joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x542154
jb 0x5421b3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00541f60
aeskeygenassist xmm1, xmm0, 1
call fcn.00541f80
aeskeygenassist xmm1, xmm2, 2
call fcn.00541f60
aeskeygenassist xmm1, xmm0, 2
call fcn.00541f80
aeskeygenassist xmm1, xmm2, 4
call fcn.00541f60
aeskeygenassist xmm1, xmm0, 4
call fcn.00541f80
aeskeygenassist xmm1, xmm2, 8
call fcn.00541f60
aeskeygenassist xmm1, xmm0, 8
call fcn.00541f80
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00541f60
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00541f80
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00541f60
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00541f80
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00541f60
jmp 0x542221
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00541ec0
aeskeygenassist xmm1, xmm2, 2
call fcn.00541f20
aeskeygenassist xmm1, xmm2, 4
call fcn.00541ec0
aeskeygenassist xmm1, xmm2, 8
call fcn.00541f20
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00541ec0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00541f20
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00541ec0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00541f20
jmp 0x542221
aeskeygenassist xmm1, xmm0, 1
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 2
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 4
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 8
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00541e80
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00541e80
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x54222e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x542720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5428c8
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x337a32a996359f60
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x373a38954e39355b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x45660e66655e6235
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4a3751908036c943
mov qword [rsp + 0x32], rdx
movabs rdx, 0x649b863761368933
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xbe65a575a2ac66a7
mov qword [rsp + 0x42], rdx
movabs rdx, 0x7476d05d3632d266
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x7c616a9394377e6f
mov qword [rsp + 0x52], rdx
movabs rdx, 0x1904391b21353f15
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x3f3c262f3d001904
mov qword [rsp + 0x60], rdx
movabs rdx, 0x3c16063131062d3f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x130c212d083b1c01
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe312a213f190403
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1f342b21282c3604
mov qword [rsp + 0x80], rdx
movabs rdx, 0x380b3817011d3e25
mov qword [rsp + 0x88], rdx
movabs rdx, 0x38180f210e250e12
mov qword [rsp + 0x90], rdx
movabs rdx, 0x2f3716081f000133
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x542863
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x46
jge 0x542895
movzx edx, byte [rsp + rax + 0x5a]
movzx esi, byte [rsp + rax + 0x5b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x40
jae 0x5428bb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0x40
jb 0x542849
jmp 0x5428af
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x40
call fcn.0044c140
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x40
call fcn.00461b40
mov eax, edi
mov ecx, 0x40
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00542720

Function at 0x5428e0
Capabilities:
Execute syscall

Disassembly:
xor rax, rax
mov ax, word [rsp + 8]
push rcx
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rdi, qword gs:[0x30]
mov dword [rdi + 0x68], 0
sub rsp, 0x80
cmp ecx, 4
jle 0x542920
cmp ecx, 0x10
jle 0x542916
int 3
mov rdi, rsp
cld
rep movsq qword [rdi], qword [rsi]
mov rsi, rsp
sub rsp, 8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r9, qword [rsi + 0x18]
movq xmm0, rcx
movq xmm1, rdx
movq xmm2, r8
movq xmm3, r9
mov r10, rcx
syscall
add rsp, 0x88
pop rcx
mov dword [rsp + 0x28], eax
ret
Function at 0x544d40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x544d57
inc rax
cmp rax, 4
jge 0x544d6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x544d54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x544d80
inc rax
cmp rax, 4
jge 0x544d8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x544db7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x544d9b
jmp 0x544d7d

Function at 0x544dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544eec
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3715e36328de6962
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x293a68ac203715e3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x28081aa778653cad
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8035677240a6ce1c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65700174b93a6e86
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1612071302091313
mov qword [rsp + 0x40], rdx
movabs rdx, 0x91d0d18120c021f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d091508031c0e1b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1120172006180c1d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x14160320221f0c05
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x544e86
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x14]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x28
jge 0x544ebc
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x544edf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x14]
cmp rsi, 0x25
jb 0x544e6c
jmp 0x544ed3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.0044c140
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461b40
mov eax, edi
mov ecx, 0x25
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00544dc0

Function at 0x5488e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5489a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb73bb42f12ec7954
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x4f
movabs rdx, 0x403050702050702
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6060602
xor eax, eax
nop
jmp 0x548940
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x548972
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x548997
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x29]
cmp rsi, 9
jb 0x548922
jmp 0x54898b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461b40
mov eax, edi
mov ecx, 9
nop
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005488e0
Function at 0x549160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54921d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf34804b373221243
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xfc42
movabs rdx, 0x208090805070408
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x9050107
xor eax, eax
jmp 0x5491c0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x3d]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x3d]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x5491ed
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x549210
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x5491a3
jmp 0x549204
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461b40
mov eax, edi
mov ecx, 0xa
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00549160

Function at 0x5494a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54958a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc165539dbbaca3fc
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xab01c165539dbbac
mov qword [rsp + 0x20], rdx
movabs rdx, 0x65efeb8799054672
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0e000100080c0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7010f0910080f08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x308040401000d02
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54952d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x24]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x24]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x54955a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x54957d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x549510
jmp 0x549571
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461b40
mov eax, edi
mov ecx, 0x12
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005494a0
Function at 0x5495a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54968c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x901d4e13b50c4378
mov qword [rsp + 0x19], rdx
movabs rdx, 0x56d49901d4e13b5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6411fb1e65ba19b7
mov qword [rsp + 0x24], rdx
movabs rdx, 0x211000307030d11
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4030f0602110003
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40a00070c100c0b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x54962a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x40]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x54965c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x54967f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x40]
cmp rsi, 0x13
jb 0x549610
jmp 0x549673
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461b40
mov eax, edi
mov ecx, 0x13
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005495a0

Function at 0x5496a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x549767
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x668c52a937c01617
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x1ecebb9b
movabs rdx, 0x90b04000b060108
mov qword [rsp + 0x28], rdx
movabs rdx, 0x209030204060a08
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x549708
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x4f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x4f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x549737
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x54975a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x5496eb
jmp 0x54974e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044c140
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461b40
mov eax, edi
mov ecx, 0xc
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.005496a0
Function at 0x54ccc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54cdf8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x796e4433ee16c674
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x27bc75fdd6796e44
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe024e1107469156f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20fff3dc350cab74
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5122c6223001828
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1032403080b1601
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14190917010c1123
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1805041116241a1e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x200221130c160e0b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b031d2217191d16
mov qword [rsp + 0x60], rdx
movabs rdx, 0x17020212160b1f08
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x54cd98
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x54cdc8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x54cdeb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x54cd7b
jmp 0x54cddf
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.0044c140
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461b40
mov eax, edi
mov ecx, 0x25
call fcn.00461b40
nop
call fcn.0045f8c0
nop dword [rax]
jmp fcn.0054ccc0

Function at 0x550140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
movups xmmword [rsp + 0x48], xmm15
movabs rdx, 0x55d0c600c39e9400
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xcdffc400
movabs rdx, 0x70602070b05010b
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], 0x9030902
xor eax, eax
nop
jmp 0x5501a0
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x5501cf
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0xc
jae 0x550207
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x29]
cmp rbx, 0xc
jb 0x550182
jmp 0x5501fb
movups xmmword [rsp + 0x28], xmm15
xor eax, eax
jmp 0x5501e5
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x28], cl
inc rax
cmp rax, 0xc
jl 0x5501d9
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x48], xmm0
add rsp, 0x38
pop rbp
ret
mov eax, ebx
mov ecx, 0xc
call fcn.00461b40
mov eax, esi
mov ecx, 0xc
call fcn.00461b40
nop
int3
Function at 0x550860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x550968
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x148c386f406e61d5
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe1da2561d58d7261
mov qword [rsp + 0x20], rdx
movabs rdx, 0xed47e1da2561d58d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65da61c344956d3f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6050b0503111500
mov qword [rsp + 0x32], rdx
movabs rdx, 0x140e07030d110a12
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x7050b180705140e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1116030f000a1110
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x55090b
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x4d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x4d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x550938
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x55095b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x5508ee
jmp 0x55094f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044c140
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461b40
mov eax, edi
mov ecx, 0x1a
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00550860

Function at 0x552120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5521dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3534574a615c7262
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x42
movabs rdx, 0x405060405070208
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7080502
xor eax, eax
nop
jmp 0x552180
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x5521ad
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5521d0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x552162
jmp 0x5521c4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461b40
mov eax, edi
mov ecx, 9
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00552120
Function at 0x552de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x552eec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xa37489199d826f6e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x72cdcdb7ab655c90
mov qword [rsp + 0x27], rdx
movabs rdx, 0x8372cdcdb7ab655c
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa06e67e0b31fbaca
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1208160811090803
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140c0e0d16150205
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4030b1413101304
mov qword [rsp + 0x48], rdx
movabs rdx, 0x412110418070405
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x552e88
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x20
jge 0x552ebc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x552edf
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
cmp rsi, 0x19
jb 0x552e6e
jmp 0x552ed3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.0044c140
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461b40
mov eax, edi
mov ecx, 0x19
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00552de0

Function at 0x5571e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5572dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8bf6690d610204f3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x820926e8e0ef520
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2101688281656378
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x900140215170904
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd06060b16011713
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x17000d06060b1601
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf02060a0702150a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x557280
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x74]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x74]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x5572ad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x5572d0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x55725f
jmp 0x5572c4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0044c140
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461b40
mov eax, edi
mov ecx, 0x18
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.005571e0
Function at 0x557300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5573ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5960533f72687375
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x126452755e596053
mov qword [rsp + 0x20], rdx
movabs rdx, 0x59200d2b6e4269ef
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd14060714070908
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf11120704120902
mov qword [rsp + 0x38], rdx
movabs rdx, 0x206140c060f0a05
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x55738a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x5573bc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5573df
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
cmp rsi, 0x15
jb 0x557370
jmp 0x5573d3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461b40
mov eax, edi
mov ecx, 0x15
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00557300

Function at 0x558860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xc984cfa68d0f8f55
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x606040007010300
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x302
xor eax, eax
jmp 0x5588b4
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x2a]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x5588e8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x558925
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x2a]
nop dword [rax + rax]
cmp rbx, 8
jb 0x55889a
jmp 0x558917
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x558901
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5588f5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461b40
mov eax, esi
mov ecx, 8
call fcn.00461b40
nop
int3
Function at 0x5589c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xe0148b0da9bff998
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x405030101000107
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7030600
xor eax, eax
jmp 0x558a15
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x74]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
cmp rax, 0xc
jge 0x558a48
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x558a85
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x74]
nop dword [rax]
cmp rbx, 8
jb 0x5589fb
jmp 0x558a77
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x558a61
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x558a55
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461b40
mov eax, esi
mov ecx, 8
call fcn.00461b40
nop
int3

Function at 0x559b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xce8bd48d0caca2e0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x40500050406
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x701
xor eax, eax
jmp 0x559b54
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x1e]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x559b88
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x559bc5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x1e]
nop dword [rax + rax]
cmp rbx, 8
jb 0x559b3a
jmp 0x559bb7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x559ba1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x559b95
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461b40
mov eax, esi
mov ecx, 8
call fcn.00461b40
nop
int3