 0x55705a
jmp 0x5570d7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5570c1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5570b5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.004610a0
mov eax, esi
mov ecx, 8
call fcn.004610a0
nop
int3

Function at 0x557300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0x3abca23c5c852581
mov qword [rsp + 0x18], rax
movabs rax, 0x1d59d503e7bbf13
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x19]
movzx ecx, byte [rsp + 0x1d]
sub eax, ecx
movzx ecx, byte [rsp + 0x26]
movzx edx, byte [rsp + 0x22]
sub ecx, edx
movzx edx, byte [rsp + 0x1b]
movzx ebx, byte [rsp + 0x1c]
add edx, ebx
movzx ebx, byte [rsp + 0x1f]
movzx esi, byte [rsp + 0x27]
sub ebx, esi
movzx esi, byte [rsp + 0x21]
movzx edi, byte [rsp + 0x25]
add esi, edi
movzx edi, byte [rsp + 0x1e]
movzx r8d, byte [rsp + 0x18]
sub edi, r8d
movzx r8d, byte [rsp + 0x20]
movzx r9d, byte [rsp + 0x24]
sub r8d, r9d
movzx r9d, byte [rsp + 0x1a]
movzx r10d, byte [rsp + 0x23]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
xor r9d, r10d
mov byte [rsp + 0x16], r9b
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x5573e6
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5573da
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret